Merge branch 'main' into model-experiments

cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/exprparents.ql

@@ -0,0 +1,19 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Expr extends @expr {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Expr child, int index, int index_new, Element parent
+where
+  exprparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index - 1 else index_new = index
+select child, index_new, parent

cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/for_initialization.ql

@@ -0,0 +1,9 @@
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+from Stmt f, Stmt i
+where
+  for_initialization(f, i) and
+  f instanceof @stmt_for
+select f, i

cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/stmtparents.ql

@@ -0,0 +1,20 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Stmt child, int index, int index_new, Element parent
+where
+  stmtparents(child, index, parent) and
+  (
+    not isStmtWithInitializer(parent)
+    or
+    index > 0
+  ) and
+  if isStmtWithInitializer(parent) then index_new = index - 1 else index_new = index
+select child, index_new, parent

cpp/downgrades/298438feb146335af824002589cd6d4e96e5dbf9/upgrade.properties

@@ -0,0 +1,5 @@
+description: Support C++20 range-based for initializers
+compatibility: partial
+exprparents.rel: run exprparents.qlo
+stmtparents.rel: run stmtparents.qlo
+for_initialization.rel: run for_initialization.qlo

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.12.6
+
+### New Features
+
+* A `getInitialization` predicate was added to the `RangeBasedForStmt` class that yields the C++20-style initializer of the range-based `for` statement when it exists.
+
 ## 0.12.5
 
 ### New Features

cpp/ql/lib/change-notes/released/0.12.6.md

@@ -0,0 +1,5 @@
+## 0.12.6
+
+### New Features
+
+* A `getInitialization` predicate was added to the `RangeBasedForStmt` class that yields the C++20-style initializer of the range-based `for` statement when it exists.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.5
+lastReleaseVersion: 0.12.6

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.6-dev
+version: 0.12.7-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -735,7 +735,9 @@ private predicate namedStmtChildPredicates(Locatable s, Element e, string pred)
     or
     s.(ForStmt).getStmt() = e and pred = "getStmt()"
     or
-    s.(RangeBasedForStmt).getChild(0) = e and pred = "getChild(0)"
+    s.(RangeBasedForStmt).getInitialization() = e and pred = "getInitialization()"
+    or
+    s.(RangeBasedForStmt).getChild(1) = e and pred = "getChild(1)"
     or
     s.(RangeBasedForStmt).getBeginEndDeclaration() = e and pred = "getBeginEndDeclaration()"
     or
@@ -743,7 +745,7 @@ private predicate namedStmtChildPredicates(Locatable s, Element e, string pred)
     or
     s.(RangeBasedForStmt).getUpdate() = e and pred = "getUpdate()"
     or
-    s.(RangeBasedForStmt).getChild(4) = e and pred = "getChild(4)"
+    s.(RangeBasedForStmt).getChild(5) = e and pred = "getChild(5)"
     or
     s.(RangeBasedForStmt).getStmt() = e and pred = "getStmt()"
     or

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -203,30 +203,42 @@ private class GuardConditionFromIR extends GuardCondition {
    * `&&` and `||`. See the detailed explanation on predicate `controls`.
    */
   private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
-    exists(IRBlock irb, Instruction instr |
+    exists(IRBlock irb |
       ir.controls(irb, testIsTrue) and
-      instr = irb.getAnInstruction() and
-      instr.getAst().(ControlFlowNode).getBasicBlock() = controlled and
-      not isUnreachedBlock(irb) and
-      not this.excludeAsControlledInstruction(instr)
+      nonExcludedIRAndBasicBlock(irb, controlled) and
+      not isUnreachedBlock(irb)
     )
   }
+}
 
-  private predicate excludeAsControlledInstruction(Instruction instr) {
-    // Exclude the temporaries generated by a ternary expression.
-    exists(TranslatedConditionalExpr tce |
-      instr = tce.getInstruction(ConditionValueFalseStoreTag())
-      or
-      instr = tce.getInstruction(ConditionValueTrueStoreTag())
-      or
-      instr = tce.getInstruction(ConditionValueTrueTempAddressTag())
-      or
-      instr = tce.getInstruction(ConditionValueFalseTempAddressTag())
-    )
+private predicate excludeAsControlledInstruction(Instruction instr) {
+  // Exclude the temporaries generated by a ternary expression.
+  exists(TranslatedConditionalExpr tce |
+    instr = tce.getInstruction(ConditionValueFalseStoreTag())
     or
-    // Exclude unreached instructions, as their AST is the whole function and not a block.
-    instr instanceof UnreachedInstruction
-  }
+    instr = tce.getInstruction(ConditionValueTrueStoreTag())
+    or
+    instr = tce.getInstruction(ConditionValueTrueTempAddressTag())
+    or
+    instr = tce.getInstruction(ConditionValueFalseTempAddressTag())
+  )
+  or
+  // Exclude unreached instructions, as their AST is the whole function and not a block.
+  instr instanceof UnreachedInstruction
+}
+
+/**
+ * Holds if `irb` is the `IRBlock` corresponding to the AST basic block
+ * `controlled`, and `irb` does not contain any instruction(s) that should make
+ * the `irb` be ignored.
+ */
+pragma[nomagic]
+private predicate nonExcludedIRAndBasicBlock(IRBlock irb, BasicBlock controlled) {
+  exists(Instruction instr |
+    instr = irb.getAnInstruction() and
+    instr.getAst().(ControlFlowNode).getBasicBlock() = controlled and
+    not excludeAsControlledInstruction(instr)
+  )
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/controlflow/internal/CFG.qll

@@ -637,8 +637,10 @@ private predicate straightLineSparse(Node scope, int i, Node ni, Spec spec) {
     any(RangeBasedForStmt for |
       i = -1 and ni = for and spec.isAt()
       or
+      i = 0 and ni = for.getInitialization() and spec.isAround()
+      or
       exists(DeclStmt s | s.getADeclaration() = for.getRangeVariable() |
-        i = 0 and ni = s and spec.isAround()
+        i = 1 and ni = s and spec.isAround()
       )
       or
       exists(DeclStmt s |
@@ -649,22 +651,22 @@ private predicate straightLineSparse(Node scope, int i, Node ni, Spec spec) {
         // DeclStmt in that case.
         exists(s.getADeclaration())
       |
-        i = 1 and ni = s and spec.isAround()
+        i = 2 and ni = s and spec.isAround()
       )
       or
-      i = 2 and ni = for.getCondition() and spec.isBefore()
+      i = 3 and ni = for.getCondition() and spec.isBefore()
       or
-      i = 3 and /* BARRIER */ ni = for and spec.isBarrier()
+      i = 4 and /* BARRIER */ ni = for and spec.isBarrier()
       or
       exists(DeclStmt declStmt | declStmt.getADeclaration() = for.getVariable() |
-        i = 4 and ni = declStmt and spec.isAfter()
+        i = 5 and ni = declStmt and spec.isAfter()
       )
       or
-      i = 5 and ni = for.getStmt() and spec.isAround()
+      i = 6 and ni = for.getStmt() and spec.isAround()
       or
-      i = 6 and ni = for.getUpdate() and spec.isAround()
+      i = 7 and ni = for.getUpdate() and spec.isAround()
       or
-      i = 7 and ni = for.getCondition() and spec.isBefore()
+      i = 8 and ni = for.getCondition() and spec.isBefore()
     )
   or
   scope =

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll

@@ -960,25 +960,38 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
   override RangeBasedForStmt stmt;
 
   override TranslatedElement getChild(int id) {
-    id = 0 and result = this.getRangeVariableDeclStmt()
+    id = 0 and result = this.getInitialization()
+    or
+    id = 1 and result = this.getRangeVariableDeclStmt()
     or
     // Note: `__begin` and `__end` are declared by the same `DeclStmt`
-    id = 1 and result = this.getBeginEndVariableDeclStmt()
+    id = 2 and result = this.getBeginEndVariableDeclStmt()
     or
-    id = 2 and result = this.getCondition()
+    id = 3 and result = this.getCondition()
     or
-    id = 3 and result = this.getUpdate()
+    id = 4 and result = this.getUpdate()
     or
-    id = 4 and result = this.getVariableDeclStmt()
+    id = 5 and result = this.getVariableDeclStmt()
     or
-    id = 5 and result = this.getBody()
+    id = 6 and result = this.getBody()
+  }
+
+  private predicate hasInitialization() { exists(stmt.getInitialization()) }
+
+  private TranslatedStmt getInitialization() {
+    result = getTranslatedStmt(stmt.getInitialization())
   }
 
   override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getRangeVariableDeclStmt().getFirstInstruction(kind)
+    if this.hasInitialization()
+    then result = this.getInitialization().getFirstInstruction(kind)
+    else result = this.getFirstRangeVariableDeclStmtInstruction(kind)
   }
 
   override Instruction getChildSuccessor(TranslatedElement child, EdgeKind kind) {
+    child = this.getInitialization() and
+    result = this.getFirstRangeVariableDeclStmtInstruction(kind)
+    or
     child = this.getRangeVariableDeclStmt() and
     result = this.getBeginEndVariableDeclStmt().getFirstInstruction(kind)
     or
@@ -1018,6 +1031,10 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
     )
   }
 
+  private Instruction getFirstRangeVariableDeclStmtInstruction(EdgeKind kind) {
+    result = this.getRangeVariableDeclStmt().getFirstInstruction(kind)
+  }
+
   private TranslatedDeclStmt getBeginEndVariableDeclStmt() {
     exists(IRVariableDeclarationEntry entry |
       entry.getStmt() = stmt.getBeginEndDeclaration() and

cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll

@@ -892,6 +892,26 @@ class DoStmt extends Loop, @stmt_end_test_while {
 class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   override string getAPrimaryQlClass() { result = "RangeBasedForStmt" }
 
+  /**
+   * Gets the initialization statement of this 'for' statement, if any.
+   *
+   * For example, for
+   * ```
+   * for (int x = y; auto z : ... ) { }
+   * ```
+   * the result is `int x = y;`.
+   *
+   * Does not hold if the initialization statement is missing or an empty statement, as in
+   * ```
+   * for (auto z : ...) { }
+   * ```
+   * or
+   * ```
+   * for (; auto z : ) { }
+   * ```
+   */
+  Stmt getInitialization() { for_initialization(underlyingElement(this), unresolveElement(result)) }
+
   /**
    * Gets the 'body' statement of this range-based 'for' statement.
    *
@@ -901,7 +921,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
    * ```
    * the result is the `BlockStmt` `{ y += x; }`.
    */
-  override Stmt getStmt() { result = this.getChild(5) }
+  override Stmt getStmt() { result = this.getChild(6) }
 
   override string toString() { result = "for(...:...) ..." }
 
@@ -914,7 +934,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
    * ```
    * the result is `int x`.
    */
-  LocalVariable getVariable() { result = this.getChild(4).(DeclStmt).getADeclaration() }
+  LocalVariable getVariable() { result = this.getChild(5).(DeclStmt).getADeclaration() }
 
   /**
    * Gets the expression giving the range to iterate over.
@@ -928,7 +948,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
   Expr getRange() { result = this.getRangeVariable().getInitializer().getExpr() }
 
   /** Gets the compiler-generated `__range` variable after desugaring. */
-  LocalVariable getRangeVariable() { result = this.getChild(0).(DeclStmt).getADeclaration() }
+  LocalVariable getRangeVariable() { result = this.getChild(1).(DeclStmt).getADeclaration() }
 
   /**
    * Gets the compiler-generated `__begin != __end` which is the
@@ -936,7 +956,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
    * It will be either an `NEExpr` or a call to a user-defined
    * `operator!=`.
    */
-  override Expr getCondition() { result = this.getChild(2) }
+  override Expr getCondition() { result = this.getChild(3) }
 
   override Expr getControllingExpr() { result = this.getCondition() }
 
@@ -945,7 +965,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
    * `__end`, initializing them to the values they have before entering the
    * desugared loop.
    */
-  DeclStmt getBeginEndDeclaration() { result = this.getChild(1) }
+  DeclStmt getBeginEndDeclaration() { result = this.getChild(2) }
 
   /** Gets the compiler-generated `__begin` variable after desugaring. */
   LocalVariable getBeginVariable() { result = this.getBeginEndDeclaration().getDeclaration(0) }
@@ -959,7 +979,7 @@ class RangeBasedForStmt extends Loop, @stmt_range_based_for {
    * be either a `PrefixIncrExpr` or a call to a user-defined
    * `operator++`.
    */
-  Expr getUpdate() { result = this.getChild(3) }
+  Expr getUpdate() { result = this.getChild(4) }
 
   /** Gets the compiler-generated `__begin` variable after desugaring. */
   LocalVariable getAnIterationVariable() { result = this.getBeginVariable() }

