Merge remote-tracking branch 'upstream/main' into access-invalid-pointer-fp

2025-12-17 01:03:14 +01:00 · 2025-11-21 17:39:56 +00:00
parent 9db1722060 b1ed72d760
commit 03fc4cb0aa
583 changed files with 32416 additions and 12567 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -82,9 +82,6 @@
 /csharp/paket.main.bzl linguist-generated=true
 /csharp/paket.main_extension.bzl linguist-generated=true

-# ripunzip tool
-/misc/ripunzip/ripunzip-* filter=lfs diff=lfs merge=lfs -text
-
 # swift prebuilt resources
 /swift/third_party/resources/*.zip filter=lfs diff=lfs merge=lfs -text
 /swift/third_party/resources/*.tar.zst filter=lfs diff=lfs merge=lfs -text
--- a/.github/workflows/build-ripunzip.yml
+++ b/.github/workflows/build-ripunzip.yml
@@ -1,166 +0,0 @@
-name: Build ripunzip
-
-on:
-  workflow_dispatch:
-    inputs:
-      ripunzip-version:
-        description: What reference to checkout from google/ripunzip. Latest by default
-        required: false
-      openssl-version:
-        description: What reference to checkout from openssl/openssl for Linux. Latest by default
-        required: false
-      open-pr:
-        description: Open a pull request updating the ripunzip versions committed to lfs
-        required: false
-        default: true  # will be false on PRs
-  pull_request:
-    paths:
-      - .github/workflows/build-ripunzip.yml
-
-permissions: {}
-  
-jobs:
-  versions:
-    runs-on: ubuntu-slim
-    outputs:
-      ripunzip-version: ${{ inputs.ripunzip-version || steps.fetch-ripunzip-version.outputs.version }}
-      openssl-version: ${{ inputs.openssl-version || steps.fetch-openssl-version.outputs.version }}
-    steps:
-      - name: Fetch latest ripunzip version
-        id: fetch-ripunzip-version
-        if: "!inputs.ripunzip-version"
-        run: &fetch-version
-          echo "version=$(gh release view --repo $REPO --json tagName --jq .tagName)" | tee -a $GITHUB_OUTPUT
-        env:
-          REPO: "google/ripunzip"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Fetch latest openssl version
-        id: fetch-openssl-version
-        if: "!inputs.openssl-version"
-        run: *fetch-version
-        env:
-          REPO: "openssl/openssl"
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  build:
-    needs: versions
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-24.04, macos-15, windows-2025]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          repository: google/ripunzip
-          ref: ${{ needs.versions.outputs.ripunzip-version }}
-      # we need to avoid ripunzip dynamically linking into libssl
-      # see https://github.com/sfackler/rust-openssl/issues/183
-      - if: runner.os == 'Linux'
-        name: checkout openssl
-        uses: actions/checkout@v5
-        with:
-          repository: openssl/openssl
-          path: openssl
-          ref: ${{ needs.versions.outputs.openssl-version }}
-      - if: runner.os == 'Linux'
-        name: build and install openssl with fPIC
-        shell: bash
-        working-directory: openssl
-        run: |
-          ./config -fPIC --prefix=$HOME/.local --openssldir=$HOME/.local/ssl
-          make -j $(nproc)
-          make install_sw -j $(nproc)
-      - if: runner.os == 'Linux'
-        name: build (linux)
-        shell: bash
-        run: |
-          env OPENSSL_LIB_DIR=$HOME/.local/lib64 OPENSSL_INCLUDE_DIR=$HOME/.local/include OPENSSL_STATIC=yes cargo build --release
-          mv target/release/ripunzip ripunzip-linux
-      - if: runner.os == 'Windows'
-        name: build (windows)
-        shell: bash
-        run: |
-          cargo build --release
-          mv target/release/ripunzip ripunzip-windows
-      - name: build (macOS)
-        if: runner.os == 'macOS'
-        shell: bash
-        run: |
-          rustup target install x86_64-apple-darwin
-          rustup target install aarch64-apple-darwin
-          cargo build --target x86_64-apple-darwin --release
-          cargo build --target aarch64-apple-darwin --release
-          lipo -create -output ripunzip-macos \
-            -arch x86_64 target/x86_64-apple-darwin/release/ripunzip \
-            -arch arm64 target/aarch64-apple-darwin/release/ripunzip
-      - name: Archive
-        shell: bash
-        run: |
-          tar acf ripunzip-$RUNNER_OS.tar.zst ripunzip-$(echo $RUNNER_OS | tr '[:upper:]' '[:lower:]')
-      - name: Upload built binary
-        uses: actions/upload-artifact@v4
-        with:
-          name: ripunzip-${{ runner.os }}
-          path: ripunzip-${{ runner.os }}.tar.zst
-          retention-days: 5
-          compression: 0
-      - name: Check built binary
-        shell: bash
-        run: |
-          rm -f ripunzip-*.tar.zst
-          ./ripunzip-* --version
-  publish:
-    needs: [versions, build]
-    if: inputs.open-pr == 'true'
-    permissions:
-      contents: write
-      pull-requests: write
-    runs-on: ubuntu-slim
-    steps:
-      # workaround for git-lfs not being installed yet on ubuntu-slim runners
-      - name: Ensure git-lfs is installed
-        shell: bash
-        run: |
-          if which git-lfs &>/dev/null; then
-            echo "git-lfs is already installed"
-            exit 0
-          fi
-          cd $TMP
-          gh release download --repo git-lfs/git-lfs --pattern "git-lfs-linux-amd64-*.tar.gz" --clobber
-          tar xzf git-lfs-linux-amd64-*.tar.gz
-          rm git-lfs-linux-amd64-*.tar.gz
-          cd git-lfs-*
-          pwd | tee -a $GITHUB_PATH
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v5
-        with:
-          sparse-checkout: |
-            .github
-            misc/ripunzip
-          lfs: true
-      - name: Download built binaries
-        uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-          path: misc/ripunzip
-      - name: Open PR
-        shell: bash
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git switch -c update-ripunzip
-          git add misc/ripunzip
-          git commit -m "Update ripunzip binaries to version $VERSION"
-          git push --set-upstream origin update-ripunzip --force
-          TITLE="Update ripunzip binaries to version $VERSION"
-          gh pr create \
-            --draft \
-            --title "$TITLE" \
-            --body "Automated update of ripunzip binaries." \
-            --assignee "$ACTOR" ||
-              (gh pr edit --title "$TITLE" --add-assignee "$ACTOR" && gh pr ready --undo)
-        env:
-          ACTOR: ${{ github.actor }}
-          VERSION: ${{ needs.versions.outputs.ripunzip-version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -269,24 +269,16 @@ go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
 use_repo(go_deps, "org_golang_x_mod", "org_golang_x_tools")

-lfs_archive = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_archive")
+ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")

-lfs_archive(
-    name = "ripunzip-linux",
-    src = "//misc/ripunzip:ripunzip-Linux.tar.zst",
-    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
-)
-
-lfs_archive(
-    name = "ripunzip-windows",
-    src = "//misc/ripunzip:ripunzip-Windows.tar.zst",
-    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
-)
-
-lfs_archive(
-    name = "ripunzip-macos",
-    src = "//misc/ripunzip:ripunzip-macOS.tar.zst",
-    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
+# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
+ripunzip_archive(
+    name = "ripunzip",
+    sha256_linux = "ee0e8a957687a5dc3a66b2a4b25883bf762df4c9c07f0651af527a32a405054b",
+    sha256_macos_arm = "8a88eea54eac232d162a72a42065e0429b82dbf4f05e9642915dff9d7a81f846",
+    sha256_macos_intel = "4457a18bfcc5feabe09f5ea3d1157128e07b4873392cb404a870e611924abf64",
+    sha256_windows = "66d0c1375301bf5ab815348048f43b110631d3fa7200acd50d50a8ed8655ca62",
+    version = "2.0.3",
 )

 register_toolchains(
--- a/actions/ql/lib/CHANGELOG.md
+++ b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.4.21
+
+No user-facing changes.
+
 ## 0.4.20

 No user-facing changes.
--- a/actions/ql/lib/change-notes/released/0.4.21.md
+++ b/actions/ql/lib/change-notes/released/0.4.21.md
@@ -0,0 +1,3 @@
+## 0.4.21
+
+No user-facing changes.
--- a/actions/ql/lib/codeql-pack.release.yml
+++ b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.20
+lastReleaseVersion: 0.4.21
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.21-dev
+version: 0.4.22-dev
 library: true
 warnOnImplicitThis: true
 dependencies:
--- a/actions/ql/src/CHANGELOG.md
+++ b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.13
+
+No user-facing changes.
+
 ## 0.6.12

 No user-facing changes.
--- a/actions/ql/src/change-notes/released/0.6.13.md
+++ b/actions/ql/src/change-notes/released/0.6.13.md
@@ -0,0 +1,3 @@
+## 0.6.13
+
+No user-facing changes.
--- a/actions/ql/src/codeql-pack.release.yml
+++ b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.12
+lastReleaseVersion: 0.6.13
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.13-dev
+version: 0.6.14-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]
--- a/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/old.dbscheme
+++ b/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/old.dbscheme
--- a/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/semmlecode.cpp.dbscheme
+++ b/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/semmlecode.cpp.dbscheme
--- a/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/upgrade.properties
+++ b/cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/upgrade.properties
@@ -0,0 +1,3 @@
+description: Support expanded compilation argument lists
+compatibility: full
+compilation_expanded_args.rel: delete
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 6.1.0
+
+### New Features
+
+* New predicates `getAnExpandedArgument` and `getExpandedArgument` were added to the `Compilation` class, yielding compilation arguments after expansion of response files.
+
+### Bug Fixes
+
+* Improve performance of the range analysis in cases where it would otherwise take an exorbitant amount of time.
+
 ## 6.0.1

 No user-facing changes.
@@ -259,8 +269,8 @@ No user-facing changes.

 ### Breaking Changes

-* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`.
-* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`.
+* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`. 
+* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`. 
 * Deleted the deprecated `hasQualifiedName` and `isDefined` predicates from the `Declaration` class, use `hasGlobalName` and `hasDefinition` respectively instead.
 * Deleted the `getFullSignature` predicate from the `Function` class, use `getIdentityString(Declaration)` from `semmle.code.cpp.Print` instead.
 * Deleted the deprecated `freeCall` predicate from `Alloc.qll`. Use `DeallocationExpr` instead.
@@ -294,7 +304,7 @@ No user-facing changes.
 * A `getTemplateClass` predicate was added to the `DeductionGuide` class to get the class template for which the deduction guide is a guide.
 * An `isExplicit` predicate was added to the `Function` class that determines whether the function was declared as explicit.
 * A `getExplicitExpr` predicate was added to the `Function` class that yields the constant boolean expression (if any) that conditionally determines whether the function is explicit.
-* A `isDestroyingDeleteDeallocation` predicate was added to the `NewOrNewArrayExpr` and `DeleteOrDeleteArrayExpr` classes to indicate whether the deallocation function is a destroying delete.
+* A `isDestroyingDeleteDeallocation` predicate was added to the `NewOrNewArrayExpr` and `DeleteOrDeleteArrayExpr` classes to indicate whether the deallocation function is a destroying delete. 

 ### Minor Analysis Improvements

@@ -372,9 +382,9 @@ No user-facing changes.
 ### New Features

 * Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant.
+* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
 * Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant.
+* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
 * Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
 * Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.

@@ -490,7 +500,7 @@ No user-facing changes.
 * Functions that do not return due to calling functions that don't return (e.g. `exit`) are now detected as
 non-returning in the IR and dataflow.
 * Treat functions that reach the end of the function as returning in the IR.
-  They used to be treated as unreachable but it is allowed in C.
+  They used to be treated as unreachable but it is allowed in C. 
 * The `DataFlow::asDefiningArgument` predicate now takes its argument from the range starting at `1` instead of `2`. Queries that depend on the single-parameter version of `DataFlow::asDefiningArgument` should have their arguments updated accordingly.

 ## 0.9.3
@@ -539,7 +549,7 @@ No user-facing changes.

 ### New Features

-* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`.
+* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`. 
  Hence it is no longer needed to provide `none()` implementations of these predicates if they are not needed.

 ### Minor Analysis Improvements
@@ -733,7 +743,7 @@ No user-facing changes.

 ### Deprecated APIs

-* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### New Features
@@ -750,7 +760,7 @@ No user-facing changes.

 ### Deprecated APIs

-* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### New Features
@@ -849,7 +859,7 @@ No user-facing changes.

 ### Deprecated APIs

-* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide.
+* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### New Features
--- a/cpp/ql/lib/change-notes/2025-11-19-content.md
+++ b/cpp/ql/lib/change-notes/2025-11-19-content.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The class `DataFlow::FieldContent` now covers both `union` and `struct`/`class` types. A new predicate `FieldContent.getAField` has been added to access the union members associated with the `FieldContent`. The old `FieldContent` has been renamed to `NonUnionFieldContent`.
--- a/cpp/ql/lib/change-notes/released/6.1.0.md
+++ b/cpp/ql/lib/change-notes/released/6.1.0.md
@@ -0,0 +1,9 @@
+## 6.1.0
+
+### New Features
+
+* New predicates `getAnExpandedArgument` and `getExpandedArgument` were added to the `Compilation` class, yielding compilation arguments after expansion of response files.
+
+### Bug Fixes
+
+* Improve performance of the range analysis in cases where it would otherwise take an exorbitant amount of time.
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 6.0.1
+lastReleaseVersion: 6.1.0
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 6.0.2-dev
+version: 6.1.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
--- a/cpp/ql/lib/semmle/code/cpp/Compilation.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Compilation.qll
@@ -94,6 +94,25 @@ class Compilation extends @compilation {
   */
  string getArgument(int i) { compilation_args(this, i, result) }

+  /**
+   * Gets an expanded argument passed to the extractor on this invocation.
+   */
+  string getAnExpandedArgument() { result = this.getExpandedArgument(_) }
+
+  /**
+   * Gets the `i`th expanded argument passed to the extractor on this
+   * invocation.
+   *
+   * This is similar to `getArgument`, but for a `@someFile` argument, it
+   * includes the arguments from that file, rather than just taking the
+   * argument literally.
+   */
+  string getExpandedArgument(int i) {
+    if exists(string arg | compilation_expanded_args(this, _, arg))
+    then compilation_expanded_args(this, i, result)
+    else result = this.getArgument(i)
+  }
+
  /**
   * Gets the total amount of CPU time spent processing all the files in the
   * front-end and extractor.
--- a/cpp/ql/lib/semmle/code/cpp/Function.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Function.qll
@@ -171,12 +171,14 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   * Gets the nth parameter of this function. There is no result for the
   * implicit `this` parameter, and there is no `...` varargs pseudo-parameter.
   */
+  pragma[nomagic]
  Parameter getParameter(int n) { params(unresolveElement(result), underlyingElement(this), n, _) }

  /**
   * Gets a parameter of this function. There is no result for the implicit
   * `this` parameter, and there is no `...` varargs pseudo-parameter.
   */
+  pragma[nomagic]
  Parameter getAParameter() { params(unresolveElement(result), underlyingElement(this), _, _) }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/exprs/Cast.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/Cast.qll
@@ -750,6 +750,16 @@ class SizeofPackTypeOperator extends SizeofPackOperator {
 */
 class SizeofOperator extends Expr, @runtime_sizeof {
  override int getPrecedence() { result = 16 }
+
+  /**
+   * Gets the contained type of this `sizeof`. For example,
+   * the result is `int` in both cases below:
+   * ```
+   * sizeof(int);
+   * sizeof(42);
+   * ```
+   */
+  Type getTypeOperand() { none() } // overridden in subclasses
 }

 /**
@@ -766,6 +776,8 @@ class SizeofExprOperator extends SizeofOperator {
  /** Gets the contained expression. */
  Expr getExprOperand() { result = this.getChild(0) }

+  override Type getTypeOperand() { result = this.getExprOperand().getType() }
+
  override string toString() { result = "sizeof(<expr>)" }

  override predicate mayBeImpure() { this.getExprOperand().mayBeImpure() }
@@ -784,8 +796,7 @@ class SizeofTypeOperator extends SizeofOperator {

  override string getAPrimaryQlClass() { result = "SizeofTypeOperator" }

-  /** Gets the contained type. */
-  Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }
+  override Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }

  override string toString() { result = "sizeof(" + this.getTypeOperand().getName() + ")" }

@@ -842,6 +853,16 @@ class AlignofTypeOperator extends AlignofOperator {
 */
 class DatasizeofOperator extends Expr, @datasizeof {
  override int getPrecedence() { result = 16 }
+
+  /**
+   * Gets the contained type of this `__datasizeof`. For example,
+   * the result is `int` in both cases below:
+   * ```
+   * __datasizeof(int);
+   * __datasizeof(42);
+   * ```
+   */
+  Type getTypeOperand() { none() }
 }

 /**
@@ -855,6 +876,8 @@ class DatasizeofExprOperator extends DatasizeofOperator {
  /** Gets the contained expression. */
  Expr getExprOperand() { result = this.getChild(0) }

+  override Type getTypeOperand() { result = this.getExprOperand().getType() }
+
  override string toString() { result = "__datasizeof(<expr>)" }

  override predicate mayBeImpure() { this.getExprOperand().mayBeImpure() }
@@ -870,8 +893,7 @@ class DatasizeofTypeOperator extends DatasizeofOperator {

  override string getAPrimaryQlClass() { result = "DatasizeofTypeOperator" }

-  /** Gets the contained type. */
-  Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }
+  override Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }

  override string toString() { result = "__datasizeof(" + this.getTypeOperand().getName() + ")" }

--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -861,6 +861,10 @@ predicate jumpStep(Node n1, Node n2) {
    n2.(FlowSummaryNode).getSummaryNode())
 }

+bindingset[c]
+pragma[inline_late]
+private int getIndirectionIndexLate(Content c) { result = c.getIndirectionIndex() }
+
 /**
 * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
 * Thus, `node2` references an object with a field `f` that contains the
@@ -873,23 +877,17 @@ predicate jumpStep(Node n1, Node n2) {
 predicate storeStepImpl(Node node1, Content c, Node node2, boolean certain) {
  exists(
    PostFieldUpdateNode postFieldUpdate, int indirectionIndex1, int numberOfLoads,
-    StoreInstruction store
+    StoreInstruction store, FieldContent fc
  |
    postFieldUpdate = node2 and
-    nodeHasInstruction(node1, store, pragma[only_bind_into](indirectionIndex1)) and
+    fc = c and
+    nodeHasInstruction(node1, pragma[only_bind_into](store),
+      pragma[only_bind_into](indirectionIndex1)) and
    postFieldUpdate.getIndirectionIndex() = 1 and
    numberOfLoadsFromOperand(postFieldUpdate.getFieldAddress(),
-      store.getDestinationAddressOperand(), numberOfLoads, certain)
-  |
-    exists(FieldContent fc | fc = c |
-      fc.getField() = postFieldUpdate.getUpdatedField() and
-      fc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
-    )
-    or
-    exists(UnionContent uc | uc = c |
-      uc.getAField() = postFieldUpdate.getUpdatedField() and
-      uc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
-    )
+      store.getDestinationAddressOperand(), numberOfLoads, certain) and
+    fc.getAField() = postFieldUpdate.getUpdatedField() and
+    getIndirectionIndexLate(fc) = 1 + indirectionIndex1 + numberOfLoads
  )
  or
  // models-as-data summarized flow
@@ -965,22 +963,17 @@ predicate nodeHasInstruction(Node node, Instruction instr, int indirectionIndex)
 * `node2`.
 */
 predicate readStep(Node node1, ContentSet c, Node node2) {
-  exists(FieldAddress fa1, Operand operand, int numberOfLoads, int indirectionIndex2 |
+  exists(
+    FieldAddress fa1, Operand operand, int numberOfLoads, int indirectionIndex2, FieldContent fc
+  |
+    fc = c and
    nodeHasOperand(node2, operand, indirectionIndex2) and
    // The `1` here matches the `node2.getIndirectionIndex() = 1` conjunct
    // in `storeStep`.
    nodeHasOperand(node1, fa1.getObjectAddressOperand(), 1) and
-    numberOfLoadsFromOperand(fa1, operand, numberOfLoads, _)
-  |
-    exists(FieldContent fc | fc = c |
-      fc.getField() = fa1.getField() and
-      fc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
-    )
-    or
-    exists(UnionContent uc | uc = c |
-      uc.getAField() = fa1.getField() and
-      uc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
-    )
+    numberOfLoadsFromOperand(fa1, operand, numberOfLoads, _) and
+    fc.getAField() = fa1.getField() and
+    getIndirectionIndexLate(fc) = indirectionIndex2 + numberOfLoads
  )
  or
  // models-as-data summarized flow
@@ -1574,7 +1567,7 @@ pragma[inline]
 ContentApprox getContentApprox(Content c) {
  exists(string prefix, Field f |
    prefix = result.(FieldApproxContent).getPrefix() and
-    f = c.(FieldContent).getField() and
+    f = c.(NonUnionFieldContent).getField() and
    fieldHasApproxName(f, prefix)
  )
  or
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -2093,8 +2093,8 @@ private Field getAFieldWithSize(Union u, int bytes) {

 cached
 private newtype TContent =
-  TFieldContent(Field f, int indirectionIndex) {
-    // the indirection index for field content starts at 1 (because `TFieldContent` is thought of as
+  TNonUnionContent(Field f, int indirectionIndex) {
+    // the indirection index for field content starts at 1 (because `TNonUnionContent` is thought of as
    // the address of the field, `FieldAddress` in the IR).
    indirectionIndex = [1 .. SsaImpl::getMaxIndirectionsForType(f.getUnspecifiedType())] and
    // Reads and writes of union fields are tracked using `UnionContent`.
@@ -2124,14 +2124,14 @@ private newtype TContent =
 */
 class Content extends TContent {
  /** Gets a textual representation of this element. */
-  abstract string toString();
+  string toString() { none() } // overridden in subclasses

  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
  }

  /** Gets the indirection index of this `Content`. */
-  abstract int getIndirectionIndex();
+  int getIndirectionIndex() { none() } // overridden in subclasses

  /**
   * INTERNAL: Do not use.
@@ -2142,7 +2142,7 @@ class Content extends TContent {
   * For example, a write to a field `f` implies that any content of
   * the form `*f` is also cleared.
   */
-  abstract predicate impliesClearOf(Content c);
+  predicate impliesClearOf(Content c) { none() } // overridden in subclasses
 }

