Merge branch 'main' into callderef

.github/codeql/codeql-config.yml

@@ -7,3 +7,5 @@ paths-ignore:
   - '/cpp/'
   - '/java/'
   - '/python/'
+  - '/javascript/ql/test'
+  - '/javascript/extractor/tests'

.vscode/extensions.json

@@ -3,7 +3,7 @@
     // Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
     // List of extensions which should be recommended for users of this workspace.
     "recommendations": [
-        "github.vscode-codeql"
+        "GitHub.vscode-codeql"
     ],
     // List of extensions recommended by VS Code that should not be recommended for users of this workspace.
     "unwantedRecommendations": []

change-notes/1.26/analysis-cpp.md

@@ -25,6 +25,7 @@ The following changes in version 1.26 affect C/C++ analysis in all applications.
 * The models library now models many more taint flows through `std::string`.
 * The models library now models many taint flows through `std::istream` and `std::ostream`.
 * The models library now models some taint flows through `std::shared_ptr`, `std::unique_ptr`, `std::make_shared` and `std::make_unique`.
+* The models library now models many taint flows through `std::pair`, `std::map`, `std::unordered_map`, `std::set` and `std::unordered_set`.
 * The models library now models `bcopy`.
 * The `SimpleRangeAnalysis` library now supports multiplications of the form
   `e1 * e2` and `x *= e2` when `e1` and `e2` are unsigned or constant.

change-notes/1.26/analysis-javascript.md

@@ -3,6 +3,8 @@
 ## General improvements
 
 * Support for the following frameworks and libraries has been improved:
+  - [AWS Serverless](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html)
+  - [Alibaba Serverless](https://www.alibabacloud.com/help/doc-detail/156876.htm)
   - [bluebird](https://www.npmjs.com/package/bluebird)
   - [express](https://www.npmjs.com/package/express)
   - [fast-json-stable-stringify](https://www.npmjs.com/package/fast-json-stable-stringify)
@@ -14,6 +16,7 @@
   - [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
   - [json3](https://www.npmjs.com/package/json3)
   - [lodash](https://www.npmjs.com/package/lodash)
+  - [needle](https://www.npmjs.com/package/needle)
   - [object-inspect](https://www.npmjs.com/package/object-inspect)
   - [pretty-format](https://www.npmjs.com/package/pretty-format)
   - [stringify-object](https://www.npmjs.com/package/stringify-object)
@@ -39,6 +42,7 @@
 | Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
 | Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
 | Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
+| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
 
 
 ## Changes to libraries

config/identical-files.json

@@ -62,6 +62,14 @@
     "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
   ],
+  "Bound Java/C#": [
+    "java/ql/src/semmle/code/java/dataflow/Bound.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/Bound.qll"
+  ],
+  "ModulusAnalysis Java/C#": [
+    "java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
+  ],
   "C++ SubBasicBlocks": [
     "cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
     "cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>netcoreapp3.0</TargetFramework>
+    <TargetFramework>netcoreapp3.1</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.0</TargetFramework>
+    <TargetFramework>netcoreapp3.1</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />

cpp/change-notes/2020-09-29-range-analysis-rollup.md

@@ -0,0 +1,14 @@
+lgtm,codescanning
+* The `SimpleRangeAnalysis` library has gained support for several language
+  constructs it did not support previously. These improvements primarily affect
+  the queries `cpp/constant-comparison`, `cpp/comparison-with-wider-type`, and
+  `cpp/integer-multiplication-cast-to-long`. The newly supported language
+  features are:
+    * Multiplication of unsigned numbers.
+    * Multiplication by a constant.
+    * Reference-typed function parameters.
+    * Comparing a variable not equal to an endpoint of its range, thus narrowing the range by one.
+    * Using `if (x)` or `if (!x)` or similar to test for equality to zero.
+* The `SimpleRangeAnalysis` library can now be extended with custom rules. See
+  examples in
+  `cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/extensions/`.

cpp/ql/src/Critical/OverflowDestination.ql

@@ -23,10 +23,7 @@ import semmle.code.cpp.security.TaintTracking
  * ```
  */
 predicate sourceSized(FunctionCall fc, Expr src) {
-  exists(string name |
-    (name = "strncpy" or name = "strncat" or name = "memcpy" or name = "memmove") and
-    fc.getTarget().hasGlobalOrStdName(name)
-  ) and
+  fc.getTarget().hasGlobalOrStdName(["strncpy", "strncat", "memcpy", "memmove"]) and
   exists(Expr dest, Expr size, Variable v |
     fc.getArgument(0) = dest and
     fc.getArgument(1) = src and

cpp/ql/src/Critical/SizeCheck2.ql

@@ -15,12 +15,7 @@
 import cpp
 
 class Allocation extends FunctionCall {
-  Allocation() {
-    exists(string name |
-      this.getTarget().hasGlobalOrStdName(name) and
-      (name = "malloc" or name = "calloc" or name = "realloc")
-    )
-  }
+  Allocation() { this.getTarget().hasGlobalOrStdName(["malloc", "calloc", "realloc"]) }
 
   private string getName() { this.getTarget().hasGlobalOrStdName(result) }
 

cpp/ql/src/JPL_C/LOC-2/Rule 11/SimpleControlFlowJmp.ql

@@ -13,14 +13,7 @@
 import cpp
 
 class ForbiddenFunction extends Function {
-  ForbiddenFunction() {
-    exists(string name | name = this.getName() |
-      name = "setjmp" or
-      name = "longjmp" or
-      name = "sigsetjmp" or
-      name = "siglongjmp"
-    )
-  }
+  ForbiddenFunction() { this.getName() = ["setjmp", "longjmp", "sigsetjmp", "siglongjmp"] }
 }
 
 from FunctionCall call

cpp/ql/src/Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql

@@ -40,9 +40,7 @@ class DateStructModifiedFieldAccess extends LeapYearFieldAccess {
  */
 class SafeTimeGatheringFunction extends Function {
   SafeTimeGatheringFunction() {
-    this.getQualifiedName() = "GetFileTime" or
-    this.getQualifiedName() = "GetSystemTime" or
-    this.getQualifiedName() = "NtQuerySystemTime"
+    this.getQualifiedName() = ["GetFileTime", "GetSystemTime", "NtQuerySystemTime"]
   }
 }
 
@@ -51,15 +49,11 @@ class SafeTimeGatheringFunction extends Function {
  */
 class TimeConversionFunction extends Function {
   TimeConversionFunction() {
-    this.getQualifiedName() = "FileTimeToSystemTime" or
-    this.getQualifiedName() = "SystemTimeToFileTime" or
-    this.getQualifiedName() = "SystemTimeToTzSpecificLocalTime" or
-    this.getQualifiedName() = "SystemTimeToTzSpecificLocalTimeEx" or
-    this.getQualifiedName() = "TzSpecificLocalTimeToSystemTime" or
-    this.getQualifiedName() = "TzSpecificLocalTimeToSystemTimeEx" or
-    this.getQualifiedName() = "RtlLocalTimeToSystemTime" or
-    this.getQualifiedName() = "RtlTimeToSecondsSince1970" or
-    this.getQualifiedName() = "_mkgmtime"
+    this.getQualifiedName() =
+      ["FileTimeToSystemTime", "SystemTimeToFileTime", "SystemTimeToTzSpecificLocalTime",
+          "SystemTimeToTzSpecificLocalTimeEx", "TzSpecificLocalTimeToSystemTime",
+          "TzSpecificLocalTimeToSystemTimeEx", "RtlLocalTimeToSystemTime",
+          "RtlTimeToSecondsSince1970", "_mkgmtime"]
   }
 }
 

cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name External dependencies
  * @description Count the number of dependencies a C/C++ source file has on external libraries.
  * @kind treemap

cpp/ql/src/Metrics/Dependencies/ExternalDependenciesSourceLinks.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name External dependency source links
  * @kind source-link
  * @metricType externalDependency

cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Duplicated lines in files
  * @description The number of lines in a file, including code, comment
  *              and whitespace lines, which are duplicated in at least

cpp/ql/src/Microsoft/SAL.qll

@@ -10,13 +10,8 @@ import cpp
  */
 class SALMacro extends Macro {
   SALMacro() {
-    exists(string filename | filename = this.getFile().getBaseName() |
-      filename = "sal.h" or
-      filename = "specstrings_strict.h" or
-      filename = "specstrings.h" or
-      filename = "w32p.h" or
-      filename = "minwindef.h"
-    ) and
+    this.getFile().getBaseName() =
+      ["sal.h", "specstrings_strict.h", "specstrings.h", "w32p.h", "minwindef.h"] and
     (
       // Dialect for Windows 8 and above
       this.getName().matches("\\_%\\_")
@@ -58,10 +53,7 @@ class SALAnnotation extends MacroInvocation {
  */
 class SALCheckReturn extends SALAnnotation {
   SALCheckReturn() {
-    exists(SALMacro m | m = this.getMacro() |
-      m.getName() = "_Check_return_" or
-      m.getName() = "_Must_inspect_result_"
-    )
+    this.getMacro().(SALMacro).getName() = ["_Check_return_", "_Must_inspect_result_"]
   }
 }
 

cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp

@@ -39,7 +39,7 @@ access all the system's passwords.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Path_traversal">Path Traversal</a>.
+<a href="https://owasp.org/www-community/attacks/Path_Traversal">Path Traversal</a>.
 </li>
 
 </references>

cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql

@@ -56,7 +56,7 @@ class VarargsFunction extends Function {
   }
 
   string normalTerminator(int cnt) {
-    (result = "0" or result = "-1") and
+    result = ["0", "-1"] and
     cnt = trailingArgValueCount(result) and
     2 * cnt > totalCount() and
     not exists(FunctionCall fc, int index |

cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql

@@ -66,10 +66,7 @@ class IFStream extends Type {
  */
 class CinVariable extends NamespaceVariable {
   CinVariable() {
-    (
-      getName() = "cin" or
-      getName() = "wcin"
-    ) and
+    getName() = ["cin", "wcin"] and
     getNamespace().getName() = "std"
   }
 }

cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql

@@ -14,12 +14,7 @@ import cpp
 
 predicate potentiallyDangerousFunction(Function f, string message) {
   exists(string name | f.hasGlobalName(name) |
-    (
-      name = "gmtime" or
-      name = "localtime" or
-      name = "ctime" or
-      name = "asctime"
-    ) and
+    name = ["gmtime", "localtime", "ctime", "asctime"] and
     message = "Call to " + name + " is potentially dangerous"
   )
 }

cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql

@@ -19,12 +19,7 @@ predicate worldWritableCreation(FileCreationExpr fc, int mode) {
 }
 
 predicate setWorldWritable(FunctionCall fc, int mode) {
-  exists(string name | fc.getTarget().getName() = name |
-    name = "chmod" or
-    name = "fchmod" or
-    name = "_chmod" or
-    name = "_wchmod"
-  ) and
+  fc.getTarget().getName() = ["chmod", "fchmod", "_chmod", "_wchmod"] and
   mode = fc.getArgument(1).getValue().toInt() and
   sets(mode, s_iwoth())
 }

cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll

@@ -31,11 +31,7 @@ predicate sets(int mask, int fields) { mask.bitAnd(fields) != 0 }
  * one of the `umask` family of functions.
  */
 private int umask(FunctionCall fc) {
-  exists(string name | name = fc.getTarget().getName() |
-    name = "umask" or
-    name = "_umask" or
-    name = "_umask_s"
-  ) and
+  fc.getTarget().getName() = ["umask", "_umask", "_umask_s"] and
   result = fc.getArgument(0).getValue().toInt()
 }
 
@@ -89,11 +85,7 @@ abstract class FileCreationExpr extends FunctionCall {
 
 class OpenCreationExpr extends FileCreationExpr {
   OpenCreationExpr() {
-    exists(string name | name = this.getTarget().getName() |
-      name = "open" or
-      name = "_open" or
-      name = "_wopen"
-    ) and
+    this.getTarget().getName() = ["open", "_open", "_wopen"] and
     sets(this.getArgument(1).getValue().toInt(), o_creat())
   }
 
@@ -134,14 +126,9 @@ private int fopenMode() {
 
 class FopenCreationExpr extends FileCreationExpr {
   FopenCreationExpr() {
-    exists(string name | name = this.getTarget().getName() |
-      name = "fopen" or
-      name = "_wfopen" or
-      name = "fsopen" or
-      name = "_wfsopen"
-    ) and
+    this.getTarget().getName() = ["fopen", "_wfopen", "fsopen", "_wfsopen"] and
     exists(string mode |
-      (mode = "w" or mode = "a") and
+      mode = ["w", "a"] and
       this.getArgument(1).getValue().matches(mode + "%")
     )
   }

cpp/ql/src/codeql-suites/cpp-lgtm-full.qls

@@ -9,10 +9,7 @@
     tags contain:
       - ide-contextual-queries/local-definitions
       - ide-contextual-queries/local-references
-- query: Metrics/Dependencies/ExternalDependencies.ql
-- query: Metrics/Dependencies/ExternalDependenciesSourceLinks.ql
 - query: Metrics/Files/FLinesOfCode.ql
 - query: Metrics/Files/FLinesOfCommentedOutCode.ql
 - query: Metrics/Files/FLinesOfComments.ql
-- query: Metrics/Files/FLinesOfDuplicatedCode.ql
 - query: Metrics/Files/FNumberOfTests.ql

cpp/ql/src/experimental/semmle/code/cpp/models/interfaces/SimpleRangeAnalysisDefinition.qll

@@ -0,0 +1,65 @@
+/**
+ * EXPERIMENTAL: The API of this module may change without notice.
+ *
+ * Provides a class for modeling `RangeSsaDefinition`s with a restricted range.
+ */
+
+import cpp
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+/**
+ * EXPERIMENTAL: The API of this class may change without notice.
+ *
+ * An SSA definition for which a range can be deduced. As with
+ * `RangeSsaDefinition` and `SsaDefinition`, instances of this class
+ * correspond to points in the program where one or more variables are defined
+ * or have their value constrained in some way.
+ *
+ * Extend this class to add functionality to the range analysis library.
+ */
+abstract class SimpleRangeAnalysisDefinition extends RangeSsaDefinition {
+  /**
+   * Holds if this `SimpleRangeAnalysisDefinition` adds range information for
+   * `v`. Because a `SimpleRangeAnalysisDefinition` is just a point in the
+   * program, it's possible that more than one variable might be defined at
+   * this point. This predicate clarifies which variable(s) should get range
+   * information from `this`.
+   *
+   * This predicate **must be overridden** to hold for any `v` that can show
+   * up in the other members of `SimpleRangeAnalysisDefinition`. Conversely,
+   * the other members **must be accurate** for any `v` in this predicate.
+   */
+  abstract predicate hasRangeInformationFor(StackVariable v);
+
+  /**
+   * Holds if `(this, v)` depends on the range of the unconverted expression
+   * `e`. This information is used to inform the range analysis about cyclic
+   * dependencies. Without this information, range analysis might work for
+   * simple cases but will go into infinite loops on complex code.
+   *
+   * For example, when modelling the definition by reference in a call to an
+   * overloaded `operator=`, written as `v = e`, the definition of `(this, v)`
+   * depends on `e`.
+   */
+  abstract predicate dependsOnExpr(StackVariable v, Expr e);
+
+  /**
+   * Gets the lower bound of the variable `v` defined by this definition.
+   *
+   * Implementations of this predicate should use
+   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
+   * recursive calls to get the bounds of their dependencies.
+   */
+  abstract float getLowerBounds(StackVariable v);
+
+  /**
+   * Gets the upper bound of the variable `v` defined by this definition.
+   *
+   * Implementations of this predicate should use
+   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
+   * recursive calls to get the bounds of their dependencies.
+   */
+  abstract float getUpperBounds(StackVariable v);
+}
+
+import SimpleRangeAnalysisInternal

cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/ExtendedRangeAnalysis.qll

@@ -2,3 +2,4 @@ import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 //
 // Import each extension we want to enable
 import extensions.SubtractSelf
+import extensions.ConstantBitwiseAndExprRange

cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/extensions/ConstantBitwiseAndExprRange.qll

@@ -0,0 +1,90 @@
+private import cpp
+private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
+private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+
+/**
+ * Holds if `e` is a constant or if it is a variable with a constant value
+ */
+float evaluateConstantExpr(Expr e) {
+  result = e.getValue().toFloat()
+  or
+  exists(SsaDefinition defn, StackVariable sv |
+    defn.getAUse(sv) = e and
+    result = defn.getDefiningValue(sv).getValue().toFloat()
+  )
+}
+
+/**
+ * The current implementation for `BitwiseAndExpr` only handles cases where both operands are
+ * either unsigned or non-negative constants. This class not only covers these cases, but also
+ * adds support for `&` expressions between a signed integer with a non-negative range and a
+ * non-negative constant. It also adds support for `&=` for the same set of cases as `&`.
+ */
+private class ConstantBitwiseAndExprRange extends SimpleRangeAnalysisExpr {
+  ConstantBitwiseAndExprRange() {
+    exists(Expr l, Expr r |
+      l = this.(BitwiseAndExpr).getLeftOperand() and
+      r = this.(BitwiseAndExpr).getRightOperand()
+      or
+      l = this.(AssignAndExpr).getLValue() and
+      r = this.(AssignAndExpr).getRValue()
+    |
+      // No operands can be negative constants
+      not (evaluateConstantExpr(l) < 0 or evaluateConstantExpr(r) < 0) and
+      // At least one operand must be a non-negative constant
+      (evaluateConstantExpr(l) >= 0 or evaluateConstantExpr(r) >= 0)
+    )
+  }
+
+  Expr getLeftOperand() {
+    result = this.(BitwiseAndExpr).getLeftOperand() or
+    result = this.(AssignAndExpr).getLValue()
+  }
+
+  Expr getRightOperand() {
+    result = this.(BitwiseAndExpr).getRightOperand() or
+    result = this.(AssignAndExpr).getRValue()
+  }
+
+  override float getLowerBounds() {
+    // If an operand can have negative values, the lower bound is unconstrained.
+    // Otherwise, the lower bound is zero.
+    exists(float lLower, float rLower |
+      lLower = getFullyConvertedLowerBounds(getLeftOperand()) and
+      rLower = getFullyConvertedLowerBounds(getRightOperand()) and
+      (
+        (lLower < 0 or rLower < 0) and
+        result = exprMinVal(this)
+        or
+        // This technically results in two lowerBounds when an operand range is negative, but
+        // that's fine since `exprMinVal(x) <= 0`. We can't use an if statement here without
+        // non-monotonic recursion issues
+        result = 0
+      )
+    )
+  }
+
+  override float getUpperBounds() {
+    // If an operand can have negative values, the upper bound is unconstrained.
+    // Otherwise, the upper bound is the minimum of the upper bounds of the operands
+    exists(float lLower, float lUpper, float rLower, float rUpper |
+      lLower = getFullyConvertedLowerBounds(getLeftOperand()) and
+      lUpper = getFullyConvertedUpperBounds(getLeftOperand()) and
+      rLower = getFullyConvertedLowerBounds(getRightOperand()) and
+      rUpper = getFullyConvertedUpperBounds(getRightOperand()) and
+      (
+        (lLower < 0 or rLower < 0) and
+        result = exprMaxVal(this)
+        or
+        // This technically results in two upperBounds when an operand range is negative, but
+        // that's fine since `exprMaxVal(b) >= result`. We can't use an if statement here without
+        // non-monotonic recursion issues
+        result = rUpper.minimum(lUpper)
+      )
+    )
+  }
+
+  override predicate dependsOnChild(Expr child) {
+    child = getLeftOperand() or child = getRightOperand()
+  }
+}

cpp/ql/src/external/DuplicateBlock.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Duplicate code
  * @description This block of code is duplicated elsewhere. If possible, the shared code should be refactored so there is only one occurrence left. It may not always be possible to address these issues; other duplicate code checks (such as duplicate function, duplicate class) give subsets of the results with higher confidence.
  * @kind problem

cpp/ql/src/external/DuplicateFunction.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Duplicate function
  * @description There is another identical implementation of this function. Extract the code to a common file or superclass or delegate to improve sharing.
  * @kind problem

cpp/ql/src/external/MostlyDuplicateClass.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Mostly duplicate class
  * @description More than 80% of the methods in this class are duplicated in another class. Create a common supertype to improve code sharing.
  * @kind problem

cpp/ql/src/external/MostlyDuplicateFile.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Mostly duplicate file
  * @description There is another file that shares a lot of the code with this file. Merge the two files to improve maintainability.
  * @kind problem

cpp/ql/src/external/MostlyDuplicateFunction.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Mostly duplicate function
  * @description There is another function that shares a lot of the code with this one. Extract the code to a common file/superclass or delegate to improve sharing.
  * @kind problem

cpp/ql/src/external/MostlySimilarFile.ql

@@ -1,4 +1,5 @@
 /**
+ * @deprecated
  * @name Mostly similar file
  * @description There is another file that shares a lot of the code with this file. Notice that names of variables and types may have been changed. Merge the two files to improve maintainability.
  * @kind problem

cpp/ql/src/jsf/4.09 Style/AV Rule 53.ql

@@ -18,6 +18,6 @@ import cpp
 
 from File f
 where
-  (f.getExtension().toLowerCase() = "h" or f.getExtension().toLowerCase() = "hpp") and
+  f.getExtension().toLowerCase() = ["h", "hpp"] and
   f.getExtension() != "h"
 select f, "AV Rule 53: Header files will always have a file name extension of .h."

cpp/ql/src/jsf/4.12 Templates/AV Rule 104.ql

@@ -21,8 +21,8 @@ import cpp
  */
 class WarningLateTemplateSpecialization extends CompilerWarning {
   WarningLateTemplateSpecialization() {
-    this.getTag() = "partial_spec_after_instantiation" or
-    this.getTag() = "partial_spec_after_instantiation_ambiguous"
+    this.getTag() =
+      ["partial_spec_after_instantiation", "partial_spec_after_instantiation_ambiguous"]
   }
 }
 

cpp/ql/src/semmle/code/cpp/Variable.qll

@@ -144,6 +144,11 @@ class Variable extends Declaration, @variable {
    */
   predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
 
+  /**
+   * Holds if this variable is declared `constinit`.
+   */
+  predicate isConstinit() { this.hasSpecifier("declared_constinit") }
+
   /**
    * Holds if this variable is `thread_local`.
    */

cpp/ql/src/semmle/code/cpp/commons/Environment.qll

@@ -29,7 +29,7 @@ private predicate readsEnvironment(Expr read, string sourceDescription) {
   exists(FunctionCall call, string name |
     read = call and
     call.getTarget().hasGlobalOrStdName(name) and
-    (name = "getenv" or name = "secure_getenv" or name = "_wgetenv") and
+    name = ["getenv", "secure_getenv", "_wgetenv"] and
     sourceDescription = name
   )
 }

cpp/ql/src/semmle/code/cpp/commons/Printf.qll

@@ -9,10 +9,7 @@ import semmle.code.cpp.models.interfaces.FormattingFunction
 import semmle.code.cpp.models.implementations.Printf
 
 class PrintfFormatAttribute extends FormatAttribute {
-  PrintfFormatAttribute() {
-    getArchetype() = "printf" or
-    getArchetype() = "__printf__"
-  }
+  PrintfFormatAttribute() { getArchetype() = ["printf", "__printf__"] }
 }
 
 /**
@@ -601,12 +598,12 @@ class FormatLiteral extends Literal {
         or
         len = "l" and result = this.getLongType()
         or
-        (len = "ll" or len = "L" or len = "q") and
+        len = ["ll", "L", "q"] and
         result instanceof LongLongType
         or
         len = "j" and result = this.getIntmax_t()
         or
-        (len = "z" or len = "Z") and
+        len = ["z", "Z"] and
         (result = this.getSize_t() or result = this.getSsize_t())
         or
         len = "t" and result = this.getPtrdiff_t()
@@ -639,12 +636,12 @@ class FormatLiteral extends Literal {
         or
         len = "l" and result = this.getLongType()
         or
-        (len = "ll" or len = "L" or len = "q") and
+        len = ["ll", "L", "q"] and
         result instanceof LongLongType
         or
         len = "j" and result = this.getIntmax_t()
         or
-        (len = "z" or len = "Z") and
+        len = ["z", "Z"] and
         (result = this.getSize_t() or result = this.getSsize_t())
         or
         len = "t" and result = this.getPtrdiff_t()
@@ -670,9 +667,7 @@ class FormatLiteral extends Literal {
   FloatingPointType getFloatingPointConversion(int n) {
     exists(string len |
       len = this.getLength(n) and
-      if len = "L" or len = "ll"
-      then result instanceof LongDoubleType
-      else result instanceof DoubleType
+      if len = ["L", "ll"] then result instanceof LongDoubleType else result instanceof DoubleType
     )
   }
 
@@ -689,7 +684,7 @@ class FormatLiteral extends Literal {
         or
         len = "l" and base = this.getLongType()
         or
-        (len = "ll" or len = "L") and
+        len = ["ll", "L"] and
         base instanceof LongLongType
         or
         len = "q" and base instanceof LongLongType
@@ -736,12 +731,12 @@ class FormatLiteral extends Literal {
     exists(string len, string conv |
       this.parseConvSpec(n, _, _, _, _, _, len, conv) and
       (
-        (conv = "c" or conv = "C") and
+        conv = ["c", "C"] and
         len = "h" and
         result instanceof PlainCharType
         or
-        (conv = "c" or conv = "C") and
-        (len = "l" or len = "w") and
+        conv = ["c", "C"] and
+        len = ["l", "w"] and
         result = getWideCharType()
         or
         conv = "c" and
@@ -781,12 +776,12 @@ class FormatLiteral extends Literal {
     exists(string len, string conv |
       this.parseConvSpec(n, _, _, _, _, _, len, conv) and
       (
-        (conv = "s" or conv = "S") and
+        conv = ["s", "S"] and
         len = "h" and
         result.(PointerType).getBaseType() instanceof PlainCharType
         or
-        (conv = "s" or conv = "S") and
-        (len = "l" or len = "w") and
+        conv = ["s", "S"] and
+        len = ["l", "w"] and
         result.(PointerType).getBaseType() = getWideCharType()
         or
         conv = "s" and
@@ -823,10 +818,7 @@ class FormatLiteral extends Literal {
 
   private Type getConversionType9(int n) {
     this.getConversionChar(n) = "Z" and
-    (
-      this.getLength(n) = "l" or
-      this.getLength(n) = "w"
-    ) and
+    this.getLength(n) = ["l", "w"] and
     exists(Type t |
       t.getName() = "UNICODE_STRING" and
       result.(PointerType).getBaseType() = t
@@ -979,10 +971,7 @@ class FormatLiteral extends Literal {
           len = (afterdot.maximum(1) + 6).maximum(1 + 1 + dot + afterdot + 1 + 1 + 3)
         ) // (e.g. "-1.59203e-319")
         or
-        (
-          this.getConversionChar(n).toLowerCase() = "d" or
-          this.getConversionChar(n).toLowerCase() = "i"
-        ) and
+        this.getConversionChar(n).toLowerCase() = ["d", "i"] and
         // e.g. -2^31 = "-2147483648"
         exists(int sizeBits |
           sizeBits =

cpp/ql/src/semmle/code/cpp/commons/Strcat.qll

@@ -8,14 +8,13 @@ import cpp
  */
 class StrcatFunction extends Function {
   StrcatFunction() {
-    exists(string name | name = getName() |
-      name = "strcat" or // strcat(dst, src)
-      name = "strncat" or // strncat(dst, src, max_amount)
-      name = "wcscat" or // wcscat(dst, src)
-      name = "_mbscat" or // _mbscat(dst, src)
-      name = "wcsncat" or // wcsncat(dst, src, max_amount)
-      name = "_mbsncat" or // _mbsncat(dst, src, max_amount)
-      name = "_mbsncat_l" // _mbsncat_l(dst, src, max_amount, locale)
-    )
+    getName() =
+      ["strcat", // strcat(dst, src)
+          "strncat", // strncat(dst, src, max_amount)
+          "wcscat", // wcscat(dst, src)
+          "_mbscat", // _mbscat(dst, src)
+          "wcsncat", // wcsncat(dst, src, max_amount)
+          "_mbsncat", // _mbsncat(dst, src, max_amount)
+          "_mbsncat_l"] // _mbsncat_l(dst, src, max_amount, locale)
   }
 }

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -167,4 +167,9 @@ module Consistency {
     not isImmutableOrUnobservable(n) and
     msg = "ArgumentNode is missing PostUpdateNode."
   }
+
+  query predicate postWithInFlow(PostUpdateNode n, string msg) {
+    simpleLocalFlowStep(_, n) and
+    msg = "PostUpdateNode should not be the target of local flow."
+  }
 }

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -1,6 +1,7 @@
 private import cpp
 private import DataFlowUtil
 private import DataFlowDispatch
+private import FlowVar
 
 /** Gets the instance argument of a non-static call. */
 private Node getInstanceArgument(Call call) {
@@ -106,7 +107,7 @@ private class ExprOutNode extends OutNode, ExprNode {
   override DataFlowCall getCall() { result = this.getExpr() }
 }
 
-private class RefOutNode extends OutNode, DefinitionByReferenceNode {
+private class RefOutNode extends OutNode, DefinitionByReferenceOrIteratorNode {
   /** Gets the underlying call. */
   override DataFlowCall getCall() { result = this.getArgument().getParent() }
 }
@@ -120,7 +121,7 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
   kind = TNormalReturnKind()
   or
   exists(int i |
-    result.asDefiningArgument() = call.getArgument(i) and
+    result.(DefinitionByReferenceOrIteratorNode).getArgument() = call.getArgument(i) and
     kind = TRefReturnKind(i)
   )
 }

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -183,28 +183,29 @@ class ImplicitParameterNode extends ParameterNode, TInstanceParameterNode {
 }
 
 /**
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference.
+ * INTERNAL: do not use.
  *
- * A typical example would be a call `f(&x)`. Firstly, there will be flow into
- * `x` from previous definitions of `x`. Secondly, there will be a
- * `DefinitionByReferenceNode` to represent the value of `x` after the call has
- * returned. This node will have its `getArgument()` equal to `&x`.
+ * A node that represents the value of a variable after a function call that
+ * may have changed the variable because it's passed by reference or because an
+ * iterator for it was passed by value or by reference.
  */
-class DefinitionByReferenceNode extends PartialDefinitionNode {
+class DefinitionByReferenceOrIteratorNode extends PartialDefinitionNode {
   Expr inner;
   Expr argument;
 
-  DefinitionByReferenceNode() {
-    this.getPartialDefinition().(DefinitionByReference).definesExpressions(inner, argument)
+  DefinitionByReferenceOrIteratorNode() {
+    this.getPartialDefinition().definesExpressions(inner, argument) and
+    (
+      this.getPartialDefinition() instanceof DefinitionByReference
+      or
+      this.getPartialDefinition() instanceof DefinitionByIterator
+    )
   }
 
   override Function getFunction() { result = inner.getEnclosingFunction() }
 
   override Type getType() { result = inner.getType() }
 
-  override string toString() { result = "ref arg " + argument.toString() }
-
   override Location getLocation() { result = argument.getLocation() }
 
   override ExprNode getPreUpdateNode() { result.getExpr() = argument }
@@ -221,6 +222,21 @@ class DefinitionByReferenceNode extends PartialDefinitionNode {
   }
 }
 
+/**
+ * A node that represents the value of a variable after a function call that
+ * may have changed the variable because it's passed by reference.
+ *
+ * A typical example would be a call `f(&x)`. Firstly, there will be flow into
+ * `x` from previous definitions of `x`. Secondly, there will be a
+ * `DefinitionByReferenceNode` to represent the value of `x` after the call has
+ * returned. This node will have its `getArgument()` equal to `&x`.
+ */
+class DefinitionByReferenceNode extends DefinitionByReferenceOrIteratorNode {
+  override VariablePartialDefinition pd;
+
+  override string toString() { result = "ref arg " + argument.toString() }
+}
+
 /**
  * The value of an uninitialized local variable, viewed as a node in a data
  * flow graph.
@@ -284,13 +300,11 @@ abstract class PostUpdateNode extends Node {
   override Location getLocation() { result = getPreUpdateNode().getLocation() }
 }
 
-private class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
+abstract private class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
   PartialDefinition pd;
 
   PartialDefinitionNode() { this = TPartialDefinitionNode(pd) }
 
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-
   override Location getLocation() { result = pd.getActualLocation() }
 
   PartialDefinition getPartialDefinition() { result = pd }
@@ -298,6 +312,24 @@ private class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNo
   override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
 }
 
+private class VariablePartialDefinitionNode extends PartialDefinitionNode {
+  override VariablePartialDefinition pd;
+
+  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A synthetic data flow node used for flow into a collection when an iterator
+ * write occurs in a callee.
+ */
+class IteratorPartialDefinitionNode extends PartialDefinitionNode {
+  override IteratorPartialDefinition pd;
+
+  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
+}
+
 /**
  * A post-update node on the `e->f` in `f(&e->f)` (and other forms).
  */

cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll

@@ -6,6 +6,7 @@ import cpp
 private import semmle.code.cpp.controlflow.SSA
 private import semmle.code.cpp.dataflow.internal.SubBasicBlocks
 private import semmle.code.cpp.dataflow.internal.AddressFlow
+private import semmle.code.cpp.models.implementations.Iterator
 
 /**
  * A conceptual variable that is assigned only once, like an SSA variable. This
@@ -108,21 +109,12 @@ class FlowVar extends TFlowVar {
  * ```
  */
 private module PartialDefinitions {
-  class PartialDefinition extends Expr {
-    Expr innerDefinedExpr;
+  abstract class PartialDefinition extends Expr {
     ControlFlowNode node;
 