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -2050,8 +2050,11 @@ switch_body(
     int body_id: @stmt ref
 );
 
+@stmt_for_or_range_based_for = @stmt_for
+                             | @stmt_range_based_for;
+
 for_initialization(
-    unique int for_stmt: @stmt_for ref,
+    unique int for_stmt: @stmt_for_or_range_based_for ref,
     int init_id: @stmt ref
 );
 

cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/exprparents.ql

@@ -0,0 +1,19 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Expr extends @expr {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Expr child, int index, int index_new, Element parent
+where
+  exprparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index + 1 else index_new = index
+select child, index_new, parent

cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/stmtparents.ql

@@ -0,0 +1,15 @@
+class Element extends @element {
+  string toString() { none() }
+}
+
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+predicate isStmtWithInitializer(Stmt stmt) { exists(int kind | stmts(stmt, kind, _) | kind = 29) }
+
+from Stmt child, int index, int index_new, Element parent
+where
+  stmtparents(child, index, parent) and
+  if isStmtWithInitializer(parent) then index_new = index + 1 else index_new = index
+select child, index_new, parent

cpp/ql/lib/upgrades/4f9fabab5124d49108782c081579f45a70571d74/upgrade.properties

@@ -0,0 +1,4 @@
+description: Support C++20 range-based for initializers
+compatibility: partial
+exprparents.rel: run exprparents.qlo
+stmtparents.rel: run stmtparents.qlo

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.9.5
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been updated to produce fewer false positives.
+* Added dataflow models for the `gettext` function variants. 
+
 ## 0.9.4
 
 ### Minor Analysis Improvements

cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

@@ -1,9 +1,13 @@
 /**
  * @name Non-constant format string
- * @description Passing a non-constant 'format' string to a printf-like function can lead
+ * @description Passing a value that is not a string literal 'format' string to a printf-like function can lead
  *              to a mismatch between the number of arguments defined by the 'format' and the number
  *              of arguments actually passed to the function. If the format string ultimately stems
  *              from an untrusted source, this can be used for exploits.
+ *              This query finds format strings coming from non-literal sources. Note that format strings of
+ *              type `const char*` it is still considered non-constant if the value is not coming from a string
+ *              literal. For example, for a parameter with type `const char*` of an exported function that is
+ *              used as a format string, there is no way to ensure the originating value was a string literal.
  * @kind problem
  * @problem.severity recommendation
  * @security-severity 9.3
@@ -16,135 +20,118 @@
  */
 
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.models.implementations.GetText
 import semmle.code.cpp.commons.Printf
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.ir.dataflow.internal.ModelUtil
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.ir.IR
 
-// For the following `...gettext` functions, we assume that
-// all translations preserve the type and order of `%` specifiers
-// (and hence are safe to use as format strings).  This
-// assumption is hard-coded into the query.
-predicate whitelistFunction(Function f, int arg) {
-  // basic variations of gettext
-  f.getName() = "_" and arg = 0
-  or
-  exists(FunctionInput input |
-    f.(GetTextFunction).hasDataFlow(input, _) and
-    input.isParameterDeref(arg)
-  )
-}
-
-// we assume that ALL uses of the `_` macro (and calls to `gettext`)
-// return constant string literals
-predicate underscoreMacro(Expr e) {
-  exists(MacroInvocation mi |
-    mi.getMacroName() = "_" and
-    mi.getExpr() = e
-  )
-  or
-  e = any(GetTextFunction gettext).getACallToThisFunction()
+class UncalledFunction extends Function {
+  UncalledFunction() {
+    not exists(Call c | c.getTarget() = this) and
+    // Ignore functions that appear to be function pointers
+    // function pointers may be seen as uncalled statically
+    not exists(FunctionAccess fa | fa.getTarget() = this)
+  }
 }
 
 /**
- * Holds if `t` cannot hold a character array, directly or indirectly.
+ * Holds if `node` is a non-constant source of data flow for non-const format string detection.
+ * This is defined as either:
+ * 1) a `FlowSource`
+ * 2) a parameter of an 'uncalled' function
+ * 3) an argument to a function with no definition that is not known to define the output through its input
+ * 4) an out arg of a function with no definition that is not known to define the output through its input
+ *
+ * The latter two cases address identifying standard string manipulation libraries as input sources
+ * e.g., strcpy. More simply, functions without definitions that are known to manipulate the
+ * input to produce an output are not sources. Instead the ultimate source of input to these functions
+ * should be considered as the source.
+ *
+ * False Negative Implication: This approach has false negatives (fails to identify non-const sources)
+ * when the source is a field of a struct or object and the initialization is not observed statically.
+ * There are 3 general cases where this can occur:
+ * 1) Parameters of uncalled functions that are structs/objects and a field is accessed for a format string.
+ * 2) A local variable that is a struct/object and initialization of the field occurs in code that is unseen statically.
+ *    e.g., an object constructor isn't known statically, or a function sets fields
+ *    of a struct, but the function is not known statically.
+ * 3) A function meeting cases (3) and (4) above returns (through an out argument or return value)
+ *    a struct or object where a field containing a format string has been initialized.
+ *
+ * Note, uninitialized variables used as format strings are never detected by design.
+ * Uninitialized variables are a separate vulnerability concern and should be addressed by a separate query.
  */
-predicate cannotContainString(Type t, boolean isIndirect) {
-  isIndirect = false and
-  exists(Type unspecified |
-    unspecified = t.getUnspecifiedType() and
-    not unspecified instanceof UnknownType
+predicate isNonConst(DataFlow::Node node) {
+  node instanceof FlowSource
+  or
+  // Parameters of uncalled functions that aren't const
+  exists(UncalledFunction f, Parameter p |
+    f.getAParameter() = p and
+    p = node.asParameter()
+  )
+  or
+  // Consider as an input any out arg of a function or a function's return where the function is not:
+  // 1. a function with a known dataflow or taintflow from input to output and the `node` is the output
+  // 2. a function where there is a known definition
+  // i.e., functions that with unknown bodies and are not known to define the output through its input
+  //       are considered as possible non-const sources
+  // The function's output must also not be const to be considered a non-const source
+  exists(Function func, CallInstruction call |
+    // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
+    // variables representing the same call in ordoer to use `callOutput` below.
+    exists(Expr arg |
+      call.getPositionalArgumentOperand(_).getDef().getUnconvertedResultExpression() = arg and
+      arg = node.asDefiningArgument()
+    )
+    or
+    call.getUnconvertedResultExpression() = node.asIndirectExpr()
   |
-    unspecified instanceof BuiltInType or
-    unspecified instanceof IntegralOrEnumType
+    func = call.getStaticCallTarget() and
+    not exists(FunctionOutput output |
+      // NOTE: we must include dataflow and taintflow. e.g., including only dataflow we will find sprintf
+      // variant function's output are now possible non-const sources
+      pragma[only_bind_out](func).(DataFlowFunction).hasDataFlow(_, output) or
+      pragma[only_bind_out](func).(TaintFunction).hasTaintFlow(_, output)
+    |
+      node = callOutput(call, output)
+    )
+  ) and
+  not exists(Call c |
+    c.getTarget().hasDefinition() and
+    if node instanceof DataFlow::DefinitionByReferenceNode
+    then c.getAnArgument() = node.asDefiningArgument()
+    else c = [node.asExpr(), node.asIndirectExpr()]
   )
 }
 
-predicate isNonConst(DataFlow::Node node, boolean isIndirect) {
-  exists(Expr e |
-    e = node.asExpr() and isIndirect = false
-    or
-    e = node.asIndirectExpr() and isIndirect = true
-  |
-    exists(FunctionCall fc | fc = e |
-      not (
-        whitelistFunction(fc.getTarget(), _) or
-        fc.getTarget().hasDefinition()
-      )
-    )
-    or
-    exists(Parameter p | p = e.(VariableAccess).getTarget() |
-      p.getFunction().getName() = "main" and p.getType() instanceof PointerType
-    )
-    or
-    e instanceof CrementOperation
-    or
-    e instanceof AddressOfExpr
-    or
-    e instanceof ReferenceToExpr
-    or
-    e instanceof AssignPointerAddExpr
-    or
-    e instanceof AssignPointerSubExpr
-    or
-    e instanceof PointerArithmeticOperation
-    or
-    e instanceof FieldAccess
-    or
-    e instanceof PointerDereferenceExpr
-    or
-    e instanceof AddressOfExpr
-    or
-    e instanceof ExprCall
-    or
-    e instanceof NewArrayExpr
-    or
-    exists(Variable v | v = e.(VariableAccess).getTarget() |
-      v.getType().(ArrayType).getBaseType() instanceof CharType and
-      exists(AssignExpr ae |
-        ae.getLValue().(ArrayExpr).getArrayBase().(VariableAccess).getTarget() = v
-      )
-    )
-  )
-  or
-  node instanceof DataFlow::DefinitionByReferenceNode and
-  isIndirect = true
-}
-
-pragma[noinline]
-predicate isBarrierNode(DataFlow::Node node) {
-  underscoreMacro([node.asExpr(), node.asIndirectExpr()])
-  or
-  exists(node.asExpr()) and
-  cannotContainString(node.getType(), false)
-}
-
+/**
+ * Holds if `sink` is a sink is a format string of any
+ * `FormattingFunctionCall`.
+ */
 predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
   [sink.asExpr(), sink.asIndirectExpr()] = formatString and
   exists(FormattingFunctionCall fc | formatString = fc.getArgument(fc.getFormatParameterIndex()))
 }
 
 module NonConstFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    exists(boolean isIndirect, Type t |
-      isNonConst(source, isIndirect) and
-      t = source.getType() and
-      not cannotContainString(t, isIndirect)
-    )
-  }
+  predicate isSource(DataFlow::Node source) { isNonConst(source) }
 
   predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
 
-  predicate isBarrier(DataFlow::Node node) { isBarrierNode(node) }
+  predicate isBarrier(DataFlow::Node node) {
+    // Ignore tracing non-const through array indices
+    exists(ArrayExpr a | a.getArrayOffset() = node.asExpr())
+  }
 }
 
 module NonConstFlow = TaintTracking::Global<NonConstFlowConfig>;
 
-from FormattingFunctionCall call, Expr formatString
+from FormattingFunctionCall call, Expr formatString, DataFlow::Node sink
 where
   call.getArgument(call.getFormatParameterIndex()) = formatString and
-  exists(DataFlow::Node sink |
-    NonConstFlow::flowTo(sink) and
-    isSinkImpl(sink, formatString)
-  )
+  NonConstFlow::flowTo(sink) and
+  isSinkImpl(sink, formatString)
 select formatString,
   "The format string argument to " + call.getTarget().getName() +
     " should be constant to prevent security issues and other potential errors."

cpp/ql/src/change-notes/2024-02-05-gettext-dataflows.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added dataflow models for the `gettext` function variants. 

cpp/ql/src/change-notes/released/0.9.5.md

@@ -0,0 +1,6 @@
+## 0.9.5
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been updated to produce fewer false positives.
+* Added dataflow models for the `gettext` function variants. 