 /**
@@ -2162,22 +2162,42 @@ private module ContentStars {

 private import ContentStars

-/** A reference through a non-union instance field. */
+private class TFieldContent = TNonUnionContent or TUnionContent;
+
+/**
+ * A `Content` that references a `Field`. This may be a field of a `struct`,
+ * `class`, or `union`. In the case of a `union` there may be multiple fields
+ * associated with the same `Content`.
+ */
 class FieldContent extends Content, TFieldContent {
+  /** Gets a `Field` of this `Content`. */
+  Field getAField() { none() }
+
+  /**
+   * Gets the field associated with this `Content`, if a unique one exists.
+   */
+  final Field getField() { result = unique( | | this.getAField()) }
+
+  override int getIndirectionIndex() { none() } // overridden in subclasses
+
+  override string toString() { none() } // overridden in subclasses
+
+  override predicate impliesClearOf(Content c) { none() } // overridden in subclasses
+}
+
+/** A reference through a non-union instance field. */
+class NonUnionFieldContent extends FieldContent, TNonUnionContent {
  private Field f;
  private int indirectionIndex;

-  FieldContent() { this = TFieldContent(f, indirectionIndex) }
+  NonUnionFieldContent() { this = TNonUnionContent(f, indirectionIndex) }

  override string toString() { result = contentStars(this) + f.toString() }

-  Field getField() { result = f }
+  override Field getAField() { result = f }

  /** Gets the indirection index of this `FieldContent`. */
-  pragma[inline]
-  override int getIndirectionIndex() {
-    pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
-  }
+  override int getIndirectionIndex() { result = indirectionIndex }

  override predicate impliesClearOf(Content c) {
    exists(FieldContent fc |
@@ -2191,7 +2211,7 @@ class FieldContent extends Content, TFieldContent {
 }

 /** A reference through an instance field of a union. */
-class UnionContent extends Content, TUnionContent {
+class UnionContent extends FieldContent, TUnionContent {
  private Union u;
  private int indirectionIndex;
  private int bytes;
@@ -2201,16 +2221,13 @@ class UnionContent extends Content, TUnionContent {
  override string toString() { result = contentStars(this) + u.toString() }

  /** Gets a field of the underlying union of this `UnionContent`, if any. */
-  Field getAField() { result = u.getAField() and getFieldSize(result) = bytes }
+  override Field getAField() { result = u.getAField() and getFieldSize(result) = bytes }

  /** Gets the underlying union of this `UnionContent`. */
  Union getUnion() { result = u }

  /** Gets the indirection index of this `UnionContent`. */
-  pragma[inline]
-  override int getIndirectionIndex() {
-    pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
-  }
+  override int getIndirectionIndex() { result = indirectionIndex }

  override predicate impliesClearOf(Content c) {
    exists(UnionContent uc |
@@ -2234,10 +2251,7 @@ class ElementContent extends Content, TElementContent {

  ElementContent() { this = TElementContent(indirectionIndex) }

-  pragma[inline]
-  override int getIndirectionIndex() {
-    pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
-  }
+  override int getIndirectionIndex() { result = indirectionIndex }

  override predicate impliesClearOf(Content c) { none() }

--- a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -93,6 +93,18 @@ private float wideningUpperBounds(ArithmeticType t) {
  result = 1.0 / 0.0 // +Inf
 }

+/** Gets the widened lower bound for a given type and lower bound. */
+bindingset[type, lb]
+float widenLowerBound(Type type, float lb) {
+  result = max(float widenLB | widenLB = wideningLowerBounds(type) and widenLB <= lb | widenLB)
+}
+
+/** Gets the widened upper bound for a given type and upper bound. */
+bindingset[type, ub]
+float widenUpperBound(Type type, float ub) {
+  result = min(float widenUB | widenUB = wideningUpperBounds(type) and widenUB >= ub | widenUB)
+}
+
 /**
 * Gets the value of the expression `e`, if it is a constant.
 * This predicate also handles the case of constant variables initialized in different
@@ -504,6 +516,336 @@ private predicate isRecursiveExpr(Expr e) {
  )
 }

+/**
+ * Provides predicates that estimate the number of bounds that the range
+ * analysis might produce.
+ */
+private module BoundsEstimate {
+  /**
+   * Gets the limit beyond which we enable widening. That is, if the estimated
+   * number of bounds exceeds this limit, we enable widening such that the limit
+   * will not be reached.
+   */
+  float getBoundsLimit() {
+    // This limit is arbitrary, but low enough that it prevents timeouts on
+    // specific observed customer databases (and the in the tests).
+    result = 2.0.pow(40)
+  }
+
+  /** Gets the maximum number of bounds possible for `t` when widening is used. */
+  private int getNrOfWideningBounds(ArithmeticType t) {
+    result = strictcount(wideningLowerBounds(t)).maximum(strictcount(wideningUpperBounds(t)))
+  }
+
+  /**
+   * Holds if `boundFromGuard(guard, v, _, branch)` holds, but without
+   * relying on range analysis (which would cause non-monotonic recursion
+   * elsewhere).
+   */
+  private predicate hasBoundFromGuard(Expr guard, VariableAccess v, boolean branch) {
+    exists(Expr lhs | linearAccess(lhs, v, _, _) |
+      relOpWithSwapAndNegate(guard, lhs, _, _, _, branch)
+      or
+      eqOpWithSwapAndNegate(guard, lhs, _, true, branch)
+      or
+      eqZeroWithNegate(guard, lhs, true, branch)
+    )
+  }
+
+  /** Holds if `def` is a guard phi node for `v` with a bound from a guard. */
+  predicate isGuardPhiWithBound(RangeSsaDefinition def, StackVariable v, VariableAccess access) {
+    exists(Expr guard, boolean branch |
+      def.isGuardPhi(v, access, guard, branch) and
+      hasBoundFromGuard(guard, access, branch)
+    )
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a guard phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiGuard(RangeSsaDefinition def, StackVariable v) {
+    // If we have
+    //
+    //   if (x < c) { e1 }
+    //   e2
+    //
+    // then `e2` is both a guard phi node (guarded by `x < c`) and a normal
+    // phi node (control is merged after the `if` statement).
+    //
+    // Assume `x` has `n` bounds. Then `n` bounds are propagated to the guard
+    // phi node `{ e1 }` and, since `{ e1 }` is input to `e2` as a normal phi
+    // node, `n` bounds are propagated to `e2`. If we also propagate the `n`
+    // bounds to `e2` as a guard phi node, then we square the number of
+    // bounds.
+    //
+    // However in practice `x < c` is going to cut down the number of bounds:
+    // The tracked bounds can't flow to both branches as that would require
+    // them to simultaneously be greater and smaller than `c`. To approximate
+    // this better, the contribution from a guard phi node that is also a
+    // normal phi node is 1.
+    exists(def.getAPhiInput(v)) and
+    isGuardPhiWithBound(def, v, _) and
+    result = 1
+    or
+    not exists(def.getAPhiInput(v)) and
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result =
+      max(VariableAccess access | isGuardPhiWithBound(def, v, access) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isGuardPhiWithBound(def, v, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a normal phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiNormal(RangeSsaDefinition def, StackVariable v) {
+    result =
+      strictsum(RangeSsaDefinition inputDef |
+        inputDef = def.getAPhiInput(v)
+      |
+        nrOfBoundsDef(inputDef, v)
+      )
+    or
+    def.isPhiNode(v) and
+    not exists(def.getAPhiInput(v)) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an NE phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  float nrOfBoundsNEPhi(RangeSsaDefinition def, StackVariable v) {
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result = max(VariableAccess access | isNEPhi(v, def, access, _) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isNEPhi(v, def, _, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an unsupported guard phi
+   * node for the variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsUnsupportedGuardPhi(RangeSsaDefinition def, StackVariable v) {
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result =
+      max(VariableAccess access | isUnsupportedGuardPhi(v, def, access) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isUnsupportedGuardPhi(v, def, _) and
+    result = 0
+  }
+
+  private float nrOfBoundsPhi(RangeSsaDefinition def, StackVariable v) {
+    // The cases for phi nodes are not mutually exclusive. For instance a phi
+    // node can be both a guard phi node and a normal phi node. To handle this
+    // we sum the contributions from the different cases.
+    result =
+      nrOfBoundsPhiGuard(def, v) + nrOfBoundsPhiNormal(def, v) + nrOfBoundsNEPhi(def, v) +
+        nrOfBoundsUnsupportedGuardPhi(def, v)
+  }
+
+  /** Gets the estimated number of bounds for `def` and `v`. */
+  float nrOfBoundsDef(RangeSsaDefinition def, StackVariable v) {
+    // Recursive definitions are already widened, so we simply estimate them as
+    // having the number of widening bounds available. This is crucial as it
+    // ensures that we don't follow recursive cycles when calculating the
+    // estimate. Had that not been the case the estimate itself would be at risk
+    // of causing performance issues and being non-functional.
+    if isRecursiveDef(def, v)
+    then result = getNrOfWideningBounds(getVariableRangeType(v))
+    else (
+      // Definitions with a defining value
+      exists(Expr defExpr | assignmentDef(def, v, defExpr) and result = nrOfBoundsExpr(defExpr))
+      or
+      // Assignment operations with a defining value
+      exists(AssignOperation assignOp |
+        def = assignOp and
+        assignOp.getLValue() = v.getAnAccess() and
+        result = nrOfBoundsExpr(assignOp)
+      )
+      or
+      // Phi nodes
+      result = nrOfBoundsPhi(def, v)
+      or
+      unanalyzableDefBounds(def, v, _, _) and result = 1
+    )
+  }
+
+  /**
+   * Gets a naive estimate of the number of bounds for `e`.
+   *
+   * The estimate is like an abstract interpretation of the range analysis,
+   * where the abstract value is the number of bounds. For instance,
+   * `nrOfBoundsExpr(12) = 1` and `nrOfBoundsExpr(x + y) = nrOfBoundsExpr(x) *
+   * nrOfBoundsExpr(y)`.
+   *
+   * The estimated number of bounds will usually be greater than the actual
+   * number of bounds, as the estimate can not detect cases where bounds are cut
+   * down when tracked precisely. For instance, in
+   * ```c
+   * int x = 1;
+   * if (cond) { x = 1; }
+   * int y = x + x;
+   * ```
+   * the actual number of bounds for `y` is 1. However, the estimate will be 4
+   * as the conditional assignment to `x` gives two bounds for `x` on the last
+   * line and the addition gives 2 * 2 bounds. There are two sources of inaccuracies:
+   *
+   * 1. Without tracking the lower bounds we can't see that `x` is assigned a
+   * value that is equal to its lower bound.
+   * 2. Had the conditional assignment been `x = 2` then the estimate of two
+   * bounds for `x` would have been correct. However, the estimate of 4 for `y`
+   * would still be incorrect. Summing the actual bounds `{1,2}` with itself
+   * gives `{2,3,4}` which is only three bounds. Again, we can't realise this
+   * without tracking the bounds.
+   *
+   * Since these inaccuracies compound the estimated number of bounds can often
+   * be _much_ greater than the actual number of bounds. Do note though that the
+   * estimate is not _guaranteed_ to be an upper bound. In some cases the
+   * approximations might underestimate the number of bounds.
+   *
+   * This predicate is functional. This is crucial as:
+   *
+   * - It ensures that the computing the estimate itself is fast.
+   * - Our use of monotonic aggregates assumes functionality.
+   *
+   * Any non-functional case should be considered a bug.
+   */
+  float nrOfBoundsExpr(Expr e) {
+    // Similarly to what we do for definitions, we do not attempt to measure the
+    // number of bounds for recursive expressions.
+    if isRecursiveExpr(e)
+    then result = getNrOfWideningBounds(e.getUnspecifiedType())
+    else
+      if analyzableExpr(e)
+      then
+        // The cases here are an abstraction of and mirrors the cases inside
+        // `getLowerBoundsImpl`/`getUpperBoundsImpl`.
+        result = 1 and exists(getValue(e).toFloat())
+        or
+        exists(Expr operand | result = nrOfBoundsExpr(operand) |
+          effectivelyMultipliesByPositive(e, operand, _)
+          or
+          effectivelyMultipliesByNegative(e, operand, _)
+        )
+        or
+        exists(ConditionalExpr condExpr |
+          e = condExpr and
+          result = nrOfBoundsExpr(condExpr.getThen()) * nrOfBoundsExpr(condExpr.getElse())
+        )
+        or
+        exists(BinaryOperation binop |
+          e = binop and
+          result = nrOfBoundsExpr(binop.getLeftOperand()) * nrOfBoundsExpr(binop.getRightOperand())
+        |
+          e instanceof MaxExpr or
+          e instanceof MinExpr or
+          e instanceof AddExpr or
+          e instanceof SubExpr or
+          e instanceof UnsignedMulExpr or
+          e instanceof UnsignedBitwiseAndExpr
+        )
+        or
+        exists(AssignExpr assign | e = assign and result = nrOfBoundsExpr(assign.getRValue()))
+        or
+        exists(AssignArithmeticOperation assignOp |
+          e = assignOp and
+          result = nrOfBoundsExpr(assignOp.getLValue()) * nrOfBoundsExpr(assignOp.getRValue())
+        |
+          e instanceof AssignAddExpr or
+          e instanceof AssignSubExpr or
+          e instanceof UnsignedAssignMulExpr
+        )
+        or
+        // Handles `AssignMulByPositiveConstantExpr` and `AssignMulByNegativeConstantExpr`
+        exists(AssignMulByConstantExpr mulExpr |
+          e = mulExpr and
+          result = nrOfBoundsExpr(mulExpr.getLValue())
+        )
+        or
+        // Handles the prefix and postfix increment and decrement operators.
+        exists(CrementOperation crementOp |
+          e = crementOp and result = nrOfBoundsExpr(crementOp.getOperand())
+        )
+        or
+        exists(RemExpr remExpr | e = remExpr | result = nrOfBoundsExpr(remExpr.getRightOperand()))
+        or
+        exists(Conversion convExpr |
+          e = convExpr and
+          if convExpr.getUnspecifiedType() instanceof BoolType
+          then result = 1
+          else result = nrOfBoundsExpr(convExpr.getExpr())
+        )
+        or
+        exists(RangeSsaDefinition def, StackVariable v |
+          e = def.getAUse(v) and
+          result = nrOfBoundsDef(def, v) and
+          // Avoid returning two numbers when `e` is a use with a constant value.
+          not exists(getValue(e).toFloat())
+        )
+        or
+        exists(RShiftExpr rsExpr |
+          e = rsExpr and
+          exists(getValue(rsExpr.getRightOperand().getFullyConverted()).toInt()) and
+          result = nrOfBoundsExpr(rsExpr.getLeftOperand())
+        )
+      else (
+        exists(exprMinVal(e)) and result = 1
+      )
+  }
+}
+
+/**
+ * Holds if `v` is a variable for which widening should be used, as otherwise a
+ * very large number of bounds might be generated during the range analysis for
+ * `v`.
+ */
+private predicate varHasTooManyBounds(StackVariable v) {
+  exists(RangeSsaDefinition def |
+    def.getAVariable() = v and
+    BoundsEstimate::nrOfBoundsDef(def, v) > BoundsEstimate::getBoundsLimit()
+  )
+}
+
+/**
+ * Holds if `e` is an expression for which widening should be used, as otherwise
+ * a very large number of bounds might be generated during the range analysis
+ * for `e`.
+ */
+private predicate exprHasTooManyBounds(Expr e) {
+  BoundsEstimate::nrOfBoundsExpr(e) > BoundsEstimate::getBoundsLimit()
+  or
+  // A subexpressions of an expression with too many bounds may itself not have
+  // to many bounds. For instance, `x + y` can have too many bounds without `x`
+  // having as well. But in these cases, still want to consider `e` as having
+  // too many bounds since:
+  // - The overall result is widened anyway, so widening `e` as well is unlikely
+  //   to cause further precision loss.
+  // - The number of bounds could be very large but still below the arbitrary
+  //   limit. Hence widening `e` can improve performance.
+  exists(Expr pe | exprHasTooManyBounds(pe) and e.getParent() = pe)
+}
+
 /**
 * Holds if `binop` is a binary operation that's likely to be assigned a
 * quadratic (or more) number of candidate bounds during the analysis. This can
@@ -654,13 +996,8 @@ private float getTruncatedLowerBounds(Expr expr) {
    if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
    then
      // Apply widening where we might get a combinatorial explosion.
-      if isRecursiveBinary(expr)
-      then
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
-            not widenLB > newLB
-          )
+      if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+      then result = widenLowerBound(expr.getUnspecifiedType(), newLB)
      else result = newLB
    else result = exprMinVal(expr)
  ) and
@@ -713,13 +1050,8 @@ private float getTruncatedUpperBounds(Expr expr) {
        if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
        then
          // Apply widening where we might get a combinatorial explosion.
-          if isRecursiveBinary(expr)
-          then
-            result =
-              min(float widenUB |
-                widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
-                not widenUB < newUB
-              )
+          if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+          then result = widenUpperBound(expr.getUnspecifiedType(), newUB)
          else result = newUB
        else result = exprMaxVal(expr)
      )
@@ -1796,18 +2128,12 @@ module SimpleRangeAnalysisInternal {
    |
      // Widening: check whether the new lower bound is from a source which
      // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
      then
        // The new lower bound is from a recursive source, so we round
        // down to one of a limited set of values to prevent the
        // recursion from exploding.
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(getVariableRangeType(v)) and
-            not widenLB > truncatedLB
-          |
-            widenLB
-          )
+        result = widenLowerBound(getVariableRangeType(v), truncatedLB)
      else result = truncatedLB
    )
    or
@@ -1826,18 +2152,12 @@ module SimpleRangeAnalysisInternal {
    |
      // Widening: check whether the new upper bound is from a source which
      // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
      then
        // The new upper bound is from a recursive source, so we round
        // up to one of a fixed set of values to prevent the recursion
        // from exploding.
-        result =
-          min(float widenUB |
-            widenUB = wideningUpperBounds(getVariableRangeType(v)) and
-            not widenUB < truncatedUB
-          |
-            widenUB
-          )
+        result = widenUpperBound(getVariableRangeType(v), truncatedUB)
      else result = truncatedUB
    )
    or
@@ -1845,4 +2165,60 @@ module SimpleRangeAnalysisInternal {
    // bound is `typeUpperBound`.
    defMightOverflowNegatively(def, v) and result = varMaxVal(v)
  }
+
+  /** Gets the estimate of the number of bounds for `e`. */
+  float estimateNrOfBounds(Expr e) { result = BoundsEstimate::nrOfBoundsExpr(e) }
+}
+
+/** Provides predicates for debugging the simple range analysis library. */
+private module Debug {
+  Locatable getRelevantLocatable() {
+    exists(string filepath, int startline |
+      result.getLocation().hasLocationInfo(filepath, startline, _, _, _) and
+      filepath.matches("%/test.c") and
+      startline = [621 .. 639]
+    )
+  }
+
+  float debugGetLowerBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getLowerBoundsImpl(e)
+  }
+
+  float debugGetUpperBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getUpperBoundsImpl(e)
+  }
+
+  /**
+   * Counts the number of lower bounds for a given expression. This predicate is
+   * useful for identifying performance issues in the range analysis.
+   */
+  predicate countGetLowerBoundsImpl(Expr e, int n) {
+    e = getRelevantLocatable() and
+    n = strictcount(float lb | lb = getLowerBoundsImpl(e) | lb)
+  }
+
+  float debugNrOfBounds(Expr e) {
+    e = getRelevantLocatable() and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Finds any expressions for which `nrOfBounds` is not functional. The result
+   * should be empty, so this predicate is useful to debug non-functional cases.
+   */
+  int nonFunctionalNrOfBounds(Expr e) {
+    strictcount(BoundsEstimate::nrOfBoundsExpr(e)) > 1 and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Holds if `e` is an expression that has a lower bound, but where
+   * `nrOfBounds` does not compute an estimate.
+   */
+  predicate missingNrOfBounds(Expr e, float n) {
+    n = lowerBound(e) and
+    not exists(BoundsEstimate::nrOfBoundsExpr(e))
+  }
 }
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -47,6 +47,19 @@ compilation_args(
    string arg : string ref
 );

+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
 /**
 * Optionally, record the build mode for each compilation.
 */
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
--- a/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/old.dbscheme
+++ b/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/old.dbscheme
--- a/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/semmlecode.cpp.dbscheme
--- a/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/upgrade.properties
+++ b/cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/upgrade.properties
@@ -0,0 +1,2 @@
+description: Support expanded compilation argument lists
+compatibility: backwards
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.5.4
+
+No user-facing changes.
+
 ## 1.5.3

 No user-facing changes.
--- a/cpp/ql/src/change-notes/released/1.5.4.md
+++ b/cpp/ql/src/change-notes/released/1.5.4.md
@@ -0,0 +1,3 @@
+## 1.5.4
+
+No user-facing changes.
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.3
+lastReleaseVersion: 1.5.4
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.4-dev
+version: 1.5.5-dev
 groups:
  - cpp
  - queries
--- a/cpp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
+++ b/cpp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
@@ -190,7 +190,7 @@ module ModelGeneratorCommonInput implements ModelGeneratorCommonInputSig<Cpp::Lo
  predicate isRelevantType(Type t) { any() }

  Type getUnderlyingContentType(DataFlow::ContentSet c) {
-    result = c.(DataFlow::FieldContent).getField().getUnspecifiedType() or
+    result = c.(DataFlow::NonUnionFieldContent).getField().getUnspecifiedType() or
    result = c.(DataFlow::UnionContent).getUnion().getUnspecifiedType()
  }

@@ -340,12 +340,7 @@ private module SummaryModelGeneratorInput implements SummaryModelGeneratorInputS
    )
  }