-    PartialDefinition() {
-      exists(Expr convertedInner |
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted() and
-        not this instanceof Conversion
-      )
-    }
+    abstract deprecated predicate partiallyDefines(Variable v);
 
-    deprecated predicate partiallyDefines(Variable v) { innerDefinedExpr = v.getAnAccess() }
-
-    deprecated predicate partiallyDefinesThis(ThisExpr e) { innerDefinedExpr = e }
+    abstract deprecated predicate partiallyDefinesThis(ThisExpr e);
 
     /**
      * Gets the subBasicBlock where this `PartialDefinition` is defined.
@@ -133,11 +125,9 @@ private module PartialDefinitions {
      * Holds if this `PartialDefinition` defines variable `v` at control-flow
      * node `cfn`.
      */
+    // does this work with a dispred?
     pragma[noinline]
-    predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn) {
-      innerDefinedExpr = v.getAnAccess() and
-      cfn = node
-    }
+    abstract predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn);
 
     /**
      * Holds if this partial definition may modify `inner` (or what it points
@@ -147,10 +137,7 @@ private module PartialDefinitions {
      * - `inner` = `... .x`, `outer` = `&...`
      * - `inner` = `a`, `outer` = `*`
      */
-    predicate definesExpressions(Expr inner, Expr outer) {
-      inner = innerDefinedExpr and
-      outer = this
-    }
+    abstract predicate definesExpressions(Expr inner, Expr outer);
 
     /**
      * Gets the location of this element, adjusted to avoid unknown locations
@@ -166,10 +153,107 @@ private module PartialDefinitions {
     }
   }
 
+  class IteratorPartialDefinition extends PartialDefinition {
+    Variable collection;
+    Expr innerDefinedExpr;
+
+    IteratorPartialDefinition() {
+      exists(Expr convertedInner |
+        not this instanceof Conversion and
+        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
+        innerDefinedExpr = convertedInner.getUnconverted() and
+        (
+          innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
+          or
+          innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
+          collection instanceof IteratorParameter
+        ) and
+        innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
+      )
+      or
+      // iterators passed by value without a copy constructor
+      exists(Call call |
+        call = node and
+        call.getAnArgument() = innerDefinedExpr and
+        innerDefinedExpr = this and
+        this = getAnIteratorAccess(collection) and
+        not call.getTarget() instanceof IteratorPointerDereferenceMemberOperator
+      )
+      or
+      // iterators passed by value with a copy constructor
+      exists(Call call, ConstructorCall copy |
+        copy.getTarget() instanceof CopyConstructor and
+        call = node and
+        call.getAnArgument() = copy and
+        copy.getArgument(0) = getAnIteratorAccess(collection) and
+        innerDefinedExpr = this and
+        this = copy and
+        not call.getTarget() instanceof IteratorPointerDereferenceMemberOperator
+      )
+    }
+
+    deprecated override predicate partiallyDefines(Variable v) { v = collection }
+
+    deprecated override predicate partiallyDefinesThis(ThisExpr e) { none() }
+
+    override predicate definesExpressions(Expr inner, Expr outer) {
+      inner = innerDefinedExpr and
+      outer = this
+    }
+
+    override predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn) {
+      v = collection and
+      cfn = node
+    }
+  }
+
+  class VariablePartialDefinition extends PartialDefinition {
+    Expr innerDefinedExpr;
+
+    VariablePartialDefinition() {
+      not this instanceof Conversion and
+      exists(Expr convertedInner |
+        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
+        innerDefinedExpr = convertedInner.getUnconverted()
+      )
+    }
+
+    deprecated override predicate partiallyDefines(Variable v) {
+      innerDefinedExpr = v.getAnAccess()
+    }
+
+    deprecated override predicate partiallyDefinesThis(ThisExpr e) { innerDefinedExpr = e }
+
+    /**
+     * Holds if this partial definition may modify `inner` (or what it points
+     * to) through `outer`. These expressions will never be `Conversion`s.
+     *
+     * For example, in `f(& (*a).x)`, there are two results:
+     * - `inner` = `... .x`, `outer` = `&...`
+     * - `inner` = `a`, `outer` = `*`
+     */
+    override predicate definesExpressions(Expr inner, Expr outer) {
+      inner = innerDefinedExpr and
+      outer = this
+    }
+
+    override predicate partiallyDefinesVariableAt(Variable v, ControlFlowNode cfn) {
+      innerDefinedExpr = v.getAnAccess() and
+      cfn = node
+    }
+  }
+
+  /**
+   * A partial definition that's a definition via an output iterator.
+   */
+  class DefinitionByIterator extends IteratorPartialDefinition {
+    DefinitionByIterator() { exists(Call c | this = c.getAnArgument() or this = c.getQualifier()) }
+  }
+
   /**
    * A partial definition that's a definition by reference.
    */
-  class DefinitionByReference extends PartialDefinition {
+  class DefinitionByReference extends VariablePartialDefinition {
     DefinitionByReference() { exists(Call c | this = c.getAnArgument() or this = c.getQualifier()) }
   }
 }
@@ -211,7 +295,8 @@ module FlowVar_internal {
     // The SSA library has a theoretically accurate treatment of reference types,
     // treating them as immutable, but for data flow it gives better results in
     // practice to make the variable synonymous with its contents.
-    not v.getUnspecifiedType() instanceof ReferenceType
+    not v.getUnspecifiedType() instanceof ReferenceType and
+    not v instanceof IteratorParameter
   }
 
   /**
@@ -240,7 +325,7 @@ module FlowVar_internal {
       (
         initializer(v, sbb.getANode())
         or
-        assignmentLikeOperation(sbb, v, _, _)
+        assignmentLikeOperation(sbb, v, _)
         or
         exists(PartialDefinition p | p.partiallyDefinesVariableAt(v, sbb))
         or
@@ -359,7 +444,7 @@ module FlowVar_internal {
     }
 
     override predicate definedByExpr(Expr e, ControlFlowNode node) {
-      assignmentLikeOperation(node, v, _, e) and
+      assignmentLikeOperation(node, v, e) and
       node = sbb
       or
       // We pick the defining `ControlFlowNode` of an `Initializer` to be its
@@ -449,7 +534,7 @@ module FlowVar_internal {
     pragma[noinline]
     private Variable getAVariableAssignedInLoop() {
       exists(BasicBlock bbAssign |
-        assignmentLikeOperation(bbAssign.getANode(), result, _, _) and
+        assignmentLikeOperation(bbAssign.getANode(), result, _) and
         this.bbInLoop(bbAssign)
       )
     }
@@ -487,7 +572,7 @@ module FlowVar_internal {
 
   pragma[noinline]
   private predicate assignsToVar(BasicBlock bb, Variable v) {
-    assignmentLikeOperation(bb.getANode(), v, _, _) and
+    assignmentLikeOperation(bb.getANode(), v, _) and
     exists(AlwaysTrueUponEntryLoop loop | v = loop.getARelevantVariable())
   }
 
@@ -524,7 +609,7 @@ module FlowVar_internal {
       result = mid.getASuccessor() and
       variableLiveInSBB(result, v) and
       forall(AlwaysTrueUponEntryLoop loop | skipLoop(mid, result, v, loop) | loop.sbbInLoop(sbbDef)) and
-      not assignmentLikeOperation(result, v, _, _)
+      not assignmentLikeOperation(result, v, _)
     )
   }
 
@@ -560,13 +645,15 @@ module FlowVar_internal {
       refType = p.getUnderlyingType() and
       not refType.getBaseType().isConst()
     )
+    or
+    p instanceof IteratorParameter
   }
 
   /**
    * Holds if liveness of `v` should stop propagating backwards from `sbb`.
    */
   private predicate variableNotLiveBefore(SubBasicBlock sbb, Variable v) {
-    assignmentLikeOperation(sbb, v, _, _)
+    assignmentLikeOperation(sbb, v, _)
     or
     // Liveness of `v` is killed when going backwards from a block that declares it
     exists(DeclStmt ds | ds.getADeclaration().(LocalVariable) = v and sbb.contains(ds))
@@ -686,21 +773,17 @@ module FlowVar_internal {
    * `node instanceof Initializer` is covered by `initializer` instead of this
    * predicate.
    */
-  predicate assignmentLikeOperation(
-    ControlFlowNode node, Variable v, VariableAccess va, Expr assignedExpr
-  ) {
+  predicate assignmentLikeOperation(ControlFlowNode node, Variable v, Expr assignedExpr) {
     // Together, the two following cases cover `Assignment`
     node =
       any(AssignExpr ae |
-        va = ae.getLValue() and
-        v = va.getTarget() and
+        v.getAnAccess() = ae.getLValue() and
         assignedExpr = ae.getRValue()
       )
     or
     node =
       any(AssignOperation ao |
-        va = ao.getLValue() and
-        v = va.getTarget() and
+        v.getAnAccess() = ao.getLValue() and
         // Here and in the `PrefixCrementOperation` case, we say that the assigned
         // expression is the operation itself. For example, we say that `x += 1`
         // assigns `x += 1` to `x`. The justification is that after this operation,
@@ -712,12 +795,24 @@ module FlowVar_internal {
     // `PrefixCrementOperation` is itself a source
     node =
       any(CrementOperation op |
-        va = op.getOperand() and
-        v = va.getTarget() and
+        v.getAnAccess() = op.getOperand() and
         assignedExpr = op
       )
   }
 
+  Expr getAnIteratorAccess(Variable collection) {
+    exists(Call c, SsaDefinition def, Variable iterator |
+      c.getQualifier() = collection.getAnAccess() and
+      c.getTarget() instanceof BeginOrEndFunction and
+      def.getAnUltimateDefiningValue(iterator) = c and
+      result = def.getAUse(iterator)
+    )
+  }
+
+  class IteratorParameter extends Parameter {
+    IteratorParameter() { this.getUnspecifiedType() instanceof Iterator }
+  }
+
   /**
    * Holds if `v` is initialized to have value `assignedExpr`.
    */
@@ -749,7 +844,7 @@ module FlowVar_internal {
   class DataFlowSubBasicBlockCutNode extends SubBasicBlockCutNode {
     DataFlowSubBasicBlockCutNode() {
       exists(Variable v | not fullySupportedSsaVariable(v) |
-        assignmentLikeOperation(this, v, _, _)
+        assignmentLikeOperation(this, v, _)
         or
         exists(PartialDefinition p | p.partiallyDefinesVariableAt(v, this))
         // It is not necessary to cut the basic blocks at `Initializer` nodes

cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

@@ -10,6 +10,7 @@
 
 private import semmle.code.cpp.models.interfaces.DataFlow
 private import semmle.code.cpp.models.interfaces.Taint
+private import semmle.code.cpp.models.interfaces.Iterator
 
 private module DataFlow {
   import semmle.code.cpp.dataflow.internal.DataFlowUtil
@@ -255,4 +256,12 @@ private predicate exprToPartialDefinitionStep(Expr exprIn, Expr exprOut) {
       exprIn = call.getArgument(argInIndex)
     )
   )
+  or
+  exists(Assignment a |
+    iteratorDereference(exprOut) and
+    a.getLValue() = exprOut and
+    a.getRValue() = exprIn
+  )
 }
+
+private predicate iteratorDereference(Call c) { c.getTarget() instanceof IteratorReferenceFunction }

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -167,4 +167,9 @@ module Consistency {
     not isImmutableOrUnobservable(n) and
     msg = "ArgumentNode is missing PostUpdateNode."
   }
+
+  query predicate postWithInFlow(PostUpdateNode n, string msg) {
+    simpleLocalFlowStep(_, n) and
+    msg = "PostUpdateNode should not be the target of local flow."
+  }
 }

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -5,37 +5,60 @@ private import DataFlowDispatch
 
 /**
  * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Instance arguments (`this` pointer) are also included.
+ * to the callable. Instance arguments (`this` pointer) and read side effects
+ * on parameters are also included.
  */
-class ArgumentNode extends InstructionNode {
-  ArgumentNode() {
-    exists(CallInstruction call |
-      instr = call.getAnArgument()
-      or
-      instr.(ReadSideEffectInstruction).getPrimaryInstruction() = call
-    )
-  }
-
+abstract class ArgumentNode extends OperandNode {
   /**
    * Holds if this argument occurs at the given position in the given call.
    * The instance argument is considered to have index `-1`.
    */
-  predicate argumentOf(DataFlowCall call, int pos) {
-    instr = call.getPositionalArgument(pos)
-    or
-    instr = call.getThisArgument() and pos = -1
-    or
-    exists(ReadSideEffectInstruction read |
-      read = instr and
-      read.getPrimaryInstruction() = call and
-      pos = getArgumentPosOfSideEffect(read.getIndex())
-    )
-  }
+  abstract predicate argumentOf(DataFlowCall call, int pos);
 
   /** Gets the call in which this node is an argument. */
   DataFlowCall getCall() { this.argumentOf(result, _) }
 }
 
+/**
+ * A data flow node that occurs as the argument to a call, or an
+ * implicit `this` pointer argument.
+ */
+private class PrimaryArgumentNode extends ArgumentNode {
+  override ArgumentOperand op;
+
+  PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
+
+  override predicate argumentOf(DataFlowCall call, int pos) {
+    op = call.getPositionalArgumentOperand(pos)
+    or
+    op = call.getThisArgumentOperand() and pos = -1
+  }
+
+  override string toString() {
+    result = "Argument " + op.(PositionalArgumentOperand).getIndex()
+    or
+    op instanceof ThisArgumentOperand and result = "This argument"
+  }
+}
+
+/**
+ * A data flow node representing the read side effect of a call on a
+ * specific parameter.
+ */
+private class SideEffectArgumentNode extends ArgumentNode {
+  override SideEffectOperand op;
+  ReadSideEffectInstruction read;
+
+  SideEffectArgumentNode() { op = read.getSideEffectOperand() }
+
+  override predicate argumentOf(DataFlowCall call, int pos) {
+    read.getPrimaryInstruction() = call and
+    pos = getArgumentPosOfSideEffect(read.getIndex())
+  }
+
+  override string toString() { result = "Argument " + read.getIndex() + " indirection" }
+}
+
 private newtype TReturnKind =
   TNormalReturnKind() or
   TIndirectReturnKind(ParameterIndex index)

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -505,18 +505,6 @@ class DefinitionByReferenceNode extends InstructionNode {
   }
 }
 
-/**
- * A node representing the memory pointed to by a function argument.
- *
- * This class exists only in order to override `toString`, which would
- * otherwise be the default implementation inherited from `InstructionNode`.
- */
-private class ArgumentIndirectionNode extends InstructionNode {
-  override ReadSideEffectInstruction instr;
-
-  override string toString() { result = "Argument " + instr.getIndex() + " indirection" }
-}
-
 /**
  * A `Node` corresponding to a variable in the program, as opposed to the
  * value of that variable at some particular point. This can be used for
@@ -680,10 +668,6 @@ private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo
   or
   iTo.(PhiInstruction).getAnInputOperand() = opFrom
   or
-  // A read side effect is almost never exact since we don't know exactly how
-  // much memory the callee will read.
-  iTo.(ReadSideEffectInstruction).getSideEffectOperand() = opFrom
-  or
   // Treat all conversions as flow, even conversions between different numeric types.
   iTo.(ConvertInstruction).getUnaryOperand() = opFrom
   or

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll

@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
 }
 
 /**
- * A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
+ * An operand of an `Instruction`. The operand represents a use of the result of one instruction
+ * (the defining instruction) in another instruction (the use instruction)
  */
 class Operand extends TOperand {
   /** Gets a textual representation of this element. */

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -133,6 +133,12 @@ abstract class MemoryLocation extends TMemoryLocation {
   predicate isAlwaysAllocatedOnStack() { none() }
 }
 
+/**
+ * Represents a set of `MemoryLocation`s that cannot overlap with
+ * `MemoryLocation`s outside of the set. The `VirtualVariable` will be
+ * represented by a `MemoryLocation` that totally overlaps all other
+ * `MemoryLocations` in the set.
+ */
 abstract class VirtualVariable extends MemoryLocation { }
 
 abstract class AllocationMemoryLocation extends MemoryLocation {

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll

@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
 }
 
 /**
- * A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
+ * An operand of an `Instruction`. The operand represents a use of the result of one instruction
+ * (the defining instruction) in another instruction (the use instruction)
  */
 class Operand extends TOperand {
   /** Gets a textual representation of this element. */

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll

@@ -79,7 +79,8 @@ private PhiOperandBase phiOperand(
 }
 
 /**
- * A source operand of an `Instruction`. The operand represents a value consumed by the instruction.
+ * An operand of an `Instruction`. The operand represents a use of the result of one instruction
+ * (the defining instruction) in another instruction (the use instruction)
  */
 class Operand extends TOperand {
   /** Gets a textual representation of this element. */

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll

@@ -59,6 +59,12 @@ class MemoryLocation extends TMemoryLocation {
   final string getUniqueId() { result = var.getUniqueId() }
 }
 
+/**
+ * Represents a set of `MemoryLocation`s that cannot overlap with
+ * `MemoryLocation`s outside of the set. The `VirtualVariable` will be
+ * represented by a `MemoryLocation` that totally overlaps all other
+ * `MemoryLocations` in the set.
+ */
 class VirtualVariable extends MemoryLocation { }
 
 /** A virtual variable that groups all escaped memory within a function. */

cpp/ql/src/semmle/code/cpp/ir/internal/Overlap.qll

@@ -3,18 +3,33 @@ private newtype TOverlap =
   TMustTotallyOverlap() or
   TMustExactlyOverlap()
 
+/**
+ * Represents a possible overlap between two memory ranges.
+ */
 abstract class Overlap extends TOverlap {
   abstract string toString();
 }
 
+/**
+ * Represents a partial overlap between two memory ranges, which may or may not
+ * actually occur in practice.
+ */
 class MayPartiallyOverlap extends Overlap, TMayPartiallyOverlap {
   final override string toString() { result = "MayPartiallyOverlap" }
 }
 
+/**
+ * Represents an overlap in which the first memory range is known to include all
+ * bits of the second memory range, but may be larger or have a different type.
+ */
 class MustTotallyOverlap extends Overlap, TMustTotallyOverlap {
   final override string toString() { result = "MustTotallyOverlap" }
 }
 
+/**
+ * Represents an overlap between two memory ranges that have the same extent and
+ * the same type.
+ */
 class MustExactlyOverlap extends Overlap, TMustExactlyOverlap {
   final override string toString() { result = "MustExactlyOverlap" }
 }

cpp/ql/src/semmle/code/cpp/models/Models.qll

@@ -15,6 +15,9 @@ private import implementations.Strcpy
 private import implementations.Strdup
 private import implementations.Strftime
 private import implementations.StdContainer
+private import implementations.StdPair
+private import implementations.StdMap
+private import implementations.StdSet
 private import implementations.StdString
 private import implementations.Swap
 private import implementations.GetDelim

cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll

@@ -16,11 +16,10 @@ import semmle.code.cpp.models.interfaces.FlowSource
 class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
   SideEffectFunction, RemoteFlowFunction {
   GetsFunction() {
-    exists(string name | hasGlobalOrStdName(name) |
-      name = "gets" or // gets(str)
-      name = "fgets" or // fgets(str, num, stream)
-      name = "fgetws" // fgetws(wstr, num, stream)
-    )
+    // gets(str)
+    // fgets(str, num, stream)
+    // fgetws(wstr, num, stream)
+    hasGlobalOrStdName(["gets", "fgets", "fgetws"])
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {

cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll

@@ -4,16 +4,13 @@ import semmle.code.cpp.models.interfaces.DataFlow
 import semmle.code.cpp.models.interfaces.SideEffect
 
 /**
- * The standard function templates `std::move` and `std::identity`
+ * The standard function templates `std::move` and `std::forward`.
  */
 class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFunction {
   IdentityFunction() {
     this.getNamespace().getParentNamespace() instanceof GlobalNamespace and
     this.getNamespace().getName() = "std" and
-    (
-      this.getName() = "move" or
-      this.getName() = "forward"
-    )
+    this.getName() = ["move", "forward"]
   }
 
   override predicate hasOnlySpecificReadSideEffects() { any() }

cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll

@@ -8,6 +8,7 @@
 import cpp
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Iterator
 
 /**
  * An instantiation of the `std::iterator_traits` template.
@@ -80,7 +81,7 @@ private FunctionInput getIteratorArgumentInput(Operator op, int index) {
 /**
  * A non-member prefix `operator*` function for an iterator type.
  */
-class IteratorPointerDereferenceOperator extends Operator, TaintFunction {
+class IteratorPointerDereferenceOperator extends Operator, TaintFunction, IteratorReferenceFunction {
   FunctionInput iteratorInput;
 
   IteratorPointerDereferenceOperator() {
@@ -169,7 +170,8 @@ class IteratorAssignArithmeticOperator extends Operator, DataFlowFunction, Taint
 /**
  * A prefix `operator*` member function for an iterator type.
  */
-class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunction {
+class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunction,
+  IteratorReferenceFunction {
   IteratorPointerDereferenceMemberOperator() {
     this.hasName("operator*") and
     this.getDeclaringType() instanceof Iterator
@@ -260,7 +262,7 @@ class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFun
 /**
  * An `operator[]` member function of an iterator class.
  */
-class IteratorArrayMemberOperator extends MemberFunction, TaintFunction {
+class IteratorArrayMemberOperator extends MemberFunction, TaintFunction, IteratorReferenceFunction {
   IteratorArrayMemberOperator() {
     this.hasName("operator[]") and
     this.getDeclaringType() instanceof Iterator
@@ -271,3 +273,21 @@ class IteratorArrayMemberOperator extends MemberFunction, TaintFunction {
     output.isReturnValue()
   }
 }
+
+/**
+ * A `begin` or `end` member function, or a related member function, that
+ * returns an iterator.
+ */
+class BeginOrEndFunction extends MemberFunction, TaintFunction {
+  BeginOrEndFunction() {
+    this
+        .hasName(["begin", "cbegin", "rbegin", "crbegin", "end", "cend", "rend", "crend",
+              "before_begin", "cbefore_begin"]) and
+    this.getType().getUnspecifiedType() instanceof Iterator
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll

@@ -170,26 +170,6 @@ class StdSequenceContainerAssign extends TaintFunction {
   }
 }
 
-/**
- * The standard container `begin` and `end` functions and their
- * variants.
- */
-class StdSequenceContainerBeginEnd extends TaintFunction {
-  StdSequenceContainerBeginEnd() {
-    this
-        .hasQualifiedName("std", ["array", "vector", "deque", "list"],
-          ["begin", "cbegin", "rbegin", "crbegin", "end", "cend", "rend", "crend"]) or
-    this
-        .hasQualifiedName("std", "forward_list",
-          ["before_begin", "begin", "end", "cbefore_begin", "cbegin", "cend"])
-  }
-
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierObject() and
-    output.isReturnValue()
-  }
-}
-
 /**
  * The standard container `swap` functions.
  */

cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll

@@ -0,0 +1,192 @@
+/**
+ * Provides models for C++ containers `std::map` and `std::unordered_map`.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.implementations.Iterator
+
+/**
+ * Additional model for map constructors using iterator inputs.
+ */
+class StdMapConstructor extends Constructor, TaintFunction {
+  StdMapConstructor() {
+    this.hasQualifiedName("std", "map", "map") or
+    this.hasQualifiedName("std", "unordered_map", "unordered_map")
+  }
+
+  /**
+   * Gets the index of a parameter to this function that is an iterator.
+   */
+  int getAnIteratorParameterIndex() {
+    getParameter(result).getUnspecifiedType() instanceof Iterator
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // taint flow from any parameter of an iterator type to the qualifier
+    input.isParameterDeref(getAnIteratorParameterIndex()) and
+    (
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
+      or
+      output.isQualifierObject()
+    )
+  }
+}
+
+/**
+ * The standard map `insert` and `insert_or_assign` functions.
+ */
+class StdMapInsert extends TaintFunction {
+  StdMapInsert() {
+    this.hasQualifiedName("std", ["map", "unordered_map"], ["insert", "insert_or_assign"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from last parameter to qualifier and return value
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameterDeref(getNumberOfParameters() - 1) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+  }
+}
+
+/**
+ * The standard map `emplace` and `emplace_hint` functions.
+ */
+class StdMapEmplace extends TaintFunction {
+  StdMapEmplace() {
+    this.hasQualifiedName("std", ["map", "unordered_map"], ["emplace", "emplace_hint"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from the last parameter (which may be the value part used to
+    // construct a pair, or a pair to be copied / moved) to the qualifier and
+    // return value.
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameterDeref(getNumberOfParameters() - 1) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `try_emplace` function.
+ */
+class StdMapTryEmplace extends TaintFunction {
+  StdMapTryEmplace() { this.hasQualifiedName("std", ["map", "unordered_map"], "try_emplace") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from any parameter apart from the key to qualifier and return value
+    // (here we assume taint flow from any constructor parameter to the constructed object)
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    exists(int arg | arg = [1 .. getNumberOfParameters() - 1] |
+      (
+        not getUnspecifiedType() instanceof Iterator or
+        arg != 1
+      ) and
+      input.isParameterDeref(arg)
+    ) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `swap` function.
+ */
+class StdMapSwap extends TaintFunction {
+  StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.swap(container2)
+    input.isQualifierObject() and
+    output.isParameterDeref(0)
+    or
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
+/**
+ * The standard map `merge` function.
+ */
+class StdMapMerge extends TaintFunction {
+  StdMapMerge() { this.hasQualifiedName("std", ["map", "unordered_map"], "merge") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.merge(container2)
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
+/**
+ * The standard map functions `at` and `operator[]`.
+ */
+class StdMapAt extends TaintFunction {
+  StdMapAt() { this.hasQualifiedName("std", ["map", "unordered_map"], ["at", "operator[]"]) }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to referenced return value
+    input.isQualifierObject() and
+    output.isReturnValueDeref()
+    or
+    // reverse flow from returned reference to the qualifier
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
+  }
+}
+
+/**
+ * The standard map `find` function.
+ */
+class StdMapFind extends TaintFunction {
+  StdMapFind() { this.hasQualifiedName("std", ["map", "unordered_map"], "find") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `erase` function.
+ */
+class StdMapErase extends TaintFunction {
+  StdMapErase() { this.hasQualifiedName("std", ["map", "unordered_map"], "erase") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to iterator return value
+    getType().getUnderlyingType() instanceof Iterator and
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `lower_bound`, `upper_bound` and `equal_range` functions.
+ */
+class StdMapEqualRange extends TaintFunction {
+  StdMapEqualRange() {
+    this
+        .hasQualifiedName("std", ["map", "unordered_map"],
+          ["lower_bound", "upper_bound", "equal_range"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to return value
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll

@@ -0,0 +1,48 @@
+/**
+ * Provides models for the C++ `std::pair` class.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+
+/**
+ * Additional model for `std::pair` constructors.
+ */
+class StdPairConstructor extends Constructor, TaintFunction {
+  StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
+
+  /**
+   * Gets the index of a parameter to this function that is a reference to
+   * either value type of the pair.
+   */
+  int getAValueTypeParameterIndex() {
+    getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
+      getDeclaringType().getTemplateArgument(_).(Type).getUnspecifiedType() // i.e. the `T1` or `T2` of this `std::pair<T1, T2>`
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // taint flow from second parameter of a value type to the qualifier
+    getAValueTypeParameterIndex() = 1 and
+    input.isParameterDeref(1) and
+    (
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
+      or
+      output.isQualifierObject()
+    )
+  }
+}
+
+/**
+ * The standard pair `swap` function.
+ */
+class StdPairSwap extends TaintFunction {
+  StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.swap(container2)
+    input.isQualifierObject() and
+    output.isParameterDeref(0)
+    or
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll

@@ -0,0 +1,145 @@
+/**
+ * Provides models for C++ containers `std::set` and `std::unordered_set`.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.implementations.Iterator
+
+/**
+ * Additional model for set constructors using iterator inputs.
+ */
+class StdSetConstructor extends Constructor, TaintFunction {
+  StdSetConstructor() {
+    this.hasQualifiedName("std", "set", "set") or
+    this.hasQualifiedName("std", "unordered_set", "unordered_set")
+  }
+
+  /**
+   * Gets the index of a parameter to this function that is an iterator.
+   */
+  int getAnIteratorParameterIndex() {
+    getParameter(result).getUnspecifiedType() instanceof Iterator
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // taint flow from any parameter of an iterator type to the qualifier
+    input.isParameterDeref(getAnIteratorParameterIndex()) and
+    (
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
+      or
+      output.isQualifierObject()
+    )
+  }
+}
+
+/**
+ * The standard set `insert` and `insert_or_assign` functions.
+ */
+class StdSetInsert extends TaintFunction {
+  StdSetInsert() { this.hasQualifiedName("std", ["set", "unordered_set"], "insert") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from last parameter to qualifier and return value
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameterDeref(getNumberOfParameters() - 1) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+  }
+}
+
+/**
+ * The standard set `emplace` and `emplace_hint` functions.
+ */
+class StdSetEmplace extends TaintFunction {
+  StdSetEmplace() {
+    this.hasQualifiedName("std", ["set", "unordered_set"], ["emplace", "emplace_hint"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from any parameter to qualifier and return value
+    // (here we assume taint flow from any constructor parameter to the constructed object)
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameter([0 .. getNumberOfParameters() - 1]) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard set `swap` functions.
+ */
+class StdSetSwap extends TaintFunction {
+  StdSetSwap() { this.hasQualifiedName("std", ["set", "unordered_set"], "swap") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.swap(container2)
+    input.isQualifierObject() and
+    output.isParameterDeref(0)
+    or
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
+/**
+ * The standard set `merge` function.
+ */
+class StdSetMerge extends TaintFunction {
+  StdSetMerge() { this.hasQualifiedName("std", ["set", "unordered_set"], "merge") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.merge(container2)
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
+/**
+ * The standard set `find` function.
+ */
+class StdSetFind extends TaintFunction {
+  StdSetFind() { this.hasQualifiedName("std", ["set", "unordered_set"], "find") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard set `erase` function.
+ */
+class StdSetErase extends TaintFunction {
+  StdSetErase() { this.hasQualifiedName("std", ["set", "unordered_set"], "erase") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to iterator return value
+    getType().getUnderlyingType() instanceof Iterator and
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard set `lower_bound`, `upper_bound` and `equal_range` functions.
+ */
+class StdSetEqualRange extends TaintFunction {
+  StdSetEqualRange() {
+    this
+        .hasQualifiedName("std", ["set", "unordered_set"],
+          ["lower_bound", "upper_bound", "equal_range"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to return value
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll

@@ -216,23 +216,6 @@ class StdStringAssign extends TaintFunction {
   }
 }
 
-/**
- * The standard functions `std::string.begin` and `std::string.end` and their
- * variants.
- */
-class StdStringBeginEnd extends TaintFunction {
-  StdStringBeginEnd() {
-    this
-        .hasQualifiedName("std", "basic_string",
-          ["begin", "cbegin", "rbegin", "crbegin", "end", "cend", "rend", "crend"])
-  }
-
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    input.isQualifierObject() and
-    output.isReturnValue()
-  }
-}
-
 /**
  * The standard function `std::string.copy`.
  */

cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll

@@ -13,43 +13,24 @@ import semmle.code.cpp.models.interfaces.SideEffect
  */
 class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, SideEffectFunction {
   StrcpyFunction() {
-    exists(string name | name = getName() |
-      // strcpy(dst, src)
-      name = "strcpy"
-      or
-      // wcscpy(dst, src)
-      name = "wcscpy"
-      or
-      // _mbscpy(dst, src)
-      name = "_mbscpy"
-      or
-      (
-        name = "strcpy_s" or // strcpy_s(dst, max_amount, src)
-        name = "wcscpy_s" or // wcscpy_s(dst, max_amount, src)
-        name = "_mbscpy_s" // _mbscpy_s(dst, max_amount, src)
-      ) and
-      // exclude the 2-parameter template versions
-      // that find the size of a fixed size destination buffer.
-      getNumberOfParameters() = 3
-      or
-      // strncpy(dst, src, max_amount)
-      name = "strncpy"
-      or
-      // _strncpy_l(dst, src, max_amount, locale)
-      name = "_strncpy_l"
-      or
-      // wcsncpy(dst, src, max_amount)
-      name = "wcsncpy"
-      or
-      // _wcsncpy_l(dst, src, max_amount, locale)
-      name = "_wcsncpy_l"
-      or
-      // _mbsncpy(dst, src, max_amount)
-      name = "_mbsncpy"
-      or
-      // _mbsncpy_l(dst, src, max_amount, locale)
-      name = "_mbsncpy_l"
-    )
+    getName() =
+      ["strcpy", // strcpy(dst, src)
+          "wcscpy", // wcscpy(dst, src)
+          "_mbscpy", // _mbscpy(dst, src)
+          "strncpy", // strncpy(dst, src, max_amount)
+          "_strncpy_l", // _strncpy_l(dst, src, max_amount, locale)
+          "wcsncpy", // wcsncpy(dst, src, max_amount)
+          "_wcsncpy_l", // _wcsncpy_l(dst, src, max_amount, locale)
+          "_mbsncpy", // _mbsncpy(dst, src, max_amount)
+          "_mbsncpy_l"] // _mbsncpy_l(dst, src, max_amount, locale)
+    or
+    getName() =
+      ["strcpy_s", // strcpy_s(dst, max_amount, src)
+          "wcscpy_s", // wcscpy_s(dst, max_amount, src)
+          "_mbscpy_s"] and // _mbscpy_s(dst, max_amount, src)
+    // exclude the 2-parameter template versions
+    // that find the size of a fixed size destination buffer.
+    getNumberOfParameters() = 3
   }
 
   /**

cpp/ql/src/semmle/code/cpp/models/interfaces/Iterator.qll

@@ -0,0 +1,17 @@
+/**
+ * Provides an abstract class for accurate modeling of flow through output
+ * iterators.  To use this QL library, create a QL class extending
+ * `IteratorReferenceFunction` with a characteristic predicate that selects the
+ * function or set of functions you are modeling. Within that class, override
+ * the predicates provided by `AliasFunction` to match the flow within that
+ * function.
+ */
+
+import cpp
+import semmle.code.cpp.models.Models
+
+/**
+ * A function which takes an iterator argument and returns a reference that
+ * can be used to write to the iterator's underlying collection.
+ */
+abstract class IteratorReferenceFunction extends Function { }

cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -45,6 +45,7 @@
 import cpp
 private import RangeAnalysisUtils
 private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
+private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisDefinition
 import RangeSSA
 import SimpleRangeAnalysisCached
 private import NanAnalysis
@@ -335,6 +336,11 @@ private predicate defDependsOnDef(
   or
   // Phi nodes.
   phiDependsOnDef(def, v, srcDef, srcVar)
+  or
+  // Extensions
+  exists(Expr expr | def.(SimpleRangeAnalysisDefinition).dependsOnExpr(v, expr) |
+    exprDependsOnDef(expr, srcDef, srcVar)
+  )
 }
 
 /**
@@ -454,6 +460,39 @@ private predicate isRecursiveDef(RangeSsaDefinition def, StackVariable v) {
   defDependsOnDefTransitively(def, v, def, v)
 }
 
+/**
+ * Holds if the bounds of `e` depend on a recursive definition, meaning that
+ * `e` is likely to have many candidate bounds during the main recursion.
+ */
+private predicate isRecursiveExpr(Expr e) {
+  exists(RangeSsaDefinition def, StackVariable v | exprDependsOnDef(e, def, v) |
+    isRecursiveDef(def, v)
+  )
+}
+
+/**
+ * Holds if `binop` is a binary operation that's likely to be assigned a
+ * quadratic (or more) number of candidate bounds during the analysis. This can
+ * happen when two conditions are satisfied:
+ * 1. It is likely there are many more candidate bounds for `binop` than for
+ *    its operands. For example, the number of candidate bounds for `x + y`,
+ *    denoted here nbounds(`x + y`), will be O(nbounds(`x`) * nbounds(`y`)).
+ *    In contrast, nbounds(`b ? x : y`) is only O(nbounds(`x`) + nbounds(`y`)).
+ * 2. Both operands of `binop` are recursively determined and are therefore
+ *    likely to have a large number of candidate bounds.
+ */
+private predicate isRecursiveBinary(BinaryOperation binop) {
+  (
+    binop instanceof UnsignedMulExpr
+    or
+    binop instanceof AddExpr
+    or
+    binop instanceof SubExpr
+  ) and
+  isRecursiveExpr(binop.getLeftOperand()) and
+  isRecursiveExpr(binop.getRightOperand())
+}
+
 /**
  * We distinguish 3 kinds of RangeSsaDefinition:
  *
@@ -492,6 +531,9 @@ private predicate analyzableDef(RangeSsaDefinition def, StackVariable v) {
   v = def.getAVariable()
   or
   phiDependsOnDef(def, v, _, _)
+  or
+  // A modeled def for range analysis
+  def.(SimpleRangeAnalysisDefinition).hasRangeInformationFor(v)
 }
 
 /**
@@ -572,7 +614,16 @@ private float getTruncatedLowerBounds(Expr expr) {
       // overflow, so we replace invalid bounds with exprMinVal.
       exists(float newLB | newLB = normalizeFloatUp(getLowerBoundsImpl(expr)) |
         if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
-        then result = newLB
+        then
+          // Apply widening where we might get a combinatorial explosion.
+          if isRecursiveBinary(expr)
+          then
+            result =
+              max(float widenLB |
+                widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
+                not widenLB > newLB
+              )
+          else result = newLB
         else result = exprMinVal(expr)
       )
       or
@@ -619,7 +670,16 @@ private float getTruncatedUpperBounds(Expr expr) {
       // `exprMaxVal`.
       exists(float newUB | newUB = normalizeFloatUp(getUpperBoundsImpl(expr)) |
         if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
-        then result = newUB
+        then
+          // Apply widening where we might get a combinatorial explosion.
+          if isRecursiveBinary(expr)
+          then
+            result =
+              min(float widenUB |
+                widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
+                not widenUB < newUB
+              )
+          else result = newUB
         else result = exprMaxVal(expr)
       )
       or
@@ -1215,6 +1275,9 @@ private float getDefLowerBoundsImpl(RangeSsaDefinition def, StackVariable v) {
   // Phi nodes.
   result = getPhiLowerBounds(v, def)
   or
+  // A modeled def for range analysis
+  result = def.(SimpleRangeAnalysisDefinition).getLowerBounds(v)
+  or
   // Unanalyzable definitions.
   unanalyzableDefBounds(def, v, result, _)
 }
@@ -1248,6 +1311,9 @@ private float getDefUpperBoundsImpl(RangeSsaDefinition def, StackVariable v) {
   // Phi nodes.
   result = getPhiUpperBounds(v, def)
   or
+  // A modeled def for range analysis
+  result = def.(SimpleRangeAnalysisDefinition).getUpperBounds(v)
+  or
   // Unanalyzable definitions.
   unanalyzableDefBounds(def, v, _, result)
 }

cpp/ql/src/semmle/code/cpp/security/BufferWrite.qll

@@ -354,11 +354,10 @@ class SnprintfBW extends BufferWriteCall {
  */
 class GetsBW extends BufferWriteCall {
   GetsBW() {
-    exists(TopLevelFunction fn, string name | fn = getTarget() and name = fn.getName() |
-      name = "gets" or // gets(dst)
-      name = "fgets" or // fgets(dst, max_amount, src_stream)
-      name = "fgetws" // fgetws(dst, max_amount, src_stream)
-    )
+    getTarget().(TopLevelFunction).getName() =
+      ["gets", // gets(dst)
+          "fgets", // fgets(dst, max_amount, src_stream)
+          "fgetws"] // fgetws(dst, max_amount, src_stream)
   }
 
   /**

cpp/ql/src/semmle/code/cpp/security/FileWrite.qll

@@ -123,9 +123,7 @@ class WriteFunctionCall extends ChainedOutputCall {
 private predicate fileStreamChain(ChainedOutputCall out, Expr source, Expr dest) {
   source = out.getSource() and
   dest = out.getEndDest() and
-  exists(string nme | nme = "basic_ofstream" or nme = "basic_fstream" |
-    dest.getUnderlyingType().(Class).getSimpleName() = nme
-  )
+  dest.getUnderlyingType().(Class).getSimpleName() = ["basic_ofstream", "basic_fstream"]
 }
 
 /**
@@ -139,15 +137,7 @@ private predicate fileWrite(Call write, Expr source, Expr dest) {
       // named functions
       name = "fwrite" and s = 0 and d = 3
       or
-      (
-        name = "fputs" or
-        name = "fputws" or
-        name = "fputc" or
-        name = "fputwc" or
-        name = "putc" or
-        name = "putwc" or
-        name = "putw"
-      ) and
+      name = ["fputs", "fputws", "fputc", "fputwc", "putc", "putwc", "putw"] and
       s = 0 and
       d = 1
     )

cpp/ql/src/semmle/code/cpp/security/OutputWrite.qll

@@ -48,10 +48,7 @@ private predicate outputFile(Expr e) {
       name = e.(VariableAccess).getTarget().(GlobalVariable).toString() or
       name = e.findRootCause().(Macro).getName()
     ) and
-    (
-      name = "stdout" or
-      name = "stderr"
-    )
+    name = ["stdout", "stderr"]
   )
 }
 

cpp/ql/src/semmle/code/cpp/security/TaintTrackingImpl.qll

@@ -252,11 +252,10 @@ private predicate insideFunctionValueMoveTo(Element src, Element dest) {
       copyValueBetweenArguments(c.getTarget(), sourceArg, destArg) and
       // Only consider copies from `printf`-like functions if the format is a string
       (
-        exists(FormattingFunctionCall ffc, FormatLiteral format, string argFormat |
+        exists(FormattingFunctionCall ffc, FormatLiteral format |
           ffc = c and
           format = ffc.getFormat() and
-          format.getConversionChar(sourceArg - ffc.getTarget().getNumberOfParameters()) = argFormat and
-          (argFormat = "s" or argFormat = "S")
+          format.getConversionChar(sourceArg - ffc.getTarget().getNumberOfParameters()) = ["s", "S"]
         )
         or
         not exists(FormatLiteral fl | fl = c.(FormattingFunctionCall).getFormat())
@@ -273,12 +272,12 @@ private predicate insideFunctionValueMoveTo(Element src, Element dest) {
       dest = c
     )
     or
-    exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format, string argFormat |
+    exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format |
       dest = formattingSend and
       formattingSend.getArgument(arg) = src and
       format = formattingSend.getFormat() and
-      format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) = argFormat and
-      (argFormat = "s" or argFormat = "S" or argFormat = "@")
+      format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) =
+        ["s", "S", "@"]
     )
     or
     // Expressions computed from tainted data are also tainted

cpp/ql/src/semmle/uml/MagicDraw.qll

@@ -65,15 +65,8 @@ class UMLElement extends XMLElement {
  */
 class UMLType extends UMLElement {
   UMLType() {
-    exists(string type |
-      this.getName() = "packagedElement" and
-      this.getAttribute("type").getValue() = type and
-      (
-        type = "uml:Class" or
-        type = "uml:Interface" or
-        type = "uml:PrimitiveType"
-      )
-    )
+    this.getName() = "packagedElement" and
+    this.getAttribute("type").getValue() = ["uml:Class", "uml:Interface", "uml:PrimitiveType"]
   }
 
   /**

cpp/ql/test/experimental/library-tests/rangeanalysis/bitwiseand/bitwiseand.cpp

@@ -0,0 +1,59 @@
+typedef unsigned char uint8_t;
+typedef signed char int8_t;
+typedef unsigned uint32_t;
+typedef signed long long int64_t;
+
+void test_assign_operator(uint8_t x) {
+  x &= 7; // [0 .. 7]
+}
+
+void test_non_negative_const(uint8_t x) {
+  uint8_t unsigned_const = 7;
+
+  // Non-negative range operand and non-negative constant. The operands are promoted
+  // to signed ints.
+  x & 0; // [0 .. 0]
+  x & 7; // [0 .. 7]
+  x & unsigned_const; // [0 .. 7]
+
+  // This tests what happens when both arguments are promoted to `unsigned int` instead
+  // of `int`, and when the constant is larger than the max bound
+  x & 0xFFFFFFFF; // [0 .. 255]
+}
+
+void test_non_const(uint8_t a, uint8_t b, uint32_t c, uint32_t d) {
+  if (b <= 100) {
+    // `a` and `b` are promoted to signed ints, meaning neither the range analysis library
+    // nor this extension handle it
+    a & b; // [-2147483648 .. 2147483647]
+  }
+  if (d <= 100) {
+    // Handled by the range analysis library
+    c & d; // [0 .. 100]
+  }
+}
+
+void test_negative_operand(uint8_t x, int8_t y) {
+  uint8_t unsigned_const = 7;
+  int8_t signed_const = -7;
+
+  // The right operand can be negative
+  x & -7; // [-2147483648 .. 2147483647]
+  x & signed_const; // [-2147483648 .. 2147483647]
+  x & y; // [-2147483648 .. 2147483647]
+
+  // The left operand can be negative
+  y & 7; // [-2147483648 .. 2147483647]
+  y & unsigned_const; // [-2147483648 .. 2147483647]
+  y & 0xFFFFFFFF; // [0 .. 4294967295]
+  (int64_t)y & 0xFFFFFFFF; // [-9223372036854776000 .. 9223372036854776000]
+  y & x; // [-2147483648 .. 2147483647]
+
+  // Both can be negative
+  y & -7; // [-2147483648 .. 2147483647]
+  y & signed_const; // [-2147483648 .. 2147483647]
+  signed_const & -7; // [-2147483648 .. 2147483647]
+  signed_const & y; // [-2147483648 .. 2147483647]
+  -7 & y; // [-2147483648 .. 2147483647]
+  -7 & signed_const; // [-2147483648 .. 2147483647]
+}

cpp/ql/test/experimental/library-tests/rangeanalysis/bitwiseand/bitwiseand.expected

@@ -0,0 +1,21 @@
+| bitwiseand.cpp:7:3:7:8 | ... &= ... | 0.0 | 7.0 |
+| bitwiseand.cpp:15:3:15:7 | ... & ... | 0.0 | 0.0 |
+| bitwiseand.cpp:16:3:16:7 | ... & ... | 0.0 | 7.0 |
+| bitwiseand.cpp:17:3:17:20 | ... & ... | 0.0 | 7.0 |
+| bitwiseand.cpp:21:3:21:16 | ... & ... | 0.0 | 255.0 |
+| bitwiseand.cpp:28:5:28:9 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:32:5:32:9 | ... & ... | 0.0 | 100.0 |
+| bitwiseand.cpp:41:3:41:8 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:42:3:42:18 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:43:3:43:7 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:46:3:46:7 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:47:3:47:20 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:48:3:48:16 | ... & ... | 0.0 | 4.294967295E9 |
+| bitwiseand.cpp:49:3:49:25 | ... & ... | -9.223372036854776E18 | 9.223372036854776E18 |
+| bitwiseand.cpp:50:3:50:7 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:53:3:53:8 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:54:3:54:18 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:55:3:55:19 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:56:3:56:18 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:57:3:57:8 | ... & ... | -2.147483648E9 | 2.147483647E9 |
+| bitwiseand.cpp:58:3:58:19 | ... & ... | -2.147483648E9 | 2.147483647E9 |

cpp/ql/test/experimental/library-tests/rangeanalysis/bitwiseand/bitwiseand.ql

@@ -0,0 +1,8 @@
+import experimental.semmle.code.cpp.rangeanalysis.ExtendedRangeAnalysis
+
+from Operation expr, float lower, float upper
+where
+  (expr instanceof BitwiseAndExpr or expr instanceof AssignAndExpr) and
+  lower = lowerBound(expr) and
+  upper = upperBound(expr)
+select expr, lower, upper

cpp/ql/test/experimental/library-tests/rangeanalysis/extensibility/extensibility.c

@@ -12,3 +12,8 @@ int test_overridability_sub(int x) {
   int result = x - (unsigned char)x; // Returns 0 due to custom modeling for this test being deliberately wrong
   return result; // 0
 }
+
+void test_parameter_override(int magic_name_at_most_10, int magic_name_at_most_20) {
+  magic_name_at_most_10;
+  magic_name_at_most_20;
+}

cpp/ql/test/experimental/library-tests/rangeanalysis/extensibility/extensibility.expected

@@ -5,3 +5,5 @@
 | extensibility.c:12:16:12:16 | x | -2.147483648E9 | 2.147483647E9 |
 | extensibility.c:12:35:12:35 | x | -2.147483648E9 | 2.147483647E9 |
 | extensibility.c:13:10:13:15 | result | 0.0 | 0.0 |
+| extensibility.c:17:3:17:23 | magic_name_at_most_10 | -2.147483648E9 | 10.0 |
+| extensibility.c:18:3:18:23 | magic_name_at_most_20 | -2.147483648E9 | 20.0 |

cpp/ql/test/experimental/library-tests/rangeanalysis/extensibility/extensibility.ql

@@ -1,5 +1,7 @@
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
+import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisDefinition
 
 class CustomAddFunctionCall extends SimpleRangeAnalysisExpr, FunctionCall {
   CustomAddFunctionCall() { this.getTarget().hasGlobalName("custom_add_function") }
@@ -37,6 +39,40 @@ class SelfSub extends SimpleRangeAnalysisExpr, SubExpr {
   override predicate dependsOnChild(Expr child) { child = this.getAnOperand() }
 }
 
+/**
+ * A definition for test purposes of a parameter `p` that starts with a
+ * special prefix. This class is written to exploit how QL behaves when class
+ * fields are not functionally determined by `this`. When multiple parameters
+ * of the same function have the special prefix, there is still only one
+ * instance of this class.
+ */
+class MagicParameterName extends SimpleRangeAnalysisDefinition {
+  Parameter p;
+  float value;
+
+  MagicParameterName() {
+    this.definedByParameter(p) and
+    value = p.getName().regexpCapture("magic_name_at_most_(\\d+)", 1).toFloat()
+  }
+
+  override predicate hasRangeInformationFor(StackVariable v) { v = p }
+
+  override predicate dependsOnExpr(StackVariable v, Expr e) {
+    // No dependencies. This sample class yields constant values.
+    none()
+  }
+
+  override float getLowerBounds(StackVariable var) {
+    var = p and
+    result = typeLowerBound(p.getUnspecifiedType())
+  }
+
+  override float getUpperBounds(StackVariable var) {
+    var = p and
+    result = value
+  }
+}
+
 from VariableAccess expr, float lower, float upper
 where
   lower = lowerBound(expr) and

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -21,3 +21,69 @@ argHasPostUpdate
 | lambdas.cpp:38:2:38:2 | d | ArgumentNode is missing PostUpdateNode. |
 | lambdas.cpp:45:2:45:2 | e | ArgumentNode is missing PostUpdateNode. |
 | test.cpp:67:29:67:35 | source1 | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| BarrierGuard.cpp:49:6:49:6 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| BarrierGuard.cpp:60:7:60:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:22:9:22:20 | sourceArray1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:28:22:28:23 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:12 | stackArray [inner post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:15 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:60:3:60:14 | globalBottom [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:61:3:61:14 | globalMiddle [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:78:24:78:37 | call to allocateBottom [inner post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:148:5:148:5 | f [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:168:8:168:8 | f [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:24:9:24:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:24:20:24:20 | y [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:26:9:26:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:26:19:26:24 | coords [inner post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:28:23:28:25 | pos [inner post update] | PostUpdateNode should not be the target of local flow. |
+| globals.cpp:13:5:13:19 | flowTestGlobal1 [post update] | PostUpdateNode should not be the target of local flow. |
+| globals.cpp:23:5:23:19 | flowTestGlobal2 [post update] | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:23:3:23:14 | v [post update] | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:43:3:43:3 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:20:5:20:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:22:7:22:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:24:7:24:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:29:5:29:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:31:7:31:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:39:7:39:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:44:5:44:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:46:7:46:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:48:7:48:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:75:9:75:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:83:9:83:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:87:11:87:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:89:11:89:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:94:9:94:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:96:11:96:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:104:11:104:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:109:9:109:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:113:11:113:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:115:11:115:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:91:3:91:9 | source1 [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:3:115:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:4:115:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:3:120:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:4:120:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:3:125:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:4:125:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:333:5:333:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:347:5:347:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:359:5:359:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:10:384:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:11:384:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:10:391:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:11:391:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:10:400:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:11:400:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:10:407:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:11:407:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:423:21:423:25 | local [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:436:19:436:23 | local [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:3:465:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:4:465:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:470:22:470:22 | x [inner post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -30,3 +30,56 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| BarrierGuard.cpp:49:3:49:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| BarrierGuard.cpp:60:3:60:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:28:3:28:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:34:22:34:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:34:32:34:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:39:32:39:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:39:42:39:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:43:35:43:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:43:51:43:51 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:49:25:49:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:49:35:49:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:17:19:17:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:17:21:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:24:2:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:24:13:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:26:2:26:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:13:12:13:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:13:15:13:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:43:3:43:14 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:20:5:20:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:22:7:22:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:24:7:24:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:29:5:29:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:31:7:31:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:39:7:39:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:44:5:44:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:46:7:46:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:48:7:48:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:75:5:75:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:83:5:83:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:87:7:87:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:89:7:89:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:94:5:94:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:96:7:96:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:104:7:104:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:109:5:109:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:113:7:113:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:115:7:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:91:3:91:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:3:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:3:120:10 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -39,3 +39,111 @@ argHasPostUpdate
 | by_reference.cpp:51:8:51:8 | s | ArgumentNode is missing PostUpdateNode. |
 | by_reference.cpp:57:8:57:8 | s | ArgumentNode is missing PostUpdateNode. |
 | by_reference.cpp:63:8:63:8 | s | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| A.cpp:25:13:25:13 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:27:28:27:28 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:42:11:42:12 | cc [inner post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:43:11:43:12 | ct [inner post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:100:9:100:9 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:142:10:142:10 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:143:13:143:13 | b [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:183:7:183:10 | head [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:184:13:184:16 | next [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:35:13:35:17 | elem1 [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:36:13:36:17 | elem2 [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:46:13:46:16 | box1 [post update] | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:11:24:12 | s3 [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:9:21:9:24 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:11:29:11:32 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:16:21:16:23 | box [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:18:29:18:31 | box [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:30:13:30:16 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:44:19:44:22 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:12 | boxfield [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:58:20:58:23 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| E.cpp:33:19:33:19 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:9:6:9:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:13:5:13:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:17:5:17:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:25:18:25:19 | s1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:37:8:37:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:42:6:42:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:49:9:49:10 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:54:6:54:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:60:6:60:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:72:5:72:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:79:6:79:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:86:5:86:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:92:7:92:8 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:98:5:98:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:3:106:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:4:106:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:111:18:111:19 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:126:15:126:16 | xs [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:136:16:136:17 | xs [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:16:147:16 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:21:147:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:175:21:175:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:181:21:181:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:187:21:187:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:194:21:194:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:200:23:200:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:205:23:205:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:5 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:3:15:10 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:5:15:7 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:12:36:14 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:19:36:22 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:37:17:37:19 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:38:17:38:19 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:42:15:42:17 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:42:22:42:25 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:43:20:43:22 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:44:20:44:22 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:48:15:48:17 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:48:22:48:25 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:49:20:49:22 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:50:20:50:22 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:12:8:12:8 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:16:11:16:11 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:68:18:68:18 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:84:10:84:10 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:88:9:88:9 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:3:92:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:4:92:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:96:3:96:4 | pa [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:102:28:102:39 | inner_nested [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:104:22:104:22 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:106:30:106:41 | inner_nested [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:108:24:108:24 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:123:28:123:36 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:127:30:127:38 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:11:22:11:23 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:12:22:12:23 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:20:24:20:25 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:21:24:21:25 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:9:36:9:36 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:12:56:12:56 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:13:57:13:57 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:22:23:22:23 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:37:26:37:33 | call to getInner [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:42:13:42:20 | call to getInner [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:42:25:42:25 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:47:7:47:11 | outer [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:47:27:47:27 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:13:49:15 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:20:49:22 | baz [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:53:13:53:15 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:53:35:53:43 | bufferLen [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:54:20:54:22 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:60:16:60:18 | ref arg dst | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:61:25:61:27 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:65:25:65:27 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:20:24:20:25 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:21:24:21:25 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:65:7:65:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:12:83:13 | f1 [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -22,3 +22,129 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| A.cpp:25:7:25:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:27:22:27:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:98:12:98:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:100:5:100:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:142:7:142:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:143:7:143:31 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:183:7:183:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:184:7:184:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:6:15:6:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:15:15:15:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:35:7:35:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:36:7:36:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:46:7:46:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:5:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:16:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:9:21:9:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:11:29:11:36 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:16:21:16:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:18:29:18:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:28:15:28:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:35:15:35:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:42:15:42:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:49:15:49:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:56:15:56:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:42 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:9:3:9:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:13:3:13:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:17:3:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:21:12:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:21:15:21:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:22:12:22:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:22:15:22:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:23:12:23:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:23:15:23:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:35:12:35:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:35:15:35:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:37:3:37:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:40:12:40:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:40:15:40:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:42:3:42:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:47:12:47:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:47:15:47:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:49:3:49:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:52:12:52:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:52:15:52:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:54:3:54:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:59:12:59:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:59:15:59:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:60:3:60:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:70:19:70:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:70:22:70:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:72:3:72:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:77:19:77:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:77:22:77:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:79:3:79:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:84:19:84:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:84:22:84:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:86:3:86:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:91:19:91:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:91:22:91:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:92:3:92:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:98:3:98:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:3:106:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:111:15:111:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:15:147:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:175:15:175:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:181:15:181:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:187:15:187:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:194:15:194:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:200:15:200:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:205:15:205:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:5:18:5:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:5:21:5:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:14:18:14:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:14:21:14:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:3:15:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:3:36:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:12:5:12:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:16:5:16:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:84:3:84:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:88:3:88:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:3:92:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:96:3:96:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:102:21:102:39 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:104:15:104:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:106:21:106:41 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:108:15:108:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:122:21:122:38 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:124:15:124:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:126:21:126:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:128:15:128:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:11:22:11:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:12:22:12:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:14:33:14:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:9:30:9:44 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:12:49:12:64 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:13:51:13:65 | Chi | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:39:12:39:95 | Chi | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:9:49:64 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:27:7:27:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:27:21:27:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:28:5:28:7 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:36:10:36:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:40:20:40:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:40:34:40:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:42:7:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:42:21:42:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:43:5:43:7 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