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.4
+lastReleaseVersion: 0.9.5

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.5-dev
+version: 0.9.6-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -12581,216 +12581,693 @@ ir.cpp:
 # 2131|     v2131_23(void)                      = AliasedUse                   : ~m2131_19
 # 2131|     v2131_24(void)                      = ExitFunction                 : 
 
-# 2134| bool initialization_with_destructor_bool
-# 2134|   Block 0
-# 2134|     v2134_1(void)        = EnterFunction                                        : 
-# 2134|     m2134_2(unknown)     = AliasedDefinition                                    : 
-# 2134|     r2134_3(glval<bool>) = VariableAddress[initialization_with_destructor_bool] : 
-# 2134|     r2134_4(bool)        = Constant[1]                                          : 
-# 2134|     m2134_5(bool)        = Store[initialization_with_destructor_bool]           : &:r2134_3, r2134_4
-# 2134|     m2134_6(unknown)     = Chi                                                  : total:m2134_2, partial:m2134_5
-# 2134|     v2134_7(void)        = ReturnVoid                                           : 
-# 2134|     v2134_8(void)        = AliasedUse                                           : ~m2134_6
-# 2134|     v2134_9(void)        = ExitFunction                                         : 
+# 2132| char ClassWithDestructor::get_x()
+# 2132|   Block 0
+# 2132|     v2132_1(void)                       = EnterFunction                : 
+# 2132|     m2132_2(unknown)                    = AliasedDefinition            : 
+# 2132|     m2132_3(unknown)                    = InitializeNonLocal           : 
+# 2132|     m2132_4(unknown)                    = Chi                          : total:m2132_2, partial:m2132_3
+# 2132|     r2132_5(glval<unknown>)             = VariableAddress[#this]       : 
+# 2132|     m2132_6(glval<ClassWithDestructor>) = InitializeParameter[#this]   : &:r2132_5
+# 2132|     r2132_7(glval<ClassWithDestructor>) = Load[#this]                  : &:r2132_5, m2132_6
+# 2132|     m2132_8(ClassWithDestructor)        = InitializeIndirection[#this] : &:r2132_7
+# 2132|     r2132_9(glval<char>)                = VariableAddress[#return]     : 
+# 2132|     r2132_10(glval<unknown>)            = VariableAddress[#this]       : 
+# 2132|     r2132_11(ClassWithDestructor *)     = Load[#this]                  : &:r2132_10, m2132_6
+# 2132|     r2132_12(glval<char *>)             = FieldAddress[x]              : r2132_11
+# 2132|     r2132_13(char *)                    = Load[?]                      : &:r2132_12, ~m2132_8
+# 2132|     r2132_14(char)                      = Load[?]                      : &:r2132_13, ~m2132_4
+# 2132|     m2132_15(char)                      = Store[#return]               : &:r2132_9, r2132_14
+# 2132|     v2132_16(void)                      = ReturnIndirection[#this]     : &:r2132_7, m2132_8
+# 2132|     r2132_17(glval<char>)               = VariableAddress[#return]     : 
+# 2132|     v2132_18(void)                      = ReturnValue                  : &:r2132_17, m2132_15
+# 2132|     v2132_19(void)                      = AliasedUse                   : m2132_3
+# 2132|     v2132_20(void)                      = ExitFunction                 : 
 
-# 2136| void initialization_with_destructor(bool, char)
-# 2136|   Block 0
-# 2136|     v2136_1(void)                       = EnterFunction                        : 
-# 2136|     m2136_2(unknown)                    = AliasedDefinition                    : 
-# 2136|     m2136_3(unknown)                    = InitializeNonLocal                   : 
-# 2136|     m2136_4(unknown)                    = Chi                                  : total:m2136_2, partial:m2136_3
-# 2136|     r2136_5(glval<bool>)                = VariableAddress[b]                   : 
-# 2136|     m2136_6(bool)                       = InitializeParameter[b]               : &:r2136_5
-# 2136|     r2136_7(glval<char>)                = VariableAddress[c]                   : 
-# 2136|     m2136_8(char)                       = InitializeParameter[c]               : &:r2136_7
-# 2137|     r2137_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2137|     m2137_2(ClassWithDestructor)        = Uninitialized[x]                     : &:r2137_1
-# 2137|     r2137_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2137|     v2137_4(void)                       = Call[ClassWithDestructor]            : func:r2137_3, this:r2137_1
-# 2137|     m2137_5(unknown)                    = ^CallSideEffect                      : ~m2136_4
-# 2137|     m2137_6(unknown)                    = Chi                                  : total:m2136_4, partial:m2137_5
-# 2137|     m2137_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2137_1
-# 2137|     m2137_8(ClassWithDestructor)        = Chi                                  : total:m2137_2, partial:m2137_7
-# 2137|     r2137_9(glval<bool>)                = VariableAddress[b]                   : 
-# 2137|     r2137_10(bool)                      = Load[b]                              : &:r2137_9, m2136_6
-# 2137|     v2137_11(void)                      = ConditionalBranch                    : r2137_10
-#-----|   False -> Block 2
-#-----|   True -> Block 1
+# 2135| bool initialization_with_destructor_bool
+# 2135|   Block 0
+# 2135|     v2135_1(void)        = EnterFunction                                        : 
+# 2135|     m2135_2(unknown)     = AliasedDefinition                                    : 
+# 2135|     r2135_3(glval<bool>) = VariableAddress[initialization_with_destructor_bool] : 
+# 2135|     r2135_4(bool)        = Constant[1]                                          : 
+# 2135|     m2135_5(bool)        = Store[initialization_with_destructor_bool]           : &:r2135_3, r2135_4
+# 2135|     m2135_6(unknown)     = Chi                                                  : total:m2135_2, partial:m2135_5
+# 2135|     v2135_7(void)        = ReturnVoid                                           : 
+# 2135|     v2135_8(void)        = AliasedUse                                           : ~m2135_6
+# 2135|     v2135_9(void)        = ExitFunction                                         : 
 
-# 2138|   Block 1
-# 2138|     r2138_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2138|     r2138_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2138|     r2138_3(char)                       = Constant[97]                    : 
-# 2138|     v2138_4(void)                       = Call[set_x]                     : func:r2138_2, this:r2138_1, 0:r2138_3
-# 2138|     m2138_5(unknown)                    = ^CallSideEffect                 : ~m2137_6
-# 2138|     m2138_6(unknown)                    = Chi                             : total:m2137_6, partial:m2138_5
-# 2138|     v2138_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2138_1, m2137_8
-# 2138|     m2138_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2138_1
-# 2138|     m2138_9(ClassWithDestructor)        = Chi                             : total:m2137_8, partial:m2138_8
-#-----|   Goto -> Block 2
+# 2137| void initialization_with_destructor(bool, char)
+# 2137|   Block 0
+# 2137|     v2137_1(void)                       = EnterFunction                        : 
+# 2137|     m2137_2(unknown)                    = AliasedDefinition                    : 
+# 2137|     m2137_3(unknown)                    = InitializeNonLocal                   : 
+# 2137|     m2137_4(unknown)                    = Chi                                  : total:m2137_2, partial:m2137_3
+# 2137|     r2137_5(glval<bool>)                = VariableAddress[b]                   : 
+# 2137|     m2137_6(bool)                       = InitializeParameter[b]               : &:r2137_5
+# 2137|     r2137_7(glval<char>)                = VariableAddress[c]                   : 
+# 2137|     m2137_8(char)                       = InitializeParameter[c]               : &:r2137_7
+# 2138|     r2138_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2138|     m2138_2(ClassWithDestructor)        = Uninitialized[x]                     : &:r2138_1
+# 2138|     r2138_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2138|     v2138_4(void)                       = Call[ClassWithDestructor]            : func:r2138_3, this:r2138_1
+# 2138|     m2138_5(unknown)                    = ^CallSideEffect                      : ~m2137_4
+# 2138|     m2138_6(unknown)                    = Chi                                  : total:m2137_4, partial:m2138_5
+# 2138|     m2138_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2138_1
+# 2138|     m2138_8(ClassWithDestructor)        = Chi                                  : total:m2138_2, partial:m2138_7
+# 2138|     r2138_9(glval<bool>)                = VariableAddress[b]                   : 
+# 2138|     r2138_10(bool)                      = Load[b]                              : &:r2138_9, m2137_6
+# 2138|     v2138_11(void)                      = ConditionalBranch                    : r2138_10
+#-----|   False -> Block 3
+#-----|   True -> Block 2
 
-# 2140|   Block 2
-# 2140|     m2140_1(unknown)                    = Phi                                  : from 0:~m2137_6, from 1:~m2138_6
-# 2140|     r2140_2(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2140|     m2140_3(ClassWithDestructor)        = Uninitialized[x]                     : &:r2140_2
-# 2140|     r2140_4(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2140|     v2140_5(void)                       = Call[ClassWithDestructor]            : func:r2140_4, this:r2140_2
-# 2140|     m2140_6(unknown)                    = ^CallSideEffect                      : ~m2140_1
-# 2140|     m2140_7(unknown)                    = Chi                                  : total:m2140_1, partial:m2140_6
-# 2140|     m2140_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2140_2
-# 2140|     m2140_9(ClassWithDestructor)        = Chi                                  : total:m2140_3, partial:m2140_8
-# 2140|     r2140_10(bool)                      = Constant[1]                          : 
-# 2140|     v2140_11(void)                      = ConditionalBranch                    : r2140_10
-#-----|   False -> Block 10
-#-----|   True -> Block 3
+# 2137|   Block 1
+# 2137|     m2137_9(unknown) = Phi          : from 14:~m2159_5, from 19:~m2163_54, from 23:~m2168_42
+# 2137|     v2137_10(void)   = ReturnVoid   : 
+# 2137|     v2137_11(void)   = AliasedUse   : ~m2137_9
+# 2137|     v2137_12(void)   = ExitFunction : 
+
+# 2139|   Block 2
+# 2139|     r2139_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2139|     r2139_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2139|     r2139_3(char)                       = Constant[97]                    : 
+# 2139|     v2139_4(void)                       = Call[set_x]                     : func:r2139_2, this:r2139_1, 0:r2139_3
+# 2139|     m2139_5(unknown)                    = ^CallSideEffect                 : ~m2138_6
+# 2139|     m2139_6(unknown)                    = Chi                             : total:m2138_6, partial:m2139_5
+# 2139|     v2139_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2139_1, m2138_8
+# 2139|     m2139_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2139_1
+# 2139|     m2139_9(ClassWithDestructor)        = Chi                             : total:m2138_8, partial:m2139_8
+#-----|   Goto -> Block 3
 
 # 2141|   Block 3
-# 2141|     r2141_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2141|     r2141_2(glval<unknown>)             = FunctionAddress[set_x]               : 
-# 2141|     r2141_3(char)                       = Constant[97]                         : 
-# 2141|     v2141_4(void)                       = Call[set_x]                          : func:r2141_2, this:r2141_1, 0:r2141_3
-# 2141|     m2141_5(unknown)                    = ^CallSideEffect                      : ~m2140_7
-# 2141|     m2141_6(unknown)                    = Chi                                  : total:m2140_7, partial:m2141_5
-# 2141|     v2141_7(void)                       = ^IndirectReadSideEffect[-1]          : &:r2141_1, m2140_9
-# 2141|     m2141_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2141_1
-# 2141|     m2141_9(ClassWithDestructor)        = Chi                                  : total:m2140_9, partial:m2141_8
-# 2143|     r2143_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2143|     m2143_2(ClassWithDestructor)        = Uninitialized[x]                     : &:r2143_1
-# 2143|     r2143_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2143|     v2143_4(void)                       = Call[ClassWithDestructor]            : func:r2143_3, this:r2143_1
-# 2143|     m2143_5(unknown)                    = ^CallSideEffect                      : ~m2141_6
-# 2143|     m2143_6(unknown)                    = Chi                                  : total:m2141_6, partial:m2143_5
-# 2143|     m2143_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2143_1
-# 2143|     m2143_8(ClassWithDestructor)        = Chi                                  : total:m2143_2, partial:m2143_7
-# 2143|     r2143_9(glval<char>)                = VariableAddress[c]                   : 
-# 2143|     r2143_10(char)                      = Load[c]                              : &:r2143_9, m2136_8
-# 2143|     r2143_11(int)                       = Convert                              : r2143_10
-# 2143|     v2143_12(void)                      = Switch                               : r2143_11
-#-----|   Case[97] -> Block 4
-#-----|   Default -> Block 5
+# 2141|     m2141_1(unknown)                    = Phi                                  : from 0:~m2138_6, from 2:~m2139_6
+# 2141|     r2141_2(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2141|     m2141_3(ClassWithDestructor)        = Uninitialized[x]                     : &:r2141_2
+# 2141|     r2141_4(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2141|     v2141_5(void)                       = Call[ClassWithDestructor]            : func:r2141_4, this:r2141_2
+# 2141|     m2141_6(unknown)                    = ^CallSideEffect                      : ~m2141_1
+# 2141|     m2141_7(unknown)                    = Chi                                  : total:m2141_1, partial:m2141_6
+# 2141|     m2141_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2141_2
+# 2141|     m2141_9(ClassWithDestructor)        = Chi                                  : total:m2141_3, partial:m2141_8
+# 2141|     r2141_10(bool)                      = Constant[1]                          : 
+# 2141|     v2141_11(void)                      = ConditionalBranch                    : r2141_10
+#-----|   False -> Block 24
+#-----|   True -> Block 4
 