-  predicate isField(DataFlow::ContentSet cs) {
-    exists(DataFlow::Content c | cs.isSingleton(c) |
-      c instanceof DataFlow::FieldContent or
-      c instanceof DataFlow::UnionContent
-    )
-  }
+  predicate isField(DataFlow::ContentSet cs) { cs.isSingleton(any(DataFlow::FieldContent fc)) }

  predicate isCallback(DataFlow::ContentSet c) { none() }

--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected
@@ -485,197 +485,529 @@
 | test.c:411:59:411:59 | k | 0.205191 |
 | test.c:411:63:411:63 | l | 0.132041 |
 | test.c:413:10:413:15 | output | 1.842468 |
-| test.c:418:20:418:20 | x | 0 |
-| test.c:418:30:418:30 | x | 0 |
-| test.c:421:3:421:4 | y1 | 0 |
-| test.c:421:11:421:11 | y | 0 |
-| test.c:421:14:421:14 | y | 1 |
-| test.c:422:3:422:4 | y2 | 0 |
-| test.c:422:9:422:9 | y | 1 |
-| test.c:422:14:422:14 | y | 2 |
-| test.c:422:22:422:22 | y | 5 |
-| test.c:423:10:423:11 | y1 | 1 |
-| test.c:423:15:423:16 | y2 | 5 |
-| test.c:431:3:431:3 | i | -2147483648 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | -2147483648 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | -2147483648 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | -2147483648 |
-| test.c:442:7:442:7 | j | -2147483648 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | -2147483648 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | -2147483648 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 0 |
-| test.c:456:17:456:17 | a | 3 |
-| test.c:456:33:456:33 | b | 0 |
-| test.c:456:38:456:38 | b | 5 |
-| test.c:457:13:457:13 | a | 3 |
-| test.c:457:15:457:15 | b | 5 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 15 |
-| test.c:460:12:460:12 | a | 0 |
-| test.c:460:17:460:17 | a | 3 |
-| test.c:460:33:460:33 | b | 0 |
-| test.c:460:38:460:38 | b | 0 |
-| test.c:461:13:461:13 | a | 3 |
-| test.c:461:15:461:15 | b | 0 |
-| test.c:462:5:462:9 | total | 0 |
-| test.c:462:14:462:14 | r | 0 |
-| test.c:464:12:464:12 | a | 0 |
-| test.c:464:17:464:17 | a | 3 |
-| test.c:464:34:464:34 | b | 0 |
-| test.c:464:39:464:39 | b | 13 |
-| test.c:465:13:465:13 | a | 3 |
-| test.c:465:15:465:15 | b | 13 |
-| test.c:466:5:466:9 | total | 0 |
-| test.c:466:14:466:14 | r | 39 |
-| test.c:469:10:469:14 | total | 0 |
-| test.c:475:12:475:12 | b | 0 |
-| test.c:475:17:475:17 | b | 5 |
-| test.c:476:16:476:16 | b | 5 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 55 |
-| test.c:479:12:479:12 | b | 0 |
-| test.c:479:17:479:17 | b | 0 |
-| test.c:480:16:480:16 | b | 0 |
-| test.c:481:5:481:9 | total | 0 |
-| test.c:481:14:481:14 | r | 0 |
-| test.c:483:13:483:13 | b | 0 |
-| test.c:483:18:483:18 | b | 13 |
-| test.c:484:16:484:16 | b | 13 |
-| test.c:485:5:485:9 | total | 0 |
-| test.c:485:14:485:14 | r | 143 |
-| test.c:488:10:488:14 | total | 0 |
-| test.c:493:3:493:3 | x | 0 |
-| test.c:493:7:493:7 | y | 0 |
-| test.c:494:3:494:4 | xy | 0 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 0 |
-| test.c:501:3:501:3 | y | 0 |
-| test.c:502:3:502:4 | xy | 0 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 0 |
-| test.c:508:43:508:44 | ui | 10 |
-| test.c:508:48:508:49 | ui | 10 |
-| test.c:509:12:509:17 | result | 100 |
-| test.c:511:7:511:8 | ul | 0 |
-| test.c:512:28:512:29 | ul | 10 |
-| test.c:512:33:512:34 | ul | 10 |
-| test.c:513:12:513:17 | result | 0 |
-| test.c:519:7:519:8 | ui | 0 |
-| test.c:519:19:519:20 | ui | 0 |
-| test.c:520:5:520:6 | ui | 2 |
-| test.c:520:11:520:12 | ui | 2 |
-| test.c:521:12:521:13 | ui | 4 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | -2147483648 |
-| test.c:533:18:533:18 | i | -1 |
-| test.c:534:5:534:5 | i | -2147483648 |
-| test.c:534:13:534:13 | i | -1 |
-| test.c:535:9:535:9 | i | -5 |
-| test.c:537:5:537:5 | i | -2147483648 |
-| test.c:537:9:537:9 | i | -5 |
-| test.c:538:9:538:9 | i | -30 |
-| test.c:540:5:540:5 | i | -30 |
-| test.c:541:9:541:9 | i | -210 |
-| test.c:543:5:543:5 | i | -210 |
-| test.c:544:9:544:9 | i | -1155 |
-| test.c:546:7:546:7 | i | -2147483648 |
-| test.c:547:5:547:5 | i | -2147483648 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | -2147483648 |
-| test.c:550:7:550:7 | i | -2147483648 |
-| test.c:551:10:551:10 | i | -2147483648 |
-| test.c:554:3:554:3 | i | -2147483648 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | -128 |
-| test.c:563:7:563:7 | n | 0 |
-| test.c:565:7:565:7 | n | 0 |
-| test.c:566:9:566:9 | n | 1 |
-| test.c:569:7:569:7 | n | 0 |
-| test.c:570:9:570:9 | n | 1 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 0 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 1 |
-| test.c:581:10:581:10 | n | 0 |
-| test.c:582:5:582:5 | n | 1 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | -32768 |
-| test.c:592:7:592:7 | n | 0 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 1 |
-| test.c:598:7:598:7 | n | 0 |
-| test.c:599:9:599:9 | n | 1 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 0 |
-| test.c:605:5:605:5 | n | 1 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | -32768 |
-| test.c:613:9:613:9 | n | -32768 |
-| test.c:614:11:614:11 | n | 0 |
-| test.c:618:7:618:7 | n | -32768 |
-| test.c:619:13:619:13 | n | 5 |
-| test.c:622:9:622:9 | n | 6 |
-| test.c:625:7:625:7 | n | -32768 |
-| test.c:625:22:625:22 | n | -32767 |
-| test.c:626:9:626:9 | n | -32766 |
-| test.c:629:7:629:7 | n | -32768 |
-| test.c:630:5:630:5 | n | 0 |
-| test.c:630:10:630:10 | n | 1 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 0 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 1 |
-| test.c:642:7:642:8 | ss | -32768 |
-| test.c:643:9:643:10 | ss | 0 |
-| test.c:646:7:646:8 | ss | -32768 |
-| test.c:647:9:647:10 | ss | -32768 |
-| test.c:650:14:650:15 | us | 0 |
-| test.c:651:9:651:10 | us | 0 |
-| test.c:654:14:654:15 | us | 0 |
-| test.c:655:9:655:10 | us | 0 |
-| test.c:658:7:658:8 | ss | -32768 |
-| test.c:659:9:659:10 | ss | -32768 |
-| test.c:662:7:662:8 | ss | -32768 |
-| test.c:663:9:663:10 | ss | -1 |
-| test.c:669:8:669:8 | s | -2147483648 |
-| test.c:669:15:669:15 | s | 0 |
-| test.c:669:23:669:23 | s | 0 |
-| test.c:670:18:670:18 | s | 0 |
-| test.c:670:22:670:22 | s | 0 |
-| test.c:671:9:671:14 | result | 0 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | -2147483648 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 0 |
-| test.c:688:12:688:12 | s | -2147483648 |
-| test.c:689:7:689:8 | s2 | -4 |
-| test.c:694:7:694:7 | x | -2147483648 |
-| test.c:695:9:695:9 | y | -2147483648 |
-| test.c:699:7:699:7 | y | -2147483648 |
-| test.c:708:7:708:7 | x | -2147483648 |
-| test.c:713:7:713:7 | x | -2147483648 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 0 |
+| test.c:420:19:420:21 | rhs | 0 |
+| test.c:421:7:421:9 | rhs | 0 |
+| test.c:421:19:421:21 | rhs | 0 |
+| test.c:422:7:422:9 | rhs | 0 |
+| test.c:422:19:422:21 | rhs | 0 |
+| test.c:423:7:423:9 | rhs | 0 |
+| test.c:423:19:423:21 | rhs | 0 |
+| test.c:424:7:424:9 | rhs | 0 |
+| test.c:424:19:424:21 | rhs | 0 |
+| test.c:425:10:425:12 | rhs | 0 |
+| test.c:429:7:429:7 | a | -2147483648 |
+| test.c:430:9:430:9 | b | -2147483648 |
+| test.c:431:7:431:7 | a | 17 |
+| test.c:431:12:431:12 | b | 23 |
+| test.c:433:9:433:9 | a | 17 |
+| test.c:434:7:434:7 | b | -2147483648 |
+| test.c:439:11:439:11 | a | -2147483648 |
+| test.c:439:15:439:15 | b | -2147483648 |
+| test.c:440:10:440:10 | a | -2147483648 |
+| test.c:440:14:440:14 | b | -2147483648 |
+| test.c:447:10:447:11 | ip | 0 |
+| test.c:447:20:447:21 | ip | 0 |
+| test.c:447:40:447:41 | ip | 0 |
+| test.c:448:14:448:15 | ip | 1 |
+| test.c:449:14:449:15 | ip | 0 |
+| test.c:449:34:449:35 | ip | 0 |
+| test.c:450:11:450:12 | ip | 0 |
+| test.c:451:13:451:14 | ip | 0 |
+| test.c:452:14:452:15 | ip | 0 |
+| test.c:453:14:453:15 | ip | 0 |
+| test.c:454:15:454:16 | ip | 0 |
+| test.c:454:41:454:42 | ip | 0 |
+| test.c:454:52:454:53 | ip | 0 |
+| test.c:454:67:454:68 | ip | 0 |
+| test.c:454:78:454:79 | ip | 0 |
+| test.c:455:18:455:19 | ip | 0 |
+| test.c:456:23:456:24 | ip | 0 |
+| test.c:456:34:456:35 | ip | 0 |
+| test.c:457:25:457:26 | ip | 0 |
+| test.c:458:20:458:21 | ip | 0 |
+| test.c:459:11:459:12 | ip | 0 |
+| test.c:459:26:459:27 | ip | 0 |
+| test.c:460:16:460:17 | ip | 0 |
+| test.c:461:16:461:17 | ip | 0 |
+| test.c:462:16:462:17 | ip | 0 |
+| test.c:463:17:463:18 | ip | 0 |
+| test.c:464:22:464:23 | ip | 0 |
+| test.c:464:33:464:34 | ip | 0 |
+| test.c:464:48:464:49 | ip | 0 |
+| test.c:464:59:464:60 | ip | 0 |
+| test.c:465:20:465:21 | ip | 0 |
+| test.c:466:25:466:26 | ip | 0 |
+| test.c:466:36:466:37 | ip | 0 |
+| test.c:467:27:467:28 | ip | 0 |
+| test.c:468:22:468:23 | ip | 0 |
+| test.c:469:15:469:16 | ip | 0 |
+| test.c:469:30:469:31 | ip | 0 |
+| test.c:470:11:470:12 | ip | 0 |
+| test.c:471:12:471:13 | ip | 0 |
+| test.c:472:12:472:13 | ip | 0 |
+| test.c:473:13:473:14 | ip | 0 |
+| test.c:473:39:473:40 | ip | 0 |
+| test.c:473:50:473:51 | ip | 0 |
+| test.c:473:65:473:66 | ip | 0 |
+| test.c:473:76:473:77 | ip | 0 |
+| test.c:474:16:474:17 | ip | 0 |
+| test.c:475:21:475:22 | ip | 0 |
+| test.c:475:32:475:33 | ip | 0 |
+| test.c:476:23:476:24 | ip | 0 |
+| test.c:477:18:477:19 | ip | 0 |
+| test.c:478:11:478:12 | ip | 0 |
+| test.c:478:17:478:18 | ip | 0 |
+| test.c:478:37:478:38 | ip | 0 |
+| test.c:478:43:478:44 | ip | 0 |
+| test.c:479:14:479:15 | ip | 0 |
+| test.c:480:14:480:15 | ip | 0 |
+| test.c:481:14:481:15 | ip | 0 |
+| test.c:482:15:482:16 | ip | 0 |
+| test.c:482:41:482:42 | ip | 0 |
+| test.c:482:52:482:53 | ip | 0 |
+| test.c:482:67:482:68 | ip | 0 |
+| test.c:482:78:482:79 | ip | 0 |
+| test.c:483:18:483:19 | ip | 0 |
+| test.c:484:23:484:24 | ip | 0 |
+| test.c:484:34:484:35 | ip | 0 |
+| test.c:485:25:485:26 | ip | 0 |
+| test.c:486:20:486:21 | ip | 0 |
+| test.c:487:14:487:15 | ip | 0 |
+| test.c:487:20:487:21 | ip | 0 |
+| test.c:488:16:488:17 | ip | 0 |
+| test.c:489:12:489:13 | ip | 0 |
+| test.c:490:14:490:15 | ip | 0 |
+| test.c:491:15:491:16 | ip | 0 |
+| test.c:492:16:492:17 | ip | 0 |
+| test.c:493:16:493:17 | ip | 0 |
+| test.c:494:17:494:18 | ip | 0 |
+| test.c:495:22:495:23 | ip | 0 |
+| test.c:495:33:495:34 | ip | 0 |
+| test.c:495:48:495:49 | ip | 0 |
+| test.c:495:59:495:60 | ip | 0 |
+| test.c:496:20:496:21 | ip | 0 |
+| test.c:497:25:497:26 | ip | 0 |
+| test.c:497:36:497:37 | ip | 0 |
+| test.c:498:27:498:28 | ip | 0 |
+| test.c:499:22:499:23 | ip | 0 |
+| test.c:500:13:500:14 | ip | 0 |
+| test.c:500:28:500:29 | ip | 0 |
+| test.c:501:18:501:19 | ip | 0 |
+| test.c:502:18:502:19 | ip | 0 |
+| test.c:503:18:503:19 | ip | 0 |
+| test.c:504:19:504:20 | ip | 0 |
+| test.c:505:24:505:25 | ip | 0 |
+| test.c:505:35:505:36 | ip | 0 |
+| test.c:505:50:505:51 | ip | 0 |
+| test.c:505:61:505:62 | ip | 0 |
+| test.c:506:22:506:23 | ip | 0 |
+| test.c:507:27:507:28 | ip | 0 |
+| test.c:507:38:507:39 | ip | 0 |
+| test.c:508:29:508:30 | ip | 0 |
+| test.c:509:24:509:25 | ip | 0 |
+| test.c:510:17:510:18 | ip | 0 |
+| test.c:510:32:510:33 | ip | 0 |
+| test.c:511:14:511:15 | ip | 0 |
+| test.c:512:18:512:19 | ip | 0 |
+| test.c:513:18:513:19 | ip | 0 |
+| test.c:514:19:514:20 | ip | 0 |
+| test.c:515:24:515:25 | ip | 0 |
+| test.c:515:35:515:36 | ip | 0 |
+| test.c:515:50:515:51 | ip | 0 |
+| test.c:515:61:515:62 | ip | 0 |
+| test.c:516:22:516:23 | ip | 0 |
+| test.c:517:27:517:28 | ip | 0 |
+| test.c:517:38:517:39 | ip | 0 |
+| test.c:518:29:518:30 | ip | 0 |
+| test.c:519:24:519:25 | ip | 0 |
+| test.c:520:17:520:18 | ip | 0 |
+| test.c:520:23:520:24 | ip | 0 |
+| test.c:520:43:520:44 | ip | 0 |
+| test.c:520:49:520:50 | ip | 0 |
+| test.c:521:16:521:17 | ip | 0 |
+| test.c:522:16:522:17 | ip | 0 |
+| test.c:523:16:523:17 | ip | 0 |
+| test.c:524:17:524:18 | ip | 0 |
+| test.c:525:22:525:23 | ip | 0 |
+| test.c:525:33:525:34 | ip | 0 |
+| test.c:525:48:525:49 | ip | 0 |
+| test.c:525:59:525:60 | ip | 0 |
+| test.c:526:20:526:21 | ip | 0 |
+| test.c:527:25:527:26 | ip | 0 |
+| test.c:527:36:527:37 | ip | 0 |
+| test.c:528:27:528:28 | ip | 0 |
+| test.c:529:22:529:23 | ip | 0 |
+| test.c:530:16:530:17 | ip | 0 |
+| test.c:530:22:530:23 | ip | 0 |
+| test.c:531:18:531:19 | ip | 0 |
+| test.c:532:14:532:15 | ip | 0 |
+| test.c:533:14:533:15 | ip | 0 |
+| test.c:533:24:533:25 | ip | 0 |
+| test.c:533:44:533:45 | ip | 0 |
+| test.c:534:16:534:17 | ip | 1 |
+| test.c:535:16:535:17 | ip | 0 |
+| test.c:535:36:535:37 | ip | 0 |
+| test.c:536:14:536:15 | ip | 0 |
+| test.c:537:19:537:20 | ip | 0 |
+| test.c:538:20:538:21 | ip | 0 |
+| test.c:539:20:539:21 | ip | 0 |
+| test.c:540:21:540:22 | ip | 0 |
+| test.c:541:26:541:27 | ip | 0 |
+| test.c:541:37:541:38 | ip | 0 |
+| test.c:541:52:541:53 | ip | 0 |
+| test.c:541:63:541:64 | ip | 0 |
+| test.c:542:24:542:25 | ip | 0 |
+| test.c:543:29:543:30 | ip | 0 |
+| test.c:543:40:543:41 | ip | 0 |
+| test.c:544:31:544:32 | ip | 0 |
+| test.c:545:26:545:27 | ip | 0 |
+| test.c:546:17:546:18 | ip | 0 |
+| test.c:546:32:546:33 | ip | 0 |
+| test.c:547:22:547:23 | ip | 0 |
+| test.c:548:22:548:23 | ip | 0 |
+| test.c:549:22:549:23 | ip | 0 |
+| test.c:550:23:550:24 | ip | 0 |
+| test.c:551:28:551:29 | ip | 0 |
+| test.c:551:39:551:40 | ip | 0 |
+| test.c:551:54:551:55 | ip | 0 |
+| test.c:551:65:551:66 | ip | 0 |
+| test.c:552:26:552:27 | ip | 0 |
+| test.c:553:31:553:32 | ip | 0 |
+| test.c:553:42:553:43 | ip | 0 |
+| test.c:554:33:554:34 | ip | 0 |
+| test.c:555:28:555:29 | ip | 0 |
+| test.c:556:21:556:22 | ip | 0 |
+| test.c:556:36:556:37 | ip | 0 |
+| test.c:557:17:557:18 | ip | 0 |
+| test.c:558:18:558:19 | ip | 0 |
+| test.c:559:18:559:19 | ip | 0 |
+| test.c:560:19:560:20 | ip | 0 |
+| test.c:561:24:561:25 | ip | 0 |
+| test.c:561:35:561:36 | ip | 0 |
+| test.c:561:50:561:51 | ip | 0 |
+| test.c:561:61:561:62 | ip | 0 |
+| test.c:562:22:562:23 | ip | 0 |
+| test.c:563:27:563:28 | ip | 0 |
+| test.c:563:38:563:39 | ip | 0 |
+| test.c:564:29:564:30 | ip | 0 |
+| test.c:565:24:565:25 | ip | 0 |
+| test.c:566:17:566:18 | ip | 0 |
+| test.c:566:23:566:24 | ip | 0 |
+| test.c:566:43:566:44 | ip | 0 |
+| test.c:566:49:566:50 | ip | 0 |
+| test.c:567:20:567:21 | ip | 0 |
+| test.c:568:20:568:21 | ip | 0 |
+| test.c:569:20:569:21 | ip | 0 |
+| test.c:570:21:570:22 | ip | 0 |
+| test.c:571:26:571:27 | ip | 0 |
+| test.c:571:37:571:38 | ip | 0 |
+| test.c:571:52:571:53 | ip | 0 |
+| test.c:571:63:571:64 | ip | 0 |
+| test.c:572:24:572:25 | ip | 0 |
+| test.c:573:29:573:30 | ip | 0 |
+| test.c:573:40:573:41 | ip | 0 |
+| test.c:574:31:574:32 | ip | 0 |
+| test.c:575:26:575:27 | ip | 0 |
+| test.c:576:20:576:21 | ip | 0 |
+| test.c:576:26:576:27 | ip | 0 |
+| test.c:577:22:577:23 | ip | 0 |
+| test.c:578:18:578:19 | ip | 0 |
+| test.c:579:16:579:17 | ip | 0 |
+| test.c:580:17:580:18 | ip | 0 |
+| test.c:581:18:581:19 | ip | 0 |
+| test.c:582:18:582:19 | ip | 0 |
+| test.c:583:19:583:20 | ip | 0 |
+| test.c:584:24:584:25 | ip | 0 |
+| test.c:584:35:584:36 | ip | 0 |
+| test.c:584:50:584:51 | ip | 0 |
+| test.c:584:61:584:62 | ip | 0 |
+| test.c:585:22:585:23 | ip | 0 |
+| test.c:586:27:586:28 | ip | 0 |
+| test.c:586:38:586:39 | ip | 0 |
+| test.c:587:29:587:30 | ip | 0 |
+| test.c:588:24:588:25 | ip | 0 |
+| test.c:589:15:589:16 | ip | 0 |
+| test.c:589:30:589:31 | ip | 0 |
+| test.c:590:20:590:21 | ip | 0 |
+| test.c:591:20:591:21 | ip | 0 |
+| test.c:592:20:592:21 | ip | 0 |
+| test.c:593:21:593:22 | ip | 0 |
+| test.c:594:26:594:27 | ip | 0 |
+| test.c:594:37:594:38 | ip | 0 |
+| test.c:594:52:594:53 | ip | 0 |
+| test.c:594:63:594:64 | ip | 0 |
+| test.c:595:24:595:25 | ip | 0 |
+| test.c:596:29:596:30 | ip | 0 |
+| test.c:596:40:596:41 | ip | 0 |
+| test.c:597:31:597:32 | ip | 0 |
+| test.c:598:26:598:27 | ip | 0 |
+| test.c:599:19:599:20 | ip | 0 |
+| test.c:599:34:599:35 | ip | 0 |
+| test.c:600:16:600:17 | ip | 0 |
+| test.c:601:20:601:21 | ip | 0 |
+| test.c:602:20:602:21 | ip | 0 |
+| test.c:603:21:603:22 | ip | 0 |
+| test.c:604:26:604:27 | ip | 0 |
+| test.c:604:37:604:38 | ip | 0 |
+| test.c:604:52:604:53 | ip | 0 |
+| test.c:604:63:604:64 | ip | 0 |
+| test.c:605:24:605:25 | ip | 0 |
+| test.c:606:29:606:30 | ip | 0 |
+| test.c:606:40:606:41 | ip | 0 |
+| test.c:607:31:607:32 | ip | 0 |
+| test.c:608:26:608:27 | ip | 0 |
+| test.c:609:19:609:20 | ip | 0 |
+| test.c:609:25:609:26 | ip | 0 |
+| test.c:609:45:609:46 | ip | 0 |
+| test.c:609:51:609:52 | ip | 0 |
+| test.c:610:18:610:19 | ip | 0 |
+| test.c:611:18:611:19 | ip | 0 |
+| test.c:612:18:612:19 | ip | 0 |
+| test.c:613:19:613:20 | ip | 0 |
+| test.c:614:24:614:25 | ip | 0 |
+| test.c:614:35:614:36 | ip | 0 |
+| test.c:614:50:614:51 | ip | 0 |
+| test.c:614:61:614:62 | ip | 0 |
+| test.c:615:22:615:23 | ip | 0 |
+| test.c:616:27:616:28 | ip | 0 |
+| test.c:616:38:616:39 | ip | 0 |
+| test.c:617:29:617:30 | ip | 0 |
+| test.c:618:24:618:25 | ip | 0 |
+| test.c:619:18:619:19 | ip | 0 |
+| test.c:619:24:619:25 | ip | 0 |
+| test.c:620:20:620:21 | ip | 0 |
+| test.c:621:16:621:17 | ip | 0 |
+| test.c:622:10:622:23 | special_number | 0 |
+| test.c:630:7:630:8 | c1 | -2147483648 |
+| test.c:630:13:630:13 | x | 0 |
+| test.c:631:7:631:8 | c2 | -2147483648 |
+| test.c:631:13:631:13 | x | 0 |
+| test.c:632:7:632:8 | c3 | -2147483648 |
+| test.c:632:13:632:13 | x | 0 |
+| test.c:633:7:633:8 | c4 | -2147483648 |
+| test.c:633:13:633:13 | x | 0 |
+| test.c:634:7:634:8 | c5 | -2147483648 |
+| test.c:634:13:634:13 | x | 0 |
+| test.c:635:7:635:8 | c1 | -2147483648 |
+| test.c:635:13:635:14 | c2 | -2147483648 |
+| test.c:635:19:635:19 | x | 0 |
+| test.c:636:7:636:8 | c1 | -2147483648 |
+| test.c:636:13:636:14 | c3 | -2147483648 |
+| test.c:636:19:636:19 | x | 0 |
+| test.c:637:7:637:8 | c1 | -2147483648 |
+| test.c:637:13:637:14 | c4 | -2147483648 |
+| test.c:637:19:637:19 | x | 0 |
+| test.c:638:7:638:8 | c1 | -2147483648 |
+| test.c:638:13:638:14 | c5 | -2147483648 |
+| test.c:638:19:638:19 | x | 0 |
+| test.c:639:7:639:8 | c2 | -2147483648 |
+| test.c:639:13:639:14 | c3 | -2147483648 |
+| test.c:639:19:639:19 | x | 0 |
+| test.c:641:11:641:11 | x | 0 |
+| test.c:641:15:641:15 | x | 0 |
+| test.c:641:19:641:19 | x | 0 |
+| test.c:641:23:641:23 | x | 0 |
+| test.c:641:27:641:27 | x | 0 |
+| test.c:641:31:641:31 | x | 0 |
+| test.c:641:35:641:35 | x | 0 |
+| test.c:641:39:641:39 | x | 0 |
+| test.c:641:43:641:43 | x | 0 |
+| test.c:641:47:641:47 | x | 0 |
+| test.c:641:51:641:51 | x | 0 |
+| test.c:641:55:641:55 | x | 0 |
+| test.c:642:10:642:10 | y | -2147483648 |
+| test.c:647:20:647:20 | x | 0 |
+| test.c:647:30:647:30 | x | 0 |
+| test.c:650:3:650:4 | y1 | 0 |
+| test.c:650:11:650:11 | y | 0 |
+| test.c:650:14:650:14 | y | 1 |
+| test.c:651:3:651:4 | y2 | 0 |
+| test.c:651:9:651:9 | y | 1 |
+| test.c:651:14:651:14 | y | 2 |
+| test.c:651:22:651:22 | y | 5 |
+| test.c:652:10:652:11 | y1 | 1 |
+| test.c:652:15:652:16 | y2 | 5 |
+| test.c:660:3:660:3 | i | -2147483648 |
+| test.c:661:7:661:7 | i | 10 |
+| test.c:663:3:663:3 | i | -2147483648 |
+| test.c:664:3:664:3 | i | 10 |
+| test.c:665:7:665:7 | i | 20 |
+| test.c:667:3:667:3 | i | -2147483648 |
+| test.c:668:3:668:3 | i | 40 |
+| test.c:669:7:669:7 | i | 30 |
+| test.c:671:3:671:3 | i | -2147483648 |
+| test.c:671:7:671:7 | j | -2147483648 |
+| test.c:672:7:672:7 | i | 40 |
+| test.c:674:3:674:3 | i | -2147483648 |
+| test.c:674:8:674:8 | j | 40 |
+| test.c:675:7:675:7 | i | 50 |
+| test.c:677:3:677:3 | i | -2147483648 |
+| test.c:677:13:677:13 | j | 50 |
+| test.c:678:7:678:7 | i | 60 |
+| test.c:685:12:685:12 | a | 0 |
+| test.c:685:17:685:17 | a | 3 |
+| test.c:685:33:685:33 | b | 0 |
+| test.c:685:38:685:38 | b | 5 |
+| test.c:686:13:686:13 | a | 3 |
+| test.c:686:15:686:15 | b | 5 |
+| test.c:687:5:687:9 | total | 0 |
+| test.c:687:14:687:14 | r | 15 |
+| test.c:689:12:689:12 | a | 0 |
+| test.c:689:17:689:17 | a | 3 |
+| test.c:689:33:689:33 | b | 0 |
+| test.c:689:38:689:38 | b | 0 |
+| test.c:690:13:690:13 | a | 3 |
+| test.c:690:15:690:15 | b | 0 |
+| test.c:691:5:691:9 | total | 0 |
+| test.c:691:14:691:14 | r | 0 |
+| test.c:693:12:693:12 | a | 0 |
+| test.c:693:17:693:17 | a | 3 |
+| test.c:693:34:693:34 | b | 0 |
+| test.c:693:39:693:39 | b | 13 |
+| test.c:694:13:694:13 | a | 3 |
+| test.c:694:15:694:15 | b | 13 |
+| test.c:695:5:695:9 | total | 0 |
+| test.c:695:14:695:14 | r | 39 |
+| test.c:698:10:698:14 | total | 0 |
+| test.c:704:12:704:12 | b | 0 |
+| test.c:704:17:704:17 | b | 5 |
+| test.c:705:16:705:16 | b | 5 |
+| test.c:706:5:706:9 | total | 0 |
+| test.c:706:14:706:14 | r | 55 |
+| test.c:708:12:708:12 | b | 0 |
+| test.c:708:17:708:17 | b | 0 |
+| test.c:709:16:709:16 | b | 0 |
+| test.c:710:5:710:9 | total | 0 |
+| test.c:710:14:710:14 | r | 0 |
+| test.c:712:13:712:13 | b | 0 |
+| test.c:712:18:712:18 | b | 13 |
+| test.c:713:16:713:16 | b | 13 |
+| test.c:714:5:714:9 | total | 0 |
+| test.c:714:14:714:14 | r | 143 |
+| test.c:717:10:717:14 | total | 0 |
+| test.c:722:3:722:3 | x | 0 |
+| test.c:722:7:722:7 | y | 0 |
+| test.c:723:3:723:4 | xy | 0 |
+| test.c:723:8:723:8 | x | 1000000003 |
+| test.c:723:12:723:12 | y | 1000000003 |
+| test.c:724:10:724:11 | xy | 1000000006000000000 |
+| test.c:729:3:729:3 | x | 0 |
+| test.c:730:3:730:3 | y | 0 |
+| test.c:731:3:731:4 | xy | 0 |
+| test.c:731:8:731:8 | x | 274177 |
+| test.c:731:12:731:12 | y | 67280421310721 |
+| test.c:732:10:732:11 | xy | 18446744073709551616 |
+| test.c:736:7:736:8 | ui | 0 |
+| test.c:737:43:737:44 | ui | 10 |
+| test.c:737:48:737:49 | ui | 10 |
+| test.c:738:12:738:17 | result | 100 |
+| test.c:740:7:740:8 | ul | 0 |
+| test.c:741:28:741:29 | ul | 10 |
+| test.c:741:33:741:34 | ul | 10 |
+| test.c:742:12:742:17 | result | 0 |
+| test.c:748:7:748:8 | ui | 0 |
+| test.c:748:19:748:20 | ui | 0 |
+| test.c:749:5:749:6 | ui | 2 |
+| test.c:749:11:749:12 | ui | 2 |
+| test.c:750:12:750:13 | ui | 4 |
+| test.c:754:3:754:9 | uiconst | 10 |
+| test.c:757:3:757:9 | ulconst | 10 |
+| test.c:758:10:758:16 | uiconst | 40 |
+| test.c:758:20:758:26 | ulconst | 40 |
+| test.c:762:7:762:7 | i | -2147483648 |
+| test.c:762:18:762:18 | i | -1 |
+| test.c:763:5:763:5 | i | -2147483648 |
+| test.c:763:13:763:13 | i | -1 |
+| test.c:764:9:764:9 | i | -5 |
+| test.c:766:5:766:5 | i | -2147483648 |
+| test.c:766:9:766:9 | i | -5 |
+| test.c:767:9:767:9 | i | -30 |
+| test.c:769:5:769:5 | i | -30 |
+| test.c:770:9:770:9 | i | -210 |
+| test.c:772:5:772:5 | i | -210 |
+| test.c:773:9:773:9 | i | -1155 |
+| test.c:775:7:775:7 | i | -2147483648 |
+| test.c:776:5:776:5 | i | -2147483648 |
+| test.c:776:9:776:9 | i | -1 |
+| test.c:777:9:777:9 | i | 1 |
+| test.c:779:3:779:3 | i | -2147483648 |
+| test.c:779:7:779:7 | i | -2147483648 |
+| test.c:780:10:780:10 | i | -2147483648 |
+| test.c:783:3:783:3 | i | -2147483648 |
+| test.c:783:10:783:11 | sc | 1 |
+| test.c:785:7:785:7 | i | -128 |
+| test.c:792:7:792:7 | n | 0 |
+| test.c:794:7:794:7 | n | 0 |
+| test.c:795:9:795:9 | n | 1 |
+| test.c:798:7:798:7 | n | 0 |
+| test.c:799:9:799:9 | n | 1 |
+| test.c:801:9:801:9 | n | 0 |
+| test.c:804:8:804:8 | n | 0 |
+| test.c:805:9:805:9 | n | 0 |
+| test.c:807:9:807:9 | n | 1 |
+| test.c:810:10:810:10 | n | 0 |
+| test.c:811:5:811:5 | n | 1 |
+| test.c:814:7:814:7 | n | 0 |
+| test.c:818:7:818:7 | n | -32768 |
+| test.c:821:7:821:7 | n | 0 |
+| test.c:822:9:822:9 | n | 0 |
+| test.c:824:9:824:9 | n | 1 |
+| test.c:827:7:827:7 | n | 0 |
+| test.c:828:9:828:9 | n | 1 |
+| test.c:830:9:830:9 | n | 0 |
+| test.c:833:10:833:10 | n | 0 |
+| test.c:834:5:834:5 | n | 1 |
+| test.c:837:7:837:7 | n | 0 |
+| test.c:841:7:841:7 | n | -32768 |
+| test.c:842:9:842:9 | n | -32768 |
+| test.c:843:11:843:11 | n | 0 |
+| test.c:847:7:847:7 | n | -32768 |
+| test.c:848:13:848:13 | n | 5 |
+| test.c:851:9:851:9 | n | 6 |
+| test.c:854:7:854:7 | n | -32768 |
+| test.c:854:22:854:22 | n | -32767 |
+| test.c:855:9:855:9 | n | -32766 |
+| test.c:858:7:858:7 | n | -32768 |
+| test.c:859:5:859:5 | n | 0 |
+| test.c:859:10:859:10 | n | 1 |
+| test.c:859:14:859:14 | n | 0 |
+| test.c:860:6:860:6 | n | 0 |
+| test.c:860:10:860:10 | n | 0 |
+| test.c:860:14:860:14 | n | 1 |
+| test.c:871:7:871:8 | ss | -32768 |
+| test.c:872:9:872:10 | ss | 0 |
+| test.c:875:7:875:8 | ss | -32768 |
+| test.c:876:9:876:10 | ss | -32768 |
+| test.c:879:14:879:15 | us | 0 |
+| test.c:880:9:880:10 | us | 0 |
+| test.c:883:14:883:15 | us | 0 |
+| test.c:884:9:884:10 | us | 0 |
+| test.c:887:7:887:8 | ss | -32768 |
+| test.c:888:9:888:10 | ss | -32768 |
+| test.c:891:7:891:8 | ss | -32768 |
+| test.c:892:9:892:10 | ss | -1 |
+| test.c:898:8:898:8 | s | -2147483648 |
+| test.c:898:15:898:15 | s | 0 |
+| test.c:898:23:898:23 | s | 0 |
+| test.c:899:18:899:18 | s | 0 |
+| test.c:899:22:899:22 | s | 0 |
+| test.c:900:9:900:14 | result | 0 |
+| test.c:906:7:906:7 | i | 0 |
+| test.c:907:9:907:9 | i | -2147483648 |
+| test.c:911:7:911:7 | u | 0 |
+| test.c:912:9:912:9 | u | 0 |
+| test.c:917:12:917:12 | s | -2147483648 |
+| test.c:918:7:918:8 | s2 | -4 |
+| test.c:923:7:923:7 | x | -2147483648 |
+| test.c:924:9:924:9 | y | -2147483648 |
+| test.c:928:7:928:7 | y | -2147483648 |
+| test.c:937:7:937:7 | x | -2147483648 |
+| test.c:942:7:942:7 | x | -2147483648 |
+| test.c:949:8:949:8 | x | 2147483647 |
+| test.c:949:12:949:12 | y | 256 |
+| test.c:950:9:950:9 | x | 2147483647 |
+| test.c:951:9:951:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.ql
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.ql
@@ -0,0 +1,31 @@
+import cpp
+import utils.test.InlineExpectationsTest
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+query predicate estimateNrOfBounds(Expr e, float nrOfBounds) {
+  nrOfBounds = SimpleRangeAnalysisInternal::estimateNrOfBounds(e)
+}
+
+/**
+ * Finds any expressions for which `nrOfBounds` is not functional. The result
+ * should be empty, so this predicate is useful to debug non-functional cases.
+ */
+private predicate nonFunctionalNrOfBounds(Expr e) {
+  strictcount(SimpleRangeAnalysisInternal::estimateNrOfBounds(e)) > 1
+}
+
+module FunctionalityTest implements TestSig {
+  string getARelevantTag() { result = "nonFunctionalNrOfBounds" }
+
+  predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(Expr e |
+      nonFunctionalNrOfBounds(e) and
+      location = e.getLocation() and
+      element = e.toString() and
+      tag = "nonFunctionalNrOfBounds" and
+      value = ""
+    )
+  }
+}
+
+import MakeTest<FunctionalityTest>
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryLower.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryLower.expected
@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.13204114 | 0.42186276 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
+| test.c:447:4:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:447:5:449:49 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:450:6:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:451:8:469:41 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:454:10:458:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:454:31:454:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:456:13:458:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:463:12:468:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:464:12:464:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:466:15:468:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:470:6:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:473:8:477:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:473:29:473:77 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:475:11:477:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:478:6:478:54 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:482:10:486:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:482:31:482:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:484:13:486:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:487:9:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:491:10:510:43 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:494:12:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:495:12:495:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:497:15:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:504:14:509:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:505:14:505:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:507:17:509:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:511:9:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:514:14:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:515:14:515:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:517:17:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:520:12:520:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:524:12:529:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:525:12:525:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:527:15:529:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:530:11:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:533:9:535:51 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:536:9:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:537:14:556:47 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:540:16:545:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:541:16:541:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:543:19:545:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:550:18:555:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:551:18:551:66 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:553:21:555:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:557:12:578:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:560:14:565:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:561:14:561:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:563:17:565:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:566:12:566:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:570:16:575:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:571:16:571:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:573:19:575:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:576:15:578:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:580:12:599:45 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:583:14:588:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:584:14:584:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:586:17:588:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:593:16:598:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:594:16:594:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:596:19:598:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:600:11:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:603:16:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:604:16:604:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:606:19:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:609:14:609:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:613:14:618:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:614:14:614:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:616:17:618:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:619:13:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:647:20:647:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
+| test.c:859:5:859:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
+| test.c:860:5:860:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryUpper.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryUpper.expected
@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.53843358 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
+| test.c:447:4:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:447:5:449:49 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:450:6:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:451:8:469:41 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:454:10:458:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:454:31:454:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:456:13:458:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:463:12:468:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:464:12:464:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:466:15:468:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:470:6:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:473:8:477:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:473:29:473:77 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:475:11:477:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:478:6:478:54 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:482:10:486:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:482:31:482:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:484:13:486:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:487:9:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:491:10:510:43 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:494:12:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:495:12:495:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:497:15:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:504:14:509:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:505:14:505:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:507:17:509:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:511:9:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:514:14:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:515:14:515:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:517:17:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:520:12:520:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:524:12:529:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:525:12:525:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:527:15:529:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:530:11:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:533:9:535:51 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:536:9:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:537:14:556:47 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:540:16:545:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:541:16:541:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:543:19:545:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:550:18:555:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:551:18:551:66 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:553:21:555:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:557:12:578:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:560:14:565:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:561:14:561:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:563:17:565:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:566:12:566:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:570:16:575:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:571:16:571:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:573:19:575:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:576:15:578:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:580:12:599:45 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:583:14:588:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:584:14:584:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:586:17:588:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:593:16:598:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:594:16:594:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:596:19:598:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:600:11:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:603:16:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:604:16:604:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:606:19:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:609:14:609:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:613:14:618:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:614:14:614:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:616:17:618:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:619:13:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:647:20:647:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
+| test.c:859:5:859:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
+| test.c:860:5:860:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c
@@ -413,6 +413,235 @@ double test_ternary_nested_of_literals(double m, double n, double o, double p, d
  return output;
 }