@@ -1,15 +1,12 @@
 edges
-| A.cpp:55:5:55:5 | set output argument [c] | A.cpp:56:10:56:10 | Argument -1 indirection [c] |
+| A.cpp:55:5:55:5 | set output argument [c] | A.cpp:56:13:56:15 | call to get |
 | A.cpp:55:12:55:19 | (C *)... | A.cpp:55:5:55:5 | set output argument [c] |
-| A.cpp:55:12:55:19 | new | A.cpp:55:12:55:19 | (C *)... |
-| A.cpp:56:10:56:10 | Argument -1 indirection [c] | A.cpp:56:13:56:15 | call to get |
-| A.cpp:57:10:57:25 | Argument -1 indirection [c] | A.cpp:57:28:57:30 | call to get |
-| A.cpp:57:11:57:24 | B output argument [c] | A.cpp:57:10:57:25 | Argument -1 indirection [c] |
+| A.cpp:55:12:55:19 | new | A.cpp:55:5:55:5 | set output argument [c] |
+| A.cpp:57:11:57:24 | B output argument [c] | A.cpp:57:28:57:30 | call to get |
 | A.cpp:57:17:57:23 | new | A.cpp:57:11:57:24 | B output argument [c] |
 | A.cpp:98:12:98:18 | new | A.cpp:100:5:100:13 | Store |
-| A.cpp:100:5:100:13 | Chi [a] | A.cpp:101:8:101:9 | Argument 0 indirection [a] |
+| A.cpp:100:5:100:13 | Chi [a] | A.cpp:103:14:103:14 | *c [a] |
 | A.cpp:100:5:100:13 | Store | A.cpp:100:5:100:13 | Chi [a] |
-| A.cpp:101:8:101:9 | Argument 0 indirection [a] | A.cpp:103:14:103:14 | *c [a] |
 | A.cpp:103:14:103:14 | *c [a] | A.cpp:107:16:107:16 | a |
 | A.cpp:126:5:126:5 | Chi [c] | A.cpp:131:8:131:8 | f7 output argument [c] |
 | A.cpp:126:5:126:5 | set output argument [c] | A.cpp:126:5:126:5 | Chi [c] |
@@ -22,16 +19,13 @@ edges
 | A.cpp:143:7:143:31 | Chi [b] | A.cpp:151:12:151:24 | D output argument [b] |
 | A.cpp:143:7:143:31 | Store | A.cpp:143:7:143:31 | Chi [b] |
 | A.cpp:143:25:143:31 | new | A.cpp:143:7:143:31 | Store |
-| A.cpp:150:12:150:18 | new | A.cpp:151:18:151:18 | b |
+| A.cpp:150:12:150:18 | new | A.cpp:151:12:151:24 | D output argument [b] |
 | A.cpp:151:12:151:24 | Chi [b] | A.cpp:152:13:152:13 | b |
 | A.cpp:151:12:151:24 | D output argument [b] | A.cpp:151:12:151:24 | Chi [b] |
 | A.cpp:151:18:151:18 | Chi [c] | A.cpp:154:13:154:13 | c |
 | A.cpp:151:18:151:18 | D output argument [c] | A.cpp:151:18:151:18 | Chi [c] |
-| A.cpp:151:18:151:18 | b | A.cpp:151:12:151:24 | D output argument [b] |
-| C.cpp:18:12:18:18 | C output argument [s1] | C.cpp:19:5:19:5 | Argument -1 indirection [s1] |
-| C.cpp:18:12:18:18 | C output argument [s3] | C.cpp:19:5:19:5 | Argument -1 indirection [s3] |
-| C.cpp:19:5:19:5 | Argument -1 indirection [s1] | C.cpp:27:8:27:11 | *#this [s1] |
-| C.cpp:19:5:19:5 | Argument -1 indirection [s3] | C.cpp:27:8:27:11 | *#this [s3] |
+| C.cpp:18:12:18:18 | C output argument [s1] | C.cpp:27:8:27:11 | *#this [s1] |
+| C.cpp:18:12:18:18 | C output argument [s3] | C.cpp:27:8:27:11 | *#this [s3] |
 | C.cpp:22:12:22:21 | Chi [s1] | C.cpp:24:5:24:25 | Chi [s1] |
 | C.cpp:22:12:22:21 | Store | C.cpp:22:12:22:21 | Chi [s1] |
 | C.cpp:22:12:22:21 | new | C.cpp:22:12:22:21 | Store |
@@ -102,18 +96,14 @@ edges
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:10:8:10:15 | * ... |
 | arrays.cpp:15:14:15:23 | call to user_input | arrays.cpp:16:8:16:13 | access to array |
 | arrays.cpp:36:26:36:35 | call to user_input | arrays.cpp:37:24:37:27 | data |
-| by_reference.cpp:50:3:50:3 | setDirectly output argument [a] | by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] |
+| by_reference.cpp:50:3:50:3 | setDirectly output argument [a] | by_reference.cpp:51:10:51:20 | call to getDirectly |
 | by_reference.cpp:50:17:50:26 | call to user_input | by_reference.cpp:50:3:50:3 | setDirectly output argument [a] |
-| by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] | by_reference.cpp:51:10:51:20 | call to getDirectly |
-| by_reference.cpp:56:3:56:3 | setIndirectly output argument [a] | by_reference.cpp:57:8:57:8 | Argument -1 indirection [a] |
+| by_reference.cpp:56:3:56:3 | setIndirectly output argument [a] | by_reference.cpp:57:10:57:22 | call to getIndirectly |
 | by_reference.cpp:56:19:56:28 | call to user_input | by_reference.cpp:56:3:56:3 | setIndirectly output argument [a] |
-| by_reference.cpp:57:8:57:8 | Argument -1 indirection [a] | by_reference.cpp:57:10:57:22 | call to getIndirectly |
-| by_reference.cpp:62:3:62:3 | setThroughNonMember output argument [a] | by_reference.cpp:63:8:63:8 | Argument -1 indirection [a] |
+| by_reference.cpp:62:3:62:3 | setThroughNonMember output argument [a] | by_reference.cpp:63:10:63:28 | call to getThroughNonMember |
 | by_reference.cpp:62:25:62:34 | call to user_input | by_reference.cpp:62:3:62:3 | setThroughNonMember output argument [a] |
-| by_reference.cpp:63:8:63:8 | Argument -1 indirection [a] | by_reference.cpp:63:10:63:28 | call to getThroughNonMember |
-| by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] | by_reference.cpp:69:22:69:23 | Argument 0 indirection [a] |
+| by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] | by_reference.cpp:69:8:69:20 | call to nonMemberGetA |
 | by_reference.cpp:68:21:68:30 | call to user_input | by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] |
-| by_reference.cpp:69:22:69:23 | Argument 0 indirection [a] | by_reference.cpp:69:8:69:20 | call to nonMemberGetA |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
 | by_reference.cpp:84:3:84:25 | Store | by_reference.cpp:84:3:84:25 | Chi [a] |
@@ -150,104 +140,75 @@ edges
 | by_reference.cpp:128:15:128:23 | Chi | by_reference.cpp:128:15:128:23 | Chi [a] |
 | by_reference.cpp:128:15:128:23 | Chi [a] | by_reference.cpp:136:16:136:16 | a |
 | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | Chi |
-| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | complex.cpp:52:18:52:18 | call to b |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] |
+| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:18:51:18 | call to a |
+| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
+| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:18:52:18 | call to b |
+| complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:18:52:18 | call to b |
+| complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
 | complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | setA output argument [a_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] |
+| complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | setB output argument [b_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
+| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
 | complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | setA output argument [a_] |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] |
+| complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | setB output argument [b_] |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:10:28:10 | Argument -1 indirection [a_] |
-| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | Argument -1 indirection [b_] |
-| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:29:10:29:10 | Argument -1 indirection [b_] |
-| constructors.cpp:28:10:28:10 | Argument -1 indirection [a_] | constructors.cpp:28:12:28:12 | call to a |
-| constructors.cpp:28:10:28:10 | Argument -1 indirection [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
-| constructors.cpp:28:10:28:10 | a output argument [b_] | constructors.cpp:29:10:29:10 | Argument -1 indirection [b_] |
-| constructors.cpp:29:10:29:10 | Argument -1 indirection [b_] | constructors.cpp:29:12:29:12 | call to b |
+| constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:12:28:12 | call to a |
+| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
+| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:29:12:29:12 | call to b |
+| constructors.cpp:28:10:28:10 | a output argument [b_] | constructors.cpp:29:12:29:12 | call to b |
 | constructors.cpp:34:11:34:20 | call to user_input | constructors.cpp:34:11:34:26 | Foo output argument [a_] |
-| constructors.cpp:34:11:34:26 | Foo output argument [a_] | constructors.cpp:40:9:40:9 | Argument 0 indirection [a_] |
-| constructors.cpp:35:11:35:26 | Foo output argument [b_] | constructors.cpp:43:9:43:9 | Argument 0 indirection [b_] |
+| constructors.cpp:34:11:34:26 | Foo output argument [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
+| constructors.cpp:35:11:35:26 | Foo output argument [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
 | constructors.cpp:35:14:35:23 | call to user_input | constructors.cpp:35:11:35:26 | Foo output argument [b_] |
 | constructors.cpp:36:11:36:20 | call to user_input | constructors.cpp:36:11:36:37 | Foo output argument [a_] |
-| constructors.cpp:36:11:36:37 | Foo output argument [a_] | constructors.cpp:46:9:46:9 | Argument 0 indirection [a_] |
-| constructors.cpp:36:11:36:37 | Foo output argument [b_] | constructors.cpp:46:9:46:9 | Argument 0 indirection [b_] |
+| constructors.cpp:36:11:36:37 | Foo output argument [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
+| constructors.cpp:36:11:36:37 | Foo output argument [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
 | constructors.cpp:36:25:36:34 | call to user_input | constructors.cpp:36:11:36:37 | Foo output argument [b_] |
-| constructors.cpp:40:9:40:9 | Argument 0 indirection [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
-| constructors.cpp:43:9:43:9 | Argument 0 indirection [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
-| constructors.cpp:46:9:46:9 | Argument 0 indirection [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
-| constructors.cpp:46:9:46:9 | Argument 0 indirection [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
-| simple.cpp:26:15:26:15 | *f [a_] | simple.cpp:28:10:28:10 | Argument -1 indirection [a_] |
-| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:28:10:28:10 | Argument -1 indirection [b_] |
-| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:29:10:29:10 | Argument -1 indirection [b_] |
-| simple.cpp:28:10:28:10 | Argument -1 indirection [a_] | simple.cpp:28:12:28:12 | call to a |
-| simple.cpp:28:10:28:10 | Argument -1 indirection [b_] | simple.cpp:28:10:28:10 | a output argument [b_] |
-| simple.cpp:28:10:28:10 | a output argument [b_] | simple.cpp:29:10:29:10 | Argument -1 indirection [b_] |
-| simple.cpp:29:10:29:10 | Argument -1 indirection [b_] | simple.cpp:29:12:29:12 | call to b |
-| simple.cpp:39:5:39:5 | setA output argument [a_] | simple.cpp:45:9:45:9 | Argument 0 indirection [a_] |
+| simple.cpp:26:15:26:15 | *f [a_] | simple.cpp:28:12:28:12 | call to a |
+| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:28:10:28:10 | a output argument [b_] |
+| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:29:12:29:12 | call to b |
+| simple.cpp:28:10:28:10 | a output argument [b_] | simple.cpp:29:12:29:12 | call to b |
+| simple.cpp:39:5:39:5 | setA output argument [a_] | simple.cpp:26:15:26:15 | *f [a_] |
 | simple.cpp:39:12:39:21 | call to user_input | simple.cpp:39:5:39:5 | setA output argument [a_] |
-| simple.cpp:40:5:40:5 | setB output argument [b_] | simple.cpp:48:9:48:9 | Argument 0 indirection [b_] |
+| simple.cpp:40:5:40:5 | setB output argument [b_] | simple.cpp:26:15:26:15 | *f [b_] |
 | simple.cpp:40:12:40:21 | call to user_input | simple.cpp:40:5:40:5 | setB output argument [b_] |
-| simple.cpp:41:5:41:5 | setA output argument [a_] | simple.cpp:42:5:42:5 | Argument -1 indirection [a_] |
-| simple.cpp:41:5:41:5 | setA output argument [a_] | simple.cpp:51:9:51:9 | Argument 0 indirection [a_] |
+| simple.cpp:41:5:41:5 | setA output argument [a_] | simple.cpp:26:15:26:15 | *f [a_] |
+| simple.cpp:41:5:41:5 | setA output argument [a_] | simple.cpp:42:5:42:5 | setB output argument [a_] |
 | simple.cpp:41:12:41:21 | call to user_input | simple.cpp:41:5:41:5 | setA output argument [a_] |
-| simple.cpp:42:5:42:5 | Argument -1 indirection [a_] | simple.cpp:42:5:42:5 | setB output argument [a_] |
-| simple.cpp:42:5:42:5 | setB output argument [a_] | simple.cpp:51:9:51:9 | Argument 0 indirection [a_] |
-| simple.cpp:42:5:42:5 | setB output argument [b_] | simple.cpp:51:9:51:9 | Argument 0 indirection [b_] |
+| simple.cpp:42:5:42:5 | setB output argument [a_] | simple.cpp:26:15:26:15 | *f [a_] |
+| simple.cpp:42:5:42:5 | setB output argument [b_] | simple.cpp:26:15:26:15 | *f [b_] |
 | simple.cpp:42:12:42:21 | call to user_input | simple.cpp:42:5:42:5 | setB output argument [b_] |
-| simple.cpp:45:9:45:9 | Argument 0 indirection [a_] | simple.cpp:26:15:26:15 | *f [a_] |
-| simple.cpp:48:9:48:9 | Argument 0 indirection [b_] | simple.cpp:26:15:26:15 | *f [b_] |
-| simple.cpp:51:9:51:9 | Argument 0 indirection [a_] | simple.cpp:26:15:26:15 | *f [a_] |
-| simple.cpp:51:9:51:9 | Argument 0 indirection [b_] | simple.cpp:26:15:26:15 | *f [b_] |
 | simple.cpp:65:5:65:22 | Store [i] | simple.cpp:66:12:66:12 | Store [i] |
 | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
 | simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] |
+| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
 | simple.cpp:83:9:83:28 | Store | simple.cpp:83:9:83:28 | Chi [f1] |
 | simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Store |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
 | simple.cpp:92:5:92:22 | Store [i] | simple.cpp:93:20:93:20 | Store [i] |
 | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | Store [i] |
 | simple.cpp:93:20:93:20 | Store [i] | simple.cpp:94:13:94:13 | i |
 | struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a |
-| struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:24:10:24:12 | Argument 0 indirection [a] |
+| struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
 | struct_init.c:20:20:20:29 | Store | struct_init.c:20:20:20:29 | Chi [a] |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:20:20:29 | Store |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:11:22:11 | a |
-| struct_init.c:24:10:24:12 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:36:10:36:24 | Argument 0 indirection [a] |
+| struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
 | struct_init.c:27:7:27:16 | Store | struct_init.c:27:7:27:16 | Chi [a] |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:7:27:16 | Store |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:23:31:23 | a |
-| struct_init.c:36:10:36:24 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
 nodes
 | A.cpp:55:5:55:5 | set output argument [c] | semmle.label | set output argument [c] |
 | A.cpp:55:12:55:19 | (C *)... | semmle.label | (C *)... |
 | A.cpp:55:12:55:19 | new | semmle.label | new |
-| A.cpp:56:10:56:10 | Argument -1 indirection [c] | semmle.label | Argument -1 indirection [c] |
 | A.cpp:56:13:56:15 | call to get | semmle.label | call to get |
-| A.cpp:57:10:57:25 | Argument -1 indirection [c] | semmle.label | Argument -1 indirection [c] |
 | A.cpp:57:11:57:24 | B output argument [c] | semmle.label | B output argument [c] |
 | A.cpp:57:17:57:23 | new | semmle.label | new |
 | A.cpp:57:28:57:30 | call to get | semmle.label | call to get |
 | A.cpp:98:12:98:18 | new | semmle.label | new |
 | A.cpp:100:5:100:13 | Chi [a] | semmle.label | Chi [a] |
 | A.cpp:100:5:100:13 | Store | semmle.label | Store |
-| A.cpp:101:8:101:9 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 | A.cpp:103:14:103:14 | *c [a] | semmle.label | *c [a] |
 | A.cpp:107:16:107:16 | a | semmle.label | a |
 | A.cpp:126:5:126:5 | Chi [c] | semmle.label | Chi [c] |
@@ -267,13 +228,10 @@ nodes
 | A.cpp:151:12:151:24 | D output argument [b] | semmle.label | D output argument [b] |
 | A.cpp:151:18:151:18 | Chi [c] | semmle.label | Chi [c] |
 | A.cpp:151:18:151:18 | D output argument [c] | semmle.label | D output argument [c] |
-| A.cpp:151:18:151:18 | b | semmle.label | b |
 | A.cpp:152:13:152:13 | b | semmle.label | b |
 | A.cpp:154:13:154:13 | c | semmle.label | c |
 | C.cpp:18:12:18:18 | C output argument [s1] | semmle.label | C output argument [s1] |
 | C.cpp:18:12:18:18 | C output argument [s3] | semmle.label | C output argument [s3] |
-| C.cpp:19:5:19:5 | Argument -1 indirection [s1] | semmle.label | Argument -1 indirection [s1] |
-| C.cpp:19:5:19:5 | Argument -1 indirection [s3] | semmle.label | Argument -1 indirection [s3] |
 | C.cpp:22:12:22:21 | Chi [s1] | semmle.label | Chi [s1] |
 | C.cpp:22:12:22:21 | Store | semmle.label | Store |
 | C.cpp:22:12:22:21 | new | semmle.label | new |
@@ -361,20 +319,16 @@ nodes
 | arrays.cpp:37:24:37:27 | data | semmle.label | data |
 | by_reference.cpp:50:3:50:3 | setDirectly output argument [a] | semmle.label | setDirectly output argument [a] |
 | by_reference.cpp:50:17:50:26 | call to user_input | semmle.label | call to user_input |
-| by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] | semmle.label | Argument -1 indirection [a] |
 | by_reference.cpp:51:10:51:20 | call to getDirectly | semmle.label | call to getDirectly |
 | by_reference.cpp:56:3:56:3 | setIndirectly output argument [a] | semmle.label | setIndirectly output argument [a] |
 | by_reference.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
-| by_reference.cpp:57:8:57:8 | Argument -1 indirection [a] | semmle.label | Argument -1 indirection [a] |
 | by_reference.cpp:57:10:57:22 | call to getIndirectly | semmle.label | call to getIndirectly |
 | by_reference.cpp:62:3:62:3 | setThroughNonMember output argument [a] | semmle.label | setThroughNonMember output argument [a] |
 | by_reference.cpp:62:25:62:34 | call to user_input | semmle.label | call to user_input |
-| by_reference.cpp:63:8:63:8 | Argument -1 indirection [a] | semmle.label | Argument -1 indirection [a] |
 | by_reference.cpp:63:10:63:28 | call to getThroughNonMember | semmle.label | call to getThroughNonMember |
 | by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] | semmle.label | nonMemberSetA output argument [a] |
 | by_reference.cpp:68:21:68:30 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:69:8:69:20 | call to nonMemberGetA | semmle.label | call to nonMemberGetA |
-| by_reference.cpp:69:22:69:23 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [a] |
 | by_reference.cpp:84:3:84:25 | Store | semmle.label | Store |
 | by_reference.cpp:84:14:84:23 | call to user_input | semmle.label | call to user_input |
@@ -417,11 +371,8 @@ nodes
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | complex.cpp:51:16:51:16 | a output argument [b_] | semmle.label | a output argument [b_] |
 | complex.cpp:51:18:51:18 | call to a | semmle.label | call to a |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | complex.cpp:52:18:52:18 | call to b | semmle.label | call to b |
 | complex.cpp:62:12:62:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:62:19:62:28 | call to user_input | semmle.label | call to user_input |
@@ -429,21 +380,13 @@ nodes
 | complex.cpp:63:19:63:28 | call to user_input | semmle.label | call to user_input |
 | complex.cpp:64:12:64:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:64:19:64:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
 | complex.cpp:65:12:65:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
 | complex.cpp:65:12:65:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:65:19:65:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
-| constructors.cpp:28:10:28:10 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| constructors.cpp:28:10:28:10 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | constructors.cpp:28:10:28:10 | a output argument [b_] | semmle.label | a output argument [b_] |
 | constructors.cpp:28:12:28:12 | call to a | semmle.label | call to a |
-| constructors.cpp:29:10:29:10 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | constructors.cpp:29:12:29:12 | call to b | semmle.label | call to b |
 | constructors.cpp:34:11:34:20 | call to user_input | semmle.label | call to user_input |
 | constructors.cpp:34:11:34:26 | Foo output argument [a_] | semmle.label | Foo output argument [a_] |
@@ -453,17 +396,10 @@ nodes
 | constructors.cpp:36:11:36:37 | Foo output argument [a_] | semmle.label | Foo output argument [a_] |
 | constructors.cpp:36:11:36:37 | Foo output argument [b_] | semmle.label | Foo output argument [b_] |
 | constructors.cpp:36:25:36:34 | call to user_input | semmle.label | call to user_input |
-| constructors.cpp:40:9:40:9 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| constructors.cpp:43:9:43:9 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
-| constructors.cpp:46:9:46:9 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| constructors.cpp:46:9:46:9 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | simple.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
 | simple.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
-| simple.cpp:28:10:28:10 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| simple.cpp:28:10:28:10 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | simple.cpp:28:10:28:10 | a output argument [b_] | semmle.label | a output argument [b_] |
 | simple.cpp:28:12:28:12 | call to a | semmle.label | call to a |
-| simple.cpp:29:10:29:10 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | simple.cpp:29:12:29:12 | call to b | semmle.label | call to b |
 | simple.cpp:39:5:39:5 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | simple.cpp:39:12:39:21 | call to user_input | semmle.label | call to user_input |
@@ -471,14 +407,9 @@ nodes
 | simple.cpp:40:12:40:21 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:41:5:41:5 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | simple.cpp:41:12:41:21 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:42:5:42:5 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
 | simple.cpp:42:5:42:5 | setB output argument [a_] | semmle.label | setB output argument [a_] |
 | simple.cpp:42:5:42:5 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | simple.cpp:42:12:42:21 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:45:9:45:9 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| simple.cpp:48:9:48:9 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
-| simple.cpp:51:9:51:9 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| simple.cpp:51:9:51:9 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | simple.cpp:65:5:65:22 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:65:11:65:20 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
@@ -486,7 +417,6 @@ nodes
 | simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
 | simple.cpp:83:9:83:28 | Store | semmle.label | Store |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | semmle.label | Argument -1 indirection [f1] |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
 | simple.cpp:92:5:92:22 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:92:11:92:20 | call to user_input | semmle.label | call to user_input |
@@ -498,12 +428,10 @@ nodes
 | struct_init.c:20:20:20:29 | Store | semmle.label | Store |
 | struct_init.c:20:20:20:29 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:22:11:22:11 | a | semmle.label | a |
-| struct_init.c:24:10:24:12 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 | struct_init.c:27:7:27:16 | Chi [a] | semmle.label | Chi [a] |
 | struct_init.c:27:7:27:16 | Store | semmle.label | Store |
 | struct_init.c:27:7:27:16 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:31:23:31:23 | a | semmle.label | a |
-| struct_init.c:36:10:36:24 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 #select
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | (C *)... | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | (C *)... | (C *)... |
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | new | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | new | new |

cpp/ql/test/library-tests/dataflow/taint-tests/IRTaintTestCommon.qll

@@ -25,13 +25,10 @@ class TestAllocationConfig extends TaintTracking::Configuration {
       sink.(DataFlow::ExprNode).getConvertedExpr() instanceof ReferenceDereferenceExpr
     )
     or
-    sink
-        .asInstruction()
-        .(ReadSideEffectInstruction)
-        .getPrimaryInstruction()
-        .(CallInstruction)
-        .getStaticCallTarget()
-        .hasName("sink")
+    exists(ReadSideEffectInstruction read |
+      read.getSideEffectOperand() = sink.asOperand() and
+      read.getPrimaryInstruction().(CallInstruction).getStaticCallTarget().hasName("sink")
+    )
   }
 