-# 2144|   Block 4
-# 2144|     v2144_1(void)                       = NoOp                            : 
-# 2145|     r2145_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2145|     r2145_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2145|     r2145_3(char)                       = Constant[97]                    : 
-# 2145|     v2145_4(void)                       = Call[set_x]                     : func:r2145_2, this:r2145_1, 0:r2145_3
-# 2145|     m2145_5(unknown)                    = ^CallSideEffect                 : ~m2143_6
-# 2145|     m2145_6(unknown)                    = Chi                             : total:m2143_6, partial:m2145_5
-# 2145|     v2145_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2145_1, m2143_8
-# 2145|     m2145_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2145_1
-# 2145|     m2145_9(ClassWithDestructor)        = Chi                             : total:m2143_8, partial:m2145_8
-# 2146|     v2146_1(void)                       = NoOp                            : 
-#-----|   Goto -> Block 6
+# 2142|   Block 4
+# 2142|     r2142_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2142|     r2142_2(glval<unknown>)             = FunctionAddress[set_x]               : 
+# 2142|     r2142_3(char)                       = Constant[97]                         : 
+# 2142|     v2142_4(void)                       = Call[set_x]                          : func:r2142_2, this:r2142_1, 0:r2142_3
+# 2142|     m2142_5(unknown)                    = ^CallSideEffect                      : ~m2141_7
+# 2142|     m2142_6(unknown)                    = Chi                                  : total:m2141_7, partial:m2142_5
+# 2142|     v2142_7(void)                       = ^IndirectReadSideEffect[-1]          : &:r2142_1, m2141_9
+# 2142|     m2142_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2142_1
+# 2142|     m2142_9(ClassWithDestructor)        = Chi                                  : total:m2141_9, partial:m2142_8
+# 2144|     r2144_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2144|     m2144_2(ClassWithDestructor)        = Uninitialized[x]                     : &:r2144_1
+# 2144|     r2144_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2144|     v2144_4(void)                       = Call[ClassWithDestructor]            : func:r2144_3, this:r2144_1
+# 2144|     m2144_5(unknown)                    = ^CallSideEffect                      : ~m2142_6
+# 2144|     m2144_6(unknown)                    = Chi                                  : total:m2142_6, partial:m2144_5
+# 2144|     m2144_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2144_1
+# 2144|     m2144_8(ClassWithDestructor)        = Chi                                  : total:m2144_2, partial:m2144_7
+# 2144|     r2144_9(glval<char>)                = VariableAddress[c]                   : 
+# 2144|     r2144_10(char)                      = Load[c]                              : &:r2144_9, m2137_8
+# 2144|     r2144_11(int)                       = Convert                              : r2144_10
+# 2144|     v2144_12(void)                      = Switch                               : r2144_11
+#-----|   Case[97] -> Block 5
+#-----|   Default -> Block 6
 
-# 2147|   Block 5
+# 2145|   Block 5
+# 2145|     v2145_1(void)                       = NoOp                            : 
+# 2146|     r2146_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2146|     r2146_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2146|     r2146_3(char)                       = Constant[97]                    : 
+# 2146|     v2146_4(void)                       = Call[set_x]                     : func:r2146_2, this:r2146_1, 0:r2146_3
+# 2146|     m2146_5(unknown)                    = ^CallSideEffect                 : ~m2144_6
+# 2146|     m2146_6(unknown)                    = Chi                             : total:m2144_6, partial:m2146_5
+# 2146|     v2146_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2146_1, m2144_8
+# 2146|     m2146_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2146_1
+# 2146|     m2146_9(ClassWithDestructor)        = Chi                             : total:m2144_8, partial:m2146_8
 # 2147|     v2147_1(void)                       = NoOp                            : 
-# 2148|     r2148_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2148|     r2148_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2148|     r2148_3(char)                       = Constant[98]                    : 
-# 2148|     v2148_4(void)                       = Call[set_x]                     : func:r2148_2, this:r2148_1, 0:r2148_3
-# 2148|     m2148_5(unknown)                    = ^CallSideEffect                 : ~m2143_6
-# 2148|     m2148_6(unknown)                    = Chi                             : total:m2143_6, partial:m2148_5
-# 2148|     v2148_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2148_1, m2143_8
-# 2148|     m2148_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2148_1
-# 2148|     m2148_9(ClassWithDestructor)        = Chi                             : total:m2143_8, partial:m2148_8
-# 2149|     v2149_1(void)                       = NoOp                            : 
-#-----|   Goto -> Block 6
-
-# 2150|   Block 6
-# 2150|     m2150_1(unknown)                               = Phi                                  : from 4:~m2145_6, from 5:~m2148_6
-# 2150|     v2150_2(void)                                  = NoOp                                 : 
-# 2152|     r2152_1(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
-# 2152|     m2152_2(ClassWithDestructor)                   = Uninitialized[x]                     : &:r2152_1
-# 2152|     r2152_3(glval<unknown>)                        = FunctionAddress[ClassWithDestructor] : 
-# 2152|     v2152_4(void)                                  = Call[ClassWithDestructor]            : func:r2152_3, this:r2152_1
-# 2152|     m2152_5(unknown)                               = ^CallSideEffect                      : ~m2150_1
-# 2152|     m2152_6(unknown)                               = Chi                                  : total:m2150_1, partial:m2152_5
-# 2152|     m2152_7(ClassWithDestructor)                   = ^IndirectMayWriteSideEffect[-1]      : &:r2152_1
-# 2152|     m2152_8(ClassWithDestructor)                   = Chi                                  : total:m2152_2, partial:m2152_7
-# 2153|     r2153_1(glval<vector<ClassWithDestructor> &>)  = VariableAddress[(__range)]           : 
-# 2153|     r2153_2(glval<vector<ClassWithDestructor>>)    = VariableAddress                      : 
-# 2153|     r2153_3(vector<ClassWithDestructor> &)         = CopyValue                            : r2153_2
-# 2153|     m2153_4(vector<ClassWithDestructor> &)         = Store[(__range)]                     : &:r2153_1, r2153_3
-# 2153|     r2153_5(glval<iterator>)                       = VariableAddress[(__begin)]           : 
-# 2153|     r2153_6(glval<vector<ClassWithDestructor> &>)  = VariableAddress[(__range)]           : 
-# 2153|     r2153_7(vector<ClassWithDestructor> &)         = Load[(__range)]                      : &:r2153_6, m2153_4
-#-----|     r0_1(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2153_7
-#-----|     r0_2(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_1
-# 2153|     r2153_8(glval<unknown>)                        = FunctionAddress[begin]               : 
-# 2153|     r2153_9(iterator)                              = Call[begin]                          : func:r2153_8, this:r0_2
-# 2153|     m2153_10(unknown)                              = ^CallSideEffect                      : ~m2152_6
-# 2153|     m2153_11(unknown)                              = Chi                                  : total:m2152_6, partial:m2153_10
-#-----|     v0_3(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_2, ~m2153_11
-# 2153|     m2153_12(iterator)                             = Store[(__begin)]                     : &:r2153_5, r2153_9
-# 2153|     r2153_13(glval<iterator>)                      = VariableAddress[(__end)]             : 
-# 2153|     r2153_14(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
-# 2153|     r2153_15(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2153_14, m2153_4
-#-----|     r0_4(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2153_15
-#-----|     r0_5(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_4
-# 2153|     r2153_16(glval<unknown>)                       = FunctionAddress[end]                 : 
-# 2153|     r2153_17(iterator)                             = Call[end]                            : func:r2153_16, this:r0_5
-# 2153|     m2153_18(unknown)                              = ^CallSideEffect                      : ~m2153_11
-# 2153|     m2153_19(unknown)                              = Chi                                  : total:m2153_11, partial:m2153_18
-#-----|     v0_6(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_5, ~m2153_19
-# 2153|     m2153_20(iterator)                             = Store[(__end)]                       : &:r2153_13, r2153_17
 #-----|   Goto -> Block 7
 
-# 2153|   Block 7
-# 2153|     m2153_21(iterator)        = Phi                         : from 6:m2153_12, from 8:m2153_46
-# 2153|     m2153_22(unknown)         = Phi                         : from 6:~m2153_19, from 8:~m2153_43
-# 2153|     r2153_23(glval<iterator>) = VariableAddress[(__begin)]  : 
-#-----|     r0_7(glval<iterator>)     = Convert                     : r2153_23
-# 2153|     r2153_24(glval<unknown>)  = FunctionAddress[operator!=] : 
-# 2153|     r2153_25(glval<iterator>) = VariableAddress[(__end)]    : 
-# 2153|     r2153_26(iterator)        = Load[(__end)]               : &:r2153_25, m2153_20
-# 2153|     r2153_27(bool)            = Call[operator!=]            : func:r2153_24, this:r0_7, 0:r2153_26
-# 2153|     m2153_28(unknown)         = ^CallSideEffect             : ~m2153_22
-# 2153|     m2153_29(unknown)         = Chi                         : total:m2153_22, partial:m2153_28
-#-----|     v0_8(void)                = ^IndirectReadSideEffect[-1] : &:r0_7, m2153_21
-# 2153|     v2153_30(void)            = ConditionalBranch           : r2153_27
-#-----|   False -> Block 9
-#-----|   True -> Block 8
+# 2148|   Block 6
+# 2148|     v2148_1(void)                       = NoOp                            : 
+# 2149|     r2149_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2149|     r2149_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2149|     r2149_3(char)                       = Constant[98]                    : 
+# 2149|     v2149_4(void)                       = Call[set_x]                     : func:r2149_2, this:r2149_1, 0:r2149_3
+# 2149|     m2149_5(unknown)                    = ^CallSideEffect                 : ~m2144_6
+# 2149|     m2149_6(unknown)                    = Chi                             : total:m2144_6, partial:m2149_5
+# 2149|     v2149_7(void)                       = ^IndirectReadSideEffect[-1]     : &:r2149_1, m2144_8
+# 2149|     m2149_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2149_1
+# 2149|     m2149_9(ClassWithDestructor)        = Chi                             : total:m2144_8, partial:m2149_8
+# 2150|     v2150_1(void)                       = NoOp                            : 
+#-----|   Goto -> Block 7
 