+int repeated_if_statements(unsigned int rhs) {
+  // Test how many bounds we estimate for `if` statements without `else`
+  // branches where the following node is both a normal phi node and a guard phi
+  // node.
+  if (rhs < 12) { rhs << 1; }
+  if (rhs < 13) { rhs << 1; }
+  if (rhs < 14) { rhs << 1; }
+  if (rhs < 15) { rhs << 1; }
+  if (rhs < 16) { rhs << 1; }
+  return rhs; // rhs has 6 bounds
+}
+
+int ne_phi_nodes(int a, int b) {
+  if (a == 17) {
+    if (b == 23) {
+      a += b;
+    }
+    if (a == 18) {
+      b = 10;
+    }
+  }
+  // The statement below is an NE phi node for the access `a` in both `a == 17`
+  // and `a == 18`.
+  int c = a + b;
+  return a + b;
+}
+
+unsigned int conditional_nested_guards(unsigned int ip) {
+  // This tests a combinatorial explosion that can happen from a large number of
+  // nested linear guards.
+  unsigned int special_number =
+   (14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+      ? 14 * ip
+      : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17) >
+    (2 * (ip * 14 + 32) +
+      (4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip) >
+      2 * ip * 14 + (2 * ip + 1) * 17
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 2 * ip * 14 + (2 * ip + 1) * 17) >
+    (4 * (ip * 14 + 32) +
+      (2 * ip * 14 + 32) +
+      2 * (ip * 14 + 64) +
+      ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+        ? (2 * ip + 1) * 14
+        : 14 * (2 * ip) > 17 * ip
+          ? 14 * (2 * ip)
+          : 14 * ip) >
+    (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+      ? 4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip)
+      : 14 * ip > (ip + 1) * 17
+        ? 14 * ip
+        : (ip + 1) * 14)
+      ? 2 * (ip * 14 + 32) +
+        (4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip) >
+        2 * ip * 14 + (2 * ip + 1) * 17
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 2 * ip * 14 + (2 * ip + 1) * 17)
+      : 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 14 * ip > (ip + 1) * 17
+          ? 14 * ip
+          : (ip + 1) * 14)
+      ? 14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+        ? 14 * ip
+        : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17
+      : 2 * (ip * 14 + 32) +
+            (4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            2 * ip * 14 + (2 * ip + 1) * 17
+              ? 4 * (ip * 14 + 32) +
+                (2 * ip * 14 + 32) +
+                2 * (ip * 14 + 64) +
+                ((2 * ip + 1) * 14 >
+                (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                  ? (2 * ip + 1) * 14
+                  : 14 * (2 * ip) > 17 * ip
+                    ? 14 * (2 * ip)
+                    : 14 * ip)
+              : 2 * ip * 14 + (2 * ip + 1) * 17) >
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 14 * ip > (ip + 1) * 17
+              ? 14 * ip
+              : (ip + 1) * 14)
+        ? 2 * (ip * 14 + 32) +
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          2 * ip * 14 + (2 * ip + 1) * 17
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 2 * ip * 14 + (2 * ip + 1) * 17)
+        : 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 14 * ip > (ip + 1) * 17
+            ? 14 * ip
+            : (ip + 1) * 14; 
+  return special_number;
+}
+
+int many_conditional_assignments(int c1, int c2, int c3, int c4, int c5) {
+  // This tests a combinatorial explosion that can happen from many conditional
+  // assignments, since each conditional assignment doubles the number of
+  // bounds.
+  int x = 0;
+  if (c1) { x += 748596; }
+  if (c2) { x += 84652395; }
+  if (c3) { x += 3675895; }
+  if (c4) { x += 98634; }
+  if (c5) { x += 7834985; }
+  if (c1 && c2) { x += 938457398; }
+  if (c1 && c3) { x += 73895648; }
+  if (c1 && c4) { x += 12345432; }
+  if (c1 && c5) { x += 38847; }
+  if (c2 && c3) { x += 234; }
+  // x now has 2^10 bounds, the 10 additions below give (2^10)^10 bounds
+  int y = x + x + x + x + x + x + x + x + x + x + x + x;
+  return y;
+}
+
 // Test the comma expression.
 unsigned int test_comma01(unsigned int x) {
  unsigned int y = x < 100 ? x : 100;
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected
@@ -485,197 +485,529 @@
 | test.c:411:59:411:59 | k | 0.889553 |
 | test.c:411:63:411:63 | l | 0.538434 |
 | test.c:413:10:413:15 | output | 9.284378 |
-| test.c:418:20:418:20 | x | 4294967295 |
-| test.c:418:30:418:30 | x | 99 |
-| test.c:421:3:421:4 | y1 | 4294967295 |
-| test.c:421:11:421:11 | y | 100 |
-| test.c:421:14:421:14 | y | 101 |
-| test.c:422:3:422:4 | y2 | 4294967295 |
-| test.c:422:9:422:9 | y | 101 |
-| test.c:422:14:422:14 | y | 102 |
-| test.c:422:22:422:22 | y | 105 |
-| test.c:423:10:423:11 | y1 | 101 |
-| test.c:423:15:423:16 | y2 | 105 |
-| test.c:431:3:431:3 | i | 2147483647 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | 2147483647 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | 2147483647 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | 2147483647 |
-| test.c:442:7:442:7 | j | 2147483647 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | 2147483647 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | 2147483647 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 4294967295 |
-| test.c:456:17:456:17 | a | 4294967295 |
-| test.c:456:33:456:33 | b | 4294967295 |
-| test.c:456:38:456:38 | b | 4294967295 |
-| test.c:457:13:457:13 | a | 11 |
-| test.c:457:15:457:15 | b | 23 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 253 |
-| test.c:460:12:460:12 | a | 4294967295 |
-| test.c:460:17:460:17 | a | 4294967295 |
-| test.c:460:33:460:33 | b | 4294967295 |
-| test.c:460:38:460:38 | b | 4294967295 |
-| test.c:461:13:461:13 | a | 11 |
-| test.c:461:15:461:15 | b | 23 |
-| test.c:462:5:462:9 | total | 253 |
-| test.c:462:14:462:14 | r | 253 |
-| test.c:464:12:464:12 | a | 4294967295 |
-| test.c:464:17:464:17 | a | 4294967295 |
-| test.c:464:34:464:34 | b | 4294967295 |
-| test.c:464:39:464:39 | b | 4294967295 |
-| test.c:465:13:465:13 | a | 11 |
-| test.c:465:15:465:15 | b | 23 |
-| test.c:466:5:466:9 | total | 506 |
-| test.c:466:14:466:14 | r | 253 |
-| test.c:469:10:469:14 | total | 759 |
-| test.c:475:12:475:12 | b | 4294967295 |
-| test.c:475:17:475:17 | b | 4294967295 |
-| test.c:476:16:476:16 | b | 23 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 253 |
-| test.c:479:12:479:12 | b | 4294967295 |
-| test.c:479:17:479:17 | b | 4294967295 |
-| test.c:480:16:480:16 | b | 23 |
-| test.c:481:5:481:9 | total | 253 |
-| test.c:481:14:481:14 | r | 253 |
-| test.c:483:13:483:13 | b | 4294967295 |
-| test.c:483:18:483:18 | b | 4294967295 |
-| test.c:484:16:484:16 | b | 23 |
-| test.c:485:5:485:9 | total | 506 |
-| test.c:485:14:485:14 | r | 253 |
-| test.c:488:10:488:14 | total | 759 |
-| test.c:493:3:493:3 | x | 18446744073709551616 |
-| test.c:493:7:493:7 | y | 18446744073709551616 |
-| test.c:494:3:494:4 | xy | 18446744073709551616 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 18446744073709551616 |
-| test.c:501:3:501:3 | y | 18446744073709551616 |
-| test.c:502:3:502:4 | xy | 18446744073709551616 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 4294967295 |
-| test.c:508:43:508:44 | ui | 4294967295 |
-| test.c:508:48:508:49 | ui | 4294967295 |
-| test.c:509:12:509:17 | result | 18446744065119617024 |
-| test.c:511:7:511:8 | ul | 18446744073709551616 |
-| test.c:512:28:512:29 | ul | 18446744073709551616 |
-| test.c:512:33:512:34 | ul | 18446744073709551616 |
-| test.c:513:12:513:17 | result | 18446744073709551616 |
-| test.c:519:7:519:8 | ui | 4294967295 |
-| test.c:519:19:519:20 | ui | 10 |
-| test.c:520:5:520:6 | ui | 10 |
-| test.c:520:11:520:12 | ui | 10 |
-| test.c:521:12:521:13 | ui | 100 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | 2147483647 |
-| test.c:533:18:533:18 | i | 2147483647 |
-| test.c:534:5:534:5 | i | 2147483647 |
-| test.c:534:13:534:13 | i | 2 |
-| test.c:535:9:535:9 | i | 10 |
-| test.c:537:5:537:5 | i | 2147483647 |
-| test.c:537:9:537:9 | i | 10 |
-| test.c:538:9:538:9 | i | 15 |
-| test.c:540:5:540:5 | i | 15 |
-| test.c:541:9:541:9 | i | 105 |
-| test.c:543:5:543:5 | i | 105 |
-| test.c:544:9:544:9 | i | 2310 |
-| test.c:546:7:546:7 | i | 2147483647 |
-| test.c:547:5:547:5 | i | 2147483647 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | 2147483647 |
-| test.c:550:7:550:7 | i | 2147483647 |
-| test.c:551:10:551:10 | i | 2147483647 |
-| test.c:554:3:554:3 | i | 2147483647 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | 127 |
-| test.c:563:7:563:7 | n | 4294967295 |
-| test.c:565:7:565:7 | n | 4294967295 |
-| test.c:566:9:566:9 | n | 4294967295 |
-| test.c:569:7:569:7 | n | 4294967295 |
-| test.c:570:9:570:9 | n | 4294967295 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 4294967295 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 4294967295 |
-| test.c:581:10:581:10 | n | 4294967295 |
-| test.c:582:5:582:5 | n | 4294967295 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | 32767 |
-| test.c:592:7:592:7 | n | 32767 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 32767 |
-| test.c:598:7:598:7 | n | 32767 |
-| test.c:599:9:599:9 | n | 32767 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 32767 |
-| test.c:605:5:605:5 | n | 32767 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | 32767 |
-| test.c:613:9:613:9 | n | 32767 |
-| test.c:614:11:614:11 | n | 32767 |
-| test.c:618:7:618:7 | n | 32767 |
-| test.c:619:13:619:13 | n | 32767 |
-| test.c:622:9:622:9 | n | 32767 |
-| test.c:625:7:625:7 | n | 32767 |
-| test.c:625:22:625:22 | n | 32767 |
-| test.c:626:9:626:9 | n | 32767 |
-| test.c:629:7:629:7 | n | 32767 |
-| test.c:630:5:630:5 | n | 32767 |
-| test.c:630:10:630:10 | n | 32767 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 32767 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 32767 |
-| test.c:642:7:642:8 | ss | 32767 |
-| test.c:643:9:643:10 | ss | 3 |
-| test.c:646:7:646:8 | ss | 32767 |
-| test.c:647:9:647:10 | ss | 32767 |
-| test.c:650:14:650:15 | us | 65535 |
-| test.c:651:9:651:10 | us | 32767 |
-| test.c:654:14:654:15 | us | 65535 |
-| test.c:655:9:655:10 | us | 65535 |
-| test.c:658:7:658:8 | ss | 32767 |
-| test.c:659:9:659:10 | ss | 32767 |
-| test.c:662:7:662:8 | ss | 32767 |
-| test.c:663:9:663:10 | ss | 2 |
-| test.c:669:8:669:8 | s | 2147483647 |
-| test.c:669:15:669:15 | s | 127 |
-| test.c:669:23:669:23 | s | 9 |
-| test.c:670:18:670:18 | s | 9 |
-| test.c:670:22:670:22 | s | 9 |
-| test.c:671:9:671:14 | result | 127 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | 2147483647 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 4294967295 |
-| test.c:688:12:688:12 | s | 2147483647 |
-| test.c:689:7:689:8 | s2 | 4 |
-| test.c:694:7:694:7 | x | 2147483647 |
-| test.c:695:9:695:9 | y | 2147483647 |
-| test.c:699:7:699:7 | y | 2147483647 |
-| test.c:708:7:708:7 | x | 2147483647 |
-| test.c:713:7:713:7 | x | 15 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 4294967295 |
+| test.c:420:19:420:21 | rhs | 11 |
+| test.c:421:7:421:9 | rhs | 4294967295 |
+| test.c:421:19:421:21 | rhs | 12 |
+| test.c:422:7:422:9 | rhs | 4294967295 |
+| test.c:422:19:422:21 | rhs | 13 |
+| test.c:423:7:423:9 | rhs | 4294967295 |
+| test.c:423:19:423:21 | rhs | 14 |
+| test.c:424:7:424:9 | rhs | 4294967295 |
+| test.c:424:19:424:21 | rhs | 15 |
+| test.c:425:10:425:12 | rhs | 4294967295 |
+| test.c:429:7:429:7 | a | 2147483647 |
+| test.c:430:9:430:9 | b | 2147483647 |
+| test.c:431:7:431:7 | a | 17 |
+| test.c:431:12:431:12 | b | 23 |
+| test.c:433:9:433:9 | a | 40 |
+| test.c:434:7:434:7 | b | 2147483647 |
+| test.c:439:11:439:11 | a | 2147483647 |
+| test.c:439:15:439:15 | b | 2147483647 |
+| test.c:440:10:440:10 | a | 2147483647 |
+| test.c:440:14:440:14 | b | 2147483647 |
+| test.c:447:10:447:11 | ip | 4294967295 |
+| test.c:447:20:447:21 | ip | 4294967295 |
+| test.c:447:40:447:41 | ip | 4294967295 |
+| test.c:448:14:448:15 | ip | 4294967295 |
+| test.c:449:14:449:15 | ip | 4294967295 |
+| test.c:449:34:449:35 | ip | 4294967295 |
+| test.c:450:11:450:12 | ip | 4294967295 |
+| test.c:451:13:451:14 | ip | 4294967295 |
+| test.c:452:14:452:15 | ip | 4294967295 |
+| test.c:453:14:453:15 | ip | 4294967295 |
+| test.c:454:15:454:16 | ip | 4294967295 |
+| test.c:454:41:454:42 | ip | 4294967295 |
+| test.c:454:52:454:53 | ip | 4294967295 |
+| test.c:454:67:454:68 | ip | 4294967295 |
+| test.c:454:78:454:79 | ip | 4294967295 |
+| test.c:455:18:455:19 | ip | 4294967295 |
+| test.c:456:23:456:24 | ip | 4294967295 |
+| test.c:456:34:456:35 | ip | 4294967295 |
+| test.c:457:25:457:26 | ip | 4294967295 |
+| test.c:458:20:458:21 | ip | 4294967295 |
+| test.c:459:11:459:12 | ip | 4294967295 |
+| test.c:459:26:459:27 | ip | 4294967295 |
+| test.c:460:16:460:17 | ip | 4294967295 |
+| test.c:461:16:461:17 | ip | 4294967295 |
+| test.c:462:16:462:17 | ip | 4294967295 |
+| test.c:463:17:463:18 | ip | 4294967295 |
+| test.c:464:22:464:23 | ip | 4294967295 |
+| test.c:464:33:464:34 | ip | 4294967295 |
+| test.c:464:48:464:49 | ip | 4294967295 |
+| test.c:464:59:464:60 | ip | 4294967295 |
+| test.c:465:20:465:21 | ip | 4294967295 |
+| test.c:466:25:466:26 | ip | 4294967295 |
+| test.c:466:36:466:37 | ip | 4294967295 |
+| test.c:467:27:467:28 | ip | 4294967295 |
+| test.c:468:22:468:23 | ip | 4294967295 |
+| test.c:469:15:469:16 | ip | 4294967295 |
+| test.c:469:30:469:31 | ip | 4294967295 |
+| test.c:470:11:470:12 | ip | 4294967295 |
+| test.c:471:12:471:13 | ip | 4294967295 |
+| test.c:472:12:472:13 | ip | 4294967295 |
+| test.c:473:13:473:14 | ip | 4294967295 |
+| test.c:473:39:473:40 | ip | 4294967295 |
+| test.c:473:50:473:51 | ip | 4294967295 |
+| test.c:473:65:473:66 | ip | 4294967295 |
+| test.c:473:76:473:77 | ip | 4294967295 |
+| test.c:474:16:474:17 | ip | 4294967295 |
+| test.c:475:21:475:22 | ip | 4294967295 |
+| test.c:475:32:475:33 | ip | 4294967295 |
+| test.c:476:23:476:24 | ip | 4294967295 |
+| test.c:477:18:477:19 | ip | 4294967295 |
+| test.c:478:11:478:12 | ip | 4294967295 |
+| test.c:478:17:478:18 | ip | 4294967295 |
+| test.c:478:37:478:38 | ip | 4294967295 |
+| test.c:478:43:478:44 | ip | 4294967295 |
+| test.c:479:14:479:15 | ip | 4294967295 |
+| test.c:480:14:480:15 | ip | 4294967295 |
+| test.c:481:14:481:15 | ip | 4294967295 |
+| test.c:482:15:482:16 | ip | 4294967295 |
+| test.c:482:41:482:42 | ip | 4294967295 |
+| test.c:482:52:482:53 | ip | 4294967295 |
+| test.c:482:67:482:68 | ip | 4294967295 |
+| test.c:482:78:482:79 | ip | 4294967295 |
+| test.c:483:18:483:19 | ip | 4294967295 |
+| test.c:484:23:484:24 | ip | 4294967295 |
+| test.c:484:34:484:35 | ip | 4294967295 |
+| test.c:485:25:485:26 | ip | 4294967295 |
+| test.c:486:20:486:21 | ip | 4294967295 |
+| test.c:487:14:487:15 | ip | 4294967295 |
+| test.c:487:20:487:21 | ip | 4294967295 |
+| test.c:488:16:488:17 | ip | 4294967295 |
+| test.c:489:12:489:13 | ip | 4294967295 |
+| test.c:490:14:490:15 | ip | 4294967295 |
+| test.c:491:15:491:16 | ip | 4294967295 |
+| test.c:492:16:492:17 | ip | 4294967295 |
+| test.c:493:16:493:17 | ip | 4294967295 |
+| test.c:494:17:494:18 | ip | 4294967295 |
+| test.c:495:22:495:23 | ip | 4294967295 |
+| test.c:495:33:495:34 | ip | 4294967295 |
+| test.c:495:48:495:49 | ip | 4294967295 |
+| test.c:495:59:495:60 | ip | 4294967295 |
+| test.c:496:20:496:21 | ip | 4294967295 |
+| test.c:497:25:497:26 | ip | 4294967295 |
+| test.c:497:36:497:37 | ip | 4294967295 |
+| test.c:498:27:498:28 | ip | 4294967295 |
+| test.c:499:22:499:23 | ip | 4294967295 |
+| test.c:500:13:500:14 | ip | 4294967295 |
+| test.c:500:28:500:29 | ip | 4294967295 |
+| test.c:501:18:501:19 | ip | 4294967295 |
+| test.c:502:18:502:19 | ip | 4294967295 |
+| test.c:503:18:503:19 | ip | 4294967295 |
+| test.c:504:19:504:20 | ip | 4294967295 |
+| test.c:505:24:505:25 | ip | 4294967295 |
+| test.c:505:35:505:36 | ip | 4294967295 |
+| test.c:505:50:505:51 | ip | 4294967295 |
+| test.c:505:61:505:62 | ip | 4294967295 |
+| test.c:506:22:506:23 | ip | 4294967295 |
+| test.c:507:27:507:28 | ip | 4294967295 |
+| test.c:507:38:507:39 | ip | 4294967295 |
+| test.c:508:29:508:30 | ip | 4294967295 |
+| test.c:509:24:509:25 | ip | 4294967295 |
+| test.c:510:17:510:18 | ip | 4294967295 |
+| test.c:510:32:510:33 | ip | 4294967295 |
+| test.c:511:14:511:15 | ip | 4294967295 |
+| test.c:512:18:512:19 | ip | 4294967295 |
+| test.c:513:18:513:19 | ip | 4294967295 |
+| test.c:514:19:514:20 | ip | 4294967295 |
+| test.c:515:24:515:25 | ip | 4294967295 |
+| test.c:515:35:515:36 | ip | 4294967295 |
+| test.c:515:50:515:51 | ip | 4294967295 |
+| test.c:515:61:515:62 | ip | 4294967295 |
+| test.c:516:22:516:23 | ip | 4294967295 |
+| test.c:517:27:517:28 | ip | 4294967295 |
+| test.c:517:38:517:39 | ip | 4294967295 |
+| test.c:518:29:518:30 | ip | 4294967295 |
+| test.c:519:24:519:25 | ip | 4294967295 |
+| test.c:520:17:520:18 | ip | 4294967295 |
+| test.c:520:23:520:24 | ip | 4294967295 |
+| test.c:520:43:520:44 | ip | 4294967295 |
+| test.c:520:49:520:50 | ip | 4294967295 |
+| test.c:521:16:521:17 | ip | 4294967295 |
+| test.c:522:16:522:17 | ip | 4294967295 |
+| test.c:523:16:523:17 | ip | 4294967295 |
+| test.c:524:17:524:18 | ip | 4294967295 |
+| test.c:525:22:525:23 | ip | 4294967295 |
+| test.c:525:33:525:34 | ip | 4294967295 |
+| test.c:525:48:525:49 | ip | 4294967295 |
+| test.c:525:59:525:60 | ip | 4294967295 |
+| test.c:526:20:526:21 | ip | 4294967295 |
+| test.c:527:25:527:26 | ip | 4294967295 |
+| test.c:527:36:527:37 | ip | 4294967295 |
+| test.c:528:27:528:28 | ip | 4294967295 |
+| test.c:529:22:529:23 | ip | 4294967295 |
+| test.c:530:16:530:17 | ip | 4294967295 |
+| test.c:530:22:530:23 | ip | 4294967295 |