   override predicate isSanitizer(DataFlow::Node barrier) {

cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp

@@ -0,0 +1,438 @@
+
+#include "stl.h"
+
+using namespace std;
+
+char *source();
+
+void sink(char *);
+void sink(const char *);
+void sink(bool);
+void sink(std::pair<char *, char *>);
+void sink(std::map<char *, char *>);
+void sink(std::map<char *, char *>::iterator);
+void sink(std::unordered_map<char *, char *>);
+void sink(std::unordered_map<char *, char *>::iterator);
+void sink(std::unordered_map<char *, std::pair<int, int> >);
+void sink(std::unordered_map<char *, std::pair<int, int> >::iterator);
+
+void test_pair()
+{
+	std::pair<char *, char *> a, b, c;
+
+	a.first = "123";
+	sink(a.first);
+	sink(a.second);
+	sink(a);
+
+	b.first = source();
+	sink(b.first); // tainted
+	sink(b.second);
+	sink(b); // tainted [NOT DETECTED]
+
+	c.second = source();
+	sink(c.first);
+	sink(c.second); // tainted
+	sink(c); // tainted [NOT DETECTED]
+
+	std::pair<char *, char *> d("123", "456");
+	sink(d.first);
+	sink(d.second);
+	sink(d);
+
+	std::pair<char *, char *> e(source(), "456");
+	sink(e.first); // tainted
+	sink(e.second);
+	sink(e); // tainted [NOT DETECTED]
+
+	std::pair<char *, char *> f("123", source());
+	sink(f.first); // [FALSE POSITIVE]
+	sink(f.second); // tainted
+	sink(f); // tainted
+
+	std::pair<char *, char *> g(f);
+	sink(g.first); // [FALSE POSITIVE]
+	sink(g.second); // tainted
+	sink(g); // tainted
+
+	std::pair<char *, char *> h;
+	h = f;
+	sink(h.first); // [FALSE POSITIVE]
+	sink(h.second); // tainted
+	sink(h); // tainted
+
+	std::pair<char *, char *> i("123", "456");
+	std::pair<char *, char *> j("123", source());
+	std::pair<char *, char *> k("123", source());
+	std::pair<char *, char *> l("123", "456");
+ 	i.swap(j);
+	k.swap(l);
+	sink(i.first); // [FALSE POSITIVE]
+	sink(i.second); // tainted
+	sink(i); // tainted
+	sink(j.first); // [FALSE POSITIVE]
+	sink(j.second); // [FALSE POSITIVE]
+	sink(j); // [FALSE POSITIVE]
+	sink(k.first); // [FALSE POSITIVE]
+	sink(k.second); // [FALSE POSITIVE]
+	sink(k); // [FALSE POSITIVE]
+	sink(l.first); // [FALSE POSITIVE]
+	sink(l.second); // tainted
+	sink(l); // tainted
+
+	sink(make_pair("123", "456"));
+	sink(make_pair("123", "456").first);
+	sink(make_pair("123", "456").second);
+	sink(make_pair(source(), "456")); // tainted [NOT DETECTED]
+	sink(make_pair(source(), "456").first); // tainted [NOT DETECTED]
+	sink(make_pair(source(), "456").second);
+	sink(make_pair("123", source())); // tainted
+	sink(make_pair("123", source()).first); // [FALSE POSITIVE]
+	sink(make_pair("123", source()).second); // tainted
+
+	std::pair<std::pair<char *, char *>, char *> m;
+	m = make_pair(make_pair("123", source()), "789");
+	sink(m); // tainted [NOT DETECTED]
+	sink(m.first); // tainted [NOT DETECTED]
+	sink(m.first.first);
+	sink(m.first.second); // tainted [NOT DETECTED]
+	sink(m.second);
+}
+
+void test_map()
+{
+	// insert
+	std::map<char *, char *> m1, m2, m3, m4, m5, m6;
+
+	sink(m1.insert(std::make_pair("abc", "def")).first);
+	sink(m2.insert(std::make_pair("abc", source())).first); // tainted
+	sink(m3.insert(std::make_pair(source(), "def")).first); // tainted [NOT DETECTED]
+	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // tainted
+	sink(m5.insert_or_assign("abc", source()).first); // tainted
+	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted
+	sink(m1);
+	sink(m2); // tainted
+	sink(m3); // tainted [NOT DETECTED]
+	sink(m4); // tainted
+	sink(m5); // tainted
+	sink(m6); // tainted
+	sink(m1.find("abc"));
+	sink(m2.find("abc")); // tainted
+	sink(m3.find("abc"));
+	sink(m4.find("abc")); // tainted
+	sink(m5.find("abc")); // tainted
+	sink(m6.find("abc")); // tainted
+	sink(m1.find("def"));
+	sink(m2.find("def")); // [FALSE POSITIVE]
+	sink(m3.find("def"));
+	sink(m4.find("def")); // [FALSE POSITIVE]
+	sink(m5.find("def")); // [FALSE POSITIVE]
+	sink(m6.find("def")); // [FALSE POSITIVE]
+
+	// copy constructors and assignment
+	std::map<char *, char *> m7(m2);
+	std::map<char *, char *> m8 = m2;
+	std::map<char *, char *> m9;
+	m9 = m2;
+	sink(m7); // tainted
+	sink(m8); // tainted
+	sink(m9); // tainted
+	sink(m7.find("abc")); // tainted
+	sink(m8.find("abc")); // tainted
+	sink(m9.find("abc")); // tainted
+
+	// iterators
+	std::map<char *, char *>::iterator i1, i2, i3;
+	for (i1 = m1.begin(); i1 != m1.end(); i1++)
+	{
+		sink(*i1);
+		sink(i1->first);
+		sink(i1->second);
+	}
+	for (i2 = m2.begin(); i2 != m2.end(); i2++)
+	{
+		sink(*i2); // tainted
+		sink(i2->first); // [FALSE POSITIVE]
+		sink(i2->second); // tainted
+	}
+	for (i3 = m3.begin(); i3 != m3.end(); i3++)
+	{
+		sink(*i3); // tainted [NOT DETECTED]
+		sink(i2->first); // tainted
+		sink(i2->second); // [FALSE POSITIVE]
+	}
+
+	// array-like access
+	std::map<char *, char *> m10, m11, m12, m13;
+	sink(m10["abc"] = "def");
+	sink(m11["abc"] = source()); // tainted
+	sink(m12.at("abc") = "def");
+	sink(m13.at("abc") = source()); // tainted
+	sink(m10["abc"]);
+	sink(m11["abc"]); // tainted
+	sink(m12["abc"]);
+	sink(m13["abc"]); // tainted
+
+	// ranges
+	std::map<char *, char *> m14;
+	m14.insert(std::make_pair("a", "a"));
+	m14.insert(std::make_pair("b", source()));
+	m14.insert(std::make_pair("c", source()));
+	m14.insert(std::make_pair("d", "d"));
+	sink(m2.lower_bound("b")); // tainted
+	sink(m2.upper_bound("b")); // tainted
+	sink(m2.equal_range("b").first); // tainted
+	sink(m2.equal_range("b").second); // tainted
+	sink(m2.upper_bound("c")); // [FALSE POSITIVE]
+	sink(m2.equal_range("c").second); // [FALSE POSITIVE]
+
+	// swap
+	std::map<char *, char *> m15, m16, m17, m18;
+	m15.insert(std::pair<char *, char *>(source(), source()));
+	m18.insert(std::pair<char *, char *>(source(), source()));
+	sink(m15); // tainted
+	sink(m16);
+	sink(m17);
+	sink(m18); // tainted
+	m15.swap(m16);
+	m17.swap(m18);
+	sink(m15); // [FALSE POSITIVE]
+	sink(m16); // tainted
+	sink(m17); // tainted
+	sink(m18); // [FALSE POSITIVE]
+
+	// merge
+	std::map<char *, char *> m19, m20, m21, m22;
+	m19.insert(std::pair<char *, char *>(source(), source()));
+	m20.insert(std::pair<char *, char *>("abc", "def"));
+	m21.insert(std::pair<char *, char *>("abc", "def"));
+	m22.insert(std::pair<char *, char *>(source(), source()));
+	sink(m19); // tainted
+	sink(m20);
+	sink(m21);
+	sink(m22); // tainted
+	m19.merge(m20);
+	m21.merge(m22);
+	sink(m19); // tainted
+	sink(m20);
+	sink(m21); // tainted
+	sink(m22); // tainted
+
+	// erase, clear
+	std::map<char *, char *> m23;
+	m23.insert(std::pair<char *, char *>(source(), source()));
+	m23.insert(std::pair<char *, char *>(source(), source()));
+	sink(m23); // tainted
+	sink(m23.erase(m23.begin())); // tainted
+	sink(m23); // tainted
+	m23.clear();
+	sink(m23); // [FALSE POSITIVE]
+
+	// emplace, emplace_hint
+	std::map<char *, char *> m24, m25;
+	sink(m24.emplace("abc", "def").first);
+	sink(m24);
+	sink(m24.emplace("abc", source()).first); // tainted
+	sink(m24); // tainted
+	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
+	sink(m25);
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted
+	sink(m25); // tainted
+	
+	// try_emplace
+	std::map<char *, char *> m26, m27;
+	sink(m26.try_emplace("abc", "def").first);
+	sink(m26);
+	sink(m26.try_emplace("abc", source()).first); // tainted
+	sink(m26); // tainted
+	sink(m27.try_emplace(m27.begin(), "abc", "def"));
+	sink(m27);
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted
+	sink(m27); // tainted
+}
+
+void test_unordered_map()
+{
+	// insert
+	std::unordered_map<char *, char *> m1, m2, m3, m4, m5, m6;
+
+	sink(m1.insert(std::make_pair("abc", "def")).first);
+	sink(m2.insert(std::make_pair("abc", source())).first); // tainted
+	sink(m3.insert(std::make_pair(source(), "def")).first); // tainted [NOT DETECTED]
+	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // tainted
+	sink(m5.insert_or_assign("abc", source()).first); // tainted
+	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // tainted
+	sink(m1);
+	sink(m2); // tainted
+	sink(m3); // tainted [NOT DETECTED]
+	sink(m4); // tainted
+	sink(m5); // tainted
+	sink(m6); // tainted
+	sink(m1.find("abc"));
+	sink(m2.find("abc")); // tainted
+	sink(m3.find("abc"));
+	sink(m4.find("abc")); // tainted
+	sink(m5.find("abc")); // tainted
+	sink(m6.find("abc")); // tainted
+	sink(m1.find("def"));
+	sink(m2.find("def")); // [FALSE POSITIVE]
+	sink(m3.find("def"));
+	sink(m4.find("def")); // [FALSE POSITIVE]
+	sink(m5.find("def")); // [FALSE POSITIVE]
+	sink(m6.find("def")); // [FALSE POSITIVE]
+
+	// copy constructors and assignment
+	std::unordered_map<char *, char *> m7(m2);
+	std::unordered_map<char *, char *> m8 = m2;
+	std::unordered_map<char *, char *> m9;
+	m9 = m2;
+	sink(m7); // tainted
+	sink(m8); // tainted
+	sink(m9); // tainted
+	sink(m7.find("abc")); // tainted
+	sink(m8.find("abc")); // tainted
+	sink(m9.find("abc")); // tainted
+
+	// iterators
+	std::unordered_map<char *, char *>::iterator i1, i2, i3;
+	for (i1 = m1.begin(); i1 != m1.end(); i1++)
+	{
+		sink(*i1);
+		sink(i1->first);
+		sink(i1->second);
+	}
+	for (i2 = m2.begin(); i2 != m2.end(); i2++)
+	{
+		sink(*i2); // tainted
+		sink(i2->first); // [FALSE POSITIVE]
+		sink(i2->second); // tainted
+	}
+	for (i3 = m3.begin(); i3 != m3.end(); i3++)
+	{
+		sink(*i3); // tainted [NOT DETECTED]
+		sink(i2->first); // tainted
+		sink(i2->second); // [FALSE POSITIVE]
+	}
+
+	// array-like access
+	std::unordered_map<char *, char *> m10, m11, m12, m13;
+	sink(m10["abc"] = "def");
+	sink(m11["abc"] = source()); // tainted
+	sink(m12.at("abc") = "def");
+	sink(m13.at("abc") = source()); // tainted
+	sink(m10["abc"]);
+	sink(m11["abc"]); // tainted
+	sink(m12["abc"]);
+	sink(m13["abc"]); // tainted
+
+	// ranges
+	std::unordered_map<char *, char *> m14;
+	m14.insert(std::make_pair("a", "a"));
+	m14.insert(std::make_pair("b", source()));
+	m14.insert(std::make_pair("c", source()));
+	m14.insert(std::make_pair("d", "d"));
+	sink(m2.equal_range("b").first); // tainted
+	sink(m2.equal_range("b").second); // tainted
+	sink(m2.equal_range("c").second); // [FALSE POSITIVE]
+
+	// swap
+	std::unordered_map<char *, char *> m15, m16, m17, m18;
+	m15.insert(std::pair<char *, char *>(source(), source()));
+	m18.insert(std::pair<char *, char *>(source(), source()));
+	sink(m15); // tainted
+	sink(m16);
+	sink(m17);
+	sink(m18); // tainted
+	m15.swap(m16);
+	m17.swap(m18);
+	sink(m15); // [FALSE POSITIVE]
+	sink(m16); // tainted
+	sink(m17); // tainted
+	sink(m18); // [FALSE POSITIVE]
+
+	// merge
+	std::unordered_map<char *, char *> m19, m20, m21, m22;
+	m19.insert(std::pair<char *, char *>(source(), source()));
+	m20.insert(std::pair<char *, char *>("abc", "def"));
+	m21.insert(std::pair<char *, char *>("abc", "def"));
+	m22.insert(std::pair<char *, char *>(source(), source()));
+	sink(m19); // tainted
+	sink(m20);
+	sink(m21);
+	sink(m22); // tainted
+	m19.merge(m20);
+	m21.merge(m22);
+	sink(m19); // tainted
+	sink(m20);
+	sink(m21); // tainted
+	sink(m22); // tainted
+
+	// erase, clear
+	std::unordered_map<char *, char *> m23;
+	m23.insert(std::pair<char *, char *>(source(), source()));
+	m23.insert(std::pair<char *, char *>(source(), source()));
+	sink(m23); // tainted
+	sink(m23.erase(m23.begin())); // tainted
+	sink(m23); // tainted
+	m23.clear();
+	sink(m23); // [FALSE POSITIVE]
+
+	// emplace, emplace_hint
+	std::unordered_map<char *, char *> m24, m25;
+	sink(m24.emplace("abc", "def").first);
+	sink(m24);
+	sink(m24.emplace("abc", source()).first); // tainted
+	sink(m24); // tainted
+	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
+	sink(m25);
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted
+	sink(m25); // tainted
+
+	// try_emplace
+	std::unordered_map<char *, char *> m26, m27, m28;
+	sink(m26.try_emplace("abc", "def").first);
+	sink(m26.try_emplace("abc", "def").second);
+	sink(m26);
+	sink(m26.try_emplace("abc", source()).first); // tainted
+	sink(m26.try_emplace("abc", source()).second); // [FALSE POSITIVE]
+	sink(m26); // tainted
+	sink(m27.try_emplace(m27.begin(), "abc", "def"));
+	sink(m27);
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted
+	sink(m27); // tainted
+	sink(m28.try_emplace(m28.begin(), "abc", "def"));
+	sink(m28);
+	sink(m28.try_emplace(m28.begin(), source(), "def")); // tainted [NOT DETECTED]
+	sink(m28); // tainted [NOT DETECTED]
+
+	// additional try_emplace test cases
+	std::unordered_map<char *, std::pair<int, int>> m29, m30, m31, m32;
+	sink(m29.try_emplace("abc", 1, 2));
+	sink(m29);
+	sink(m29["abc"]);
+	sink(m30.try_emplace(source(), 1, 2)); // tainted [NOT DETECTED]
+	sink(m30); // tainted [NOT DETECTED]
+	sink(m30["abc"]);
+	sink(m31.try_emplace("abc", source(), 2)); // tainted
+	sink(m31); // tainted
+	sink(m31["abc"]); // tainted
+	sink(m32.try_emplace("abc", 1, source())); // tainted
+	sink(m32); // tainted
+	sink(m32["abc"]); // tainted
+
+	// additional emplace test cases
+	std::unordered_map<char *, char *> m33;
+	sink(m33.emplace(source(), "def").first); // tainted [NOT DETECTED]
+	sink(m33); // tainted [NOT DETECTED]
+
+	std::unordered_map<char *, char *> m34, m35;
+	sink(m34.emplace(std::pair<char *, char *>("abc", "def")).first);
+	sink(m34);
+	sink(m34.emplace(std::pair<char *, char *>("abc", source())).first); // tainted
+	sink(m34); // tainted
+	sink(m34.emplace_hint(m34.begin(), "abc", "def")); // tainted
+	sink(m35.emplace().first);
+	sink(m35);
+	sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // tainted [NOT DETECTED]
+	sink(m35); // tainted [NOT DETECTED]
+}

cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp

@@ -0,0 +1,238 @@
+
+#include "stl.h"
+
+using namespace std;
+
+char *source();
+
+void sink(char *);
+void sink(std::set<char *>);
+void sink(std::set<char *>::iterator);
+void sink(std::unordered_set<char *>);
+void sink(std::unordered_set<char *>::iterator);
+
+void test_set()
+{
+	// insert, find
+	std::set<char *> s1, s2, s3, s4, s5, s6;
+
+	sink(s1.insert("abc").first);
+	sink(s2.insert(source()).first); // tainted
+	sink(s3.insert(s3.begin(), "abc"));
+	sink(s4.insert(s4.begin(), source())); // tainted
+	s5.insert(s1.begin(), s1.end());
+	s6.insert(s2.begin(), s2.end());
+	sink(s1);
+	sink(s2); // tainted
+	sink(s3);
+	sink(s4); // tainted
+	sink(s5);
+	sink(s6); // tainted
+	sink(s1.find("abc"));
+	sink(s2.find("abc")); // tainted
+	sink(s3.find("abc"));
+	sink(s4.find("abc")); // tainted
+	sink(s5.find("abc"));
+	sink(s6.find("abc")); // tainted
+
+	// copy constructors and assignment
+	std::set<char *> s7(s2);
+	std::set<char *> s8 = s2;
+	std::set<char *> s9(s2.begin(), s2.end());
+	std::set<char *> s10;
+	s10 = s2;
+	sink(s7); // tainted
+	sink(s8); // tainted
+	sink(s9); // tainted
+	sink(s10); // tainted
+	sink(s7.find("abc")); // tainted
+	sink(s8.find("abc")); // tainted
+	sink(s9.find("abc")); // tainted
+	sink(s10.find("abc")); // tainted
+
+	// iterators
+	std::set<char *>::iterator i1, i2;
+	for (i1 = s1.begin(); i1 != s1.end(); i1++)
+	{
+		sink(*i1);
+	}
+	for (i2 = s2.begin(); i2 != s2.end(); i2++)
+	{
+		sink(*i2); // tainted
+	}
+
+	// ranges
+	std::set<char *> s11;
+	s11.insert("a");
+	s11.insert(source());
+	s11.insert("c");
+	sink(s11.lower_bound("b")); // tainted
+	sink(s11.upper_bound("b")); // tainted
+	sink(s11.equal_range("b").first); // tainted
+	sink(s11.equal_range("b").second); // tainted
+
+	// swap
+	std::set<char *> s12, s13, s14, s15;
+	s12.insert(source());
+	s15.insert(source());
+	sink(s12); // tainted
+	sink(s13);
+	sink(s14);
+	sink(s15); // tainted
+	s12.swap(s13);
+	s14.swap(s15);
+	sink(s12); // [FALSE POSITIVE]
+	sink(s13); // tainted
+	sink(s14); // tainted
+	sink(s15); // [FALSE POSITIVE]
+
+	// merge
+	std::set<char *> s16, s17, s18, s19;
+	s16.insert(source());
+	s17.insert("abc");
+	s18.insert("def");
+	s19.insert(source());
+	sink(s16); // tainted
+	sink(s17);
+	sink(s18);
+	sink(s19); // tainted
+	s16.merge(s17);
+	s18.merge(s19);
+	sink(s16); // tainted
+	sink(s17);
+	sink(s18); // tainted
+	sink(s19); // tainted
+
+	// erase, clear
+	std::set<char *> s20;
+	s20.insert(source());
+	s20.insert(source());
+	sink(s20); // tainted
+	sink(s20.erase(s20.begin())); // tainted
+	sink(s20); // tainted
+	s20.clear();
+	sink(s20); // [FALSE POSITIVE]
+
+	// emplace, emplace_hint
+	std::set<char *> s21, s22;
+	sink(s21.emplace("abc").first);
+	sink(s21);
+	sink(s21.emplace(source()).first); // tainted
+	sink(s21); // tainted
+	sink(s22.emplace_hint(s22.begin(), "abc"));
+	sink(s22);
+	sink(s22.emplace_hint(s22.begin(), source())); // tainted
+	sink(s22); // tainted
+}
+
+void test_unordered_set()
+{
+	// insert, find
+	std::unordered_set<char *> s1, s2, s3, s4, s5, s6;
+
+	sink(s1.insert("abc").first);
+	sink(s2.insert(source()).first); // tainted
+	sink(s3.insert(s3.begin(), "abc"));
+	sink(s4.insert(s4.begin(), source())); // tainted
+	s5.insert(s1.begin(), s1.end());
+	s6.insert(s2.begin(), s2.end());
+	sink(s1);
+	sink(s2); // tainted
+	sink(s3);
+	sink(s4); // tainted
+	sink(s5);
+	sink(s6); // tainted
+	sink(s1.find("abc"));
+	sink(s2.find("abc")); // tainted
+	sink(s3.find("abc"));
+	sink(s4.find("abc")); // tainted
+	sink(s5.find("abc"));
+	sink(s6.find("abc")); // tainted
+
+	// copy constructors and assignment
+	std::unordered_set<char *> s7(s2);
+	std::unordered_set<char *> s8 = s2;
+	std::unordered_set<char *> s9(s2.begin(), s2.end());
+	std::unordered_set<char *> s10;
+	s10 = s2;
+	sink(s7); // tainted
+	sink(s8); // tainted
+	sink(s9); // tainted
+	sink(s10); // tainted
+	sink(s7.find("abc")); // tainted
+	sink(s8.find("abc")); // tainted
+	sink(s9.find("abc")); // tainted
+	sink(s10.find("abc")); // tainted
+
+	// iterators
+	std::unordered_set<char *>::iterator i1, i2;
+	for (i1 = s1.begin(); i1 != s1.end(); i1++)
+	{
+		sink(*i1);
+	}
+	for (i2 = s2.begin(); i2 != s2.end(); i2++)
+	{
+		sink(*i2); // tainted
+	}
+
+	// ranges
+	std::unordered_set<char *> s11;
+	s11.insert("a");
+	s11.insert(source());
+	s11.insert("c");
+	sink(s11.equal_range("b").first); // tainted
+	sink(s11.equal_range("b").second); // tainted
+
+	// swap
+	std::unordered_set<char *> s12, s13, s14, s15;
+	s12.insert(source());
+	s15.insert(source());
+	sink(s12); // tainted
+	sink(s13);
+	sink(s14);
+	sink(s15); // tainted
+	s12.swap(s13);
+	s14.swap(s15);
+	sink(s12); // [FALSE POSITIVE]
+	sink(s13); // tainted
+	sink(s14); // tainted
+	sink(s15); // [FALSE POSITIVE]
+
+	// merge
+	std::unordered_set<char *> s16, s17, s18, s19;
+	s16.insert(source());
+	s17.insert("abc");
+	s18.insert("def");
+	s19.insert(source());
+	sink(s16); // tainted
+	sink(s17);
+	sink(s18);
+	sink(s19); // tainted
+	s16.merge(s17);
+	s18.merge(s19);
+	sink(s16); // tainted
+	sink(s17);
+	sink(s18); // tainted
+	sink(s19); // tainted
+
+	// erase, clear
+	std::unordered_set<char *> s20;
+	s20.insert(source());
+	s20.insert(source());
+	sink(s20); // tainted
+	sink(s20.erase(s20.begin())); // tainted
+	sink(s20); // tainted
+	s20.clear();
+	sink(s20); // [FALSE POSITIVE]
+
+	// emplace, emplace_hint
+	std::unordered_set<char *> s21, s22;
+	sink(s21.emplace("abc").first);
+	sink(s21);
+	sink(s21.emplace(source()).first); // tainted
+	sink(s21); // tainted
+	sink(s22.emplace_hint(s22.begin(), "abc"));
+	sink(s22);
+	sink(s22.emplace_hint(s22.begin(), source())); // tainted
+	sink(s22); // tainted
+}

cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp

@@ -37,15 +37,15 @@ public:
 };
 
 void test_typedefs(int_iterator_by_typedefs source1) {
-    sink(*source1);
-    sink(*(source1++));
-    sink(*(++source1));
+    sink(*source1); // tainted
+    sink(*(source1++)); // tainted
+    sink(*(++source1)); // tainted
 }
 
 void test_trait(int_iterator_by_trait source1) {
-    sink(*source1);
-    sink(*(source1++));
-    sink(*(++source1));
+    sink(*source1); // tainted
+    sink(*(source1++)); // tainted
+    sink(*(++source1)); // tainted
 }
 
 void test_non_iterator(non_iterator source1) {

cpp/ql/test/library-tests/dataflow/taint-tests/stl.h

@@ -11,6 +11,25 @@ struct remove_const<const T> { typedef T type; };
 template<class T>
 using remove_const_t = typename remove_const<T>::type;
 
+template<class T>
+struct remove_reference { typedef T type; };
+
+template<class T>
+struct remove_reference<T &> { typedef T type; };
+
+template<class T>
+struct remove_reference<T &&> { typedef T type; };
+
+// `remove_reference_t<T>` removes any `&` from `T`
+template<class T>
+using remove_reference_t = typename remove_reference<T>::type;
+
+namespace std
+{
+	template<class T> constexpr T&& forward(remove_reference_t<T>& t) noexcept;
+	template<class T> constexpr T&& forward(remove_reference_t<T>&& t) noexcept;
+}
+
 // --- iterator ---
 
 namespace std {
@@ -36,6 +55,7 @@ namespace std {
 		bool operator==(iterator other) const;
 		bool operator!=(iterator other) const;
 		reference_type operator*() const;
+		pointer_type operator->() const;
 		iterator operator+(int);
 		iterator operator-(int);
 		iterator &operator+=(int);
@@ -128,7 +148,12 @@ namespace std
 	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const charT* rhs);
 
 	typedef basic_string<char> string;
+}
 
+// --- istring / ostream / stringstream ---
+
+namespace std
+{
 	template <class charT, class traits = char_traits<charT> >
 	class basic_istream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
 	public:
@@ -301,3 +326,264 @@ namespace std {
 
 	template<typename T, class... Args> shared_ptr<T> make_shared(Args&&...);
 }
+
+// --- pair ---
+
+namespace std {
+	template <class T1, class T2>
+	struct pair {
+		typedef T1 first_type;
+		typedef T2 second_type;
+
+		T1 first;
+		T2 second;
+		pair();
+		pair(const T1& x, const T2& y) : first(x), second(y) {};
+		template<class U, class V> pair(const pair<U, V> &p);
+
+		void swap(pair& p) /*noexcept(...)*/;
+	};
+
+	template<class T1, class T2> constexpr pair<remove_reference_t<T1>, remove_reference_t<T2>> make_pair(T1&& x, T2&& y) {
+		return pair<T1, T2>(std::forward<T1>(x), std::forward<T2>(y));
+	}
+}
+
+// --- map ---
+
+namespace std {
+	template<class T = void> struct less;
+
+	template<class Key, class T, class Compare = less<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		map() /*: map(Compare()) { }*/;
+		map(const map& x);
+		map(map&& x);
+		~map();
+
+		map& operator=(const map& x);
+		map& operator=(map&& x) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		T& operator[](const key_type& x);
+		T& operator[](key_type&& x);
+		T& at(const key_type& x);
+		const T& at(const key_type& x) const;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& x);
+		pair<iterator, bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(map&) /*noexcept(/*==allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(map<Key, T, C2, Allocator>& source);
+		template<class C2> void merge(map<Key, T, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class T> struct hash;
+	template<class T = void> struct equal_to;
+
+	template<class Key, class T, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class unordered_map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_map();
+		unordered_map(const unordered_map&);
+		unordered_map(unordered_map&&);
+		~unordered_map();
+
+		unordered_map& operator=(const unordered_map&);
+		unordered_map& operator=(unordered_map&&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		mapped_type& operator[](const key_type& k);
+		mapped_type& operator[](key_type&& k);
+		mapped_type& at(const key_type& k);
+		const mapped_type& at(const key_type& k) const;
+		
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_map&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+};
+
+// --- set ---
+
+namespace std {
+	template<class Key, class Compare = less<Key>, class Allocator = allocator<Key>>
+	class set {
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using size_type = size_t;
+		using allocator_type = Allocator;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		set() /*: set(Compare())*/ { }
+		set(const set& x);
+		set(set&& x);
+		template<class InputIterator> set(InputIterator first, InputIterator last/*, const Compare& comp = Compare(), const Allocator& = Allocator()*/);
+		~set();
+		
+		set& operator=(const set& x);
+		set& operator=(set&& x) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator,bool> insert(const value_type& x);
+		pair<iterator,bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+		
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last); 
+		void swap(set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(set<Key, C2, Allocator>& source);
+		template<class C2> void merge(set<Key, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+		
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class Key, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<Key>>
+	class unordered_set { 
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using hasher = Hash;
+		using key_equal = Pred;
+		using allocator_type = Allocator;
+		using size_type = size_t;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_set();
+		unordered_set(const unordered_set&);
+		unordered_set(unordered_set&&);
+		template<class InputIterator> unordered_set(InputIterator f, InputIterator l, size_type n = 0/*, const hasher& hf = hasher(), const key_equal& eql = key_equal(), const allocator_type& a = allocator_type()*/);
+		~unordered_set();
+
+		unordered_set& operator=(const unordered_set&);
+		unordered_set& operator=(unordered_set&&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+		
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+}

cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp

@@ -18,6 +18,7 @@ void sink(const char *s);
 void sink(const std::string &s);
 void sink(const char *filename, const char *mode);
 void sink(char);
+void sink(std::string::iterator);
 
 void test_string()
 {
@@ -349,6 +350,7 @@ void test_string_data_more()
 	sink(str); // tainted
 	sink(str.data()); // tainted
 }
+
 void test_string_iterators() {
 	// string append
 	{
@@ -389,7 +391,7 @@ void test_string_iterators() {
 		string::iterator i1 = s1.begin();
 
 		string::iterator i2 = s2.begin();
-		string::iterator i3, i4, i5, i6, i7, i8, i9;
+		string::iterator i3, i4, i5, i6, i7, i8, i9, i10, i11;
 
 		sink(*(i2+1)); //tainted
 		sink(*(i2-1)); // tainted
@@ -411,6 +413,13 @@ void test_string_iterators() {
 		i9 = s2.end();
 		--i9;
 		sink(*i9); // tainted
+
+		i10 = i2;
+		sink(*(i10++)); // tainted
+		sink(i10); // tainted
+		i11 = i2;
+		sink(*(i11--)); // tainted
+		sink(i11); // tainted
 	}
 }
 