-# 2153|   Block 8
-# 2153|     r2153_31(glval<ClassWithDestructor>) = VariableAddress[y]              : 
-# 2153|     r2153_32(glval<iterator>)            = VariableAddress[(__begin)]      : 
-#-----|     r0_9(glval<iterator>)                = Convert                         : r2153_32
-# 2153|     r2153_33(glval<unknown>)             = FunctionAddress[operator*]      : 
-# 2153|     r2153_34(ClassWithDestructor &)      = Call[operator*]                 : func:r2153_33, this:r0_9
-# 2153|     m2153_35(unknown)                    = ^CallSideEffect                 : ~m2153_29
-# 2153|     m2153_36(unknown)                    = Chi                             : total:m2153_29, partial:m2153_35
-#-----|     v0_10(void)                          = ^IndirectReadSideEffect[-1]     : &:r0_9, m2153_21
-# 2153|     r2153_37(ClassWithDestructor)        = Load[?]                         : &:r2153_34, ~m2153_36
-# 2153|     m2153_38(ClassWithDestructor)        = Store[y]                        : &:r2153_31, r2153_37
-# 2154|     r2154_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
-# 2154|     r2154_2(glval<unknown>)              = FunctionAddress[set_x]          : 
-# 2154|     r2154_3(char)                        = Constant[97]                    : 
-# 2154|     v2154_4(void)                        = Call[set_x]                     : func:r2154_2, this:r2154_1, 0:r2154_3
-# 2154|     m2154_5(unknown)                     = ^CallSideEffect                 : ~m2153_36
-# 2154|     m2154_6(unknown)                     = Chi                             : total:m2153_36, partial:m2154_5
-# 2154|     v2154_7(void)                        = ^IndirectReadSideEffect[-1]     : &:r2154_1, m2153_38
-# 2154|     m2154_8(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1] : &:r2154_1
-# 2154|     m2154_9(ClassWithDestructor)         = Chi                             : total:m2153_38, partial:m2154_8
-# 2153|     r2153_39(glval<iterator>)            = VariableAddress[(__begin)]      : 
-# 2153|     r2153_40(glval<unknown>)             = FunctionAddress[operator++]     : 
-# 2153|     r2153_41(iterator &)                 = Call[operator++]                : func:r2153_40, this:r2153_39
-# 2153|     m2153_42(unknown)                    = ^CallSideEffect                 : ~m2154_6
-# 2153|     m2153_43(unknown)                    = Chi                             : total:m2154_6, partial:m2153_42
-# 2153|     v2153_44(void)                       = ^IndirectReadSideEffect[-1]     : &:r2153_39, m2153_21
-# 2153|     m2153_45(iterator)                   = ^IndirectMayWriteSideEffect[-1] : &:r2153_39
-# 2153|     m2153_46(iterator)                   = Chi                             : total:m2153_21, partial:m2153_45
-# 2153|     r2153_47(glval<iterator>)            = CopyValue                       : r2153_41
-#-----|   Goto (back edge) -> Block 7
+# 2151|   Block 7
+# 2151|     m2151_1(unknown)                               = Phi                                  : from 5:~m2146_6, from 6:~m2149_6
+# 2151|     v2151_2(void)                                  = NoOp                                 : 
+# 2153|     r2153_1(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
+# 2153|     m2153_2(ClassWithDestructor)                   = Uninitialized[x]                     : &:r2153_1
+# 2153|     r2153_3(glval<unknown>)                        = FunctionAddress[ClassWithDestructor] : 
+# 2153|     v2153_4(void)                                  = Call[ClassWithDestructor]            : func:r2153_3, this:r2153_1
+# 2153|     m2153_5(unknown)                               = ^CallSideEffect                      : ~m2151_1
+# 2153|     m2153_6(unknown)                               = Chi                                  : total:m2151_1, partial:m2153_5
+# 2153|     m2153_7(ClassWithDestructor)                   = ^IndirectMayWriteSideEffect[-1]      : &:r2153_1
+# 2153|     m2153_8(ClassWithDestructor)                   = Chi                                  : total:m2153_2, partial:m2153_7
+# 2154|     r2154_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]                  : 
+# 2154|     m2154_2(vector<ClassWithDestructor>)           = Uninitialized[ys]                    : &:r2154_1
+# 2154|     r2154_3(glval<unknown>)                        = FunctionAddress[vector]              : 
+# 2154|     r2154_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2154:40]        : 
+# 2154|     r2154_5(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
+# 2154|     r2154_6(ClassWithDestructor)                   = Load[x]                              : &:r2154_5, m2153_8
+# 2154|     m2154_7(ClassWithDestructor)                   = Store[#temp2154:40]                  : &:r2154_4, r2154_6
+# 2154|     r2154_8(ClassWithDestructor)                   = Load[#temp2154:40]                   : &:r2154_4, m2154_7
+# 2154|     v2154_9(void)                                  = Call[vector]                         : func:r2154_3, this:r2154_1, 0:r2154_8
+# 2154|     m2154_10(unknown)                              = ^CallSideEffect                      : ~m2153_6
+# 2154|     m2154_11(unknown)                              = Chi                                  : total:m2153_6, partial:m2154_10
+# 2154|     m2154_12(vector<ClassWithDestructor>)          = ^IndirectMayWriteSideEffect[-1]      : &:r2154_1
+# 2154|     m2154_13(vector<ClassWithDestructor>)          = Chi                                  : total:m2154_2, partial:m2154_12
+# 2154|     r2154_14(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_15(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]                  : 
+# 2154|     r2154_16(vector<ClassWithDestructor> &)        = CopyValue                            : r2154_15
+# 2154|     m2154_17(vector<ClassWithDestructor> &)        = Store[(__range)]                     : &:r2154_14, r2154_16
+# 2154|     r2154_18(glval<iterator>)                      = VariableAddress[(__begin)]           : 
+# 2154|     r2154_19(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_20(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2154_19, m2154_17
+#-----|     r0_1(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2154_20
+#-----|     r0_2(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_1
+# 2154|     r2154_21(glval<unknown>)                       = FunctionAddress[begin]               : 
+# 2154|     r2154_22(iterator)                             = Call[begin]                          : func:r2154_21, this:r0_2
+# 2154|     m2154_23(unknown)                              = ^CallSideEffect                      : ~m2154_11
+# 2154|     m2154_24(unknown)                              = Chi                                  : total:m2154_11, partial:m2154_23
+#-----|     v0_3(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_2, m2154_13
+# 2154|     m2154_25(iterator)                             = Store[(__begin)]                     : &:r2154_18, r2154_22
+# 2154|     r2154_26(glval<iterator>)                      = VariableAddress[(__end)]             : 
+# 2154|     r2154_27(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_28(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2154_27, m2154_17
+#-----|     r0_4(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2154_28
+#-----|     r0_5(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_4
+# 2154|     r2154_29(glval<unknown>)                       = FunctionAddress[end]                 : 
+# 2154|     r2154_30(iterator)                             = Call[end]                            : func:r2154_29, this:r0_5
+# 2154|     m2154_31(unknown)                              = ^CallSideEffect                      : ~m2154_24
+# 2154|     m2154_32(unknown)                              = Chi                                  : total:m2154_24, partial:m2154_31
+#-----|     v0_6(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_5, m2154_13
+# 2154|     m2154_33(iterator)                             = Store[(__end)]                       : &:r2154_26, r2154_30
+#-----|   Goto -> Block 8
 
-# 2155|   Block 9
-# 2155|     v2155_1(void)  = NoOp         : 
-# 2136|     v2136_9(void)  = ReturnVoid   : 
-# 2136|     v2136_10(void) = AliasedUse   : ~m2153_29
-# 2136|     v2136_11(void) = ExitFunction : 
+# 2154|   Block 8
+# 2154|     m2154_34(iterator)        = Phi                         : from 7:m2154_25, from 9:m2154_59
+# 2154|     m2154_35(unknown)         = Phi                         : from 7:~m2154_32, from 9:~m2154_56
+# 2154|     r2154_36(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_7(glval<iterator>)     = Convert                     : r2154_36
+# 2154|     r2154_37(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2154|     r2154_38(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2154|     r2154_39(iterator)        = Load[(__end)]               : &:r2154_38, m2154_33
+# 2154|     r2154_40(bool)            = Call[operator!=]            : func:r2154_37, this:r0_7, 0:r2154_39
+# 2154|     m2154_41(unknown)         = ^CallSideEffect             : ~m2154_35
+# 2154|     m2154_42(unknown)         = Chi                         : total:m2154_35, partial:m2154_41
+#-----|     v0_8(void)                = ^IndirectReadSideEffect[-1] : &:r0_7, m2154_34
+# 2154|     v2154_43(void)            = ConditionalBranch           : r2154_40
+#-----|   False -> Block 10
+#-----|   True -> Block 9
 