+| test.c:531:18:531:19 | ip | 4294967295 |
+| test.c:532:14:532:15 | ip | 4294967295 |
+| test.c:533:14:533:15 | ip | 4294967295 |
+| test.c:533:24:533:25 | ip | 4294967295 |
+| test.c:533:44:533:45 | ip | 4294967295 |
+| test.c:534:16:534:17 | ip | 4294967295 |
+| test.c:535:16:535:17 | ip | 4294967295 |
+| test.c:535:36:535:37 | ip | 4294967295 |
+| test.c:536:14:536:15 | ip | 4294967295 |
+| test.c:537:19:537:20 | ip | 4294967295 |
+| test.c:538:20:538:21 | ip | 4294967295 |
+| test.c:539:20:539:21 | ip | 4294967295 |
+| test.c:540:21:540:22 | ip | 4294967295 |
+| test.c:541:26:541:27 | ip | 4294967295 |
+| test.c:541:37:541:38 | ip | 4294967295 |
+| test.c:541:52:541:53 | ip | 4294967295 |
+| test.c:541:63:541:64 | ip | 4294967295 |
+| test.c:542:24:542:25 | ip | 4294967295 |
+| test.c:543:29:543:30 | ip | 4294967295 |
+| test.c:543:40:543:41 | ip | 4294967295 |
+| test.c:544:31:544:32 | ip | 4294967295 |
+| test.c:545:26:545:27 | ip | 4294967295 |
+| test.c:546:17:546:18 | ip | 4294967295 |
+| test.c:546:32:546:33 | ip | 4294967295 |
+| test.c:547:22:547:23 | ip | 4294967295 |
+| test.c:548:22:548:23 | ip | 4294967295 |
+| test.c:549:22:549:23 | ip | 4294967295 |
+| test.c:550:23:550:24 | ip | 4294967295 |
+| test.c:551:28:551:29 | ip | 4294967295 |
+| test.c:551:39:551:40 | ip | 4294967295 |
+| test.c:551:54:551:55 | ip | 4294967295 |
+| test.c:551:65:551:66 | ip | 4294967295 |
+| test.c:552:26:552:27 | ip | 4294967295 |
+| test.c:553:31:553:32 | ip | 4294967295 |
+| test.c:553:42:553:43 | ip | 4294967295 |
+| test.c:554:33:554:34 | ip | 4294967295 |
+| test.c:555:28:555:29 | ip | 4294967295 |
+| test.c:556:21:556:22 | ip | 4294967295 |
+| test.c:556:36:556:37 | ip | 4294967295 |
+| test.c:557:17:557:18 | ip | 4294967295 |
+| test.c:558:18:558:19 | ip | 4294967295 |
+| test.c:559:18:559:19 | ip | 4294967295 |
+| test.c:560:19:560:20 | ip | 4294967295 |
+| test.c:561:24:561:25 | ip | 4294967295 |
+| test.c:561:35:561:36 | ip | 4294967295 |
+| test.c:561:50:561:51 | ip | 4294967295 |
+| test.c:561:61:561:62 | ip | 4294967295 |
+| test.c:562:22:562:23 | ip | 4294967295 |
+| test.c:563:27:563:28 | ip | 4294967295 |
+| test.c:563:38:563:39 | ip | 4294967295 |
+| test.c:564:29:564:30 | ip | 4294967295 |
+| test.c:565:24:565:25 | ip | 4294967295 |
+| test.c:566:17:566:18 | ip | 4294967295 |
+| test.c:566:23:566:24 | ip | 4294967295 |
+| test.c:566:43:566:44 | ip | 4294967295 |
+| test.c:566:49:566:50 | ip | 4294967295 |
+| test.c:567:20:567:21 | ip | 4294967295 |
+| test.c:568:20:568:21 | ip | 4294967295 |
+| test.c:569:20:569:21 | ip | 4294967295 |
+| test.c:570:21:570:22 | ip | 4294967295 |
+| test.c:571:26:571:27 | ip | 4294967295 |
+| test.c:571:37:571:38 | ip | 4294967295 |
+| test.c:571:52:571:53 | ip | 4294967295 |
+| test.c:571:63:571:64 | ip | 4294967295 |
+| test.c:572:24:572:25 | ip | 4294967295 |
+| test.c:573:29:573:30 | ip | 4294967295 |
+| test.c:573:40:573:41 | ip | 4294967295 |
+| test.c:574:31:574:32 | ip | 4294967295 |
+| test.c:575:26:575:27 | ip | 4294967295 |
+| test.c:576:20:576:21 | ip | 4294967295 |
+| test.c:576:26:576:27 | ip | 4294967295 |
+| test.c:577:22:577:23 | ip | 4294967295 |
+| test.c:578:18:578:19 | ip | 4294967295 |
+| test.c:579:16:579:17 | ip | 4294967295 |
+| test.c:580:17:580:18 | ip | 4294967295 |
+| test.c:581:18:581:19 | ip | 4294967295 |
+| test.c:582:18:582:19 | ip | 4294967295 |
+| test.c:583:19:583:20 | ip | 4294967295 |
+| test.c:584:24:584:25 | ip | 4294967295 |
+| test.c:584:35:584:36 | ip | 4294967295 |
+| test.c:584:50:584:51 | ip | 4294967295 |
+| test.c:584:61:584:62 | ip | 4294967295 |
+| test.c:585:22:585:23 | ip | 4294967295 |
+| test.c:586:27:586:28 | ip | 4294967295 |
+| test.c:586:38:586:39 | ip | 4294967295 |
+| test.c:587:29:587:30 | ip | 4294967295 |
+| test.c:588:24:588:25 | ip | 4294967295 |
+| test.c:589:15:589:16 | ip | 4294967295 |
+| test.c:589:30:589:31 | ip | 4294967295 |
+| test.c:590:20:590:21 | ip | 4294967295 |
+| test.c:591:20:591:21 | ip | 4294967295 |
+| test.c:592:20:592:21 | ip | 4294967295 |
+| test.c:593:21:593:22 | ip | 4294967295 |
+| test.c:594:26:594:27 | ip | 4294967295 |
+| test.c:594:37:594:38 | ip | 4294967295 |
+| test.c:594:52:594:53 | ip | 4294967295 |
+| test.c:594:63:594:64 | ip | 4294967295 |
+| test.c:595:24:595:25 | ip | 4294967295 |
+| test.c:596:29:596:30 | ip | 4294967295 |
+| test.c:596:40:596:41 | ip | 4294967295 |
+| test.c:597:31:597:32 | ip | 4294967295 |
+| test.c:598:26:598:27 | ip | 4294967295 |
+| test.c:599:19:599:20 | ip | 4294967295 |
+| test.c:599:34:599:35 | ip | 4294967295 |
+| test.c:600:16:600:17 | ip | 4294967295 |
+| test.c:601:20:601:21 | ip | 4294967295 |
+| test.c:602:20:602:21 | ip | 4294967295 |
+| test.c:603:21:603:22 | ip | 4294967295 |
+| test.c:604:26:604:27 | ip | 4294967295 |
+| test.c:604:37:604:38 | ip | 4294967295 |
+| test.c:604:52:604:53 | ip | 4294967295 |
+| test.c:604:63:604:64 | ip | 4294967295 |
+| test.c:605:24:605:25 | ip | 4294967295 |
+| test.c:606:29:606:30 | ip | 4294967295 |
+| test.c:606:40:606:41 | ip | 4294967295 |
+| test.c:607:31:607:32 | ip | 4294967295 |
+| test.c:608:26:608:27 | ip | 4294967295 |
+| test.c:609:19:609:20 | ip | 4294967295 |
+| test.c:609:25:609:26 | ip | 4294967295 |
+| test.c:609:45:609:46 | ip | 4294967295 |
+| test.c:609:51:609:52 | ip | 4294967295 |
+| test.c:610:18:610:19 | ip | 4294967295 |
+| test.c:611:18:611:19 | ip | 4294967295 |
+| test.c:612:18:612:19 | ip | 4294967295 |
+| test.c:613:19:613:20 | ip | 4294967295 |
+| test.c:614:24:614:25 | ip | 4294967295 |
+| test.c:614:35:614:36 | ip | 4294967295 |
+| test.c:614:50:614:51 | ip | 4294967295 |
+| test.c:614:61:614:62 | ip | 4294967295 |
+| test.c:615:22:615:23 | ip | 4294967295 |
+| test.c:616:27:616:28 | ip | 4294967295 |
+| test.c:616:38:616:39 | ip | 4294967295 |
+| test.c:617:29:617:30 | ip | 4294967295 |
+| test.c:618:24:618:25 | ip | 4294967295 |
+| test.c:619:18:619:19 | ip | 4294967295 |
+| test.c:619:24:619:25 | ip | 4294967295 |
+| test.c:620:20:620:21 | ip | 4294967295 |
+| test.c:621:16:621:17 | ip | 4294967295 |
+| test.c:622:10:622:23 | special_number | 4294967295 |
+| test.c:630:7:630:8 | c1 | 2147483647 |
+| test.c:630:13:630:13 | x | 0 |
+| test.c:631:7:631:8 | c2 | 2147483647 |
+| test.c:631:13:631:13 | x | 748596 |
+| test.c:632:7:632:8 | c3 | 2147483647 |
+| test.c:632:13:632:13 | x | 85400991 |
+| test.c:633:7:633:8 | c4 | 2147483647 |
+| test.c:633:13:633:13 | x | 89076886 |
+| test.c:634:7:634:8 | c5 | 2147483647 |
+| test.c:634:13:634:13 | x | 89175520 |
+| test.c:635:7:635:8 | c1 | 2147483647 |
+| test.c:635:13:635:14 | c2 | 2147483647 |
+| test.c:635:19:635:19 | x | 97010505 |
+| test.c:636:7:636:8 | c1 | 2147483647 |
+| test.c:636:13:636:14 | c3 | 2147483647 |
+| test.c:636:19:636:19 | x | 1035467903 |
+| test.c:637:7:637:8 | c1 | 2147483647 |
+| test.c:637:13:637:14 | c4 | 2147483647 |
+| test.c:637:19:637:19 | x | 1109363551 |
+| test.c:638:7:638:8 | c1 | 2147483647 |
+| test.c:638:13:638:14 | c5 | 2147483647 |
+| test.c:638:19:638:19 | x | 1121708983 |
+| test.c:639:7:639:8 | c2 | 2147483647 |
+| test.c:639:13:639:14 | c3 | 2147483647 |
+| test.c:639:19:639:19 | x | 1121747830 |
+| test.c:641:11:641:11 | x | 2147483647 |
+| test.c:641:15:641:15 | x | 2147483647 |
+| test.c:641:19:641:19 | x | 2147483647 |
+| test.c:641:23:641:23 | x | 2147483647 |
+| test.c:641:27:641:27 | x | 2147483647 |
+| test.c:641:31:641:31 | x | 2147483647 |
+| test.c:641:35:641:35 | x | 2147483647 |
+| test.c:641:39:641:39 | x | 2147483647 |
+| test.c:641:43:641:43 | x | 2147483647 |
+| test.c:641:47:641:47 | x | 2147483647 |
+| test.c:641:51:641:51 | x | 2147483647 |
+| test.c:641:55:641:55 | x | 2147483647 |
+| test.c:642:10:642:10 | y | 2147483647 |
+| test.c:647:20:647:20 | x | 4294967295 |
+| test.c:647:30:647:30 | x | 99 |
+| test.c:650:3:650:4 | y1 | 4294967295 |
+| test.c:650:11:650:11 | y | 100 |
+| test.c:650:14:650:14 | y | 101 |
+| test.c:651:3:651:4 | y2 | 4294967295 |
+| test.c:651:9:651:9 | y | 101 |
+| test.c:651:14:651:14 | y | 102 |
+| test.c:651:22:651:22 | y | 105 |
+| test.c:652:10:652:11 | y1 | 101 |
+| test.c:652:15:652:16 | y2 | 105 |
+| test.c:660:3:660:3 | i | 2147483647 |
+| test.c:661:7:661:7 | i | 10 |
+| test.c:663:3:663:3 | i | 2147483647 |
+| test.c:664:3:664:3 | i | 10 |
+| test.c:665:7:665:7 | i | 20 |
+| test.c:667:3:667:3 | i | 2147483647 |
+| test.c:668:3:668:3 | i | 40 |
+| test.c:669:7:669:7 | i | 30 |
+| test.c:671:3:671:3 | i | 2147483647 |
+| test.c:671:7:671:7 | j | 2147483647 |
+| test.c:672:7:672:7 | i | 40 |
+| test.c:674:3:674:3 | i | 2147483647 |
+| test.c:674:8:674:8 | j | 40 |
+| test.c:675:7:675:7 | i | 50 |
+| test.c:677:3:677:3 | i | 2147483647 |
+| test.c:677:13:677:13 | j | 50 |
+| test.c:678:7:678:7 | i | 60 |
+| test.c:685:12:685:12 | a | 4294967295 |
+| test.c:685:17:685:17 | a | 4294967295 |
+| test.c:685:33:685:33 | b | 4294967295 |
+| test.c:685:38:685:38 | b | 4294967295 |
+| test.c:686:13:686:13 | a | 11 |
+| test.c:686:15:686:15 | b | 23 |
+| test.c:687:5:687:9 | total | 0 |
+| test.c:687:14:687:14 | r | 253 |
+| test.c:689:12:689:12 | a | 4294967295 |
+| test.c:689:17:689:17 | a | 4294967295 |
+| test.c:689:33:689:33 | b | 4294967295 |
+| test.c:689:38:689:38 | b | 4294967295 |
+| test.c:690:13:690:13 | a | 11 |
+| test.c:690:15:690:15 | b | 23 |
+| test.c:691:5:691:9 | total | 253 |
+| test.c:691:14:691:14 | r | 253 |
+| test.c:693:12:693:12 | a | 4294967295 |
+| test.c:693:17:693:17 | a | 4294967295 |
+| test.c:693:34:693:34 | b | 4294967295 |
+| test.c:693:39:693:39 | b | 4294967295 |
+| test.c:694:13:694:13 | a | 11 |
+| test.c:694:15:694:15 | b | 23 |
+| test.c:695:5:695:9 | total | 506 |
+| test.c:695:14:695:14 | r | 253 |
+| test.c:698:10:698:14 | total | 759 |
+| test.c:704:12:704:12 | b | 4294967295 |
+| test.c:704:17:704:17 | b | 4294967295 |
+| test.c:705:16:705:16 | b | 23 |
+| test.c:706:5:706:9 | total | 0 |
+| test.c:706:14:706:14 | r | 253 |
+| test.c:708:12:708:12 | b | 4294967295 |
+| test.c:708:17:708:17 | b | 4294967295 |
+| test.c:709:16:709:16 | b | 23 |
+| test.c:710:5:710:9 | total | 253 |
+| test.c:710:14:710:14 | r | 253 |
+| test.c:712:13:712:13 | b | 4294967295 |
+| test.c:712:18:712:18 | b | 4294967295 |
+| test.c:713:16:713:16 | b | 23 |
+| test.c:714:5:714:9 | total | 506 |
+| test.c:714:14:714:14 | r | 253 |
+| test.c:717:10:717:14 | total | 759 |
+| test.c:722:3:722:3 | x | 18446744073709551616 |
+| test.c:722:7:722:7 | y | 18446744073709551616 |
+| test.c:723:3:723:4 | xy | 18446744073709551616 |
+| test.c:723:8:723:8 | x | 1000000003 |
+| test.c:723:12:723:12 | y | 1000000003 |
+| test.c:724:10:724:11 | xy | 1000000006000000000 |
+| test.c:729:3:729:3 | x | 18446744073709551616 |
+| test.c:730:3:730:3 | y | 18446744073709551616 |
+| test.c:731:3:731:4 | xy | 18446744073709551616 |
+| test.c:731:8:731:8 | x | 274177 |
+| test.c:731:12:731:12 | y | 67280421310721 |
+| test.c:732:10:732:11 | xy | 18446744073709551616 |
+| test.c:736:7:736:8 | ui | 4294967295 |
+| test.c:737:43:737:44 | ui | 4294967295 |
+| test.c:737:48:737:49 | ui | 4294967295 |
+| test.c:738:12:738:17 | result | 18446744065119617024 |
+| test.c:740:7:740:8 | ul | 18446744073709551616 |
+| test.c:741:28:741:29 | ul | 18446744073709551616 |
+| test.c:741:33:741:34 | ul | 18446744073709551616 |
+| test.c:742:12:742:17 | result | 18446744073709551616 |
+| test.c:748:7:748:8 | ui | 4294967295 |
+| test.c:748:19:748:20 | ui | 10 |
+| test.c:749:5:749:6 | ui | 10 |
+| test.c:749:11:749:12 | ui | 10 |
+| test.c:750:12:750:13 | ui | 100 |
+| test.c:754:3:754:9 | uiconst | 10 |
+| test.c:757:3:757:9 | ulconst | 10 |
+| test.c:758:10:758:16 | uiconst | 40 |
+| test.c:758:20:758:26 | ulconst | 40 |
+| test.c:762:7:762:7 | i | 2147483647 |
+| test.c:762:18:762:18 | i | 2147483647 |
+| test.c:763:5:763:5 | i | 2147483647 |
+| test.c:763:13:763:13 | i | 2 |
+| test.c:764:9:764:9 | i | 10 |
+| test.c:766:5:766:5 | i | 2147483647 |
+| test.c:766:9:766:9 | i | 10 |
+| test.c:767:9:767:9 | i | 15 |
+| test.c:769:5:769:5 | i | 15 |
+| test.c:770:9:770:9 | i | 105 |
+| test.c:772:5:772:5 | i | 105 |
+| test.c:773:9:773:9 | i | 2310 |
+| test.c:775:7:775:7 | i | 2147483647 |
+| test.c:776:5:776:5 | i | 2147483647 |
+| test.c:776:9:776:9 | i | -1 |
+| test.c:777:9:777:9 | i | 1 |
+| test.c:779:3:779:3 | i | 2147483647 |
+| test.c:779:7:779:7 | i | 2147483647 |
+| test.c:780:10:780:10 | i | 2147483647 |
+| test.c:783:3:783:3 | i | 2147483647 |
+| test.c:783:10:783:11 | sc | 1 |
+| test.c:785:7:785:7 | i | 127 |
+| test.c:792:7:792:7 | n | 4294967295 |
+| test.c:794:7:794:7 | n | 4294967295 |
+| test.c:795:9:795:9 | n | 4294967295 |
+| test.c:798:7:798:7 | n | 4294967295 |
+| test.c:799:9:799:9 | n | 4294967295 |
+| test.c:801:9:801:9 | n | 0 |
+| test.c:804:8:804:8 | n | 4294967295 |
+| test.c:805:9:805:9 | n | 0 |
+| test.c:807:9:807:9 | n | 4294967295 |
+| test.c:810:10:810:10 | n | 4294967295 |
+| test.c:811:5:811:5 | n | 4294967295 |
+| test.c:814:7:814:7 | n | 0 |
+| test.c:818:7:818:7 | n | 32767 |
+| test.c:821:7:821:7 | n | 32767 |
+| test.c:822:9:822:9 | n | 0 |
+| test.c:824:9:824:9 | n | 32767 |
+| test.c:827:7:827:7 | n | 32767 |
+| test.c:828:9:828:9 | n | 32767 |
+| test.c:830:9:830:9 | n | 0 |
+| test.c:833:10:833:10 | n | 32767 |
+| test.c:834:5:834:5 | n | 32767 |
+| test.c:837:7:837:7 | n | 0 |
+| test.c:841:7:841:7 | n | 32767 |
+| test.c:842:9:842:9 | n | 32767 |
+| test.c:843:11:843:11 | n | 32767 |
+| test.c:847:7:847:7 | n | 32767 |
+| test.c:848:13:848:13 | n | 32767 |
+| test.c:851:9:851:9 | n | 32767 |
+| test.c:854:7:854:7 | n | 32767 |
+| test.c:854:22:854:22 | n | 32767 |
+| test.c:855:9:855:9 | n | 32767 |
+| test.c:858:7:858:7 | n | 32767 |
+| test.c:859:5:859:5 | n | 32767 |
+| test.c:859:10:859:10 | n | 32767 |
+| test.c:859:14:859:14 | n | 0 |
+| test.c:860:6:860:6 | n | 32767 |
+| test.c:860:10:860:10 | n | 0 |
+| test.c:860:14:860:14 | n | 32767 |
+| test.c:871:7:871:8 | ss | 32767 |
+| test.c:872:9:872:10 | ss | 3 |
+| test.c:875:7:875:8 | ss | 32767 |
+| test.c:876:9:876:10 | ss | 32767 |
+| test.c:879:14:879:15 | us | 65535 |
+| test.c:880:9:880:10 | us | 32767 |
+| test.c:883:14:883:15 | us | 65535 |
+| test.c:884:9:884:10 | us | 65535 |
+| test.c:887:7:887:8 | ss | 32767 |
+| test.c:888:9:888:10 | ss | 32767 |
+| test.c:891:7:891:8 | ss | 32767 |
+| test.c:892:9:892:10 | ss | 2 |
+| test.c:898:8:898:8 | s | 2147483647 |
+| test.c:898:15:898:15 | s | 127 |
+| test.c:898:23:898:23 | s | 9 |
+| test.c:899:18:899:18 | s | 9 |
+| test.c:899:22:899:22 | s | 9 |
+| test.c:900:9:900:14 | result | 127 |
+| test.c:906:7:906:7 | i | 0 |
+| test.c:907:9:907:9 | i | 2147483647 |
+| test.c:911:7:911:7 | u | 0 |
+| test.c:912:9:912:9 | u | 4294967295 |
+| test.c:917:12:917:12 | s | 2147483647 |
+| test.c:918:7:918:8 | s2 | 4 |
+| test.c:923:7:923:7 | x | 2147483647 |
+| test.c:924:9:924:9 | y | 2147483647 |
+| test.c:928:7:928:7 | y | 2147483647 |
+| test.c:937:7:937:7 | x | 2147483647 |
+| test.c:942:7:942:7 | x | 15 |
+| test.c:949:8:949:8 | x | 2147483647 |
+| test.c:949:12:949:12 | y | 256 |
+| test.c:950:9:950:9 | x | 2147483647 |
+| test.c:951:9:951:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |
--- a/cpp/ql/test/library-tests/types/sizeof/sizeof.expected
+++ b/cpp/ql/test/library-tests/types/sizeof/sizeof.expected
@@ -1,10 +1,16 @@
-| sizeof.cpp:19:15:19:25 | sizeof(int) | 4 | SizeofTypeOperator.getTypeOperand() | file://:0:0:0:0 | int |
-| sizeof.cpp:20:15:20:26 | sizeof(char) | 1 | SizeofTypeOperator.getTypeOperand() | file://:0:0:0:0 | char |
-| sizeof.cpp:21:15:21:27 | sizeof(int *) | 8 | SizeofTypeOperator.getTypeOperand() | file://:0:0:0:0 | int * |
-| sizeof.cpp:22:15:22:29 | sizeof(MyClass) | 16 | SizeofTypeOperator.getTypeOperand() | sizeof.cpp:4:7:4:13 | MyClass |
+| sizeof.cpp:19:15:19:25 | sizeof(int) | 4 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int |
+| sizeof.cpp:20:15:20:26 | sizeof(char) | 1 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | char |
+| sizeof.cpp:21:15:21:27 | sizeof(int *) | 8 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int * |
+| sizeof.cpp:22:15:22:29 | sizeof(MyClass) | 16 | SizeofOperator.getTypeOperand() | sizeof.cpp:4:7:4:13 | MyClass |
 | sizeof.cpp:23:15:23:23 | sizeof(<expr>) | 4 | SizeofExprOperator.getExprOperand() | sizeof.cpp:23:22:23:22 | i |
+| sizeof.cpp:23:15:23:23 | sizeof(<expr>) | 4 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int |
 | sizeof.cpp:24:15:24:23 | sizeof(<expr>) | 1 | SizeofExprOperator.getExprOperand() | sizeof.cpp:24:22:24:22 | c |
+| sizeof.cpp:24:15:24:23 | sizeof(<expr>) | 1 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | char |
 | sizeof.cpp:25:15:25:25 | sizeof(<expr>) | 8 | SizeofExprOperator.getExprOperand() | sizeof.cpp:25:22:25:24 | ptr |
+| sizeof.cpp:25:15:25:25 | sizeof(<expr>) | 8 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int * |
 | sizeof.cpp:26:15:26:24 | sizeof(<expr>) | 16 | SizeofExprOperator.getExprOperand() | sizeof.cpp:26:22:26:23 | mc |
+| sizeof.cpp:26:15:26:24 | sizeof(<expr>) | 16 | SizeofOperator.getTypeOperand() | sizeof.cpp:4:7:4:13 | MyClass |
 | sizeof.cpp:27:15:27:25 | sizeof(<expr>) | 40 | SizeofExprOperator.getExprOperand() | sizeof.cpp:27:22:27:24 | arr |
+| sizeof.cpp:27:15:27:25 | sizeof(<expr>) | 40 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int[10] |
 | sizeof.cpp:28:16:28:29 | sizeof(<expr>) | 4 | SizeofExprOperator.getExprOperand() | sizeof.cpp:28:23:28:28 | access to array |
+| sizeof.cpp:28:16:28:29 | sizeof(<expr>) | 4 | SizeofOperator.getTypeOperand() | file://:0:0:0:0 | int |
--- a/cpp/ql/test/library-tests/types/sizeof/sizeof.ql
+++ b/cpp/ql/test/library-tests/types/sizeof/sizeof.ql
@@ -2,8 +2,8 @@ import cpp