@@ -428,8 +437,6 @@ void test_string_insert_more()
 	sink(s2); // tainted
 }
 
-void sink(std::string::iterator);
-
 void test_string_iterator_methods()
 {
 	{

cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

@@ -33,6 +33,134 @@
 | format.cpp:115:8:115:13 | buffer | format.cpp:114:37:114:50 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
+| map.cpp:29:9:29:13 | first | map.cpp:28:12:28:17 | call to source |
+| map.cpp:35:9:35:14 | second | map.cpp:33:13:33:18 | call to source |
+| map.cpp:44:9:44:13 | first | map.cpp:43:30:43:35 | call to source |
+| map.cpp:50:9:50:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:51:7:51:7 | f | map.cpp:48:37:48:42 | call to source |
+| map.cpp:55:9:55:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:56:7:56:7 | g | map.cpp:48:37:48:42 | call to source |
+| map.cpp:61:9:61:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:62:7:62:7 | h | map.cpp:48:37:48:42 | call to source |
+| map.cpp:72:7:72:7 | i | map.cpp:65:37:65:42 | call to source |
+| map.cpp:74:9:74:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:75:7:75:7 | j | map.cpp:65:37:65:42 | call to source |
+| map.cpp:77:9:77:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:78:7:78:7 | k | map.cpp:66:37:66:42 | call to source |
+| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
+| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
+| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
+| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
+| map.cpp:114:7:114:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:116:7:116:8 | call to map | map.cpp:110:62:110:67 | call to source |
+| map.cpp:117:7:117:8 | call to map | map.cpp:111:34:111:39 | call to source |
+| map.cpp:118:7:118:8 | call to map | map.cpp:112:46:112:51 | call to source |
+| map.cpp:120:10:120:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:122:10:122:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:123:10:123:13 | call to find | map.cpp:111:34:111:39 | call to source |
+| map.cpp:124:10:124:13 | call to find | map.cpp:112:46:112:51 | call to source |
+| map.cpp:126:10:126:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:128:10:128:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:129:10:129:13 | call to find | map.cpp:111:34:111:39 | call to source |
+| map.cpp:130:10:130:13 | call to find | map.cpp:112:46:112:51 | call to source |
+| map.cpp:137:7:137:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:138:7:138:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:139:7:139:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:140:10:140:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:141:10:141:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:142:10:142:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:154:8:154:10 | call to pair | map.cpp:108:39:108:44 | call to source |
+| map.cpp:168:7:168:27 | ... = ... | map.cpp:168:20:168:25 | call to source |
+| map.cpp:170:7:170:30 | ... = ... | map.cpp:170:23:170:28 | call to source |
+| map.cpp:172:10:172:10 | call to operator[] | map.cpp:168:20:168:25 | call to source |
+| map.cpp:174:10:174:10 | call to operator[] | map.cpp:170:23:170:28 | call to source |
+| map.cpp:182:10:182:20 | call to lower_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:183:10:183:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:186:10:186:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:193:7:193:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:196:7:196:9 | call to map | map.cpp:192:49:192:54 | call to source |
+| map.cpp:199:7:199:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:200:7:200:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:201:7:201:9 | call to map | map.cpp:192:49:192:54 | call to source |
+| map.cpp:202:7:202:9 | call to map | map.cpp:192:49:192:54 | call to source |
+| map.cpp:210:7:210:9 | call to map | map.cpp:206:49:206:54 | call to source |
+| map.cpp:213:7:213:9 | call to map | map.cpp:209:49:209:54 | call to source |
+| map.cpp:216:7:216:9 | call to map | map.cpp:206:49:206:54 | call to source |
+| map.cpp:218:7:218:9 | call to map | map.cpp:209:49:209:54 | call to source |
+| map.cpp:219:7:219:9 | call to map | map.cpp:209:49:209:54 | call to source |
+| map.cpp:225:7:225:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:225:7:225:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:223:49:223:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:224:49:224:54 | call to source |
+| map.cpp:227:7:227:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:227:7:227:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:229:7:229:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:229:7:229:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:236:7:236:9 | call to map | map.cpp:235:26:235:31 | call to source |
+| map.cpp:239:11:239:22 | call to emplace_hint | map.cpp:239:44:239:49 | call to source |
+| map.cpp:240:7:240:9 | call to map | map.cpp:239:44:239:49 | call to source |
+| map.cpp:247:7:247:9 | call to map | map.cpp:246:30:246:35 | call to source |
+| map.cpp:250:11:250:21 | call to try_emplace | map.cpp:250:43:250:48 | call to source |
+| map.cpp:251:7:251:9 | call to map | map.cpp:250:43:250:48 | call to source |
+| map.cpp:262:10:262:15 | call to insert | map.cpp:262:62:262:67 | call to source |
+| map.cpp:264:10:264:25 | call to insert_or_assign | map.cpp:264:46:264:51 | call to source |
+| map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:268:7:268:8 | call to unordered_map | map.cpp:262:62:262:67 | call to source |
+| map.cpp:269:7:269:8 | call to unordered_map | map.cpp:263:34:263:39 | call to source |
+| map.cpp:270:7:270:8 | call to unordered_map | map.cpp:264:46:264:51 | call to source |
+| map.cpp:272:10:272:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:274:10:274:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:275:10:275:13 | call to find | map.cpp:263:34:263:39 | call to source |
+| map.cpp:276:10:276:13 | call to find | map.cpp:264:46:264:51 | call to source |
+| map.cpp:278:10:278:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:280:10:280:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:281:10:281:13 | call to find | map.cpp:263:34:263:39 | call to source |
+| map.cpp:282:10:282:13 | call to find | map.cpp:264:46:264:51 | call to source |
+| map.cpp:289:7:289:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:290:7:290:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:291:7:291:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:292:10:292:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:293:10:293:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:294:10:294:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:306:8:306:10 | call to pair | map.cpp:260:39:260:44 | call to source |
+| map.cpp:320:7:320:27 | ... = ... | map.cpp:320:20:320:25 | call to source |
+| map.cpp:322:7:322:30 | ... = ... | map.cpp:322:23:322:28 | call to source |
+| map.cpp:324:10:324:10 | call to operator[] | map.cpp:320:20:320:25 | call to source |
+| map.cpp:326:10:326:10 | call to operator[] | map.cpp:322:23:322:28 | call to source |
+| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
+| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:349:7:349:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:350:7:350:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
+| map.cpp:351:7:351:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
+| map.cpp:359:7:359:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
+| map.cpp:362:7:362:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
+| map.cpp:365:7:365:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
+| map.cpp:367:7:367:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
+| map.cpp:368:7:368:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
+| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:372:49:372:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:373:49:373:54 | call to source |
+| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:385:7:385:9 | call to unordered_map | map.cpp:384:26:384:31 | call to source |
+| map.cpp:388:11:388:22 | call to emplace_hint | map.cpp:388:44:388:49 | call to source |
+| map.cpp:389:7:389:9 | call to unordered_map | map.cpp:388:44:388:49 | call to source |
+| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:396:30:396:35 | call to source |
+| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:397:30:397:35 | call to source |
+| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
+| map.cpp:402:7:402:9 | call to unordered_map | map.cpp:401:43:401:48 | call to source |
+| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:417:7:417:9 | call to unordered_map | map.cpp:416:30:416:35 | call to source |
+| map.cpp:418:7:418:16 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:420:7:420:9 | call to unordered_map | map.cpp:419:33:419:38 | call to source |
+| map.cpp:421:7:421:16 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:432:7:432:9 | call to unordered_map | map.cpp:431:52:431:57 | call to source |
+| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
 | movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
 | movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
 | movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |
@@ -40,6 +168,84 @@
 | movableclass.cpp:55:8:55:9 | s2 | movableclass.cpp:52:23:52:28 | call to source |
 | movableclass.cpp:64:8:64:9 | s2 | movableclass.cpp:23:55:23:60 | call to source |
 | movableclass.cpp:65:11:65:11 | call to operator= | movableclass.cpp:65:13:65:18 | call to source |
+| set.cpp:22:10:22:15 | call to insert | set.cpp:22:29:22:34 | call to source |
+| set.cpp:26:7:26:8 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:28:7:28:8 | call to set | set.cpp:22:29:22:34 | call to source |
+| set.cpp:30:7:30:8 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:32:10:32:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:34:10:34:13 | call to find | set.cpp:22:29:22:34 | call to source |
+| set.cpp:36:10:36:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:44:7:44:8 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:45:7:45:8 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:46:7:46:8 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:47:7:47:9 | call to set | set.cpp:20:17:20:22 | call to source |
+| set.cpp:48:10:48:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:49:10:49:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:50:10:50:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
+| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:78:7:78:9 | call to set | set.cpp:76:13:76:18 | call to source |
+| set.cpp:81:7:81:9 | call to set | set.cpp:77:13:77:18 | call to source |
+| set.cpp:84:7:84:9 | call to set | set.cpp:76:13:76:18 | call to source |
+| set.cpp:85:7:85:9 | call to set | set.cpp:76:13:76:18 | call to source |
+| set.cpp:86:7:86:9 | call to set | set.cpp:77:13:77:18 | call to source |
+| set.cpp:87:7:87:9 | call to set | set.cpp:77:13:77:18 | call to source |
+| set.cpp:95:7:95:9 | call to set | set.cpp:91:13:91:18 | call to source |
+| set.cpp:98:7:98:9 | call to set | set.cpp:94:13:94:18 | call to source |
+| set.cpp:101:7:101:9 | call to set | set.cpp:91:13:91:18 | call to source |
+| set.cpp:103:7:103:9 | call to set | set.cpp:94:13:94:18 | call to source |
+| set.cpp:104:7:104:9 | call to set | set.cpp:94:13:94:18 | call to source |
+| set.cpp:110:7:110:9 | call to set | set.cpp:108:13:108:18 | call to source |
+| set.cpp:110:7:110:9 | call to set | set.cpp:109:13:109:18 | call to source |
+| set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
+| set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
+| set.cpp:112:7:112:9 | call to set | set.cpp:108:13:108:18 | call to source |
+| set.cpp:112:7:112:9 | call to set | set.cpp:109:13:109:18 | call to source |
+| set.cpp:114:7:114:9 | call to set | set.cpp:108:13:108:18 | call to source |
+| set.cpp:114:7:114:9 | call to set | set.cpp:109:13:109:18 | call to source |
+| set.cpp:121:7:121:9 | call to set | set.cpp:120:19:120:24 | call to source |
+| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
+| set.cpp:125:7:125:9 | call to set | set.cpp:124:37:124:42 | call to source |
+| set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
+| set.cpp:140:7:140:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:142:7:142:8 | call to unordered_set | set.cpp:136:29:136:34 | call to source |
+| set.cpp:144:7:144:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:146:10:146:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:148:10:148:13 | call to find | set.cpp:136:29:136:34 | call to source |
+| set.cpp:150:10:150:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:158:7:158:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:159:7:159:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:160:7:160:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:161:7:161:9 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
+| set.cpp:162:10:162:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:163:10:163:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:164:10:164:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:165:11:165:14 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:175:8:175:8 | call to operator* | set.cpp:134:17:134:22 | call to source |
+| set.cpp:190:7:190:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
+| set.cpp:193:7:193:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
+| set.cpp:196:7:196:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
+| set.cpp:197:7:197:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
+| set.cpp:198:7:198:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
+| set.cpp:199:7:199:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
+| set.cpp:207:7:207:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
+| set.cpp:210:7:210:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
+| set.cpp:213:7:213:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
+| set.cpp:215:7:215:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
+| set.cpp:216:7:216:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
+| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
+| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
+| set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
+| set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
+| set.cpp:224:7:224:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
+| set.cpp:224:7:224:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
+| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
+| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
+| set.cpp:233:7:233:9 | call to unordered_set | set.cpp:232:19:232:24 | call to source |
+| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
+| set.cpp:237:7:237:9 | call to unordered_set | set.cpp:236:37:236:42 | call to source |
 | smart_pointer.cpp:12:10:12:10 | call to operator* | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:13:10:13:10 | p | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:24:10:24:10 | call to operator* | smart_pointer.cpp:23:52:23:57 | call to source |
@@ -52,119 +258,123 @@
 | standalone_iterators.cpp:46:10:46:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
 | standalone_iterators.cpp:47:10:47:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
 | standalone_iterators.cpp:48:10:48:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
-| string.cpp:28:7:28:7 | a | string.cpp:24:12:24:17 | call to source |
-| string.cpp:30:7:30:7 | c | string.cpp:26:16:26:21 | call to source |
-| string.cpp:32:9:32:13 | call to c_str | string.cpp:26:16:26:21 | call to source |
-| string.cpp:38:13:38:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
-| string.cpp:42:13:42:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
-| string.cpp:45:13:45:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
-| string.cpp:55:7:55:8 | cs | string.cpp:50:19:50:24 | call to source |
-| string.cpp:56:7:56:8 | ss | string.cpp:50:19:50:24 | call to source |
-| string.cpp:69:7:69:8 | cs | string.cpp:61:19:61:24 | call to source |
-| string.cpp:70:7:70:8 | ss | string.cpp:61:19:61:24 | call to source |
-| string.cpp:92:8:92:9 | s1 | string.cpp:87:18:87:23 | call to source |
-| string.cpp:93:8:93:9 | s2 | string.cpp:88:20:88:25 | call to source |
-| string.cpp:94:8:94:9 | s3 | string.cpp:90:8:90:13 | call to source |
-| string.cpp:113:8:113:9 | s1 | string.cpp:109:32:109:37 | call to source |
-| string.cpp:114:8:114:9 | s2 | string.cpp:111:20:111:25 | call to source |
-| string.cpp:121:8:121:8 | c | string.cpp:119:16:119:21 | call to source |
-| string.cpp:125:8:125:8 | call to operator* | string.cpp:119:16:119:21 | call to source |
-| string.cpp:129:8:129:8 | c | string.cpp:119:16:119:21 | call to source |
-| string.cpp:134:8:134:8 | c | string.cpp:132:28:132:33 | call to source |
-| string.cpp:144:11:144:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:145:11:145:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:146:11:146:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:149:11:149:11 | call to operator+ | string.cpp:149:13:149:18 | call to source |
-| string.cpp:158:8:158:9 | s5 | string.cpp:154:18:154:23 | call to source |
-| string.cpp:161:11:161:11 | call to operator+= | string.cpp:154:18:154:23 | call to source |
-| string.cpp:162:8:162:9 | s6 | string.cpp:154:18:154:23 | call to source |
-| string.cpp:165:11:165:11 | call to operator+= | string.cpp:165:14:165:19 | call to source |
-| string.cpp:166:11:166:11 | call to operator+= | string.cpp:165:14:165:19 | call to source |
-| string.cpp:167:8:167:9 | s7 | string.cpp:165:14:165:19 | call to source |
-| string.cpp:171:8:171:9 | s8 | string.cpp:154:18:154:23 | call to source |
-| string.cpp:176:8:176:9 | s9 | string.cpp:174:13:174:18 | call to source |
-| string.cpp:184:8:184:10 | s10 | string.cpp:181:12:181:26 | call to source |
-| string.cpp:198:10:198:15 | call to assign | string.cpp:190:17:190:22 | call to source |
-| string.cpp:199:7:199:8 | s4 | string.cpp:190:17:190:22 | call to source |
-| string.cpp:201:10:201:15 | call to assign | string.cpp:191:11:191:25 | call to source |
-| string.cpp:202:7:202:8 | s5 | string.cpp:191:11:191:25 | call to source |
-| string.cpp:205:7:205:8 | s6 | string.cpp:193:17:193:22 | call to source |
-| string.cpp:219:10:219:15 | call to insert | string.cpp:210:17:210:22 | call to source |
-| string.cpp:220:7:220:8 | s4 | string.cpp:210:17:210:22 | call to source |
-| string.cpp:223:10:223:15 | call to insert | string.cpp:210:17:210:22 | call to source |
-| string.cpp:224:7:224:8 | s5 | string.cpp:210:17:210:22 | call to source |
-| string.cpp:227:10:227:15 | call to insert | string.cpp:211:11:211:25 | call to source |
-| string.cpp:228:7:228:8 | s6 | string.cpp:211:11:211:25 | call to source |
-| string.cpp:242:10:242:16 | call to replace | string.cpp:233:17:233:22 | call to source |
-| string.cpp:243:7:243:8 | s4 | string.cpp:233:17:233:22 | call to source |
-| string.cpp:246:10:246:16 | call to replace | string.cpp:233:17:233:22 | call to source |
-| string.cpp:247:7:247:8 | s5 | string.cpp:233:17:233:22 | call to source |
-| string.cpp:250:10:250:16 | call to replace | string.cpp:234:11:234:25 | call to source |
-| string.cpp:251:7:251:8 | s6 | string.cpp:234:11:234:25 | call to source |
-| string.cpp:264:7:264:8 | b2 | string.cpp:258:17:258:22 | call to source |
-| string.cpp:274:7:274:8 | s2 | string.cpp:269:17:269:22 | call to source |
-| string.cpp:276:7:276:8 | s4 | string.cpp:271:17:271:22 | call to source |
-| string.cpp:281:7:281:8 | s1 | string.cpp:269:17:269:22 | call to source |
-| string.cpp:282:7:282:8 | s2 | string.cpp:269:17:269:22 | call to source |
-| string.cpp:283:7:283:8 | s3 | string.cpp:271:17:271:22 | call to source |
-| string.cpp:284:7:284:8 | s4 | string.cpp:271:17:271:22 | call to source |
-| string.cpp:292:7:292:8 | s1 | string.cpp:288:17:288:22 | call to source |
-| string.cpp:293:7:293:8 | s2 | string.cpp:289:17:289:22 | call to source |
-| string.cpp:294:7:294:8 | s3 | string.cpp:290:17:290:22 | call to source |
-| string.cpp:300:7:300:8 | s1 | string.cpp:288:17:288:22 | call to source |
-| string.cpp:302:7:302:8 | s3 | string.cpp:290:17:290:22 | call to source |
-| string.cpp:311:9:311:12 | call to data | string.cpp:308:16:308:21 | call to source |
-| string.cpp:322:9:322:14 | call to substr | string.cpp:319:16:319:21 | call to source |
-| string.cpp:339:7:339:7 | a | string.cpp:335:9:335:23 | call to source |
-| string.cpp:340:7:340:7 | b | string.cpp:336:12:336:26 | call to source |
-| string.cpp:341:7:341:7 | c | string.cpp:335:9:335:23 | call to source |
-| string.cpp:349:7:349:9 | str | string.cpp:348:18:348:32 | call to source |
-| string.cpp:350:11:350:14 | call to data | string.cpp:348:18:348:32 | call to source |
-| string.cpp:361:11:361:16 | call to append | string.cpp:356:18:356:23 | call to source |
-| string.cpp:362:8:362:9 | s1 | string.cpp:356:18:356:23 | call to source |
-| string.cpp:380:8:380:8 | call to operator* | string.cpp:372:18:372:23 | call to source |
-| string.cpp:381:13:381:13 | call to operator[] | string.cpp:372:18:372:23 | call to source |
-| string.cpp:394:8:394:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:395:8:395:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:397:8:397:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:399:8:399:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:402:8:402:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:405:8:405:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:407:8:407:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:409:8:409:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:413:8:413:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:427:10:427:15 | call to insert | string.cpp:422:14:422:19 | call to source |
-| string.cpp:428:7:428:8 | s2 | string.cpp:422:14:422:19 | call to source |
-| string.cpp:442:10:442:15 | call to insert | string.cpp:442:32:442:46 | call to source |
-| string.cpp:443:8:443:8 | b | string.cpp:442:32:442:46 | call to source |
-| string.cpp:455:10:455:15 | call to insert | string.cpp:450:18:450:23 | call to source |
-| string.cpp:456:8:456:8 | d | string.cpp:450:18:450:23 | call to source |
-| string.cpp:458:11:458:16 | call to insert | string.cpp:450:18:450:23 | call to source |
-| string.cpp:459:8:459:9 | s2 | string.cpp:450:18:450:23 | call to source |
-| string.cpp:471:10:471:15 | call to append | string.cpp:466:18:466:23 | call to source |
-| string.cpp:472:8:472:8 | f | string.cpp:466:18:466:23 | call to source |
-| string.cpp:474:11:474:16 | call to append | string.cpp:466:18:466:23 | call to source |
-| string.cpp:475:8:475:9 | s4 | string.cpp:466:18:466:23 | call to source |
-| string.cpp:487:10:487:15 | call to assign | string.cpp:482:18:482:23 | call to source |
-| string.cpp:488:8:488:8 | h | string.cpp:482:18:482:23 | call to source |
-| string.cpp:491:8:491:9 | s6 | string.cpp:482:18:482:23 | call to source |
-| string.cpp:504:7:504:8 | s2 | string.cpp:497:14:497:19 | call to source |
-| string.cpp:506:7:506:8 | s4 | string.cpp:497:14:497:19 | call to source |
-| string.cpp:515:9:515:13 | call to front | string.cpp:514:14:514:28 | call to source |
-| string.cpp:516:9:516:12 | call to back | string.cpp:514:14:514:28 | call to source |
-| string.cpp:529:11:529:11 | call to operator+= | string.cpp:529:20:529:25 | call to source |
-| string.cpp:530:21:530:21 | call to operator+= | string.cpp:530:24:530:29 | call to source |
-| string.cpp:531:25:531:25 | call to operator+= | string.cpp:531:15:531:20 | call to source |
-| string.cpp:534:8:534:8 | c | string.cpp:529:20:529:25 | call to source |
-| string.cpp:535:8:535:8 | d | string.cpp:529:20:529:25 | call to source |
-| string.cpp:536:8:536:8 | e | string.cpp:530:24:530:29 | call to source |
-| string.cpp:537:8:537:8 | f | string.cpp:531:15:531:20 | call to source |
-| string.cpp:549:11:549:16 | call to assign | string.cpp:549:27:549:32 | call to source |
-| string.cpp:550:24:550:29 | call to assign | string.cpp:550:31:550:36 | call to source |
-| string.cpp:554:8:554:8 | c | string.cpp:549:27:549:32 | call to source |
-| string.cpp:555:8:555:8 | d | string.cpp:549:27:549:32 | call to source |
-| string.cpp:556:8:556:8 | e | string.cpp:550:31:550:36 | call to source |
-| string.cpp:557:8:557:8 | f | string.cpp:551:18:551:23 | call to source |
+| string.cpp:29:7:29:7 | a | string.cpp:25:12:25:17 | call to source |
+| string.cpp:31:7:31:7 | c | string.cpp:27:16:27:21 | call to source |
+| string.cpp:33:9:33:13 | call to c_str | string.cpp:27:16:27:21 | call to source |
+| string.cpp:39:13:39:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
+| string.cpp:43:13:43:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
+| string.cpp:46:13:46:17 | call to c_str | string.cpp:14:10:14:15 | call to source |
+| string.cpp:56:7:56:8 | cs | string.cpp:51:19:51:24 | call to source |
+| string.cpp:57:7:57:8 | ss | string.cpp:51:19:51:24 | call to source |
+| string.cpp:70:7:70:8 | cs | string.cpp:62:19:62:24 | call to source |
+| string.cpp:71:7:71:8 | ss | string.cpp:62:19:62:24 | call to source |
+| string.cpp:93:8:93:9 | s1 | string.cpp:88:18:88:23 | call to source |
+| string.cpp:94:8:94:9 | s2 | string.cpp:89:20:89:25 | call to source |
+| string.cpp:95:8:95:9 | s3 | string.cpp:91:8:91:13 | call to source |
+| string.cpp:114:8:114:9 | s1 | string.cpp:110:32:110:37 | call to source |
+| string.cpp:115:8:115:9 | s2 | string.cpp:112:20:112:25 | call to source |
+| string.cpp:122:8:122:8 | c | string.cpp:120:16:120:21 | call to source |
+| string.cpp:126:8:126:8 | call to operator* | string.cpp:120:16:120:21 | call to source |
+| string.cpp:130:8:130:8 | c | string.cpp:120:16:120:21 | call to source |
+| string.cpp:135:8:135:8 | c | string.cpp:133:28:133:33 | call to source |
+| string.cpp:145:11:145:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:146:11:146:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:147:11:147:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:150:11:150:11 | call to operator+ | string.cpp:150:13:150:18 | call to source |
+| string.cpp:159:8:159:9 | s5 | string.cpp:155:18:155:23 | call to source |
+| string.cpp:162:11:162:11 | call to operator+= | string.cpp:155:18:155:23 | call to source |
+| string.cpp:163:8:163:9 | s6 | string.cpp:155:18:155:23 | call to source |
+| string.cpp:166:11:166:11 | call to operator+= | string.cpp:166:14:166:19 | call to source |
+| string.cpp:167:11:167:11 | call to operator+= | string.cpp:166:14:166:19 | call to source |
+| string.cpp:168:8:168:9 | s7 | string.cpp:166:14:166:19 | call to source |
+| string.cpp:172:8:172:9 | s8 | string.cpp:155:18:155:23 | call to source |
+| string.cpp:177:8:177:9 | s9 | string.cpp:175:13:175:18 | call to source |
+| string.cpp:185:8:185:10 | s10 | string.cpp:182:12:182:26 | call to source |
+| string.cpp:199:10:199:15 | call to assign | string.cpp:191:17:191:22 | call to source |
+| string.cpp:200:7:200:8 | s4 | string.cpp:191:17:191:22 | call to source |
+| string.cpp:202:10:202:15 | call to assign | string.cpp:192:11:192:25 | call to source |
+| string.cpp:203:7:203:8 | s5 | string.cpp:192:11:192:25 | call to source |
+| string.cpp:206:7:206:8 | s6 | string.cpp:194:17:194:22 | call to source |
+| string.cpp:220:10:220:15 | call to insert | string.cpp:211:17:211:22 | call to source |
+| string.cpp:221:7:221:8 | s4 | string.cpp:211:17:211:22 | call to source |
+| string.cpp:224:10:224:15 | call to insert | string.cpp:211:17:211:22 | call to source |
+| string.cpp:225:7:225:8 | s5 | string.cpp:211:17:211:22 | call to source |
+| string.cpp:228:10:228:15 | call to insert | string.cpp:212:11:212:25 | call to source |
+| string.cpp:229:7:229:8 | s6 | string.cpp:212:11:212:25 | call to source |
+| string.cpp:243:10:243:16 | call to replace | string.cpp:234:17:234:22 | call to source |
+| string.cpp:244:7:244:8 | s4 | string.cpp:234:17:234:22 | call to source |
+| string.cpp:247:10:247:16 | call to replace | string.cpp:234:17:234:22 | call to source |
+| string.cpp:248:7:248:8 | s5 | string.cpp:234:17:234:22 | call to source |
+| string.cpp:251:10:251:16 | call to replace | string.cpp:235:11:235:25 | call to source |
+| string.cpp:252:7:252:8 | s6 | string.cpp:235:11:235:25 | call to source |
+| string.cpp:265:7:265:8 | b2 | string.cpp:259:17:259:22 | call to source |
+| string.cpp:275:7:275:8 | s2 | string.cpp:270:17:270:22 | call to source |
+| string.cpp:277:7:277:8 | s4 | string.cpp:272:17:272:22 | call to source |
+| string.cpp:282:7:282:8 | s1 | string.cpp:270:17:270:22 | call to source |
+| string.cpp:283:7:283:8 | s2 | string.cpp:270:17:270:22 | call to source |
+| string.cpp:284:7:284:8 | s3 | string.cpp:272:17:272:22 | call to source |
+| string.cpp:285:7:285:8 | s4 | string.cpp:272:17:272:22 | call to source |
+| string.cpp:293:7:293:8 | s1 | string.cpp:289:17:289:22 | call to source |
+| string.cpp:294:7:294:8 | s2 | string.cpp:290:17:290:22 | call to source |
+| string.cpp:295:7:295:8 | s3 | string.cpp:291:17:291:22 | call to source |
+| string.cpp:301:7:301:8 | s1 | string.cpp:289:17:289:22 | call to source |
+| string.cpp:303:7:303:8 | s3 | string.cpp:291:17:291:22 | call to source |
+| string.cpp:312:9:312:12 | call to data | string.cpp:309:16:309:21 | call to source |
+| string.cpp:323:9:323:14 | call to substr | string.cpp:320:16:320:21 | call to source |
+| string.cpp:340:7:340:7 | a | string.cpp:336:9:336:23 | call to source |
+| string.cpp:341:7:341:7 | b | string.cpp:337:12:337:26 | call to source |
+| string.cpp:342:7:342:7 | c | string.cpp:336:9:336:23 | call to source |
+| string.cpp:350:7:350:9 | str | string.cpp:349:18:349:32 | call to source |
+| string.cpp:351:11:351:14 | call to data | string.cpp:349:18:349:32 | call to source |
+| string.cpp:363:11:363:16 | call to append | string.cpp:358:18:358:23 | call to source |
+| string.cpp:364:8:364:9 | s1 | string.cpp:358:18:358:23 | call to source |
+| string.cpp:382:8:382:8 | call to operator* | string.cpp:374:18:374:23 | call to source |
+| string.cpp:383:13:383:13 | call to operator[] | string.cpp:374:18:374:23 | call to source |
+| string.cpp:396:8:396:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:397:8:397:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:399:8:399:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:401:8:401:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:404:8:404:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:407:8:407:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:409:8:409:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:411:8:411:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:415:8:415:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:418:8:418:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:419:8:419:10 | call to iterator | string.cpp:389:18:389:23 | call to source |
+| string.cpp:421:8:421:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:422:8:422:10 | call to iterator | string.cpp:389:18:389:23 | call to source |
+| string.cpp:436:10:436:15 | call to insert | string.cpp:431:14:431:19 | call to source |
+| string.cpp:437:7:437:8 | s2 | string.cpp:431:14:431:19 | call to source |
+| string.cpp:449:10:449:15 | call to insert | string.cpp:449:32:449:46 | call to source |
+| string.cpp:450:8:450:8 | b | string.cpp:449:32:449:46 | call to source |
+| string.cpp:462:10:462:15 | call to insert | string.cpp:457:18:457:23 | call to source |
+| string.cpp:463:8:463:8 | d | string.cpp:457:18:457:23 | call to source |
+| string.cpp:465:11:465:16 | call to insert | string.cpp:457:18:457:23 | call to source |
+| string.cpp:466:8:466:9 | s2 | string.cpp:457:18:457:23 | call to source |
+| string.cpp:478:10:478:15 | call to append | string.cpp:473:18:473:23 | call to source |
+| string.cpp:479:8:479:8 | f | string.cpp:473:18:473:23 | call to source |
+| string.cpp:481:11:481:16 | call to append | string.cpp:473:18:473:23 | call to source |
+| string.cpp:482:8:482:9 | s4 | string.cpp:473:18:473:23 | call to source |
+| string.cpp:494:10:494:15 | call to assign | string.cpp:489:18:489:23 | call to source |
+| string.cpp:495:8:495:8 | h | string.cpp:489:18:489:23 | call to source |
+| string.cpp:498:8:498:9 | s6 | string.cpp:489:18:489:23 | call to source |
+| string.cpp:511:7:511:8 | s2 | string.cpp:504:14:504:19 | call to source |
+| string.cpp:513:7:513:8 | s4 | string.cpp:504:14:504:19 | call to source |
+| string.cpp:522:9:522:13 | call to front | string.cpp:521:14:521:28 | call to source |
+| string.cpp:523:9:523:12 | call to back | string.cpp:521:14:521:28 | call to source |
+| string.cpp:536:11:536:11 | call to operator+= | string.cpp:536:20:536:25 | call to source |
+| string.cpp:537:21:537:21 | call to operator+= | string.cpp:537:24:537:29 | call to source |
+| string.cpp:538:25:538:25 | call to operator+= | string.cpp:538:15:538:20 | call to source |
+| string.cpp:541:8:541:8 | c | string.cpp:536:20:536:25 | call to source |
+| string.cpp:542:8:542:8 | d | string.cpp:536:20:536:25 | call to source |
+| string.cpp:543:8:543:8 | e | string.cpp:537:24:537:29 | call to source |
+| string.cpp:544:8:544:8 | f | string.cpp:538:15:538:20 | call to source |
+| string.cpp:556:11:556:16 | call to assign | string.cpp:556:27:556:32 | call to source |
+| string.cpp:557:24:557:29 | call to assign | string.cpp:557:31:557:36 | call to source |
+| string.cpp:561:8:561:8 | c | string.cpp:556:27:556:32 | call to source |
+| string.cpp:562:8:562:8 | d | string.cpp:556:27:556:32 | call to source |
+| string.cpp:563:8:563:8 | e | string.cpp:557:31:557:36 | call to source |
+| string.cpp:564:8:564:8 | f | string.cpp:558:18:558:23 | call to source |
 | stringstream.cpp:32:11:32:11 | call to operator<< | stringstream.cpp:32:14:32:19 | call to source |
 | stringstream.cpp:33:20:33:20 | call to operator<< | stringstream.cpp:33:23:33:28 | call to source |
 | stringstream.cpp:34:23:34:23 | call to operator<< | stringstream.cpp:34:14:34:19 | call to source |
@@ -429,3 +639,17 @@
 | vector.cpp:312:7:312:7 | d | vector.cpp:303:14:303:19 | call to source |
 | vector.cpp:324:7:324:8 | v2 | vector.cpp:318:15:318:20 | call to source |
 | vector.cpp:326:7:326:8 | v4 | vector.cpp:318:15:318:20 | call to source |
+| vector.cpp:342:7:342:8 | v1 | vector.cpp:341:8:341:13 | call to source |
+| vector.cpp:347:7:347:8 | v2 | vector.cpp:345:9:345:14 | call to source |
+| vector.cpp:357:7:357:8 | v4 | vector.cpp:330:10:330:15 | call to source |
+| vector.cpp:361:7:361:8 | v5 | vector.cpp:360:8:360:13 | call to source |
+| vector.cpp:363:7:363:8 | v5 | vector.cpp:360:8:360:13 | call to source |
+| vector.cpp:367:7:367:8 | v6 | vector.cpp:366:8:366:13 | call to source |
+| vector.cpp:369:7:369:8 | v6 | vector.cpp:366:8:366:13 | call to source |
+| vector.cpp:374:8:374:9 | v7 | vector.cpp:373:9:373:14 | call to source |
+| vector.cpp:379:7:379:8 | v7 | vector.cpp:373:9:373:14 | call to source |
+| vector.cpp:383:7:383:8 | v8 | vector.cpp:382:8:382:13 | call to source |
+| vector.cpp:385:7:385:8 | v8 | vector.cpp:382:8:382:13 | call to source |
+| vector.cpp:392:7:392:8 | v9 | vector.cpp:330:10:330:15 | call to source |
+| vector.cpp:392:7:392:8 | v9 | vector.cpp:389:8:389:13 | call to source |
+| vector.cpp:400:7:400:9 | v11 | vector.cpp:399:38:399:43 | call to source |

cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

@@ -17,67 +17,250 @@
 | copyableclass.cpp:67:11:67:21 | copyableclass.cpp:67:13:67:18 | IR only |
 | copyableclass_declonly.cpp:42:8:42:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
 | copyableclass_declonly.cpp:67:11:67:11 | copyableclass_declonly.cpp:67:13:67:18 | AST only |
+| map.cpp:49:9:49:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:54:9:54:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:60:9:60:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:70:9:70:13 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:71:9:71:14 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:73:9:73:13 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:76:9:76:13 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:79:9:79:13 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:80:9:80:14 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:90:34:90:38 | map.cpp:90:24:90:29 | IR only |
+| map.cpp:91:34:91:39 | map.cpp:91:24:91:29 | IR only |
+| map.cpp:108:7:108:54 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:111:7:111:48 | map.cpp:111:34:111:39 | IR only |
+| map.cpp:114:7:114:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:116:7:116:8 | map.cpp:110:62:110:67 | AST only |
+| map.cpp:117:7:117:8 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:118:7:118:8 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:123:10:123:13 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:124:10:124:13 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:129:10:129:13 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:130:10:130:13 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:137:7:137:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:138:7:138:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:139:7:139:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:140:10:140:13 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:141:10:141:13 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:155:12:155:16 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:156:12:156:17 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:161:12:161:16 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:162:12:162:17 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:172:10:172:10 | map.cpp:168:20:168:25 | AST only |
+| map.cpp:174:10:174:10 | map.cpp:170:23:170:28 | AST only |
+| map.cpp:184:7:184:31 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:185:7:185:32 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:187:7:187:32 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:193:7:193:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:196:7:196:9 | map.cpp:192:49:192:54 | AST only |
+| map.cpp:199:7:199:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:200:7:200:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:201:7:201:9 | map.cpp:192:49:192:54 | AST only |
+| map.cpp:202:7:202:9 | map.cpp:192:49:192:54 | AST only |
+| map.cpp:210:7:210:9 | map.cpp:206:49:206:54 | AST only |
+| map.cpp:213:7:213:9 | map.cpp:209:49:209:54 | AST only |
+| map.cpp:216:7:216:9 | map.cpp:206:49:206:54 | AST only |
+| map.cpp:218:7:218:9 | map.cpp:209:49:209:54 | AST only |
+| map.cpp:219:7:219:9 | map.cpp:209:49:209:54 | AST only |
+| map.cpp:225:7:225:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:225:7:225:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:227:7:227:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:227:7:227:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:229:7:229:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:229:7:229:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:235:7:235:40 | map.cpp:235:26:235:31 | IR only |
+| map.cpp:236:7:236:9 | map.cpp:235:26:235:31 | AST only |
+| map.cpp:240:7:240:9 | map.cpp:239:44:239:49 | AST only |
+| map.cpp:246:7:246:44 | map.cpp:246:30:246:35 | IR only |
+| map.cpp:247:7:247:9 | map.cpp:246:30:246:35 | AST only |
+| map.cpp:251:7:251:9 | map.cpp:250:43:250:48 | AST only |
+| map.cpp:260:7:260:54 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:263:7:263:48 | map.cpp:263:34:263:39 | IR only |
+| map.cpp:266:7:266:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:268:7:268:8 | map.cpp:262:62:262:67 | AST only |
+| map.cpp:269:7:269:8 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:270:7:270:8 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:275:10:275:13 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:276:10:276:13 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:281:10:281:13 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:282:10:282:13 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:289:7:289:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:290:7:290:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:291:7:291:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:292:10:292:13 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:293:10:293:13 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:307:12:307:16 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:308:12:308:17 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:313:12:313:16 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:314:12:314:17 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:324:10:324:10 | map.cpp:320:20:320:25 | AST only |
+| map.cpp:326:10:326:10 | map.cpp:322:23:322:28 | AST only |
+| map.cpp:334:7:334:31 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:335:7:335:32 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:336:7:336:32 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:342:7:342:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:345:7:345:9 | map.cpp:341:49:341:54 | AST only |
+| map.cpp:348:7:348:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:349:7:349:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:350:7:350:9 | map.cpp:341:49:341:54 | AST only |
+| map.cpp:351:7:351:9 | map.cpp:341:49:341:54 | AST only |
+| map.cpp:359:7:359:9 | map.cpp:355:49:355:54 | AST only |
+| map.cpp:362:7:362:9 | map.cpp:358:49:358:54 | AST only |
+| map.cpp:365:7:365:9 | map.cpp:355:49:355:54 | AST only |
+| map.cpp:367:7:367:9 | map.cpp:358:49:358:54 | AST only |
+| map.cpp:368:7:368:9 | map.cpp:358:49:358:54 | AST only |
+| map.cpp:374:7:374:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:374:7:374:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:376:7:376:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:376:7:376:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:378:7:378:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:378:7:378:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:384:7:384:40 | map.cpp:384:26:384:31 | IR only |
+| map.cpp:385:7:385:9 | map.cpp:384:26:384:31 | AST only |
+| map.cpp:389:7:389:9 | map.cpp:388:44:388:49 | AST only |
+| map.cpp:396:7:396:44 | map.cpp:396:30:396:35 | IR only |
+| map.cpp:397:40:397:45 | map.cpp:397:30:397:35 | IR only |
+| map.cpp:398:7:398:9 | map.cpp:396:30:396:35 | AST only |
+| map.cpp:398:7:398:9 | map.cpp:397:30:397:35 | AST only |
+| map.cpp:402:7:402:9 | map.cpp:401:43:401:48 | AST only |
+| map.cpp:417:7:417:9 | map.cpp:416:30:416:35 | AST only |
+| map.cpp:418:7:418:16 | map.cpp:416:30:416:35 | AST only |
+| map.cpp:420:7:420:9 | map.cpp:419:33:419:38 | AST only |
+| map.cpp:421:7:421:16 | map.cpp:419:33:419:38 | AST only |
+| map.cpp:431:7:431:67 | map.cpp:431:52:431:57 | IR only |
+| map.cpp:432:7:432:9 | map.cpp:431:52:431:57 | AST only |
 | movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
 | movableclass.cpp:65:11:65:21 | movableclass.cpp:65:13:65:18 | IR only |
+| set.cpp:20:7:20:31 | set.cpp:20:17:20:22 | IR only |
+| set.cpp:26:7:26:8 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:28:7:28:8 | set.cpp:22:29:22:34 | AST only |
+| set.cpp:30:7:30:8 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:44:7:44:8 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:45:7:45:8 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:46:7:46:8 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:47:7:47:9 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:48:10:48:13 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:49:10:49:13 | set.cpp:20:17:20:22 | AST only |
+| set.cpp:61:8:61:11 | set.cpp:20:17:20:22 | IR only |
+| set.cpp:71:7:71:32 | set.cpp:67:13:67:18 | IR only |
+| set.cpp:72:7:72:33 | set.cpp:67:13:67:18 | IR only |
+| set.cpp:78:7:78:9 | set.cpp:76:13:76:18 | AST only |
+| set.cpp:81:7:81:9 | set.cpp:77:13:77:18 | AST only |
+| set.cpp:84:7:84:9 | set.cpp:76:13:76:18 | AST only |
+| set.cpp:85:7:85:9 | set.cpp:76:13:76:18 | AST only |
+| set.cpp:86:7:86:9 | set.cpp:77:13:77:18 | AST only |
+| set.cpp:87:7:87:9 | set.cpp:77:13:77:18 | AST only |
+| set.cpp:95:7:95:9 | set.cpp:91:13:91:18 | AST only |
+| set.cpp:98:7:98:9 | set.cpp:94:13:94:18 | AST only |
+| set.cpp:101:7:101:9 | set.cpp:91:13:91:18 | AST only |
+| set.cpp:103:7:103:9 | set.cpp:94:13:94:18 | AST only |
+| set.cpp:104:7:104:9 | set.cpp:94:13:94:18 | AST only |
+| set.cpp:110:7:110:9 | set.cpp:108:13:108:18 | AST only |
+| set.cpp:110:7:110:9 | set.cpp:109:13:109:18 | AST only |
+| set.cpp:112:7:112:9 | set.cpp:108:13:108:18 | AST only |
+| set.cpp:112:7:112:9 | set.cpp:109:13:109:18 | AST only |
+| set.cpp:114:7:114:9 | set.cpp:108:13:108:18 | AST only |
+| set.cpp:114:7:114:9 | set.cpp:109:13:109:18 | AST only |
+| set.cpp:120:7:120:33 | set.cpp:120:19:120:24 | IR only |
+| set.cpp:121:7:121:9 | set.cpp:120:19:120:24 | AST only |
+| set.cpp:125:7:125:9 | set.cpp:124:37:124:42 | AST only |
+| set.cpp:134:7:134:31 | set.cpp:134:17:134:22 | IR only |
+| set.cpp:140:7:140:8 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:142:7:142:8 | set.cpp:136:29:136:34 | AST only |
+| set.cpp:144:7:144:8 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:158:7:158:8 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:159:7:159:8 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:160:7:160:8 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:161:7:161:9 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:162:10:162:13 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:163:10:163:13 | set.cpp:134:17:134:22 | AST only |
+| set.cpp:175:8:175:11 | set.cpp:134:17:134:22 | IR only |
+| set.cpp:183:7:183:32 | set.cpp:181:13:181:18 | IR only |
+| set.cpp:184:7:184:33 | set.cpp:181:13:181:18 | IR only |
+| set.cpp:190:7:190:9 | set.cpp:188:13:188:18 | AST only |
+| set.cpp:193:7:193:9 | set.cpp:189:13:189:18 | AST only |
+| set.cpp:196:7:196:9 | set.cpp:188:13:188:18 | AST only |
+| set.cpp:197:7:197:9 | set.cpp:188:13:188:18 | AST only |
+| set.cpp:198:7:198:9 | set.cpp:189:13:189:18 | AST only |
+| set.cpp:199:7:199:9 | set.cpp:189:13:189:18 | AST only |
+| set.cpp:207:7:207:9 | set.cpp:203:13:203:18 | AST only |
+| set.cpp:210:7:210:9 | set.cpp:206:13:206:18 | AST only |
+| set.cpp:213:7:213:9 | set.cpp:203:13:203:18 | AST only |
+| set.cpp:215:7:215:9 | set.cpp:206:13:206:18 | AST only |
+| set.cpp:216:7:216:9 | set.cpp:206:13:206:18 | AST only |
+| set.cpp:222:7:222:9 | set.cpp:220:13:220:18 | AST only |
+| set.cpp:222:7:222:9 | set.cpp:221:13:221:18 | AST only |
+| set.cpp:224:7:224:9 | set.cpp:220:13:220:18 | AST only |
+| set.cpp:224:7:224:9 | set.cpp:221:13:221:18 | AST only |
+| set.cpp:226:7:226:9 | set.cpp:220:13:220:18 | AST only |
+| set.cpp:226:7:226:9 | set.cpp:221:13:221:18 | AST only |
+| set.cpp:232:7:232:33 | set.cpp:232:19:232:24 | IR only |
+| set.cpp:233:7:233:9 | set.cpp:232:19:232:24 | AST only |
+| set.cpp:237:7:237:9 | set.cpp:236:37:236:42 | AST only |
 | smart_pointer.cpp:12:10:12:10 | smart_pointer.cpp:11:52:11:57 | AST only |
 | smart_pointer.cpp:24:10:24:10 | smart_pointer.cpp:23:52:23:57 | AST only |
 | standalone_iterators.cpp:41:10:41:10 | standalone_iterators.cpp:39:45:39:51 | AST only |
 | standalone_iterators.cpp:42:10:42:10 | standalone_iterators.cpp:39:45:39:51 | AST only |
 | standalone_iterators.cpp:47:10:47:10 | standalone_iterators.cpp:45:39:45:45 | AST only |
 | standalone_iterators.cpp:48:10:48:10 | standalone_iterators.cpp:45:39:45:45 | AST only |
-| string.cpp:32:9:32:13 | string.cpp:26:16:26:21 | AST only |
-| string.cpp:38:13:38:17 | string.cpp:14:10:14:15 | AST only |
-| string.cpp:42:13:42:17 | string.cpp:14:10:14:15 | AST only |
-| string.cpp:45:13:45:17 | string.cpp:14:10:14:15 | AST only |
-| string.cpp:69:7:69:8 | string.cpp:61:19:61:24 | AST only |
-| string.cpp:125:8:125:11 | string.cpp:119:16:119:21 | IR only |
-| string.cpp:161:11:161:11 | string.cpp:154:18:154:23 | AST only |
-| string.cpp:165:11:165:11 | string.cpp:165:14:165:19 | AST only |
-| string.cpp:166:11:166:11 | string.cpp:165:14:165:19 | AST only |
-| string.cpp:198:10:198:15 | string.cpp:190:17:190:22 | AST only |
-| string.cpp:201:10:201:15 | string.cpp:191:11:191:25 | AST only |
-| string.cpp:219:10:219:15 | string.cpp:210:17:210:22 | AST only |
-| string.cpp:223:10:223:15 | string.cpp:210:17:210:22 | AST only |
-| string.cpp:227:10:227:15 | string.cpp:211:11:211:25 | AST only |
-| string.cpp:242:10:242:16 | string.cpp:233:17:233:22 | AST only |
-| string.cpp:246:10:246:16 | string.cpp:233:17:233:22 | AST only |
-| string.cpp:250:10:250:16 | string.cpp:234:11:234:25 | AST only |
-| string.cpp:311:9:311:12 | string.cpp:308:16:308:21 | AST only |
-| string.cpp:339:7:339:7 | string.cpp:335:9:335:23 | AST only |
-| string.cpp:340:7:340:7 | string.cpp:336:12:336:26 | AST only |
-| string.cpp:341:7:341:7 | string.cpp:335:9:335:23 | AST only |
-| string.cpp:349:7:349:9 | string.cpp:348:18:348:32 | AST only |
-| string.cpp:350:11:350:14 | string.cpp:348:18:348:32 | AST only |
-| string.cpp:361:11:361:16 | string.cpp:356:18:356:23 | AST only |
-| string.cpp:380:8:380:14 | string.cpp:372:18:372:23 | IR only |
-| string.cpp:381:13:381:15 | string.cpp:372:18:372:23 | IR only |
-| string.cpp:394:8:394:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:395:8:395:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:397:8:397:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:399:8:399:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:402:8:402:11 | string.cpp:387:18:387:23 | IR only |
-| string.cpp:405:8:405:11 | string.cpp:387:18:387:23 | IR only |
-| string.cpp:407:8:407:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:409:8:409:8 | string.cpp:387:18:387:23 | AST only |
-| string.cpp:413:8:413:11 | string.cpp:387:18:387:23 | IR only |
-| string.cpp:427:10:427:15 | string.cpp:422:14:422:19 | AST only |
-| string.cpp:442:10:442:15 | string.cpp:442:32:442:46 | AST only |
-| string.cpp:455:10:455:15 | string.cpp:450:18:450:23 | AST only |
-| string.cpp:458:11:458:16 | string.cpp:450:18:450:23 | AST only |
-| string.cpp:471:10:471:15 | string.cpp:466:18:466:23 | AST only |
-| string.cpp:474:11:474:16 | string.cpp:466:18:466:23 | AST only |
-| string.cpp:487:10:487:15 | string.cpp:482:18:482:23 | AST only |
-| string.cpp:515:9:515:13 | string.cpp:514:14:514:28 | AST only |
-| string.cpp:516:9:516:12 | string.cpp:514:14:514:28 | AST only |
-| string.cpp:529:11:529:11 | string.cpp:529:20:529:25 | AST only |
-| string.cpp:530:21:530:21 | string.cpp:530:24:530:29 | AST only |
-| string.cpp:531:25:531:25 | string.cpp:531:15:531:20 | AST only |
-| string.cpp:534:8:534:8 | string.cpp:529:20:529:25 | AST only |
-| string.cpp:536:8:536:8 | string.cpp:530:24:530:29 | AST only |
-| string.cpp:549:11:549:16 | string.cpp:549:27:549:32 | AST only |
-| string.cpp:550:24:550:29 | string.cpp:550:31:550:36 | AST only |
-| string.cpp:554:8:554:8 | string.cpp:549:27:549:32 | AST only |
-| string.cpp:556:8:556:8 | string.cpp:550:31:550:36 | AST only |
+| string.cpp:33:9:33:13 | string.cpp:27:16:27:21 | AST only |
+| string.cpp:39:13:39:17 | string.cpp:14:10:14:15 | AST only |
+| string.cpp:43:13:43:17 | string.cpp:14:10:14:15 | AST only |
+| string.cpp:46:13:46:17 | string.cpp:14:10:14:15 | AST only |
+| string.cpp:70:7:70:8 | string.cpp:62:19:62:24 | AST only |
+| string.cpp:126:8:126:11 | string.cpp:120:16:120:21 | IR only |
+| string.cpp:162:11:162:11 | string.cpp:155:18:155:23 | AST only |
+| string.cpp:166:11:166:11 | string.cpp:166:14:166:19 | AST only |
+| string.cpp:167:11:167:11 | string.cpp:166:14:166:19 | AST only |
+| string.cpp:199:10:199:15 | string.cpp:191:17:191:22 | AST only |
+| string.cpp:202:10:202:15 | string.cpp:192:11:192:25 | AST only |
+| string.cpp:220:10:220:15 | string.cpp:211:17:211:22 | AST only |
+| string.cpp:224:10:224:15 | string.cpp:211:17:211:22 | AST only |
+| string.cpp:228:10:228:15 | string.cpp:212:11:212:25 | AST only |
+| string.cpp:243:10:243:16 | string.cpp:234:17:234:22 | AST only |
+| string.cpp:247:10:247:16 | string.cpp:234:17:234:22 | AST only |
+| string.cpp:251:10:251:16 | string.cpp:235:11:235:25 | AST only |
+| string.cpp:312:9:312:12 | string.cpp:309:16:309:21 | AST only |
+| string.cpp:340:7:340:7 | string.cpp:336:9:336:23 | AST only |
+| string.cpp:341:7:341:7 | string.cpp:337:12:337:26 | AST only |
+| string.cpp:342:7:342:7 | string.cpp:336:9:336:23 | AST only |
+| string.cpp:350:7:350:9 | string.cpp:349:18:349:32 | AST only |
+| string.cpp:351:11:351:14 | string.cpp:349:18:349:32 | AST only |
+| string.cpp:363:11:363:16 | string.cpp:358:18:358:23 | AST only |
+| string.cpp:382:8:382:14 | string.cpp:374:18:374:23 | IR only |
+| string.cpp:383:13:383:15 | string.cpp:374:18:374:23 | IR only |
+| string.cpp:396:8:396:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:397:8:397:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:399:8:399:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:401:8:401:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:404:8:404:11 | string.cpp:389:18:389:23 | IR only |
+| string.cpp:407:8:407:11 | string.cpp:389:18:389:23 | IR only |
+| string.cpp:409:8:409:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:411:8:411:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:415:8:415:11 | string.cpp:389:18:389:23 | IR only |
+| string.cpp:418:8:418:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:419:8:419:10 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:421:8:421:8 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:422:8:422:10 | string.cpp:389:18:389:23 | AST only |
+| string.cpp:436:10:436:15 | string.cpp:431:14:431:19 | AST only |
+| string.cpp:449:10:449:15 | string.cpp:449:32:449:46 | AST only |
+| string.cpp:462:10:462:15 | string.cpp:457:18:457:23 | AST only |
+| string.cpp:465:11:465:16 | string.cpp:457:18:457:23 | AST only |
+| string.cpp:478:10:478:15 | string.cpp:473:18:473:23 | AST only |
+| string.cpp:481:11:481:16 | string.cpp:473:18:473:23 | AST only |
+| string.cpp:494:10:494:15 | string.cpp:489:18:489:23 | AST only |
+| string.cpp:522:9:522:13 | string.cpp:521:14:521:28 | AST only |
+| string.cpp:523:9:523:12 | string.cpp:521:14:521:28 | AST only |
+| string.cpp:536:11:536:11 | string.cpp:536:20:536:25 | AST only |
+| string.cpp:537:21:537:21 | string.cpp:537:24:537:29 | AST only |
+| string.cpp:538:25:538:25 | string.cpp:538:15:538:20 | AST only |
+| string.cpp:541:8:541:8 | string.cpp:536:20:536:25 | AST only |
+| string.cpp:543:8:543:8 | string.cpp:537:24:537:29 | AST only |
+| string.cpp:556:11:556:16 | string.cpp:556:27:556:32 | AST only |
+| string.cpp:557:24:557:29 | string.cpp:557:31:557:36 | AST only |
+| string.cpp:561:8:561:8 | string.cpp:556:27:556:32 | AST only |
+| string.cpp:563:8:563:8 | string.cpp:557:31:557:36 | AST only |
 | stringstream.cpp:32:11:32:22 | stringstream.cpp:32:14:32:19 | IR only |
 | stringstream.cpp:33:20:33:31 | stringstream.cpp:33:23:33:28 | IR only |
 | stringstream.cpp:34:23:34:31 | stringstream.cpp:34:14:34:19 | IR only |
@@ -182,3 +365,17 @@
 | vector.cpp:292:7:292:18 | vector.cpp:289:17:289:30 | AST only |
 | vector.cpp:308:9:308:14 | vector.cpp:303:14:303:19 | AST only |
 | vector.cpp:311:9:311:14 | vector.cpp:303:14:303:19 | AST only |
+| vector.cpp:342:7:342:8 | vector.cpp:341:8:341:13 | AST only |
+| vector.cpp:347:7:347:8 | vector.cpp:345:9:345:14 | AST only |
+| vector.cpp:357:7:357:8 | vector.cpp:330:10:330:15 | AST only |
+| vector.cpp:361:7:361:8 | vector.cpp:360:8:360:13 | AST only |
+| vector.cpp:363:7:363:8 | vector.cpp:360:8:360:13 | AST only |
+| vector.cpp:367:7:367:8 | vector.cpp:366:8:366:13 | AST only |
+| vector.cpp:369:7:369:8 | vector.cpp:366:8:366:13 | AST only |
+| vector.cpp:374:8:374:9 | vector.cpp:373:9:373:14 | AST only |
+| vector.cpp:379:7:379:8 | vector.cpp:373:9:373:14 | AST only |
+| vector.cpp:383:7:383:8 | vector.cpp:382:8:382:13 | AST only |
+| vector.cpp:385:7:385:8 | vector.cpp:382:8:382:13 | AST only |
+| vector.cpp:392:7:392:8 | vector.cpp:330:10:330:15 | AST only |
+| vector.cpp:392:7:392:8 | vector.cpp:389:8:389:13 | AST only |
+| vector.cpp:400:7:400:9 | vector.cpp:399:38:399:43 | AST only |

cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

@@ -42,6 +42,91 @@
 | format.cpp:115:8:115:13 | Argument 0 indirection | format.cpp:114:37:114:50 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
+| map.cpp:29:9:29:13 | first | map.cpp:28:12:28:17 | call to source |
+| map.cpp:35:9:35:14 | second | map.cpp:33:13:33:18 | call to source |
+| map.cpp:44:9:44:13 | first | map.cpp:43:30:43:35 | call to source |
+| map.cpp:49:9:49:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:50:9:50:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:51:7:51:7 | f | map.cpp:48:37:48:42 | call to source |
+| map.cpp:54:9:54:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:55:9:55:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:56:7:56:7 | g | map.cpp:48:37:48:42 | call to source |
+| map.cpp:60:9:60:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:61:9:61:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:62:7:62:7 | h | map.cpp:48:37:48:42 | call to source |
+| map.cpp:70:9:70:13 | first | map.cpp:65:37:65:42 | call to source |
+| map.cpp:71:9:71:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:72:7:72:7 | i | map.cpp:65:37:65:42 | call to source |
+| map.cpp:73:9:73:13 | first | map.cpp:65:37:65:42 | call to source |
+| map.cpp:74:9:74:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:75:7:75:7 | j | map.cpp:65:37:65:42 | call to source |
+| map.cpp:76:9:76:13 | first | map.cpp:66:37:66:42 | call to source |
+| map.cpp:77:9:77:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:78:7:78:7 | k | map.cpp:66:37:66:42 | call to source |
+| map.cpp:79:9:79:13 | first | map.cpp:66:37:66:42 | call to source |
+| map.cpp:80:9:80:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
+| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
+| map.cpp:90:34:90:38 | first | map.cpp:90:24:90:29 | call to source |
+| map.cpp:91:34:91:39 | second | map.cpp:91:24:91:29 | call to source |
+| map.cpp:108:7:108:54 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
+| map.cpp:111:7:111:48 | call to iterator | map.cpp:111:34:111:39 | call to source |
+| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
+| map.cpp:120:10:120:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:122:10:122:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:126:10:126:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:128:10:128:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:142:10:142:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:154:8:154:10 | call to pair | map.cpp:108:39:108:44 | call to source |
+| map.cpp:155:12:155:16 | first | map.cpp:108:39:108:44 | call to source |
+| map.cpp:156:12:156:17 | second | map.cpp:108:39:108:44 | call to source |
+| map.cpp:161:12:161:16 | first | map.cpp:108:39:108:44 | call to source |
+| map.cpp:162:12:162:17 | second | map.cpp:108:39:108:44 | call to source |
+| map.cpp:168:7:168:27 | ... = ... | map.cpp:168:20:168:25 | call to source |
+| map.cpp:170:7:170:30 | ... = ... | map.cpp:170:23:170:28 | call to source |
+| map.cpp:182:10:182:20 | call to lower_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:183:10:183:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:184:7:184:31 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:185:7:185:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:186:10:186:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:187:7:187:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:223:49:223:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:224:49:224:54 | call to source |
+| map.cpp:235:7:235:40 | call to iterator | map.cpp:235:26:235:31 | call to source |
+| map.cpp:239:11:239:22 | call to emplace_hint | map.cpp:239:44:239:49 | call to source |
+| map.cpp:246:7:246:44 | call to iterator | map.cpp:246:30:246:35 | call to source |
+| map.cpp:250:11:250:21 | call to try_emplace | map.cpp:250:43:250:48 | call to source |
+| map.cpp:260:7:260:54 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:262:10:262:15 | call to insert | map.cpp:262:62:262:67 | call to source |
+| map.cpp:263:7:263:48 | call to iterator | map.cpp:263:34:263:39 | call to source |
+| map.cpp:264:10:264:25 | call to insert_or_assign | map.cpp:264:46:264:51 | call to source |
+| map.cpp:272:10:272:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:274:10:274:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:278:10:278:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:280:10:280:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:294:10:294:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:306:8:306:10 | call to pair | map.cpp:260:39:260:44 | call to source |
+| map.cpp:307:12:307:16 | first | map.cpp:260:39:260:44 | call to source |
+| map.cpp:308:12:308:17 | second | map.cpp:260:39:260:44 | call to source |
+| map.cpp:313:12:313:16 | first | map.cpp:260:39:260:44 | call to source |
+| map.cpp:314:12:314:17 | second | map.cpp:260:39:260:44 | call to source |
+| map.cpp:320:7:320:27 | ... = ... | map.cpp:320:20:320:25 | call to source |
+| map.cpp:322:7:322:30 | ... = ... | map.cpp:322:23:322:28 | call to source |
+| map.cpp:334:7:334:31 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:335:7:335:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:336:7:336:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:372:49:372:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:373:49:373:54 | call to source |
+| map.cpp:384:7:384:40 | call to iterator | map.cpp:384:26:384:31 | call to source |
+| map.cpp:388:11:388:22 | call to emplace_hint | map.cpp:388:44:388:49 | call to source |
+| map.cpp:396:7:396:44 | call to iterator | map.cpp:396:30:396:35 | call to source |
+| map.cpp:397:40:397:45 | second | map.cpp:397:30:397:35 | call to source |
+| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
+| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:431:7:431:67 | call to iterator | map.cpp:431:52:431:57 | call to source |
+| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
 | movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
 | movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
 | movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |
@@ -49,86 +134,118 @@
 | movableclass.cpp:55:8:55:9 | s2 | movableclass.cpp:52:23:52:28 | call to source |
 | movableclass.cpp:64:8:64:9 | s2 | movableclass.cpp:23:55:23:60 | call to source |
 | movableclass.cpp:65:11:65:21 | (reference dereference) | movableclass.cpp:65:13:65:18 | call to source |
+| set.cpp:20:7:20:31 | call to iterator | set.cpp:20:17:20:22 | call to source |
+| set.cpp:22:10:22:15 | call to insert | set.cpp:22:29:22:34 | call to source |
+| set.cpp:32:10:32:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:34:10:34:13 | call to find | set.cpp:22:29:22:34 | call to source |
+| set.cpp:36:10:36:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:50:10:50:13 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
+| set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
+| set.cpp:61:8:61:11 | (reference dereference) | set.cpp:20:17:20:22 | call to source |
+| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:71:7:71:32 | call to iterator | set.cpp:67:13:67:18 | call to source |
+| set.cpp:72:7:72:33 | call to iterator | set.cpp:67:13:67:18 | call to source |
+| set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
+| set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
+| set.cpp:120:7:120:33 | call to iterator | set.cpp:120:19:120:24 | call to source |
+| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
+| set.cpp:134:7:134:31 | call to iterator | set.cpp:134:17:134:22 | call to source |
+| set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
+| set.cpp:146:10:146:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:148:10:148:13 | call to find | set.cpp:136:29:136:34 | call to source |
+| set.cpp:150:10:150:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:164:10:164:13 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:165:11:165:14 | call to find | set.cpp:134:17:134:22 | call to source |
+| set.cpp:175:8:175:8 | call to operator* | set.cpp:134:17:134:22 | call to source |
+| set.cpp:175:8:175:11 | (reference dereference) | set.cpp:134:17:134:22 | call to source |
+| set.cpp:183:7:183:32 | call to iterator | set.cpp:181:13:181:18 | call to source |
+| set.cpp:184:7:184:33 | call to iterator | set.cpp:181:13:181:18 | call to source |
+| set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
+| set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
+| set.cpp:232:7:232:33 | call to iterator | set.cpp:232:19:232:24 | call to source |
+| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
 | smart_pointer.cpp:13:10:13:10 | Argument 0 indirection | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:25:10:25:10 | Argument 0 indirection | smart_pointer.cpp:23:52:23:57 | call to source |
 | smart_pointer.cpp:52:12:52:14 | call to get | smart_pointer.cpp:51:52:51:57 | call to source |
 | smart_pointer.cpp:57:12:57:14 | call to get | smart_pointer.cpp:56:52:56:57 | call to source |
 | standalone_iterators.cpp:40:10:40:10 | call to operator* | standalone_iterators.cpp:39:45:39:51 | source1 |
 | standalone_iterators.cpp:46:10:46:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
-| string.cpp:28:7:28:7 | a | string.cpp:24:12:24:17 | call to source |
-| string.cpp:30:7:30:7 | Argument 0 indirection | string.cpp:26:16:26:21 | call to source |
-| string.cpp:55:7:55:8 | cs | string.cpp:50:19:50:24 | call to source |
-| string.cpp:56:7:56:8 | Argument 0 indirection | string.cpp:50:19:50:24 | call to source |
-| string.cpp:70:7:70:8 | Argument 0 indirection | string.cpp:61:19:61:24 | call to source |
-| string.cpp:92:8:92:9 | Argument 0 indirection | string.cpp:87:18:87:23 | call to source |
-| string.cpp:93:8:93:9 | Argument 0 indirection | string.cpp:88:20:88:25 | call to source |
-| string.cpp:94:8:94:9 | Argument 0 indirection | string.cpp:90:8:90:13 | call to source |
-| string.cpp:113:8:113:9 | Argument 0 indirection | string.cpp:109:32:109:37 | call to source |
-| string.cpp:114:8:114:9 | Argument 0 indirection | string.cpp:111:20:111:25 | call to source |
-| string.cpp:121:8:121:8 | c | string.cpp:119:16:119:21 | call to source |
-| string.cpp:125:8:125:8 | call to operator* | string.cpp:119:16:119:21 | call to source |
-| string.cpp:125:8:125:11 | (reference dereference) | string.cpp:119:16:119:21 | call to source |
-| string.cpp:129:8:129:8 | (reference dereference) | string.cpp:119:16:119:21 | call to source |
-| string.cpp:129:8:129:8 | c | string.cpp:119:16:119:21 | call to source |
-| string.cpp:134:8:134:8 | (reference dereference) | string.cpp:132:28:132:33 | call to source |
-| string.cpp:134:8:134:8 | c | string.cpp:132:28:132:33 | call to source |
-| string.cpp:144:11:144:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:145:11:145:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:146:11:146:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
-| string.cpp:149:11:149:11 | call to operator+ | string.cpp:149:13:149:18 | call to source |
-| string.cpp:158:8:158:9 | Argument 0 indirection | string.cpp:154:18:154:23 | call to source |
-| string.cpp:162:8:162:9 | Argument 0 indirection | string.cpp:154:18:154:23 | call to source |
-| string.cpp:167:8:167:9 | Argument 0 indirection | string.cpp:165:14:165:19 | call to source |
-| string.cpp:171:8:171:9 | Argument 0 indirection | string.cpp:154:18:154:23 | call to source |
-| string.cpp:176:8:176:9 | Argument 0 indirection | string.cpp:174:13:174:18 | call to source |
-| string.cpp:184:8:184:10 | Argument 0 indirection | string.cpp:181:12:181:26 | call to source |
-| string.cpp:199:7:199:8 | Argument 0 indirection | string.cpp:190:17:190:22 | call to source |
-| string.cpp:202:7:202:8 | Argument 0 indirection | string.cpp:191:11:191:25 | call to source |
-| string.cpp:205:7:205:8 | Argument 0 indirection | string.cpp:193:17:193:22 | call to source |
-| string.cpp:220:7:220:8 | Argument 0 indirection | string.cpp:210:17:210:22 | call to source |
-| string.cpp:224:7:224:8 | Argument 0 indirection | string.cpp:210:17:210:22 | call to source |
-| string.cpp:228:7:228:8 | Argument 0 indirection | string.cpp:211:11:211:25 | call to source |
-| string.cpp:243:7:243:8 | Argument 0 indirection | string.cpp:233:17:233:22 | call to source |
-| string.cpp:247:7:247:8 | Argument 0 indirection | string.cpp:233:17:233:22 | call to source |
-| string.cpp:251:7:251:8 | Argument 0 indirection | string.cpp:234:11:234:25 | call to source |
-| string.cpp:264:7:264:8 | Argument 0 indirection | string.cpp:258:17:258:22 | call to source |
-| string.cpp:274:7:274:8 | Argument 0 indirection | string.cpp:269:17:269:22 | call to source |
-| string.cpp:276:7:276:8 | Argument 0 indirection | string.cpp:271:17:271:22 | call to source |
-| string.cpp:281:7:281:8 | Argument 0 indirection | string.cpp:269:17:269:22 | call to source |
-| string.cpp:282:7:282:8 | Argument 0 indirection | string.cpp:269:17:269:22 | call to source |
-| string.cpp:283:7:283:8 | Argument 0 indirection | string.cpp:271:17:271:22 | call to source |
-| string.cpp:284:7:284:8 | Argument 0 indirection | string.cpp:271:17:271:22 | call to source |
-| string.cpp:292:7:292:8 | Argument 0 indirection | string.cpp:288:17:288:22 | call to source |
+| string.cpp:29:7:29:7 | a | string.cpp:25:12:25:17 | call to source |
+| string.cpp:31:7:31:7 | Argument 0 indirection | string.cpp:27:16:27:21 | call to source |
+| string.cpp:56:7:56:8 | cs | string.cpp:51:19:51:24 | call to source |
+| string.cpp:57:7:57:8 | Argument 0 indirection | string.cpp:51:19:51:24 | call to source |
+| string.cpp:71:7:71:8 | Argument 0 indirection | string.cpp:62:19:62:24 | call to source |
+| string.cpp:93:8:93:9 | Argument 0 indirection | string.cpp:88:18:88:23 | call to source |
+| string.cpp:94:8:94:9 | Argument 0 indirection | string.cpp:89:20:89:25 | call to source |
+| string.cpp:95:8:95:9 | Argument 0 indirection | string.cpp:91:8:91:13 | call to source |
+| string.cpp:114:8:114:9 | Argument 0 indirection | string.cpp:110:32:110:37 | call to source |
+| string.cpp:115:8:115:9 | Argument 0 indirection | string.cpp:112:20:112:25 | call to source |
+| string.cpp:122:8:122:8 | c | string.cpp:120:16:120:21 | call to source |
+| string.cpp:126:8:126:8 | call to operator* | string.cpp:120:16:120:21 | call to source |
+| string.cpp:126:8:126:11 | (reference dereference) | string.cpp:120:16:120:21 | call to source |
+| string.cpp:130:8:130:8 | (reference dereference) | string.cpp:120:16:120:21 | call to source |
+| string.cpp:130:8:130:8 | c | string.cpp:120:16:120:21 | call to source |
+| string.cpp:135:8:135:8 | (reference dereference) | string.cpp:133:28:133:33 | call to source |
+| string.cpp:135:8:135:8 | c | string.cpp:133:28:133:33 | call to source |
+| string.cpp:145:11:145:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:146:11:146:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:147:11:147:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
+| string.cpp:150:11:150:11 | call to operator+ | string.cpp:150:13:150:18 | call to source |
+| string.cpp:159:8:159:9 | Argument 0 indirection | string.cpp:155:18:155:23 | call to source |
+| string.cpp:163:8:163:9 | Argument 0 indirection | string.cpp:155:18:155:23 | call to source |
+| string.cpp:168:8:168:9 | Argument 0 indirection | string.cpp:166:14:166:19 | call to source |
+| string.cpp:172:8:172:9 | Argument 0 indirection | string.cpp:155:18:155:23 | call to source |
+| string.cpp:177:8:177:9 | Argument 0 indirection | string.cpp:175:13:175:18 | call to source |
+| string.cpp:185:8:185:10 | Argument 0 indirection | string.cpp:182:12:182:26 | call to source |
+| string.cpp:200:7:200:8 | Argument 0 indirection | string.cpp:191:17:191:22 | call to source |
+| string.cpp:203:7:203:8 | Argument 0 indirection | string.cpp:192:11:192:25 | call to source |
+| string.cpp:206:7:206:8 | Argument 0 indirection | string.cpp:194:17:194:22 | call to source |
+| string.cpp:221:7:221:8 | Argument 0 indirection | string.cpp:211:17:211:22 | call to source |
+| string.cpp:225:7:225:8 | Argument 0 indirection | string.cpp:211:17:211:22 | call to source |
+| string.cpp:229:7:229:8 | Argument 0 indirection | string.cpp:212:11:212:25 | call to source |
+| string.cpp:244:7:244:8 | Argument 0 indirection | string.cpp:234:17:234:22 | call to source |
+| string.cpp:248:7:248:8 | Argument 0 indirection | string.cpp:234:17:234:22 | call to source |
+| string.cpp:252:7:252:8 | Argument 0 indirection | string.cpp:235:11:235:25 | call to source |
+| string.cpp:265:7:265:8 | Argument 0 indirection | string.cpp:259:17:259:22 | call to source |
+| string.cpp:275:7:275:8 | Argument 0 indirection | string.cpp:270:17:270:22 | call to source |
+| string.cpp:277:7:277:8 | Argument 0 indirection | string.cpp:272:17:272:22 | call to source |
+| string.cpp:282:7:282:8 | Argument 0 indirection | string.cpp:270:17:270:22 | call to source |
+| string.cpp:283:7:283:8 | Argument 0 indirection | string.cpp:270:17:270:22 | call to source |
+| string.cpp:284:7:284:8 | Argument 0 indirection | string.cpp:272:17:272:22 | call to source |
+| string.cpp:285:7:285:8 | Argument 0 indirection | string.cpp:272:17:272:22 | call to source |
 | string.cpp:293:7:293:8 | Argument 0 indirection | string.cpp:289:17:289:22 | call to source |
 | string.cpp:294:7:294:8 | Argument 0 indirection | string.cpp:290:17:290:22 | call to source |
-| string.cpp:300:7:300:8 | Argument 0 indirection | string.cpp:288:17:288:22 | call to source |
-| string.cpp:302:7:302:8 | Argument 0 indirection | string.cpp:290:17:290:22 | call to source |
-| string.cpp:322:9:322:14 | call to substr | string.cpp:319:16:319:21 | call to source |
-| string.cpp:362:8:362:9 | Argument 0 indirection | string.cpp:356:18:356:23 | call to source |
-| string.cpp:380:8:380:8 | call to operator* | string.cpp:372:18:372:23 | call to source |
-| string.cpp:380:8:380:14 | (reference dereference) | string.cpp:372:18:372:23 | call to source |
-| string.cpp:381:13:381:13 | call to operator[] | string.cpp:372:18:372:23 | call to source |
-| string.cpp:381:13:381:15 | (reference dereference) | string.cpp:372:18:372:23 | call to source |
-| string.cpp:402:8:402:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:402:8:402:11 | (reference dereference) | string.cpp:387:18:387:23 | call to source |
-| string.cpp:405:8:405:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:405:8:405:11 | (reference dereference) | string.cpp:387:18:387:23 | call to source |
-| string.cpp:413:8:413:8 | call to operator* | string.cpp:387:18:387:23 | call to source |
-| string.cpp:413:8:413:11 | (reference dereference) | string.cpp:387:18:387:23 | call to source |
-| string.cpp:428:7:428:8 | Argument 0 indirection | string.cpp:422:14:422:19 | call to source |
-| string.cpp:443:8:443:8 | Argument 0 indirection | string.cpp:442:32:442:46 | call to source |
-| string.cpp:456:8:456:8 | Argument 0 indirection | string.cpp:450:18:450:23 | call to source |
-| string.cpp:459:8:459:9 | Argument 0 indirection | string.cpp:450:18:450:23 | call to source |
-| string.cpp:472:8:472:8 | Argument 0 indirection | string.cpp:466:18:466:23 | call to source |
-| string.cpp:475:8:475:9 | Argument 0 indirection | string.cpp:466:18:466:23 | call to source |
-| string.cpp:488:8:488:8 | Argument 0 indirection | string.cpp:482:18:482:23 | call to source |
-| string.cpp:491:8:491:9 | Argument 0 indirection | string.cpp:482:18:482:23 | call to source |
-| string.cpp:504:7:504:8 | Argument 0 indirection | string.cpp:497:14:497:19 | call to source |
-| string.cpp:506:7:506:8 | Argument 0 indirection | string.cpp:497:14:497:19 | call to source |
-| string.cpp:535:8:535:8 | Argument 0 indirection | string.cpp:529:20:529:25 | call to source |
-| string.cpp:537:8:537:8 | Argument 0 indirection | string.cpp:531:15:531:20 | call to source |
-| string.cpp:555:8:555:8 | Argument 0 indirection | string.cpp:549:27:549:32 | call to source |
-| string.cpp:557:8:557:8 | Argument 0 indirection | string.cpp:551:18:551:23 | call to source |
+| string.cpp:295:7:295:8 | Argument 0 indirection | string.cpp:291:17:291:22 | call to source |
+| string.cpp:301:7:301:8 | Argument 0 indirection | string.cpp:289:17:289:22 | call to source |
+| string.cpp:303:7:303:8 | Argument 0 indirection | string.cpp:291:17:291:22 | call to source |
+| string.cpp:323:9:323:14 | call to substr | string.cpp:320:16:320:21 | call to source |
+| string.cpp:364:8:364:9 | Argument 0 indirection | string.cpp:358:18:358:23 | call to source |
+| string.cpp:382:8:382:8 | call to operator* | string.cpp:374:18:374:23 | call to source |
+| string.cpp:382:8:382:14 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
+| string.cpp:383:13:383:13 | call to operator[] | string.cpp:374:18:374:23 | call to source |
+| string.cpp:383:13:383:15 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
+| string.cpp:404:8:404:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:404:8:404:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
+| string.cpp:407:8:407:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:407:8:407:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
+| string.cpp:415:8:415:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
+| string.cpp:415:8:415:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
+| string.cpp:437:7:437:8 | Argument 0 indirection | string.cpp:431:14:431:19 | call to source |
+| string.cpp:450:8:450:8 | Argument 0 indirection | string.cpp:449:32:449:46 | call to source |
+| string.cpp:463:8:463:8 | Argument 0 indirection | string.cpp:457:18:457:23 | call to source |
+| string.cpp:466:8:466:9 | Argument 0 indirection | string.cpp:457:18:457:23 | call to source |
+| string.cpp:479:8:479:8 | Argument 0 indirection | string.cpp:473:18:473:23 | call to source |
+| string.cpp:482:8:482:9 | Argument 0 indirection | string.cpp:473:18:473:23 | call to source |
+| string.cpp:495:8:495:8 | Argument 0 indirection | string.cpp:489:18:489:23 | call to source |
+| string.cpp:498:8:498:9 | Argument 0 indirection | string.cpp:489:18:489:23 | call to source |
+| string.cpp:511:7:511:8 | Argument 0 indirection | string.cpp:504:14:504:19 | call to source |
+| string.cpp:513:7:513:8 | Argument 0 indirection | string.cpp:504:14:504:19 | call to source |
+| string.cpp:542:8:542:8 | Argument 0 indirection | string.cpp:536:20:536:25 | call to source |
+| string.cpp:544:8:544:8 | Argument 0 indirection | string.cpp:538:15:538:20 | call to source |
+| string.cpp:562:8:562:8 | Argument 0 indirection | string.cpp:556:27:556:32 | call to source |
+| string.cpp:564:8:564:8 | Argument 0 indirection | string.cpp:558:18:558:23 | call to source |
 | stringstream.cpp:32:11:32:11 | call to operator<< | stringstream.cpp:32:14:32:19 | call to source |
 | stringstream.cpp:32:11:32:22 | (reference dereference) | stringstream.cpp:32:14:32:19 | call to source |
 | stringstream.cpp:33:20:33:20 | call to operator<< | stringstream.cpp:33:23:33:28 | call to source |

cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp

@@ -21,7 +21,7 @@ void test_range_based_for_loop_vector(int source1) {
 	}
 
 	for(std::vector<int>::iterator it = v.begin(); it != v.end(); ++it) {
-		sink(*it); // tainted
+		sink(*it); // tainted [NOT DETECTED by IR]
 	}
 
 	for(int& x : v) {
@@ -325,3 +325,77 @@ void test_constructors_more() {
 	sink(v3);
 	sink(v4); // tainted
 }
+
+void taint_vector_output_iterator(std::vector<int>::iterator iter) {
+	*iter = source();
+}
+
+void vector_iterator_assign_wrapper(std::vector<int>::iterator iter, int i) {
+	*iter = i;
+}
+
+void test_vector_output_iterator(int b) {
+	std::vector<int> v1(10), v2(10), v3(10), v4(10), v5(10), v6(10), v7(10), v8(10), v9(10), v10(10), v11(10);
+
+	std::vector<int>::iterator i1 = v1.begin();
+	*i1 = source();
+	sink(v1); // tainted [NOT DETECTED by IR]
+
+	for(std::vector<int>::iterator it = v2.begin(); it != v2.end(); ++it) {
+		*it = source();
+	}
+	sink(v2); // tainted [NOT DETECTED by IR]
+
+	for(int& x : v3) {
+		x = source();
+	}
+	sink(v3); // tainted [NOT DETECTED]
+
+	for(std::vector<int>::iterator it = v4.begin(); it != v4.end(); ++it) {
+		taint_vector_output_iterator(it);
+	}
+	sink(v4); // tainted [NOT DETECTED by IR]
+	
+	std::vector<int>::iterator i5 = v5.begin();
+	*i5 = source();
+	sink(v5); // tainted [NOT DETECTED by IR]
+	*i5 = 1;
+	sink(v5); // tainted [NOT DETECTED by IR]
+
+	std::vector<int>::iterator i6 = v6.begin();
+	*i6 = source();
+	sink(v6); // tainted [NOT DETECTED by IR]
+	v6 = std::vector<int>(10);
+	sink(v6); // [FALSE POSITIVE in AST]
+
+	std::vector<int>::iterator i7 = v7.begin();
+	if(b) {
+		*i7 = source();
+		sink(v7); // tainted [NOT DETECTED by IR]
+	} else {
+		*i7 = 1;
+		sink(v7);
+	}
+	sink(v7); // tainted [NOT DETECTED by IR]
+
+	std::vector<int>::iterator i8 = v8.begin();
+	*i8 = source();
+	sink(v8); // tainted [NOT DETECTED by IR]
+	*i8 = 1;
+	sink(v8);
+
+	std::vector<int>::iterator i9 = v9.begin();
+
+	*i9 = source();
+	taint_vector_output_iterator(i9);
+
+	sink(v9);
+
+	std::vector<int>::iterator i10 = v10.begin();
+	vector_iterator_assign_wrapper(i10, 10);
+	sink(v10);
+
+	std::vector<int>::iterator i11 = v11.begin();
+	vector_iterator_assign_wrapper(i11, source());
+	sink(v11); // tainted [NOT DETECTED by IR]
+}

cpp/ql/test/library-tests/lambdas/captures/elements.expected

@@ -13,9 +13,9 @@
 | captures.cpp:3:5:3:5 | (constructor) |
 | captures.cpp:3:5:3:5 | (constructor) |
 | captures.cpp:3:5:3:5 | (constructor) |
-| captures.cpp:3:5:3:5 | declaration of (null) |
-| captures.cpp:3:5:3:5 | declaration of (null) |
-| captures.cpp:3:5:3:5 | definition of (null) |
+| captures.cpp:3:5:3:5 | declaration of (constructor) |
+| captures.cpp:3:5:3:5 | declaration of (constructor) |
+| captures.cpp:3:5:3:5 | definition of (constructor) |
 | captures.cpp:3:5:3:5 | definition of operator= |
 | captures.cpp:3:5:3:5 | operator= |
 | captures.cpp:3:5:5:5 | [...](...){...} |
@@ -50,9 +50,9 @@
 | captures.cpp:9:5:9:5 | (constructor) |
 | captures.cpp:9:5:9:5 | (constructor) |
 | captures.cpp:9:5:9:5 | (constructor) |
-| captures.cpp:9:5:9:5 | declaration of (null) |
-| captures.cpp:9:5:9:5 | declaration of (null) |
-| captures.cpp:9:5:9:5 | definition of (null) |
+| captures.cpp:9:5:9:5 | declaration of (constructor) |
+| captures.cpp:9:5:9:5 | declaration of (constructor) |
+| captures.cpp:9:5:9:5 | definition of (constructor) |
 | captures.cpp:9:5:9:5 | definition of operator= |
 | captures.cpp:9:5:9:5 | operator= |
 | captures.cpp:9:5:11:5 | [...](...){...} |
@@ -87,9 +87,9 @@
 | captures.cpp:15:5:15:5 | (constructor) |
 | captures.cpp:15:5:15:5 | (constructor) |
 | captures.cpp:15:5:15:5 | (constructor) |
-| captures.cpp:15:5:15:5 | declaration of (null) |
-| captures.cpp:15:5:15:5 | declaration of (null) |
-| captures.cpp:15:5:15:5 | definition of (null) |
+| captures.cpp:15:5:15:5 | declaration of (constructor) |
+| captures.cpp:15:5:15:5 | declaration of (constructor) |
+| captures.cpp:15:5:15:5 | definition of (constructor) |
 | captures.cpp:15:5:15:5 | definition of operator= |
 | captures.cpp:15:5:15:5 | operator= |
 | captures.cpp:15:5:17:5 | [...](...){...} |
@@ -129,9 +129,9 @@
 | captures.cpp:22:19:22:19 | Unknown literal |
 | captures.cpp:22:19:22:19 | constructor init of field x |
 | captures.cpp:22:19:22:19 | constructor init of field y |
-| captures.cpp:22:19:22:19 | declaration of (null) |
-| captures.cpp:22:19:22:19 | definition of (null) |
-| captures.cpp:22:19:22:19 | definition of (null) |
+| captures.cpp:22:19:22:19 | declaration of (constructor) |
+| captures.cpp:22:19:22:19 | definition of (constructor) |
+| captures.cpp:22:19:22:19 | definition of (constructor) |
 | captures.cpp:22:19:22:19 | definition of operator= |
 | captures.cpp:22:19:22:19 | operator= |
 | captures.cpp:22:19:22:19 | return ... |
@@ -187,9 +187,9 @@
 | end_pos.cpp:9:15:9:15 | (constructor) |
 | end_pos.cpp:9:15:9:15 | Unknown literal |
 | end_pos.cpp:9:15:9:15 | constructor init of field ii |
-| end_pos.cpp:9:15:9:15 | declaration of (null) |
-| end_pos.cpp:9:15:9:15 | definition of (null) |
-| end_pos.cpp:9:15:9:15 | definition of (null) |
+| end_pos.cpp:9:15:9:15 | declaration of (constructor) |
+| end_pos.cpp:9:15:9:15 | definition of (constructor) |
+| end_pos.cpp:9:15:9:15 | definition of (constructor) |
 | end_pos.cpp:9:15:9:15 | definition of operator= |
 | end_pos.cpp:9:15:9:15 | operator= |
 | end_pos.cpp:9:15:9:15 | return ... |

cpp/ql/test/library-tests/noexcept/copy_from_prototype/copy_from_prototype.expected

@@ -2,8 +2,8 @@
 | copy_from_prototype.cpp:3:7:3:7 | a | a<int>::a(const a<int> &) -> void | copy_from_prototype.cpp:3:7:3:7 | a<int> | <no expr> |
 | copy_from_prototype.cpp:3:7:3:7 | operator= | a<int>::operator=(a<int> &&) -> a<int> & | copy_from_prototype.cpp:3:7:3:7 | a<int> | <no expr> |
 | copy_from_prototype.cpp:3:7:3:7 | operator= | a<int>::operator=(const a<int> &) -> a<int> & | copy_from_prototype.cpp:3:7:3:7 | a<int> | <no expr> |
-| copy_from_prototype.cpp:4:26:4:26 | a | a<<unnamed>>::a<(unnamed)>() -> void | copy_from_prototype.cpp:3:7:3:7 | a<<unnamed>> | 123 |
-| copy_from_prototype.cpp:4:26:4:26 | a | a<int>::a<(unnamed)>() -> void | copy_from_prototype.cpp:3:7:3:7 | a<int> | <no expr> |
+| copy_from_prototype.cpp:4:26:4:26 | a | a<<unnamed>>::a<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:3:7:3:7 | a<<unnamed>> | 123 |
+| copy_from_prototype.cpp:4:26:4:26 | a | a<int>::a<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:3:7:3:7 | a<int> | <no expr> |
 | copy_from_prototype.cpp:7:7:7:7 | b | b::b() -> void | copy_from_prototype.cpp:7:7:7:7 | b | <no expr> |
 | copy_from_prototype.cpp:7:7:7:7 | b | b::b(b &&) -> void | copy_from_prototype.cpp:7:7:7:7 | b | <no expr> |
 | copy_from_prototype.cpp:7:7:7:7 | b | b::b(const b &) -> void | copy_from_prototype.cpp:7:7:7:7 | b | <no expr> |
@@ -13,8 +13,8 @@
 | copy_from_prototype.cpp:13:7:13:7 | c | c<int>::c(const c<int> &) -> void | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:13:7:13:7 | operator= | c<int>::operator=(c<int> &&) -> c<int> & | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:13:7:13:7 | operator= | c<int>::operator=(const c<int> &) -> c<int> & | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
-| copy_from_prototype.cpp:14:26:14:26 | c | c<T>::c<(unnamed)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<T> | X |
-| copy_from_prototype.cpp:14:26:14:26 | c | c<int>::c<(unnamed)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
+| copy_from_prototype.cpp:14:26:14:26 | c | c<T>::c<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<T> | X |
+| copy_from_prototype.cpp:14:26:14:26 | c | c<int>::c<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:17:7:17:7 | d | d::d() -> void | copy_from_prototype.cpp:17:7:17:7 | d | <no expr> |
 | copy_from_prototype.cpp:17:7:17:7 | d | d::d(const d &) -> void | copy_from_prototype.cpp:17:7:17:7 | d | <no expr> |
 | copy_from_prototype.cpp:17:7:17:7 | d | d::d(d &&) -> void | copy_from_prototype.cpp:17:7:17:7 | d | <no expr> |
@@ -24,7 +24,7 @@
 | copy_from_prototype.cpp:22:8:22:8 | e | e<int>::e(e<int> &&) -> void | copy_from_prototype.cpp:22:8:22:8 | e<int> | <no expr> |
 | copy_from_prototype.cpp:22:8:22:8 | operator= | e<int>::operator=(const e<int> &) -> e<int> & | copy_from_prototype.cpp:22:8:22:8 | e<int> | <no expr> |
 | copy_from_prototype.cpp:22:8:22:8 | operator= | e<int>::operator=(e<int> &&) -> e<int> & | copy_from_prototype.cpp:22:8:22:8 | e<int> | <no expr> |
-| copy_from_prototype.cpp:23:26:23:26 | e | e<T>::e<(unnamed)>() -> void | copy_from_prototype.cpp:22:8:22:8 | e<T> | 456 |
-| copy_from_prototype.cpp:26:35:26:43 | e | e<int>::e<(unnamed)>() -> void | copy_from_prototype.cpp:22:8:22:8 | e<int> | 456 |
+| copy_from_prototype.cpp:23:26:23:26 | e | e<T>::e<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:22:8:22:8 | e<T> | 456 |
+| copy_from_prototype.cpp:26:35:26:43 | e | e<int>::e<(unnamed template parameter)>() -> void | copy_from_prototype.cpp:22:8:22:8 | e<int> | 456 |
 | file://:0:0:0:0 | operator= | __va_list_tag::operator=(__va_list_tag &&) -> __va_list_tag & | file://:0:0:0:0 | __va_list_tag | <none> |
 | file://:0:0:0:0 | operator= | __va_list_tag::operator=(const __va_list_tag &) -> __va_list_tag & | file://:0:0:0:0 | __va_list_tag | <none> |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected

@@ -582,6 +582,16 @@
 | test.c:635:9:635:10 | ss | -32768 |
 | test.c:638:7:638:8 | ss | -32768 |
 | test.c:639:9:639:10 | ss | -1 |
+| test.c:645:8:645:8 | s | -2147483648 |
+| test.c:645:15:645:15 | s | 0 |
+| test.c:645:23:645:23 | s | 0 |
+| test.c:646:18:646:18 | s | 0 |
+| test.c:646:22:646:22 | s | 0 |
+| test.c:647:9:647:14 | result | 0 |
+| test.c:653:7:653:7 | i | 0 |
+| test.c:654:9:654:9 | i | -2147483648 |
+| test.c:658:7:658:7 | u | 0 |
+| test.c:659:9:659:9 | u | 0 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c

@@ -639,3 +639,23 @@ void two_bounds_from_one_test(short ss, unsigned short us) {
     out(ss); // -1 .. 2
   }
 }
+
+void widen_recursive_expr() {
+  int s;
+  for (s = 0; s < 10; s++) {
+    int result = s + s; // 0 .. 9 [BUG: upper bound is 15 due to widening]
+    out(result); // 0 .. 18 [BUG: upper bound is 127 due to double widening]
+  }
+}
+
+void guard_bound_out_of_range(void) {
+  int i = 0;
+  if (i < 0) {
+    out(i); // unreachable [BUG: is -max .. +max]
+  }
+
+  unsigned int u = 0;
+  if (u < 0) {
+    out(u); // unreachable [BUG: is 0 .. +max]
+  }
+}

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected

@@ -582,6 +582,16 @@
 | test.c:635:9:635:10 | ss | 32767 |
 | test.c:638:7:638:8 | ss | 32767 |
 | test.c:639:9:639:10 | ss | 2 |
+| test.c:645:8:645:8 | s | 2147483647 |
+| test.c:645:15:645:15 | s | 127 |
+| test.c:645:23:645:23 | s | 15 |
+| test.c:646:18:646:18 | s | 15 |
+| test.c:646:22:646:22 | s | 15 |
+| test.c:647:9:647:14 | result | 127 |
+| test.c:653:7:653:7 | i | 0 |
+| test.c:654:9:654:9 | i | 2147483647 |
+| test.c:658:7:658:7 | u | 0 |
+| test.c:659:9:659:9 | u | 4294967295 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |

cpp/ql/test/library-tests/special_members/generated_copy/functions.expected

@@ -78,8 +78,6 @@
 | copy.cpp:111:9:111:9 | MoveAssign | deleted |  |
 | copy.cpp:111:9:111:9 | operator= | deleted |  |
 | copy.cpp:113:17:113:25 | operator= |  |  |
-| copy.cpp:120:9:120:9 | OnlyCtor |  |  |
-| copy.cpp:120:9:120:9 | OnlyCtor |  |  |
 | copy.cpp:120:9:120:9 | OnlyCtor | deleted |  |
 | copy.cpp:120:9:120:9 | operator= | deleted |  |
 | copy.cpp:126:11:126:19 | operator= |  |  |

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -70,3 +70,56 @@ argHasPostUpdate
 | destructors.cpp:52:14:52:16 | ref | ArgumentNode is missing PostUpdateNode. |
 | ir.cpp:623:5:623:5 | r | ArgumentNode is missing PostUpdateNode. |
 | ir.cpp:625:5:625:5 | s | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| VacuousDestructorCall.cpp:10:22:10:22 | i [inner post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:13 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:19 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
+| assignexpr.cpp:9:4:9:4 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:34:23:34:31 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:39:37:39:45 | carry_out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:43:41:43:49 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:51:30:51:38 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:54:29:54:38 | atomic_int [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:5:3:9 | m_ptr [post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:17:11:17:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:20:11:20:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:28:11:28:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:31:11:31:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:34:9:34:13 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:6:13:6:15 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:18:13:18:15 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:7:7:7:8 | el [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:77:19:77:21 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:11:82:14 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:45:82:48 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:51:82:51 | call to Val | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:5 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:5:178:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:7:178:7 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:5 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:5:184:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:7:184:7 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:5:342:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:6:342:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:428:8:428:8 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:429:8:429:8 | y [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:643:15:643:17 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:11:644:14 | this [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:17:644:19 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:645:9:645:11 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:654:11:654:14 | this [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:745:8:745:8 | base_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:754:8:754:8 | middle_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:763:8:763:8 | derived_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:809:7:809:13 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:810:7:810:26 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:823:7:823:13 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:824:7:824:26 | call to Base | PostUpdateNode should not be the target of local flow. |
+| misc.c:130:7:130:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:131:9:131:9 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:220:3:220:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:220:4:220:5 | sp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:3:2:3:4 | ref [post update] | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:21:2:21:4 | val [post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -539,8 +539,6 @@ uniqueNodeLocation
 | file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
 | file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
 | file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
-| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
-| file://:0:0:0:0 | p#0 | Node should have one location but has 0. |
 | file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
 | file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
 | file://:0:0:0:0 | p#1 | Node should have one location but has 0. |
@@ -1418,7 +1416,7 @@ uniqueNodeLocation
 | whilestmt.c:39:6:39:11 | ReturnVoid | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | SideEffect | Node should have one location but has 4. |
 missingLocation
-| Nodes without location: 36 |
+| Nodes without location: 34 |
 uniqueNodeToString
 | break_labels.c:2:11:2:11 | i | Node should have one toString but has 2. |
 | break_labels.c:2:11:2:11 | i | Node should have one toString but has 2. |
@@ -1474,3 +1472,92 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| aggregateinitializer.c:3:14:3:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| aggregateinitializer.c:3:21:3:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:27:3:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:35:3:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| assignexpr.cpp:9:2:9:12 | Store | PostUpdateNode should not be the target of local flow. |
+| bad_asts.cpp:15:10:15:12 | Store | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:29:14:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:32:14:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:35:14:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:5:3:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:21:3:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:6:13:6:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:18:13:18:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:45:82:48 | Chi | PostUpdateNode should not be the target of local flow. |
+| defdestructordeleteexpr.cpp:4:9:4:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| deleteexpr.cpp:7:9:7:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:5:178:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:5:184:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:5:342:10 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:428:5:428:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:429:5:429:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:504:19:504:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:504:22:504:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:505:16:505:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:505:19:505:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:14:514:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:19:514:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:22:514:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:19:515:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:22:515:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:29:515:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:32:515:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:17:516:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:19:516:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:24:516:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:26:516:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:19:521:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:22:521:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:25:521:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:522:16:522:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:522:19:522:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:531:14:531:14 | Store | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:577:16:577:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:577:19:577:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:578:19:578:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:578:22:578:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:579:16:579:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:579:19:579:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:643:9:643:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:9:644:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:645:9:645:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:659:9:659:14 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:660:13:660:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:661:9:661:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:943:3:943:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:947:3:947:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:26:962:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:41:962:45 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:130:5:130:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:131:5:131:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:32:154:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:35:154:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:40:154:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:43:154:43 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:157:14:157:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:158:14:158:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| range_analysis.c:102:5:102:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:3:2:3:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:21:2:21:12 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/templates/CPP-202/template_args.expected

@@ -1,7 +1,7 @@
 | file://:0:0:0:0 | __va_list_tag | <none> |
 | test.cpp:3:8:3:9 | s1<<expression>> | {...} |
-| test.cpp:3:8:3:9 | s1<<unnamed>> | (null) |
+| test.cpp:3:8:3:9 | s1<<unnamed>> | (unnamed template parameter constant) |
 | test.cpp:5:8:5:9 | s2<T> | T |
 | test.cpp:5:8:5:9 | s2<T> | T |
-| test.cpp:7:8:7:9 | s3<T, <unnamed>> | (unnamed) |
+| test.cpp:7:8:7:9 | s3<T, <unnamed>> | (unnamed template parameter) |
 | test.cpp:7:8:7:9 | s3<T, <unnamed>> | T |