-# 2136|   Block 10
-# 2136|     v2136_12(void) = Unreached : 
+# 2154|   Block 9
+# 2154|     r2154_44(glval<ClassWithDestructor>) = VariableAddress[y]              : 
+# 2154|     r2154_45(glval<iterator>)            = VariableAddress[(__begin)]      : 
+#-----|     r0_9(glval<iterator>)                = Convert                         : r2154_45
+# 2154|     r2154_46(glval<unknown>)             = FunctionAddress[operator*]      : 
+# 2154|     r2154_47(ClassWithDestructor &)      = Call[operator*]                 : func:r2154_46, this:r0_9
+# 2154|     m2154_48(unknown)                    = ^CallSideEffect                 : ~m2154_42
+# 2154|     m2154_49(unknown)                    = Chi                             : total:m2154_42, partial:m2154_48
+#-----|     v0_10(void)                          = ^IndirectReadSideEffect[-1]     : &:r0_9, m2154_34
+# 2154|     r2154_50(ClassWithDestructor)        = Load[?]                         : &:r2154_47, ~m2154_49
+# 2154|     m2154_51(ClassWithDestructor)        = Store[y]                        : &:r2154_44, r2154_50
+# 2155|     r2155_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2155|     r2155_2(glval<unknown>)              = FunctionAddress[set_x]          : 
+# 2155|     r2155_3(char)                        = Constant[97]                    : 
+# 2155|     v2155_4(void)                        = Call[set_x]                     : func:r2155_2, this:r2155_1, 0:r2155_3
+# 2155|     m2155_5(unknown)                     = ^CallSideEffect                 : ~m2154_49
+# 2155|     m2155_6(unknown)                     = Chi                             : total:m2154_49, partial:m2155_5
+# 2155|     v2155_7(void)                        = ^IndirectReadSideEffect[-1]     : &:r2155_1, m2154_51
+# 2155|     m2155_8(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1] : &:r2155_1
+# 2155|     m2155_9(ClassWithDestructor)         = Chi                             : total:m2154_51, partial:m2155_8
+# 2154|     r2154_52(glval<iterator>)            = VariableAddress[(__begin)]      : 
+# 2154|     r2154_53(glval<unknown>)             = FunctionAddress[operator++]     : 
+# 2154|     r2154_54(iterator &)                 = Call[operator++]                : func:r2154_53, this:r2154_52
+# 2154|     m2154_55(unknown)                    = ^CallSideEffect                 : ~m2155_6
+# 2154|     m2154_56(unknown)                    = Chi                             : total:m2155_6, partial:m2154_55
+# 2154|     v2154_57(void)                       = ^IndirectReadSideEffect[-1]     : &:r2154_52, m2154_34
+# 2154|     m2154_58(iterator)                   = ^IndirectMayWriteSideEffect[-1] : &:r2154_52
+# 2154|     m2154_59(iterator)                   = Chi                             : total:m2154_34, partial:m2154_58
+# 2154|     r2154_60(glval<iterator>)            = CopyValue                       : r2154_54
+#-----|   Goto (back edge) -> Block 8
+
+# 2157|   Block 10
+# 2157|     r2157_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]             : 
+# 2157|     m2157_2(vector<ClassWithDestructor>)           = Uninitialized[ys]               : &:r2157_1
+# 2157|     r2157_3(glval<unknown>)                        = FunctionAddress[vector]         : 
+# 2157|     r2157_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2157:40]   : 
+# 2157|     r2157_5(glval<ClassWithDestructor>)            = VariableAddress[x]              : 
+# 2157|     r2157_6(ClassWithDestructor)                   = Load[x]                         : &:r2157_5, m2153_8
+# 2157|     m2157_7(ClassWithDestructor)                   = Store[#temp2157:40]             : &:r2157_4, r2157_6
+# 2157|     r2157_8(ClassWithDestructor)                   = Load[#temp2157:40]              : &:r2157_4, m2157_7
+# 2157|     v2157_9(void)                                  = Call[vector]                    : func:r2157_3, this:r2157_1, 0:r2157_8
+# 2157|     m2157_10(unknown)                              = ^CallSideEffect                 : ~m2154_42
+# 2157|     m2157_11(unknown)                              = Chi                             : total:m2154_42, partial:m2157_10
+# 2157|     m2157_12(vector<ClassWithDestructor>)          = ^IndirectMayWriteSideEffect[-1] : &:r2157_1
+# 2157|     m2157_13(vector<ClassWithDestructor>)          = Chi                             : total:m2157_2, partial:m2157_12
+# 2157|     r2157_14(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_15(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]             : 
+# 2157|     r2157_16(vector<ClassWithDestructor> &)        = CopyValue                       : r2157_15
+# 2157|     m2157_17(vector<ClassWithDestructor> &)        = Store[(__range)]                : &:r2157_14, r2157_16
+# 2157|     r2157_18(glval<iterator>)                      = VariableAddress[(__begin)]      : 
+# 2157|     r2157_19(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_20(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2157_19, m2157_17
+#-----|     r0_11(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2157_20
+#-----|     r0_12(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_11
+# 2157|     r2157_21(glval<unknown>)                       = FunctionAddress[begin]          : 
+# 2157|     r2157_22(iterator)                             = Call[begin]                     : func:r2157_21, this:r0_12
+# 2157|     m2157_23(unknown)                              = ^CallSideEffect                 : ~m2157_11
+# 2157|     m2157_24(unknown)                              = Chi                             : total:m2157_11, partial:m2157_23
+#-----|     v0_13(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_12, m2157_13
+# 2157|     m2157_25(iterator)                             = Store[(__begin)]                : &:r2157_18, r2157_22
+# 2157|     r2157_26(glval<iterator>)                      = VariableAddress[(__end)]        : 
+# 2157|     r2157_27(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_28(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2157_27, m2157_17
+#-----|     r0_14(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2157_28
+#-----|     r0_15(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_14
+# 2157|     r2157_29(glval<unknown>)                       = FunctionAddress[end]            : 
+# 2157|     r2157_30(iterator)                             = Call[end]                       : func:r2157_29, this:r0_15
+# 2157|     m2157_31(unknown)                              = ^CallSideEffect                 : ~m2157_24
+# 2157|     m2157_32(unknown)                              = Chi                             : total:m2157_24, partial:m2157_31
+#-----|     v0_16(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_15, m2157_13
+# 2157|     m2157_33(iterator)                             = Store[(__end)]                  : &:r2157_26, r2157_30
+#-----|   Goto -> Block 11
+
+# 2157|   Block 11
+# 2157|     m2157_34(iterator)        = Phi                         : from 10:m2157_25, from 12:m2157_51
+# 2157|     m2157_35(unknown)         = Phi                         : from 10:~m2157_32, from 12:~m2157_48
+# 2157|     r2157_36(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_17(glval<iterator>)    = Convert                     : r2157_36
+# 2157|     r2157_37(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2157|     r2157_38(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2157|     r2157_39(iterator)        = Load[(__end)]               : &:r2157_38, m2157_33
+# 2157|     r2157_40(bool)            = Call[operator!=]            : func:r2157_37, this:r0_17, 0:r2157_39
+# 2157|     m2157_41(unknown)         = ^CallSideEffect             : ~m2157_35
+# 2157|     m2157_42(unknown)         = Chi                         : total:m2157_35, partial:m2157_41
+#-----|     v0_18(void)               = ^IndirectReadSideEffect[-1] : &:r0_17, m2157_34
+# 2157|     v2157_43(void)            = ConditionalBranch           : r2157_40
+#-----|   False -> Block 15
+#-----|   True -> Block 13
+
+# 2157|   Block 12
+# 2157|     r2157_44(glval<iterator>) = VariableAddress[(__begin)]      : 
+# 2157|     r2157_45(glval<unknown>)  = FunctionAddress[operator++]     : 
+# 2157|     r2157_46(iterator &)      = Call[operator++]                : func:r2157_45, this:r2157_44
+# 2157|     m2157_47(unknown)         = ^CallSideEffect                 : ~m2159_5
+# 2157|     m2157_48(unknown)         = Chi                             : total:m2159_5, partial:m2157_47
+# 2157|     v2157_49(void)            = ^IndirectReadSideEffect[-1]     : &:r2157_44, m2157_34
+# 2157|     m2157_50(iterator)        = ^IndirectMayWriteSideEffect[-1] : &:r2157_44
+# 2157|     m2157_51(iterator)        = Chi                             : total:m2157_34, partial:m2157_50
+# 2157|     r2157_52(glval<iterator>) = CopyValue                       : r2157_46
+#-----|   Goto (back edge) -> Block 11
+
+# 2157|   Block 13
+# 2157|     r2157_53(glval<ClassWithDestructor>) = VariableAddress[y]              : 
+# 2157|     r2157_54(glval<iterator>)            = VariableAddress[(__begin)]      : 
+#-----|     r0_19(glval<iterator>)               = Convert                         : r2157_54
+# 2157|     r2157_55(glval<unknown>)             = FunctionAddress[operator*]      : 
+# 2157|     r2157_56(ClassWithDestructor &)      = Call[operator*]                 : func:r2157_55, this:r0_19
+# 2157|     m2157_57(unknown)                    = ^CallSideEffect                 : ~m2157_42
+# 2157|     m2157_58(unknown)                    = Chi                             : total:m2157_42, partial:m2157_57
+#-----|     v0_20(void)                          = ^IndirectReadSideEffect[-1]     : &:r0_19, m2157_34
+# 2157|     r2157_59(ClassWithDestructor)        = Load[?]                         : &:r2157_56, ~m2157_58
+# 2157|     m2157_60(ClassWithDestructor)        = Store[y]                        : &:r2157_53, r2157_59
+# 2158|     r2158_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2158|     r2158_2(glval<unknown>)              = FunctionAddress[set_x]          : 
+# 2158|     r2158_3(char)                        = Constant[97]                    : 
+# 2158|     v2158_4(void)                        = Call[set_x]                     : func:r2158_2, this:r2158_1, 0:r2158_3
+# 2158|     m2158_5(unknown)                     = ^CallSideEffect                 : ~m2157_58
+# 2158|     m2158_6(unknown)                     = Chi                             : total:m2157_58, partial:m2158_5
+# 2158|     v2158_7(void)                        = ^IndirectReadSideEffect[-1]     : &:r2158_1, m2157_60
+# 2158|     m2158_8(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1] : &:r2158_1
+# 2158|     m2158_9(ClassWithDestructor)         = Chi                             : total:m2157_60, partial:m2158_8
+# 2159|     r2159_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2159|     r2159_2(glval<unknown>)              = FunctionAddress[get_x]          : 
+# 2159|     r2159_3(char)                        = Call[get_x]                     : func:r2159_2, this:r2159_1
+# 2159|     m2159_4(unknown)                     = ^CallSideEffect                 : ~m2158_6
+# 2159|     m2159_5(unknown)                     = Chi                             : total:m2158_6, partial:m2159_4
+# 2159|     v2159_6(void)                        = ^IndirectReadSideEffect[-1]     : &:r2159_1, m2158_9
+# 2159|     m2159_7(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1] : &:r2159_1
+# 2159|     m2159_8(ClassWithDestructor)         = Chi                             : total:m2158_9, partial:m2159_7
+# 2159|     r2159_9(int)                         = Convert                         : r2159_3
+# 2159|     r2159_10(int)                        = Constant[98]                    : 
+# 2159|     r2159_11(bool)                       = CompareEQ                       : r2159_9, r2159_10
+# 2159|     v2159_12(void)                       = ConditionalBranch               : r2159_11
+#-----|   False -> Block 12
+#-----|   True -> Block 14
+
+# 2160|   Block 14
+# 2160|     v2160_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2163|   Block 15
+# 2163|     r2163_1(glval<vector<int>>)    = VariableAddress[ys]             : 
+# 2163|     m2163_2(vector<int>)           = Uninitialized[ys]               : &:r2163_1
+# 2163|     r2163_3(glval<unknown>)        = FunctionAddress[vector]         : 
+# 2163|     r2163_4(int)                   = Constant[1]                     : 
+# 2163|     v2163_5(void)                  = Call[vector]                    : func:r2163_3, this:r2163_1, 0:r2163_4
+# 2163|     m2163_6(unknown)               = ^CallSideEffect                 : ~m2157_42
+# 2163|     m2163_7(unknown)               = Chi                             : total:m2157_42, partial:m2163_6
+# 2163|     m2163_8(vector<int>)           = ^IndirectMayWriteSideEffect[-1] : &:r2163_1
+# 2163|     m2163_9(vector<int>)           = Chi                             : total:m2163_2, partial:m2163_8
+# 2163|     r2163_10(glval<vector<int> &>) = VariableAddress[(__range)]      : 
+# 2163|     r2163_11(glval<vector<int>>)   = VariableAddress[ys]             : 
+# 2163|     r2163_12(vector<int> &)        = CopyValue                       : r2163_11
+# 2163|     m2163_13(vector<int> &)        = Store[(__range)]                : &:r2163_10, r2163_12
+# 2163|     r2163_14(glval<iterator>)      = VariableAddress[(__begin)]      : 
+# 2163|     r2163_15(glval<vector<int> &>) = VariableAddress[(__range)]      : 
+# 2163|     r2163_16(vector<int> &)        = Load[(__range)]                 : &:r2163_15, m2163_13
+#-----|     r0_21(glval<vector<int>>)      = CopyValue                       : r2163_16
+#-----|     r0_22(glval<vector<int>>)      = Convert                         : r0_21
+# 2163|     r2163_17(glval<unknown>)       = FunctionAddress[begin]          : 
+# 2163|     r2163_18(iterator)             = Call[begin]                     : func:r2163_17, this:r0_22
+# 2163|     m2163_19(unknown)              = ^CallSideEffect                 : ~m2163_7
+# 2163|     m2163_20(unknown)              = Chi                             : total:m2163_7, partial:m2163_19
+#-----|     v0_23(void)                    = ^IndirectReadSideEffect[-1]     : &:r0_22, m2163_9
+# 2163|     m2163_21(iterator)             = Store[(__begin)]                : &:r2163_14, r2163_18
+# 2163|     r2163_22(glval<iterator>)      = VariableAddress[(__end)]        : 
+# 2163|     r2163_23(glval<vector<int> &>) = VariableAddress[(__range)]      : 
+# 2163|     r2163_24(vector<int> &)        = Load[(__range)]                 : &:r2163_23, m2163_13
+#-----|     r0_24(glval<vector<int>>)      = CopyValue                       : r2163_24
+#-----|     r0_25(glval<vector<int>>)      = Convert                         : r0_24
+# 2163|     r2163_25(glval<unknown>)       = FunctionAddress[end]            : 
+# 2163|     r2163_26(iterator)             = Call[end]                       : func:r2163_25, this:r0_25
+# 2163|     m2163_27(unknown)              = ^CallSideEffect                 : ~m2163_20
+# 2163|     m2163_28(unknown)              = Chi                             : total:m2163_20, partial:m2163_27
+#-----|     v0_26(void)                    = ^IndirectReadSideEffect[-1]     : &:r0_25, m2163_9
+# 2163|     m2163_29(iterator)             = Store[(__end)]                  : &:r2163_22, r2163_26
+#-----|   Goto -> Block 16
+
+# 2163|   Block 16
+# 2163|     m2163_30(iterator)        = Phi                         : from 15:m2163_21, from 17:m2163_47
+# 2163|     m2163_31(unknown)         = Phi                         : from 15:~m2163_28, from 17:~m2163_44
+# 2163|     r2163_32(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_27(glval<iterator>)    = Convert                     : r2163_32
+# 2163|     r2163_33(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2163|     r2163_34(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2163|     r2163_35(iterator)        = Load[(__end)]               : &:r2163_34, m2163_29
+# 2163|     r2163_36(bool)            = Call[operator!=]            : func:r2163_33, this:r0_27, 0:r2163_35
+# 2163|     m2163_37(unknown)         = ^CallSideEffect             : ~m2163_31
+# 2163|     m2163_38(unknown)         = Chi                         : total:m2163_31, partial:m2163_37
+#-----|     v0_28(void)               = ^IndirectReadSideEffect[-1] : &:r0_27, m2163_30
+# 2163|     v2163_39(void)            = ConditionalBranch           : r2163_36
+#-----|   False -> Block 20
+#-----|   True -> Block 18
+
+# 2163|   Block 17
+# 2163|     r2163_40(glval<iterator>) = VariableAddress[(__begin)]      : 
+# 2163|     r2163_41(glval<unknown>)  = FunctionAddress[operator++]     : 
+# 2163|     r2163_42(iterator &)      = Call[operator++]                : func:r2163_41, this:r2163_40
+# 2163|     m2163_43(unknown)         = ^CallSideEffect                 : ~m2163_54
+# 2163|     m2163_44(unknown)         = Chi                             : total:m2163_54, partial:m2163_43
+# 2163|     v2163_45(void)            = ^IndirectReadSideEffect[-1]     : &:r2163_40, m2163_30
+# 2163|     m2163_46(iterator)        = ^IndirectMayWriteSideEffect[-1] : &:r2163_40
+# 2163|     m2163_47(iterator)        = Chi                             : total:m2163_30, partial:m2163_46
+# 2163|     r2163_48(glval<iterator>) = CopyValue                       : r2163_42
+#-----|   Goto (back edge) -> Block 16
+
+# 2163|   Block 18
+# 2163|     r2163_49(glval<int>)      = VariableAddress[y]          : 
+# 2163|     r2163_50(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_29(glval<iterator>)    = Convert                     : r2163_50
+# 2163|     r2163_51(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 2163|     r2163_52(int &)           = Call[operator*]             : func:r2163_51, this:r0_29
+# 2163|     m2163_53(unknown)         = ^CallSideEffect             : ~m2163_38
+# 2163|     m2163_54(unknown)         = Chi                         : total:m2163_38, partial:m2163_53
+#-----|     v0_30(void)               = ^IndirectReadSideEffect[-1] : &:r0_29, m2163_30
+# 2163|     r2163_55(int)             = Load[?]                     : &:r2163_52, ~m2163_54
+# 2163|     m2163_56(int)             = Store[y]                    : &:r2163_49, r2163_55
+# 2164|     r2164_1(glval<int>)       = VariableAddress[y]          : 
+# 2164|     r2164_2(int)              = Load[y]                     : &:r2164_1, m2163_56
+# 2164|     r2164_3(int)              = Constant[1]                 : 
+# 2164|     r2164_4(bool)             = CompareEQ                   : r2164_2, r2164_3
+# 2164|     v2164_5(void)             = ConditionalBranch           : r2164_4
+#-----|   False -> Block 17
+#-----|   True -> Block 19
+
+# 2165|   Block 19
+# 2165|     v2165_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2168|   Block 20
+# 2168|     r2168_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]             : 
+# 2168|     m2168_2(vector<ClassWithDestructor>)           = Uninitialized[ys]               : &:r2168_1
+# 2168|     r2168_3(glval<unknown>)                        = FunctionAddress[vector]         : 