 from SizeofOperator sto, string elemDesc, Element e
 where
-  elemDesc = "SizeofTypeOperator.getTypeOperand()" and
-  e = sto.(SizeofTypeOperator).getTypeOperand()
+  elemDesc = "SizeofOperator.getTypeOperand()" and
+  e = sto.getTypeOperand()
  or
  elemDesc = "SizeofExprOperator.getExprOperand()" and
  e = sto.(SizeofExprOperator).getExprOperand()
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
@@ -84,11 +84,7 @@ namespace Semmle.Autobuild.CSharp
            var temp = FileUtils.GetTemporaryWorkingDirectory(builder.Actions.GetEnvironmentVariable, builder.Options.Language.UpperCaseName, out var shouldCleanUp);
            return DotNet.WithDotNet(builder.Actions, builder.Logger, builder.Paths.Select(x => x.Item1), temp, shouldCleanUp, ensureDotNetAvailable, builder.Options.DotNetVersion, installDir =>
            {
-                var env = new Dictionary<string, string>
-                {
-                    { "DOTNET_SKIP_FIRST_TIME_EXPERIENCE", "true" },
-                    { "MSBUILDDISABLENODEREUSE", "1" }
-                };
+                var env = DotNet.MinimalEnvironment.ToDictionary();
                if (installDir is not null)
                {
                    // The installation succeeded, so use the newly installed .NET
--- a/csharp/codeql-extractor.yml
+++ b/csharp/codeql-extractor.yml
@@ -74,3 +74,8 @@ options:
      [EXPERIMENTAL] The value is a path to the MsBuild binary log file that should be extracted.
      This option only works when `--build-mode none` is also specified.
    type: array
+  buildless_dependency_dir:
+    title: The path where buildless (standalone) extraction should keep dependencies.
+    description: >
+      If set, the buildless (standalone) extractor will store dependencies in this directory.
+    type: string
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs
@@ -0,0 +1,62 @@
+using System;
+using System.IO;
+using Semmle.Util;
+using Semmle.Util.Logging;
+
+namespace Semmle.Extraction.CSharp.DependencyFetching
+{
+    /// <summary>
+    /// A directory used for storing fetched dependencies.
+    /// When a specific directory is set via the dependency directory extractor option,
+    /// we store dependencies in that directory for caching purposes.
+    /// Otherwise, we create a temporary directory that is deleted upon disposal.
+    /// </summary>
+    public sealed class DependencyDirectory : IDisposable
+    {
+        private readonly string userReportedDirectoryPurpose;
+        private readonly ILogger logger;
+        private readonly bool attemptCleanup;
+
+        public DirectoryInfo DirInfo { get; }
+
+        public DependencyDirectory(string subfolderName, string userReportedDirectoryPurpose, ILogger logger)
+        {
+            this.logger = logger;
+            this.userReportedDirectoryPurpose = userReportedDirectoryPurpose;
+
+            string path;
+            if (EnvironmentVariables.GetBuildlessDependencyDir() is string dir)
+            {
+                path = dir;
+                attemptCleanup = false;
+            }
+            else
+            {
+                path = FileUtils.GetTemporaryWorkingDirectory(out _);
+                attemptCleanup = true;
+            }
+            DirInfo = new DirectoryInfo(Path.Join(path, subfolderName));
+            DirInfo.Create();
+        }
+
+        public void Dispose()
+        {
+            if (!attemptCleanup)
+            {
+                logger.LogInfo($"Keeping {userReportedDirectoryPurpose} directory {DirInfo.FullName} for possible caching purposes.");
+                return;
+            }
+
+            try
+            {
+                DirInfo.Delete(true);
+            }
+            catch (Exception exc)
+            {
+                logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory {exc.Message}");
+            }
+        }
+
+        public override string ToString() => DirInfo.FullName;
+    }
+}
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Collections.ObjectModel;
 using System.IO;
 using System.Linq;
 using Newtonsoft.Json.Linq;
@@ -140,6 +141,8 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        // The version number should be kept in sync with the version .NET version used for building the application.
        public const string LatestDotNetSdkVersion = "9.0.300";

+        public static ReadOnlyDictionary<string, string> MinimalEnvironment => IDotNetCliInvoker.MinimalEnvironment;
+
        /// <summary>
        /// Returns a script for downloading relevant versions of the
        /// .NET SDK. The SDK(s) will be installed at <code>installDir</code>
@@ -254,7 +257,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                else
                {
                    var dotnetInstallPath = actions.PathCombine(tempWorkingDirectory, ".dotnet", "dotnet-install.sh");
-
                    var downloadDotNetInstallSh = BuildScript.DownloadFile(
                        "https://dot.net/v1/dotnet-install.sh",
                        dotnetInstallPath,
@@ -269,17 +271,28 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                    prelude = downloadDotNetInstallSh & chmod.Script;
                    postlude = shouldCleanUp ? BuildScript.DeleteFile(dotnetInstallPath) : BuildScript.Success;

-                    getInstall = version => new CommandBuilder(actions).
-                        RunCommand(dotnetInstallPath).
-                        Argument("--channel").
-                        Argument("release").
-                        Argument("--version").
-                        Argument(version).
-                        Argument("--install-dir").
-                        Argument(path).Script;
+                    getInstall = version =>
+                    {
+                        var cb = new CommandBuilder(actions).
+                            RunCommand(dotnetInstallPath).
+                            Argument("--channel").
+                            Argument("release").
+                            Argument("--version").
+                            Argument(version);
+
+                        // Request ARM64 architecture on Apple Silicon machines
+                        if (actions.IsRunningOnAppleSilicon())
+                        {
+                            cb.Argument("--architecture").
+                                Argument("arm64");
+                        }
+
+                        return cb.Argument("--install-dir").
+                            Argument(path).Script;
+                    };
                }

-                var dotnetInfo = new CommandBuilder(actions).
+                var dotnetInfo = new CommandBuilder(actions, environment: MinimalEnvironment).
                    RunCommand(actions.PathCombine(path, "dotnet")).
                    Argument("--info").Script;

@@ -311,7 +324,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching

        private static BuildScript GetInstalledSdksScript(IBuildActions actions)
        {
-            var listSdks = new CommandBuilder(actions, silent: true).
+            var listSdks = new CommandBuilder(actions, silent: true, environment: MinimalEnvironment).
                RunCommand("dotnet").
                Argument("--list-sdks");
            return listSdks.Script;
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Collections.ObjectModel;
 using System.Diagnostics;
 using Semmle.Util;
 using Semmle.Util.Logging;
@@ -36,10 +37,12 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
            {
                startInfo.WorkingDirectory = workingDirectory;
            }
-            // Set the .NET CLI language to English to avoid localized output.
-            startInfo.EnvironmentVariables["DOTNET_CLI_UI_LANGUAGE"] = "en";
-            startInfo.EnvironmentVariables["MSBUILDDISABLENODEREUSE"] = "1";
-            startInfo.EnvironmentVariables["DOTNET_SKIP_FIRST_TIME_EXPERIENCE"] = "true";
+
+            // Set minimal environment variables.
+            foreach (var kvp in IDotNetCliInvoker.MinimalEnvironment)
+            {
+                startInfo.EnvironmentVariables[kvp.Key] = kvp.Value;
+            }

            // Configure the proxy settings, if applicable.
            if (this.proxy != null)
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNetCliInvoker.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNetCliInvoker.cs
@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using System.Collections.ObjectModel;

 namespace Semmle.Extraction.CSharp.DependencyFetching
 {
@@ -9,6 +10,20 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        /// </summary>
        string Exec { get; }

+        /// <summary>
+        /// A minimal environment for running the .NET CLI.
+        /// 
+        /// DOTNET_CLI_UI_LANGUAGE: The .NET CLI language is set to English to avoid localized output.
+        /// MSBUILDDISABLENODEREUSE: To ensure clean environment for each build.
+        /// DOTNET_SKIP_FIRST_TIME_EXPERIENCE: To skip first time experience messages.
+        /// </summary>
+        static ReadOnlyDictionary<string, string> MinimalEnvironment { get; } = new(new Dictionary<string, string>
+        {
+            {"DOTNET_CLI_UI_LANGUAGE", "en"},
+            {"MSBUILDDISABLENODEREUSE", "1"},
+            {"DOTNET_SKIP_FIRST_TIME_EXPERIENCE", "true"}
+        });
+
        /// <summary>
        /// Execute `dotnet <paramref name="args"/>` and return true if the command succeeded, otherwise false.
        /// If `silent` is true the output of the command is logged as `debug` otherwise as `info`.
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
@@ -24,16 +24,16 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        private readonly FileProvider fileProvider;

        /// <summary>
-        /// The computed packages directory.
-        /// This will be in the Temp location
+        /// The packages directory.
+        /// This will be in the user-specified or computed Temp location
        /// so as to not trample the source tree.
        /// </summary>
-        private readonly TemporaryDirectory packageDirectory;
+        private readonly DependencyDirectory packageDirectory;

        /// <summary>
        /// Create the package manager for a specified source tree.
        /// </summary>
-        public NugetExeWrapper(FileProvider fileProvider, TemporaryDirectory packageDirectory, Semmle.Util.Logging.ILogger logger)
+        public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger)
        {
            this.fileProvider = fileProvider;
            this.packageDirectory = packageDirectory;
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -24,12 +24,12 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        private readonly IDotNet dotnet;
        private readonly DependabotProxy? dependabotProxy;
        private readonly IDiagnosticsWriter diagnosticsWriter;
-        private readonly TemporaryDirectory legacyPackageDirectory;
-        private readonly TemporaryDirectory missingPackageDirectory;
+        private readonly DependencyDirectory legacyPackageDirectory;
+        private readonly DependencyDirectory missingPackageDirectory;
        private readonly ILogger logger;
        private readonly ICompilationInfoContainer compilationInfoContainer;

-        public TemporaryDirectory PackageDirectory { get; }
+        public DependencyDirectory PackageDirectory { get; }

        public NugetPackageRestorer(
            FileProvider fileProvider,
@@ -48,9 +48,9 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
            this.logger = logger;
            this.compilationInfoContainer = compilationInfoContainer;

-            PackageDirectory = new TemporaryDirectory(ComputeTempDirectoryPath("packages"), "package", logger);
-            legacyPackageDirectory = new TemporaryDirectory(ComputeTempDirectoryPath("legacypackages"), "legacy package", logger);
-            missingPackageDirectory = new TemporaryDirectory(ComputeTempDirectoryPath("missingpackages"), "missing package", logger);
+            PackageDirectory = new DependencyDirectory("packages", "package", logger);
+            legacyPackageDirectory = new DependencyDirectory("legacypackages", "legacy package", logger);
+            missingPackageDirectory = new DependencyDirectory("missingpackages", "missing package", logger);
        }

        public string? TryRestore(string package)
--- a/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs
@@ -170,7 +170,8 @@ namespace Semmle.Extraction.CSharp.Standalone
                fileLogger.LogError($"  Unhandled exception: {ex}");
            }

-            logger.Log(Severity.Info, $"Extraction completed in {overallStopwatch.Elapsed}");
+            logger.Log(Severity.Info, $"Extraction completed in {analyzerStopwatch.Elapsed}");
+            logger.Log(Severity.Info, $"Total time: {overallStopwatch.Elapsed}");

            return ExitCode.Ok;
        }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs
@@ -360,5 +360,22 @@ namespace Semmle.Extraction.CSharp
                return versionString.InformationalVersion;
            }
        }
+
+        private static readonly HashSet<string> errorsToIgnore = new HashSet<string>
+        {
+            "CS7027",   // Code signing failure
+            "CS1589",   // XML referencing not supported
+            "CS1569"    // Error writing XML documentation
+        };
+
+        /// <summary>
+        /// Retrieves the diagnostics from the compilation, filtering out those that should be ignored.
+        /// </summary>
+        protected List<Diagnostic> GetFilteredDiagnostics() =>
+            compilation is not null
+                ? compilation.GetDiagnostics()
+                    .Where(e => e.Severity >= DiagnosticSeverity.Error && !errorsToIgnore.Contains(e.Id))
+                    .ToList()
+                : [];
    }
 }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/StandaloneAnalyser.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/StandaloneAnalyser.cs
@@ -13,6 +13,14 @@ namespace Semmle.Extraction.CSharp
        {
        }

+        private void LogDiagnostics()
+        {
+            foreach (var error in GetFilteredDiagnostics())
+            {
+                Logger.LogDebug($"  Compilation error: {error}");
+            }
+        }
+
        public void Initialize(string outputPath, IEnumerable<(string, string)> compilationInfos, CSharpCompilation compilationIn, CommonOptions options)
        {
            compilation = compilationIn;
@@ -20,6 +28,7 @@ namespace Semmle.Extraction.CSharp
            this.options = options;
            LogExtractorInfo();
            SetReferencePaths();
+            LogDiagnostics();
        }
    }
 }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/TracingAnalyser.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/TracingAnalyser.cs
@@ -136,11 +136,7 @@ namespace Semmle.Extraction.CSharp

        private int LogDiagnostics()
        {
-            var filteredDiagnostics = compilation!
-                .GetDiagnostics()
-                .Where(e => e.Severity >= DiagnosticSeverity.Error && !errorsToIgnore.Contains(e.Id))
-                .ToList();
-
+            var filteredDiagnostics = GetFilteredDiagnostics();
            foreach (var error in filteredDiagnostics)
            {
                Logger.LogError($"  Compilation error: {error}");
@@ -148,7 +144,7 @@ namespace Semmle.Extraction.CSharp

            if (filteredDiagnostics.Count != 0)
            {
-                foreach (var reference in compilation.References)
+                foreach (var reference in compilation!.References)
                {
                    Logger.LogInfo($"  Resolved reference {reference.Display}");
                }
@@ -156,12 +152,5 @@ namespace Semmle.Extraction.CSharp

            return filteredDiagnostics.Count;
        }
-
-        private static readonly HashSet<string> errorsToIgnore = new HashSet<string>
-        {
-            "CS7027",   // Code signing failure
-            "CS1589",   // XML referencing not supported
-            "CS1569"    // Error writing XML documentation
-        };
    }
 }
--- a/csharp/extractor/Semmle.Util/EnvironmentVariables.cs
+++ b/csharp/extractor/Semmle.Util/EnvironmentVariables.cs
@@ -76,5 +76,14 @@ namespace Semmle.Util
        {
            return Environment.GetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OVERLAY_BASE_METADATA_OUT");
        }
+
+        /// <summary>
+        /// If set, returns the directory where buildless dependencies should be stored.
+        /// This can be used for caching dependencies.
+        /// </summary>
+        public static string? GetBuildlessDependencyDir()
+        {
+            return Environment.GetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR");
+        }
    }
 }
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.52
+
+No user-facing changes.
+
 ## 1.7.51

 No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.52.md
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.52.md
@@ -0,0 +1,3 @@
+## 1.7.52
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.51
+lastReleaseVersion: 1.7.52
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.52-dev
+version: 1.7.53-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.52
+
+No user-facing changes.
+
 ## 1.7.51