+# 2168|     r2168_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2168:40]   : 
+# 2168|     r2168_5(glval<ClassWithDestructor>)            = VariableAddress[x]              : 
+# 2168|     r2168_6(ClassWithDestructor)                   = Load[x]                         : &:r2168_5, m2153_8
+# 2168|     m2168_7(ClassWithDestructor)                   = Store[#temp2168:40]             : &:r2168_4, r2168_6
+# 2168|     r2168_8(ClassWithDestructor)                   = Load[#temp2168:40]              : &:r2168_4, m2168_7
+# 2168|     v2168_9(void)                                  = Call[vector]                    : func:r2168_3, this:r2168_1, 0:r2168_8
+# 2168|     m2168_10(unknown)                              = ^CallSideEffect                 : ~m2163_38
+# 2168|     m2168_11(unknown)                              = Chi                             : total:m2163_38, partial:m2168_10
+# 2168|     m2168_12(vector<ClassWithDestructor>)          = ^IndirectMayWriteSideEffect[-1] : &:r2168_1
+# 2168|     m2168_13(vector<ClassWithDestructor>)          = Chi                             : total:m2168_2, partial:m2168_12
+# 2168|     r2168_14(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_15(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]             : 
+# 2168|     r2168_16(vector<ClassWithDestructor> &)        = CopyValue                       : r2168_15
+# 2168|     m2168_17(vector<ClassWithDestructor> &)        = Store[(__range)]                : &:r2168_14, r2168_16
+# 2168|     r2168_18(glval<iterator>)                      = VariableAddress[(__begin)]      : 
+# 2168|     r2168_19(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_20(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2168_19, m2168_17
+#-----|     r0_31(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2168_20
+#-----|     r0_32(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_31
+# 2168|     r2168_21(glval<unknown>)                       = FunctionAddress[begin]          : 
+# 2168|     r2168_22(iterator)                             = Call[begin]                     : func:r2168_21, this:r0_32
+# 2168|     m2168_23(unknown)                              = ^CallSideEffect                 : ~m2168_11
+# 2168|     m2168_24(unknown)                              = Chi                             : total:m2168_11, partial:m2168_23
+#-----|     v0_33(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_32, m2168_13
+# 2168|     m2168_25(iterator)                             = Store[(__begin)]                : &:r2168_18, r2168_22
+# 2168|     r2168_26(glval<iterator>)                      = VariableAddress[(__end)]        : 
+# 2168|     r2168_27(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_28(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2168_27, m2168_17
+#-----|     r0_34(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2168_28
+#-----|     r0_35(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_34
+# 2168|     r2168_29(glval<unknown>)                       = FunctionAddress[end]            : 
+# 2168|     r2168_30(iterator)                             = Call[end]                       : func:r2168_29, this:r0_35
+# 2168|     m2168_31(unknown)                              = ^CallSideEffect                 : ~m2168_24
+# 2168|     m2168_32(unknown)                              = Chi                             : total:m2168_24, partial:m2168_31
+#-----|     v0_36(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_35, m2168_13
+# 2168|     m2168_33(iterator)                             = Store[(__end)]                  : &:r2168_26, r2168_30
+#-----|   Goto -> Block 21
+
+# 2168|   Block 21
+# 2168|     m2168_34(iterator)        = Phi                         : from 20:m2168_25, from 22:m2168_59
+# 2168|     m2168_35(unknown)         = Phi                         : from 20:~m2168_32, from 22:~m2168_56
+# 2168|     r2168_36(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_37(glval<iterator>)    = Convert                     : r2168_36
+# 2168|     r2168_37(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2168|     r2168_38(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2168|     r2168_39(iterator)        = Load[(__end)]               : &:r2168_38, m2168_33
+# 2168|     r2168_40(bool)            = Call[operator!=]            : func:r2168_37, this:r0_37, 0:r2168_39
+# 2168|     m2168_41(unknown)         = ^CallSideEffect             : ~m2168_35
+# 2168|     m2168_42(unknown)         = Chi                         : total:m2168_35, partial:m2168_41
+#-----|     v0_38(void)               = ^IndirectReadSideEffect[-1] : &:r0_37, m2168_34
+# 2168|     v2168_43(void)            = ConditionalBranch           : r2168_40
+#-----|   False -> Block 23
+#-----|   True -> Block 22
+
+# 2168|   Block 22
+# 2168|     r2168_44(glval<ClassWithDestructor>) = VariableAddress[y]                   : 
+# 2168|     r2168_45(glval<iterator>)            = VariableAddress[(__begin)]           : 
+#-----|     r0_39(glval<iterator>)               = Convert                              : r2168_45
+# 2168|     r2168_46(glval<unknown>)             = FunctionAddress[operator*]           : 
+# 2168|     r2168_47(ClassWithDestructor &)      = Call[operator*]                      : func:r2168_46, this:r0_39
+# 2168|     m2168_48(unknown)                    = ^CallSideEffect                      : ~m2168_42
+# 2168|     m2168_49(unknown)                    = Chi                                  : total:m2168_42, partial:m2168_48
+#-----|     v0_40(void)                          = ^IndirectReadSideEffect[-1]          : &:r0_39, m2168_34
+# 2168|     r2168_50(ClassWithDestructor)        = Load[?]                              : &:r2168_47, ~m2168_49
+# 2168|     m2168_51(ClassWithDestructor)        = Store[y]                             : &:r2168_44, r2168_50
+# 2169|     r2169_1(glval<ClassWithDestructor>)  = VariableAddress[z1]                  : 
+# 2169|     m2169_2(ClassWithDestructor)         = Uninitialized[z1]                    : &:r2169_1
+# 2169|     r2169_3(glval<unknown>)              = FunctionAddress[ClassWithDestructor] : 
+# 2169|     v2169_4(void)                        = Call[ClassWithDestructor]            : func:r2169_3, this:r2169_1
+# 2169|     m2169_5(unknown)                     = ^CallSideEffect                      : ~m2168_49
+# 2169|     m2169_6(unknown)                     = Chi                                  : total:m2168_49, partial:m2169_5
+# 2169|     m2169_7(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1]      : &:r2169_1
+# 2169|     m2169_8(ClassWithDestructor)         = Chi                                  : total:m2169_2, partial:m2169_7
+# 2170|     r2170_1(glval<ClassWithDestructor>)  = VariableAddress[z2]                  : 
+# 2170|     m2170_2(ClassWithDestructor)         = Uninitialized[z2]                    : &:r2170_1
+# 2170|     r2170_3(glval<unknown>)              = FunctionAddress[ClassWithDestructor] : 
+# 2170|     v2170_4(void)                        = Call[ClassWithDestructor]            : func:r2170_3, this:r2170_1
+# 2170|     m2170_5(unknown)                     = ^CallSideEffect                      : ~m2169_6
+# 2170|     m2170_6(unknown)                     = Chi                                  : total:m2169_6, partial:m2170_5
+# 2170|     m2170_7(ClassWithDestructor)         = ^IndirectMayWriteSideEffect[-1]      : &:r2170_1
+# 2170|     m2170_8(ClassWithDestructor)         = Chi                                  : total:m2170_2, partial:m2170_7
+# 2168|     r2168_52(glval<iterator>)            = VariableAddress[(__begin)]           : 
+# 2168|     r2168_53(glval<unknown>)             = FunctionAddress[operator++]          : 
+# 2168|     r2168_54(iterator &)                 = Call[operator++]                     : func:r2168_53, this:r2168_52
+# 2168|     m2168_55(unknown)                    = ^CallSideEffect                      : ~m2170_6
+# 2168|     m2168_56(unknown)                    = Chi                                  : total:m2170_6, partial:m2168_55
+# 2168|     v2168_57(void)                       = ^IndirectReadSideEffect[-1]          : &:r2168_52, m2168_34
+# 2168|     m2168_58(iterator)                   = ^IndirectMayWriteSideEffect[-1]      : &:r2168_52
+# 2168|     m2168_59(iterator)                   = Chi                                  : total:m2168_34, partial:m2168_58
+# 2168|     r2168_60(glval<iterator>)            = CopyValue                            : r2168_54
+#-----|   Goto (back edge) -> Block 21
+
+# 2172|   Block 23
+# 2172|     v2172_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2137|   Block 24
+# 2137|     v2137_13(void) = Unreached : 
+
+# 2174| void static_variable_with_destructor_1()
+# 2174|   Block 0
+# 2174|     v2174_1(void)                       = EnterFunction                        : 
+# 2174|     m2174_2(unknown)                    = AliasedDefinition                    : 
+# 2174|     m2174_3(unknown)                    = InitializeNonLocal                   : 
+# 2174|     m2174_4(unknown)                    = Chi                                  : total:m2174_2, partial:m2174_3
+# 2175|     r2175_1(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+# 2175|     m2175_2(ClassWithDestructor)        = Uninitialized[a]                     : &:r2175_1
+# 2175|     r2175_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2175|     v2175_4(void)                       = Call[ClassWithDestructor]            : func:r2175_3, this:r2175_1
+# 2175|     m2175_5(unknown)                    = ^CallSideEffect                      : ~m2174_4
+# 2175|     m2175_6(unknown)                    = Chi                                  : total:m2174_4, partial:m2175_5
+# 2175|     m2175_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2175_1
+# 2175|     m2175_8(ClassWithDestructor)        = Chi                                  : total:m2175_2, partial:m2175_7
+# 2176|     r2176_1(glval<bool>)                = VariableAddress[b#init]              : 
+# 2176|     r2176_2(bool)                       = Load[b#init]                         : &:r2176_1, ~m2175_6
+# 2176|     v2176_3(void)                       = ConditionalBranch                    : r2176_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2176|   Block 1
+# 2176|     r2176_4(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2176_4
+#-----|     m0_3(unknown)                       = ^CallSideEffect                      : ~m2175_6
+#-----|     m0_4(unknown)                       = Chi                                  : total:m2175_6, partial:m0_3
+#-----|     m0_5(ClassWithDestructor)           = ^IndirectMayWriteSideEffect[-1]      : &:r2176_4
+#-----|     m0_6(unknown)                       = Chi                                  : total:m0_4, partial:m0_5
+# 2176|     r2176_5(bool)                       = Constant[1]                          : 
+# 2176|     m2176_6(bool)                       = Store[b#init]                        : &:r2176_1, r2176_5
+# 2176|     m2176_7(unknown)                    = Chi                                  : total:m0_6, partial:m2176_6
+#-----|   Goto -> Block 2
+
+# 2177|   Block 2
+# 2177|     m2177_1(unknown) = Phi          : from 0:~m2175_6, from 1:~m2176_7
+# 2177|     v2177_2(void)    = NoOp         : 
+# 2174|     v2174_5(void)    = ReturnVoid   : 
+# 2174|     v2174_6(void)    = AliasedUse   : ~m2177_1
+# 2174|     v2174_7(void)    = ExitFunction : 
+
+# 2179| void static_variable_with_destructor_2()
+# 2179|   Block 0
+# 2179|     v2179_1(void)        = EnterFunction           : 
+# 2179|     m2179_2(unknown)     = AliasedDefinition       : 
+# 2179|     m2179_3(unknown)     = InitializeNonLocal      : 
+# 2179|     m2179_4(unknown)     = Chi                     : total:m2179_2, partial:m2179_3
+# 2180|     r2180_1(glval<bool>) = VariableAddress[a#init] : 
+# 2180|     r2180_2(bool)        = Load[a#init]            : &:r2180_1, ~m2179_3
+# 2180|     v2180_3(void)        = ConditionalBranch       : r2180_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2180|   Block 1
+# 2180|     r2180_4(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2180_4
+#-----|     m0_3(unknown)                       = ^CallSideEffect                      : ~m2179_4
+#-----|     m0_4(unknown)                       = Chi                                  : total:m2179_4, partial:m0_3
+#-----|     m0_5(ClassWithDestructor)           = ^IndirectMayWriteSideEffect[-1]      : &:r2180_4
+#-----|     m0_6(unknown)                       = Chi                                  : total:m0_4, partial:m0_5
+# 2180|     r2180_5(bool)                       = Constant[1]                          : 
+# 2180|     m2180_6(bool)                       = Store[a#init]                        : &:r2180_1, r2180_5
+# 2180|     m2180_7(unknown)                    = Chi                                  : total:m0_6, partial:m2180_6
+#-----|   Goto -> Block 2
+
+# 2181|   Block 2
+# 2181|     m2181_1(unknown)                    = Phi                                  : from 0:~m2179_4, from 1:~m2180_7
+# 2181|     r2181_2(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+# 2181|     m2181_3(ClassWithDestructor)        = Uninitialized[b]                     : &:r2181_2
+# 2181|     r2181_4(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2181|     v2181_5(void)                       = Call[ClassWithDestructor]            : func:r2181_4, this:r2181_2
+# 2181|     m2181_6(unknown)                    = ^CallSideEffect                      : ~m2181_1
+# 2181|     m2181_7(unknown)                    = Chi                                  : total:m2181_1, partial:m2181_6
+# 2181|     m2181_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2181_2
+# 2181|     m2181_9(ClassWithDestructor)        = Chi                                  : total:m2181_3, partial:m2181_8
+# 2182|     v2182_1(void)                       = NoOp                                 : 
+# 2179|     v2179_5(void)                       = ReturnVoid                           : 
+# 2179|     v2179_6(void)                       = AliasedUse                           : ~m2181_7
+# 2179|     v2179_7(void)                       = ExitFunction                         : 
+
+# 2184| void static_variable_with_destructor_3()
+# 2184|   Block 0
+# 2184|     v2184_1(void)                       = EnterFunction                        : 
+# 2184|     m2184_2(unknown)                    = AliasedDefinition                    : 
+# 2184|     m2184_3(unknown)                    = InitializeNonLocal                   : 
+# 2184|     m2184_4(unknown)                    = Chi                                  : total:m2184_2, partial:m2184_3
+# 2185|     r2185_1(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+# 2185|     m2185_2(ClassWithDestructor)        = Uninitialized[a]                     : &:r2185_1
+# 2185|     r2185_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2185|     v2185_4(void)                       = Call[ClassWithDestructor]            : func:r2185_3, this:r2185_1
+# 2185|     m2185_5(unknown)                    = ^CallSideEffect                      : ~m2184_4
+# 2185|     m2185_6(unknown)                    = Chi                                  : total:m2184_4, partial:m2185_5
+# 2185|     m2185_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2185_1
+# 2185|     m2185_8(ClassWithDestructor)        = Chi                                  : total:m2185_2, partial:m2185_7
+# 2186|     r2186_1(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+# 2186|     m2186_2(ClassWithDestructor)        = Uninitialized[b]                     : &:r2186_1
+# 2186|     r2186_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2186|     v2186_4(void)                       = Call[ClassWithDestructor]            : func:r2186_3, this:r2186_1
+# 2186|     m2186_5(unknown)                    = ^CallSideEffect                      : ~m2185_6
+# 2186|     m2186_6(unknown)                    = Chi                                  : total:m2185_6, partial:m2186_5
+# 2186|     m2186_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2186_1
+# 2186|     m2186_8(ClassWithDestructor)        = Chi                                  : total:m2186_2, partial:m2186_7
+# 2187|     r2187_1(glval<bool>)                = VariableAddress[c#init]              : 
+# 2187|     r2187_2(bool)                       = Load[c#init]                         : &:r2187_1, ~m2186_6
+# 2187|     v2187_3(void)                       = ConditionalBranch                    : r2187_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2187|   Block 1
+# 2187|     r2187_4(glval<ClassWithDestructor>) = VariableAddress[c]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2187_4
+#-----|     m0_3(unknown)                       = ^CallSideEffect                      : ~m2186_6
+#-----|     m0_4(unknown)                       = Chi                                  : total:m2186_6, partial:m0_3
+#-----|     m0_5(ClassWithDestructor)           = ^IndirectMayWriteSideEffect[-1]      : &:r2187_4
+#-----|     m0_6(unknown)                       = Chi                                  : total:m0_4, partial:m0_5
+# 2187|     r2187_5(bool)                       = Constant[1]                          : 
+# 2187|     m2187_6(bool)                       = Store[c#init]                        : &:r2187_1, r2187_5
+# 2187|     m2187_7(unknown)                    = Chi                                  : total:m0_6, partial:m2187_6
+#-----|   Goto -> Block 2
+
+# 2188|   Block 2
+# 2188|     m2188_1(unknown) = Phi          : from 0:~m2186_6, from 1:~m2187_7
+# 2188|     v2188_2(void)    = NoOp         : 
+# 2184|     v2184_5(void)    = ReturnVoid   : 
+# 2184|     v2184_6(void)    = AliasedUse   : ~m2188_1
+# 2184|     v2184_7(void)    = ExitFunction : 
+
+# 2190| ClassWithDestructor global_class_with_destructor
+# 2190|   Block 0
+# 2190|     v2190_1(void)                       = EnterFunction                                 : 
+# 2190|     m2190_2(unknown)                    = AliasedDefinition                             : 
+# 2190|     r2190_3(glval<ClassWithDestructor>) = VariableAddress[global_class_with_destructor] : 
+# 2190|     r2190_4(glval<unknown>)             = FunctionAddress[ClassWithDestructor]          : 
+# 2190|     v2190_5(void)                       = Call[ClassWithDestructor]                     : func:r2190_4, this:r2190_3
+# 2190|     m2190_6(unknown)                    = ^CallSideEffect                               : ~m2190_2
+# 2190|     m2190_7(unknown)                    = Chi                                           : total:m2190_2, partial:m2190_6
+# 2190|     m2190_8(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]               : &:r2190_3
+# 2190|     m2190_9(unknown)                    = Chi                                           : total:m2190_7, partial:m2190_8
+# 2190|     v2190_10(void)                      = ReturnVoid                                    : 
+# 2190|     v2190_11(void)                      = AliasedUse                                    : ~m2190_9
+# 2190|     v2190_12(void)                      = ExitFunction                                  : 
 