 No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.52.md
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.52.md
@@ -0,0 +1,3 @@
+## 1.7.52
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.51
+lastReleaseVersion: 1.7.52
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.52-dev
+version: 1.7.53-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/integration-tests/all-platforms/dotnet_10/Program.cs
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_10/Program.cs
--- a/csharp/ql/integration-tests/all-platforms/dotnet_10/dotnet_build.csproj
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_10/dotnet_build.csproj
--- a/csharp/ql/integration-tests/all-platforms/dotnet_10/global.json
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_10/global.json
@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "10.0.100"
+    }
+}
--- a/csharp/ql/integration-tests/all-platforms/dotnet_10/test.py
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_10/test.py
@@ -0,0 +1,5 @@
+def test1(codeql, csharp):
+    codeql.database.create()
+
+def test2(codeql, csharp):
+    codeql.database.create(build_mode="none")
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/Assemblies.expected
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/Assemblies.expected
@@ -0,0 +1 @@
+| dependencies/packages/newtonsoft.json/13.0.1/lib/netstandard2.0/Newtonsoft.Json.dll:0:0:0:0 | Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed |
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/Assemblies.ql
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/Assemblies.ql
@@ -0,0 +1,7 @@
+import csharp
+
+from Assembly a
+where
+  not a.getCompilation().getOutputAssembly() = a and
+  a.getName().matches("%Newtonsoft%")
+select a
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/Program.cs
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/Program.cs
@@ -0,0 +1,6 @@
+class Program
+{
+    static void Main(string[] args)
+    {
+    }
+}
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/global.json
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/global.json
@@ -0,0 +1,5 @@
+{
+  "sdk": {
+    "version": "9.0.304"
+  }
+}
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/standalone.csproj
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/proj/standalone.csproj
@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFrameworks>net9.0</TargetFrameworks>
+  </PropertyGroup>
+
+  <Target Name="DeleteBinObjFolders" BeforeTargets="Clean">
+    <RemoveDir Directories=".\bin" />
+    <RemoveDir Directories=".\obj" />
+  </Target>
+
+  <ItemGroup>
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+  </ItemGroup>
+</Project>
--- a/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/test.py
+++ b/csharp/ql/integration-tests/all-platforms/standalone_dependency_dir/test.py
@@ -0,0 +1,14 @@
+import os
+import shutil
+
+def test(codeql, csharp, cwd):
+    path = os.path.join(cwd, "dependencies")
+    os.environ["CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR"] = path
+    # The Assemblies.ql query shows that the Newtonsoft assembly is found in the
+    # dependency directory set above.
+    codeql.database.create(source_root="proj", build_mode="none")
+
+    # Check that the packages directory has been created in the dependencies folder.
+    packages_dir = os.path.join(path, "packages")
+    assert os.path.isdir(packages_dir), "The packages directory was not created in the specified dependency directory."
+    shutil.rmtree(path)
--- a/csharp/ql/integration-tests/linux/compiler_args/CompilerArgs.expected
+++ b/csharp/ql/integration-tests/linux/compiler_args/CompilerArgs.expected
@@ -7,196 +7,197 @@
 | 6 | /errorreport:prompt |
 | 7 | /warn:9 |
 | 8 | /define:TRACE;DEBUG;NET;NET9_0;NETCOREAPP;NET5_0_OR_GREATER;NET6_0_OR_GREATER;NET7_0_OR_GREATER;NET8_0_OR_GREATER;NET9_0_OR_GREATER;NETCOREAPP1_0_OR_GREATER;NETCOREAPP1_1_OR_GREATER;NETCOREAPP2_0_OR_GREATER;NETCOREAPP2_1_OR_GREATER;NETCOREAPP2_2_OR_GREATER;NETCOREAPP3_0_OR_GREATER;NETCOREAPP3_1_OR_GREATER |
-| 9 | /highentropyva+ |
-| 10 | /nullable:enable |
-| 11 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.CSharp.dll |
-| 12 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.VisualBasic.Core.dll |
-| 13 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.VisualBasic.dll |
-| 14 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.Win32.Primitives.dll |
-| 15 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.Win32.Registry.dll |
-| 16 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/mscorlib.dll |
-| 17 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/netstandard.dll |
-| 18 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.AppContext.dll |
-| 19 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Buffers.dll |
-| 20 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Concurrent.dll |
-| 21 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.dll |
-| 22 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Immutable.dll |
-| 23 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.NonGeneric.dll |
-| 24 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Specialized.dll |
-| 25 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.Annotations.dll |
-| 26 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.DataAnnotations.dll |
-| 27 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.dll |
-| 28 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.EventBasedAsync.dll |
-| 29 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.Primitives.dll |
-| 30 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.TypeConverter.dll |
-| 31 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Configuration.dll |
-| 32 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Console.dll |
-| 33 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Core.dll |
-| 34 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.Common.dll |
-| 35 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.DataSetExtensions.dll |
-| 36 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.dll |
-| 37 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Contracts.dll |
-| 38 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Debug.dll |
-| 39 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.DiagnosticSource.dll |
-| 40 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.FileVersionInfo.dll |
-| 41 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Process.dll |
-| 42 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.StackTrace.dll |
-| 43 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.TextWriterTraceListener.dll |
-| 44 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Tools.dll |
-| 45 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.TraceSource.dll |
-| 46 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Tracing.dll |
-| 47 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.dll |
-| 48 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Drawing.dll |
-| 49 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Drawing.Primitives.dll |
-| 50 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Dynamic.Runtime.dll |
-| 51 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Formats.Asn1.dll |
-| 52 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Formats.Tar.dll |
-| 53 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.Calendars.dll |
-| 54 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.dll |
-| 55 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.Extensions.dll |
-| 56 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.Brotli.dll |
-| 57 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.dll |
-| 58 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.FileSystem.dll |
-| 59 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.ZipFile.dll |
-| 60 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.dll |
-| 61 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.AccessControl.dll |
-| 62 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.dll |
-| 63 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.DriveInfo.dll |
-| 64 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.Primitives.dll |
-| 65 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.Watcher.dll |
-| 66 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.IsolatedStorage.dll |
-| 67 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.MemoryMappedFiles.dll |
-| 68 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipelines.dll |
-| 69 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipes.AccessControl.dll |
-| 70 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipes.dll |
-| 71 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.UnmanagedMemoryStream.dll |
-| 72 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.dll |
-| 73 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Expressions.dll |
-| 74 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Parallel.dll |
-| 75 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Queryable.dll |
-| 76 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Memory.dll |
-| 77 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.dll |
-| 78 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Http.dll |
-| 79 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Http.Json.dll |
-| 80 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.HttpListener.dll |
-| 81 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Mail.dll |
-| 82 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.NameResolution.dll |
-| 83 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.NetworkInformation.dll |
-| 84 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Ping.dll |
-| 85 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Primitives.dll |
-| 86 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Quic.dll |
-| 87 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Requests.dll |
-| 88 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Security.dll |
-| 89 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.ServicePoint.dll |
-| 90 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Sockets.dll |
-| 91 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebClient.dll |
-| 92 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebHeaderCollection.dll |
-| 93 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebProxy.dll |
-| 94 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebSockets.Client.dll |
-| 95 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebSockets.dll |
-| 96 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Numerics.dll |
-| 97 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Numerics.Vectors.dll |
-| 98 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ObjectModel.dll |
-| 99 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.DispatchProxy.dll |
-| 100 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.dll |
-| 101 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.dll |
-| 102 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.ILGeneration.dll |
-| 103 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.Lightweight.dll |
-| 104 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Extensions.dll |
-| 105 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Metadata.dll |
-| 106 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Primitives.dll |
-| 107 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.TypeExtensions.dll |
-| 108 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.Reader.dll |
-| 109 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.ResourceManager.dll |
-| 110 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.Writer.dll |
-| 111 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.CompilerServices.Unsafe.dll |
-| 112 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.CompilerServices.VisualC.dll |
-| 113 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.dll |
-| 114 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Extensions.dll |
-| 115 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Handles.dll |
-| 116 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.dll |
-| 117 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.JavaScript.dll |
-| 118 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.RuntimeInformation.dll |
-| 119 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Intrinsics.dll |
-| 120 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Loader.dll |
-| 121 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Numerics.dll |
-| 122 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.dll |
-| 123 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Formatters.dll |
-| 124 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Json.dll |
-| 125 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Primitives.dll |
-| 126 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Xml.dll |
-| 127 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.AccessControl.dll |
-| 128 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Claims.dll |
-| 129 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Algorithms.dll |
-| 130 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Cng.dll |
-| 131 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Csp.dll |
-| 132 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.dll |
-| 133 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Encoding.dll |
-| 134 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.OpenSsl.dll |
-| 135 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Primitives.dll |
-| 136 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.X509Certificates.dll |
-| 137 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.dll |
-| 138 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Principal.dll |
-| 139 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Principal.Windows.dll |
-| 140 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.SecureString.dll |
-| 141 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ServiceModel.Web.dll |
-| 142 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ServiceProcess.dll |
-| 143 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.CodePages.dll |
-| 144 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.dll |
-| 145 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.Extensions.dll |
-| 146 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encodings.Web.dll |
-| 147 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Json.dll |
-| 148 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.RegularExpressions.dll |
-| 149 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Channels.dll |
-| 150 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.dll |
-| 151 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Overlapped.dll |
-| 152 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Dataflow.dll |
-| 153 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.dll |
-| 154 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Extensions.dll |
-| 155 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Parallel.dll |
-| 156 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Thread.dll |
-| 157 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.ThreadPool.dll |
-| 158 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Timer.dll |
-| 159 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Transactions.dll |
-| 160 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Transactions.Local.dll |
-| 161 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ValueTuple.dll |
-| 162 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Web.dll |
-| 163 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Web.HttpUtility.dll |
-| 164 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Windows.dll |
-| 165 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.dll |
-| 166 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.Linq.dll |
-| 167 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.ReaderWriter.dll |
-| 168 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.Serialization.dll |
-| 169 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XDocument.dll |
-| 170 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XmlDocument.dll |
-| 171 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XmlSerializer.dll |
-| 172 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XPath.dll |
-| 173 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XPath.XDocument.dll |
-| 174 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/WindowsBase.dll |
-| 175 | /debug+ |
-| 176 | /debug:portable |
-| 177 | /filealign:512 |
-| 178 | /generatedfilesout:obj/Debug/net9.0//generated |
-| 179 | /optimize- |
-| 180 | /out:obj/Debug/net9.0/test.dll |
-| 181 | /refout:obj/Debug/net9.0/refint/test.dll |
-| 182 | /target:exe |
-| 183 | /warnaserror- |
-| 184 | /utf8output |
-| 185 | /deterministic+ |
-| 186 | /langversion:13.0 |
-| 187 | /analyzerconfig:obj/Debug/net9.0/test.GeneratedMSBuildEditorConfig.editorconfig |
-| 188 | /analyzerconfig:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/analyzers/build/config/analysislevel_9_default.globalconfig |
-| 189 | /analyzer:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/targets/../analyzers/Microsoft.CodeAnalysis.CSharp.NetAnalyzers.dll |
-| 190 | /analyzer:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/targets/../analyzers/Microsoft.CodeAnalysis.NetAnalyzers.dll |
-| 191 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.ComInterfaceGenerator.dll |
-| 192 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.JavaScript.JSImportGenerator.dll |
-| 193 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.LibraryImportGenerator.dll |
-| 194 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.SourceGeneration.dll |
-| 195 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/System.Text.Json.SourceGeneration.dll |
-| 196 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/System.Text.RegularExpressions.Generator.dll |
-| 197 | Program.cs |
-| 198 | obj/Debug/net9.0/test.GlobalUsings.g.cs |
-| 199 | obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs |
-| 200 | obj/Debug/net9.0/test.AssemblyInfo.cs |
-| 201 | /warnaserror+:NU1605,SYSLIB0011 |
+| 9 | /preferreduilang:en |
+| 10 | /highentropyva+ |
+| 11 | /nullable:enable |
+| 12 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.CSharp.dll |
+| 13 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.VisualBasic.Core.dll |
+| 14 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.VisualBasic.dll |
+| 15 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.Win32.Primitives.dll |
+| 16 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/Microsoft.Win32.Registry.dll |
+| 17 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/mscorlib.dll |
+| 18 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/netstandard.dll |
+| 19 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.AppContext.dll |
+| 20 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Buffers.dll |
+| 21 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Concurrent.dll |
+| 22 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.dll |
+| 23 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Immutable.dll |
+| 24 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.NonGeneric.dll |
+| 25 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Collections.Specialized.dll |
+| 26 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.Annotations.dll |
+| 27 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.DataAnnotations.dll |
+| 28 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.dll |
+| 29 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.EventBasedAsync.dll |
+| 30 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.Primitives.dll |
+| 31 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ComponentModel.TypeConverter.dll |
+| 32 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Configuration.dll |
+| 33 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Console.dll |
+| 34 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Core.dll |
+| 35 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.Common.dll |
+| 36 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.DataSetExtensions.dll |
+| 37 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Data.dll |
+| 38 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Contracts.dll |
+| 39 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Debug.dll |
+| 40 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.DiagnosticSource.dll |
+| 41 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.FileVersionInfo.dll |
+| 42 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Process.dll |
+| 43 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.StackTrace.dll |
+| 44 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.TextWriterTraceListener.dll |
+| 45 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Tools.dll |
+| 46 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.TraceSource.dll |
+| 47 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Diagnostics.Tracing.dll |
+| 48 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.dll |
+| 49 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Drawing.dll |
+| 50 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Drawing.Primitives.dll |
+| 51 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Dynamic.Runtime.dll |
+| 52 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Formats.Asn1.dll |
+| 53 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Formats.Tar.dll |
+| 54 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.Calendars.dll |
+| 55 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.dll |
+| 56 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Globalization.Extensions.dll |
+| 57 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.Brotli.dll |
+| 58 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.dll |
+| 59 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.FileSystem.dll |
+| 60 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Compression.ZipFile.dll |
+| 61 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.dll |
+| 62 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.AccessControl.dll |
+| 63 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.dll |
+| 64 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.DriveInfo.dll |
+| 65 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.Primitives.dll |
+| 66 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.FileSystem.Watcher.dll |
+| 67 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.IsolatedStorage.dll |
+| 68 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.MemoryMappedFiles.dll |
+| 69 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipelines.dll |
+| 70 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipes.AccessControl.dll |
+| 71 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.Pipes.dll |
+| 72 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.IO.UnmanagedMemoryStream.dll |
+| 73 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.dll |
+| 74 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Expressions.dll |
+| 75 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Parallel.dll |
+| 76 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Linq.Queryable.dll |
+| 77 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Memory.dll |
+| 78 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.dll |
+| 79 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Http.dll |
+| 80 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Http.Json.dll |
+| 81 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.HttpListener.dll |
+| 82 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Mail.dll |
+| 83 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.NameResolution.dll |
+| 84 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.NetworkInformation.dll |
+| 85 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Ping.dll |
+| 86 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Primitives.dll |
+| 87 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Quic.dll |
+| 88 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Requests.dll |
+| 89 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Security.dll |
+| 90 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.ServicePoint.dll |
+| 91 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.Sockets.dll |
+| 92 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebClient.dll |
+| 93 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebHeaderCollection.dll |
+| 94 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebProxy.dll |
+| 95 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebSockets.Client.dll |
+| 96 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Net.WebSockets.dll |
+| 97 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Numerics.dll |
+| 98 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Numerics.Vectors.dll |
+| 99 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ObjectModel.dll |
+| 100 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.DispatchProxy.dll |
+| 101 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.dll |
+| 102 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.dll |
+| 103 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.ILGeneration.dll |
+| 104 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Emit.Lightweight.dll |
+| 105 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Extensions.dll |
+| 106 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Metadata.dll |
+| 107 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.Primitives.dll |
+| 108 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Reflection.TypeExtensions.dll |
+| 109 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.Reader.dll |
+| 110 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.ResourceManager.dll |
+| 111 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Resources.Writer.dll |
+| 112 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.CompilerServices.Unsafe.dll |
+| 113 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.CompilerServices.VisualC.dll |
+| 114 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.dll |
+| 115 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Extensions.dll |
+| 116 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Handles.dll |
+| 117 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.dll |
+| 118 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.JavaScript.dll |
+| 119 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.InteropServices.RuntimeInformation.dll |
+| 120 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Intrinsics.dll |
+| 121 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Loader.dll |
+| 122 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Numerics.dll |
+| 123 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.dll |
+| 124 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Formatters.dll |
+| 125 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Json.dll |
+| 126 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Primitives.dll |
+| 127 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Runtime.Serialization.Xml.dll |
+| 128 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.AccessControl.dll |
+| 129 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Claims.dll |
+| 130 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Algorithms.dll |
+| 131 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Cng.dll |
+| 132 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Csp.dll |
+| 133 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.dll |
+| 134 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Encoding.dll |
+| 135 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.OpenSsl.dll |
+| 136 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.Primitives.dll |
+| 137 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Cryptography.X509Certificates.dll |
+| 138 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.dll |
+| 139 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Principal.dll |
+| 140 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.Principal.Windows.dll |
+| 141 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Security.SecureString.dll |
+| 142 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ServiceModel.Web.dll |
+| 143 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ServiceProcess.dll |
+| 144 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.CodePages.dll |
+| 145 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.dll |
+| 146 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encoding.Extensions.dll |
+| 147 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Encodings.Web.dll |
+| 148 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.Json.dll |
+| 149 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Text.RegularExpressions.dll |
+| 150 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Channels.dll |
+| 151 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.dll |
+| 152 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Overlapped.dll |
+| 153 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Dataflow.dll |
+| 154 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.dll |
+| 155 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Extensions.dll |
+| 156 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Tasks.Parallel.dll |
+| 157 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Thread.dll |
+| 158 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.ThreadPool.dll |
+| 159 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Threading.Timer.dll |
+| 160 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Transactions.dll |
+| 161 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Transactions.Local.dll |
+| 162 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.ValueTuple.dll |
+| 163 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Web.dll |
+| 164 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Web.HttpUtility.dll |
+| 165 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Windows.dll |
+| 166 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.dll |
+| 167 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.Linq.dll |
+| 168 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.ReaderWriter.dll |
+| 169 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.Serialization.dll |
+| 170 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XDocument.dll |
+| 171 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XmlDocument.dll |
+| 172 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XmlSerializer.dll |
+| 173 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XPath.dll |
+| 174 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/System.Xml.XPath.XDocument.dll |
+| 175 | /reference:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/ref/net9.0/WindowsBase.dll |
+| 176 | /debug+ |
+| 177 | /debug:portable |
+| 178 | /filealign:512 |
+| 179 | /generatedfilesout:obj/Debug/net9.0//generated |
+| 180 | /optimize- |
+| 181 | /out:obj/Debug/net9.0/test.dll |
+| 182 | /refout:obj/Debug/net9.0/refint/test.dll |
+| 183 | /target:exe |
+| 184 | /warnaserror- |
+| 185 | /utf8output |
+| 186 | /deterministic+ |
+| 187 | /langversion:13.0 |
+| 188 | /analyzerconfig:obj/Debug/net9.0/test.GeneratedMSBuildEditorConfig.editorconfig |
+| 189 | /analyzerconfig:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/analyzers/build/config/analysislevel_9_default.globalconfig |
+| 190 | /analyzer:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/targets/../analyzers/Microsoft.CodeAnalysis.CSharp.NetAnalyzers.dll |
+| 191 | /analyzer:/usr/share/dotnet/sdk/9.0.304/Sdks/Microsoft.NET.Sdk/targets/../analyzers/Microsoft.CodeAnalysis.NetAnalyzers.dll |
+| 192 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.ComInterfaceGenerator.dll |
+| 193 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.JavaScript.JSImportGenerator.dll |
+| 194 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.LibraryImportGenerator.dll |
+| 195 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/Microsoft.Interop.SourceGeneration.dll |
+| 196 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/System.Text.Json.SourceGeneration.dll |
+| 197 | /analyzer:/usr/share/dotnet/packs/Microsoft.NETCore.App.Ref/9.0.8/analyzers/dotnet/cs/System.Text.RegularExpressions.Generator.dll |
+| 198 | Program.cs |
+| 199 | obj/Debug/net9.0/test.GlobalUsings.g.cs |
+| 200 | obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs |
+| 201 | obj/Debug/net9.0/test.AssemblyInfo.cs |
+| 202 | /warnaserror+:NU1605,SYSLIB0011 |
--- a/csharp/ql/integration-tests/linux/dotnet_10_rc2/global.json
+++ b/csharp/ql/integration-tests/linux/dotnet_10_rc2/global.json
@@ -1,5 +0,0 @@
-{
-    "sdk": {
-        "version": "10.0.100-rc.2.25502.107"
-    }
-}
--- a/csharp/ql/integration-tests/linux/dotnet_10_rc2/test.py
+++ b/csharp/ql/integration-tests/linux/dotnet_10_rc2/test.py
@@ -1,6 +0,0 @@
-import os
-import runs_on
-
-@runs_on.linux
-def test(codeql, csharp):
-    codeql.database.create()
--- a/csharp/ql/integration-tests/windows/dotnet_10_rc2/Program.cs
+++ b/csharp/ql/integration-tests/windows/dotnet_10_rc2/Program.cs
@@ -1 +0,0 @@
-Console.WriteLine($"<arguments>{string.Join(",", args)}</arguments>");
--- a/csharp/ql/integration-tests/windows/dotnet_10_rc2/dotnet_build.csproj
+++ b/csharp/ql/integration-tests/windows/dotnet_10_rc2/dotnet_build.csproj
@@ -1,10 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>
--- a/csharp/ql/integration-tests/windows/dotnet_10_rc2/global.json
+++ b/csharp/ql/integration-tests/windows/dotnet_10_rc2/global.json
@@ -1,5 +0,0 @@
-{
-    "sdk": {
-        "version": "10.0.100-rc.2.25502.107"
-    }
-}
--- a/csharp/ql/integration-tests/windows/dotnet_10_rc2/test.py
+++ b/csharp/ql/integration-tests/windows/dotnet_10_rc2/test.py
@@ -1,6 +0,0 @@
-import os
-import runs_on
-
-@runs_on.windows
-def test(codeql, csharp):
-    codeql.database.create()
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 5.4.0
+
+### Deprecated APIs
+
+* `ControlFlowElement.controlsBlock` has been deprecated in favor of the Guards library.
+
+### New Features
+
+* Initial support for incremental C# databases via `codeql database create --overlay-base`/`--overlay-changes`.
+
+### Minor Analysis Improvements
+
+* Updated *roslyn* and *binlog* dependencies in the extractor, which may improve database and analysis quality.
+
 ## 5.3.0

 ### Deprecated APIs
@@ -143,7 +157,7 @@ No user-facing changes.
 * Added `remote` flow source models for properties of Blazor components annotated with any of the following attributes from `Microsoft.AspNetCore.Components`:
  - `[SupplyParameterFromForm]`
  - `[SupplyParameterFromQuery]`
-* Added the constructor and explicit cast operator of `Microsoft.AspNetCore.Components.MarkupString` as an `html-injection` sink. This will help catch cross-site scripting resulting from using `MarkupString`.
+* Added the constructor and explicit cast operator of `Microsoft.AspNetCore.Components.MarkupString` as an `html-injection` sink. This will help catch cross-site scripting resulting from using `MarkupString`. 
 * Added flow summaries for the `Microsoft.AspNetCore.Mvc.Controller::View` method.
 * The data flow library has been updated to track types in a slightly different way: The type of the tainted data (which may be stored into fields, etc.) is tracked more precisely, while the types of intermediate containers for nested contents is tracked less precisely. This may have a slight effect on false positives for complex flow paths.
 * The C# extractor now supports *basic* extraction of .NET 9 projects. There might be limited support for extraction of code using the new C# 13 language features.
@@ -163,7 +177,7 @@ No user-facing changes.
  - `System.Web.HttpUtility::ParseQueryString`
  - `Microsoft.AspNetCore.WebUtilities.QueryHelpers::ParseQuery`
  - `Microsoft.AspNetCore.WebUtilities.QueryHelpers::ParseNullableQuery`
-* Added `js-interop` sinks for the `InvokeAsync` and `InvokeVoidAsync` methods of `Microsoft.JSInterop.IJSRuntime`, which can run arbitrary JavaScript.
+* Added `js-interop` sinks for the `InvokeAsync` and `InvokeVoidAsync` methods of `Microsoft.JSInterop.IJSRuntime`, which can run arbitrary JavaScript. 

 ## 3.1.1

@@ -201,8 +215,8 @@ No user-facing changes.

 ### Breaking Changes

-* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`.
-* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`.
+* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`. 
+* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`. 
 * Deleted the deprecated `explorationLimit` predicate from `DataFlow::Configuration`, use `FlowExploration<explorationLimit>` instead.

 ### Minor Analysis Improvements
@@ -451,7 +465,7 @@ No user-facing changes.

 ### New Features

-* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`.
+* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`. 
  Hence it is no longer needed to provide `none()` implementations of these predicates if they are not needed.

 ### Minor Analysis Improvements
@@ -586,7 +600,7 @@ No user-facing changes.

 * Attributes on methods in CIL are now extracted (Bugfix).
 * Support for `static virtual` and `static abstract` interface members.
-* Support for *operators* in interface definitions.
+* Support for *operators* in interface definitions. 
 * C# 11: Added support for the unsigned right shift `>>>` and unsigned right shift assignment `>>>=` operators.
 * Query id's have been aligned such that they are prefixed with `cs` instead of `csharp`.

@@ -626,13 +640,13 @@ No user-facing changes.
 ### Minor Analysis Improvements

 * `DateTime` expressions are now considered simple type sanitizers. This affects a wide range of security queries.
-* ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected.
+* ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected. 

 ## 0.4.0

 ### Deprecated APIs

-* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### Bug Fixes
@@ -645,7 +659,7 @@ No user-facing changes.

 ### Deprecated APIs

-* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### Minor Analysis Improvements
@@ -692,7 +706,7 @@ No user-facing changes.

 ### Deprecated APIs

-* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide.
+* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide. 
  The old name still exists as a deprecated alias.

 ### New Features
--- a/csharp/ql/lib/change-notes/2025-10-04-deprecate-controlsblock.md
+++ b/csharp/ql/lib/change-notes/2025-10-04-deprecate-controlsblock.md
@@ -1,4 +0,0 @@
---
-category: deprecated
---
-* `ControlFlowElement.controlsBlock` has been deprecated in favor of the Guards library.
--- a/csharp/ql/lib/change-notes/2025-10-30-overlay-compilation-and-extraction.md
+++ b/csharp/ql/lib/change-notes/2025-10-30-overlay-compilation-and-extraction.md
@@ -1,5 +0,0 @@
---
-category: feature
---
-
-* Initial support for incremental C# databases via `codeql database create --overlay-base`/`--overlay-changes`.
--- a/csharp/ql/lib/change-notes/2025-11-03-roslyn-and-binlog.md
+++ b/csharp/ql/lib/change-notes/2025-11-03-roslyn-and-binlog.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* Updated *roslyn* and *binlog* dependencies in the extractor, which may improve database and analysis quality.
--- a/csharp/ql/lib/change-notes/2025-11-17-compiler-error-debug.md
+++ b/csharp/ql/lib/change-notes/2025-11-17-compiler-error-debug.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Compilation errors are now included in the debug log when using build-mode none.
--- a/csharp/ql/lib/change-notes/2025-11-17-dependencies-directory.md
+++ b/csharp/ql/lib/change-notes/2025-11-17-dependencies-directory.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added a new extractor option to specify a custom directory for dependency downloads in buildless mode. Use `-O buildless_dependency_dir=<path>` to configure the target directory.
--- a/csharp/ql/lib/change-notes/2025-11-19-autobuilder-stability.md
+++ b/csharp/ql/lib/change-notes/2025-11-19-autobuilder-stability.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Improved stability when downloading .NET versions by setting appropriate environment variables for `dotnet` commands. The correct architecture-specific version of .NET is now downloaded on ARM runners.
--- a/csharp/ql/lib/change-notes/released/5.3.0.md
+++ b/csharp/ql/lib/change-notes/released/5.3.0.md
@@ -6,7 +6,7 @@

 ### Major Analysis Improvements

-* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries including both minor improvements and minor regressions, for example, improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`. Two queries stand out as being significantly affected with great improvements: `cs/dereferenced-value-may-be-null` has been completely rewritten which removes a very significant number of false positives. Furthermore, `cs/constant-condition` has been updated to report many new results - these new results are primarily expected to be true positives, but a few new false positives are expected as well. As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.
+* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries including both minor improvements and minor regressions. For example, improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`. Two queries stand out as being significantly affected with great improvements: `cs/dereferenced-value-may-be-null` has been completely rewritten which removes a very significant number of false positives. Furthermore, `cs/constant-condition` has been updated to report many new results - these new results are primarily expected to be true positives, but a few new false positives are expected as well. As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.

 ### Minor Analysis Improvements

--- a/csharp/ql/lib/change-notes/released/5.4.0.md
+++ b/csharp/ql/lib/change-notes/released/5.4.0.md
@@ -0,0 +1,13 @@
+## 5.4.0
+
+### Deprecated APIs
+
+* `ControlFlowElement.controlsBlock` has been deprecated in favor of the Guards library.
+
+### New Features
+
+* Initial support for incremental C# databases via `codeql database create --overlay-base`/`--overlay-changes`.
+
+### Minor Analysis Improvements
+
+* Updated *roslyn* and *binlog* dependencies in the extractor, which may improve database and analysis quality.
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.3.0
+lastReleaseVersion: 5.4.0
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.3.1-dev
+version: 5.4.1-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 1.5.0
+
+### New Queries
+
+* The `cs/web/cookie-secure-not-set` and `cs/web/cookie-httponly-not-set` queries have been promoted from experimental to the main query pack.
+
+### Minor Analysis Improvements
+
+* An improvement to the Guards library for recognizing disjunctions means improved precision for `cs/constant-condition`, `cs/inefficient-containskey`, and `cs/dereferenced-value-may-be-null`. The two former can have additional findings, and the latter will have fewer false positives.
+
 ## 1.4.3

 ### Minor Analysis Improvements
@@ -170,7 +180,7 @@ No user-facing changes.

 ### Minor Analysis Improvements

-* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query.
+* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query. 

 ## 1.0.10

@@ -284,7 +294,7 @@ No user-facing changes.

 ### Minor Analysis Improvements

-* Fixed a Log forging false positive when using `String.Replace` to sanitize the input.
+* Fixed a Log forging false positive when using `String.Replace` to sanitize the input.    
 * Fixed a URL redirection from remote source false positive when guarding a redirect with `HttpRequestBase.IsUrlLocalToHost()`

 ## 0.8.5
--- a/csharp/ql/src/change-notes/2025-10-24-insecure-cookie-query-promote.md
+++ b/csharp/ql/src/change-notes/2025-10-24-insecure-cookie-query-promote.md
@@ -1,4 +0,0 @@
---
-category: newQuery
---
-The `cs/web/cookie-secure-not-set` and `cs/web/cookie-httponly-not-set` queries have been promoted from experimental to the main query pack.
--- a/csharp/ql/src/change-notes/released/1.0.11.md
+++ b/csharp/ql/src/change-notes/released/1.0.11.md
@@ -2,4 +2,4 @@

 ### Minor Analysis Improvements

-* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query. 
+* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query.
--- a/csharp/ql/src/change-notes/released/1.4.3.md
+++ b/csharp/ql/src/change-notes/released/1.4.3.md
@@ -2,4 +2,4 @@

 ### Minor Analysis Improvements

-* the `cs/web/missing-x-frame-options` query now correctly handles configuration nested in root `<location>` elements.
+* The `cs/web/missing-x-frame-options` query now correctly handles configuration nested in root `<location>` elements.
--- a/csharp/ql/src/change-notes/released/1.5.0.md
+++ b/csharp/ql/src/change-notes/released/1.5.0.md
@@ -0,0 +1,9 @@
+## 1.5.0
+
+### New Queries
+
+* The `cs/web/cookie-secure-not-set` and `cs/web/cookie-httponly-not-set` queries have been promoted from experimental to the main query pack.
+
+### Minor Analysis Improvements
+
+* An improvement to the Guards library for recognizing disjunctions means improved precision for `cs/constant-condition`, `cs/inefficient-containskey`, and `cs/dereferenced-value-may-be-null`. The two former can have additional findings, and the latter will have fewer false positives.
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.3
+lastReleaseVersion: 1.5.0
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.4.4-dev
+version: 1.5.1-dev
 groups:
  - csharp
  - queries
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`\| dependencies/packages/newtonsoft.json/13.0.1/lib/netstandard2.0/Newtonsoft.Json.dll:0:0:0:0 \| Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed \|`
				`@@ -1 +0,0 @@`
				`Console.WriteLine($"<arguments>{string.Join(",", args)}</arguments>");`