 perf-regression.cpp:
 #    6| void Big::Big()

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected

@@ -28,5 +28,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-| ir.cpp:2153:68:2153:69 | VariableAddress: ys | Variable address instruction 'VariableAddress: ys' has no associated variable, in function '$@'. | ir.cpp:2136:6:2136:35 | void initialization_with_destructor(bool, char) | void initialization_with_destructor(bool, char) |
 missingCppType

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected

@@ -28,5 +28,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-| ir.cpp:2153:68:2153:69 | VariableAddress: ys | Variable address instruction 'VariableAddress: ys' has no associated variable, in function '$@'. | ir.cpp:2136:6:2136:35 | void initialization_with_destructor(bool, char) | void initialization_with_destructor(bool, char) |
 missingCppType

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2129,6 +2129,7 @@ public:
     ~ClassWithDestructor() { delete x; }
 
     void set_x(char y) { *x = y; }
+    char get_x() { return *x; }
 };
 
 constexpr bool initialization_with_destructor_bool = true;
@@ -2152,6 +2153,40 @@ void initialization_with_destructor(bool b, char c) {
     ClassWithDestructor x;
     for(vector<ClassWithDestructor> ys(x); ClassWithDestructor y : ys)
       y.set_x('a');
+
+    for(vector<ClassWithDestructor> ys(x); ClassWithDestructor y : ys) {
+      y.set_x('a');
+      if (y.get_x() == 'b')
+        return;
+    }
+
+    for(vector<int> ys(1); int y : ys) {
+      if (y == 1)
+        return;
+    }
+
+    for(vector<ClassWithDestructor> ys(x); ClassWithDestructor y : ys) {
+      ClassWithDestructor z1;
+      ClassWithDestructor z2;
+    }
 }
 
+void static_variable_with_destructor_1() {
+    ClassWithDestructor a;
+    static ClassWithDestructor b;
+}
+
+void static_variable_with_destructor_2() {
+    static ClassWithDestructor a;
+    ClassWithDestructor b;
+}
+
+void static_variable_with_destructor_3() {
+    ClassWithDestructor a;
+    ClassWithDestructor b;
+    static ClassWithDestructor c;
+}
+
+static ClassWithDestructor global_class_with_destructor;
+
 // semmle-extractor-options: -std=c++20 --clang

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -761,6 +761,7 @@
 | file://:0:0:0:0 | Address | &:r0_11 |
 | file://:0:0:0:0 | Address | &:r0_11 |
 | file://:0:0:0:0 | Address | &:r0_11 |
+| file://:0:0:0:0 | Address | &:r0_12 |
 | file://:0:0:0:0 | Address | &:r0_13 |
 | file://:0:0:0:0 | Address | &:r0_13 |
 | file://:0:0:0:0 | Address | &:r0_13 |
@@ -768,15 +769,26 @@
 | file://:0:0:0:0 | Address | &:r0_15 |
 | file://:0:0:0:0 | Address | &:r0_15 |
 | file://:0:0:0:0 | Address | &:r0_15 |
+| file://:0:0:0:0 | Address | &:r0_15 |
 | file://:0:0:0:0 | Address | &:r0_16 |
 | file://:0:0:0:0 | Address | &:r0_16 |
 | file://:0:0:0:0 | Address | &:r0_16 |
 | file://:0:0:0:0 | Address | &:r0_16 |
 | file://:0:0:0:0 | Address | &:r0_17 |
+| file://:0:0:0:0 | Address | &:r0_17 |
 | file://:0:0:0:0 | Address | &:r0_18 |
 | file://:0:0:0:0 | Address | &:r0_18 |
 | file://:0:0:0:0 | Address | &:r0_19 |
 | file://:0:0:0:0 | Address | &:r0_19 |
+| file://:0:0:0:0 | Address | &:r0_19 |
+| file://:0:0:0:0 | Address | &:r0_22 |
+| file://:0:0:0:0 | Address | &:r0_25 |
+| file://:0:0:0:0 | Address | &:r0_27 |
+| file://:0:0:0:0 | Address | &:r0_29 |
+| file://:0:0:0:0 | Address | &:r0_32 |
+| file://:0:0:0:0 | Address | &:r0_35 |
+| file://:0:0:0:0 | Address | &:r0_37 |
+| file://:0:0:0:0 | Address | &:r0_39 |
 | file://:0:0:0:0 | Arg(0) | 0:r0_6 |
 | file://:0:0:0:0 | Arg(0) | 0:r0_8 |
 | file://:0:0:0:0 | Arg(0) | 0:r0_8 |
@@ -784,10 +796,19 @@
 | file://:0:0:0:0 | Arg(0) | 0:r0_15 |
 | file://:0:0:0:0 | Arg(0) | 0:r0_15 |
 | file://:0:0:0:0 | CallTarget | func:r0_1 |
+| file://:0:0:0:0 | CallTarget | func:r0_1 |
+| file://:0:0:0:0 | CallTarget | func:r0_1 |
+| file://:0:0:0:0 | CallTarget | func:r0_1 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_2 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_2 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_2 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_3 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_3 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_3 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_3 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_5 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_5 |
+| file://:0:0:0:0 | ChiPartial | partial:m0_5 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_5 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_5 |
 | file://:0:0:0:0 | ChiPartial | partial:m0_8 |
@@ -799,6 +820,9 @@
 | file://:0:0:0:0 | ChiTotal | total:m0_3 |
 | file://:0:0:0:0 | ChiTotal | total:m0_4 |
 | file://:0:0:0:0 | ChiTotal | total:m0_4 |
+| file://:0:0:0:0 | ChiTotal | total:m0_4 |
+| file://:0:0:0:0 | ChiTotal | total:m0_4 |
+| file://:0:0:0:0 | ChiTotal | total:m0_4 |
 | file://:0:0:0:0 | ChiTotal | total:m754_8 |
 | file://:0:0:0:0 | ChiTotal | total:m763_8 |
 | file://:0:0:0:0 | ChiTotal | total:m1043_10 |
@@ -808,6 +832,9 @@
 | file://:0:0:0:0 | ChiTotal | total:m1718_19 |
 | file://:0:0:0:0 | ChiTotal | total:m1836_8 |
 | file://:0:0:0:0 | ChiTotal | total:m1841_8 |
+| file://:0:0:0:0 | ChiTotal | total:m2175_6 |
+| file://:0:0:0:0 | ChiTotal | total:m2179_4 |
+| file://:0:0:0:0 | ChiTotal | total:m2186_6 |
 | file://:0:0:0:0 | Left | r0_2 |
 | file://:0:0:0:0 | Left | r0_4 |
 | file://:0:0:0:0 | Left | r0_7 |
@@ -874,8 +901,22 @@
 | file://:0:0:0:0 | SideEffect | m1080_23 |
 | file://:0:0:0:0 | SideEffect | m1086_23 |
 | file://:0:0:0:0 | SideEffect | m1086_23 |
-| file://:0:0:0:0 | SideEffect | m2153_21 |
-| file://:0:0:0:0 | SideEffect | m2153_21 |
+| file://:0:0:0:0 | SideEffect | m2154_13 |
+| file://:0:0:0:0 | SideEffect | m2154_13 |
+| file://:0:0:0:0 | SideEffect | m2154_34 |
+| file://:0:0:0:0 | SideEffect | m2154_34 |
+| file://:0:0:0:0 | SideEffect | m2157_13 |
+| file://:0:0:0:0 | SideEffect | m2157_13 |
+| file://:0:0:0:0 | SideEffect | m2157_34 |
+| file://:0:0:0:0 | SideEffect | m2157_34 |
+| file://:0:0:0:0 | SideEffect | m2163_9 |
+| file://:0:0:0:0 | SideEffect | m2163_9 |
+| file://:0:0:0:0 | SideEffect | m2163_30 |
+| file://:0:0:0:0 | SideEffect | m2163_30 |
+| file://:0:0:0:0 | SideEffect | m2168_13 |
+| file://:0:0:0:0 | SideEffect | m2168_13 |
+| file://:0:0:0:0 | SideEffect | m2168_34 |
+| file://:0:0:0:0 | SideEffect | m2168_34 |
 | file://:0:0:0:0 | SideEffect | ~m0_4 |
 | file://:0:0:0:0 | SideEffect | ~m0_4 |
 | file://:0:0:0:0 | SideEffect | ~m0_4 |
@@ -892,8 +933,9 @@
 | file://:0:0:0:0 | SideEffect | ~m1242_4 |
 | file://:0:0:0:0 | SideEffect | ~m1449_6 |
 | file://:0:0:0:0 | SideEffect | ~m1841_8 |
-| file://:0:0:0:0 | SideEffect | ~m2153_11 |
-| file://:0:0:0:0 | SideEffect | ~m2153_19 |
+| file://:0:0:0:0 | SideEffect | ~m2175_6 |
+| file://:0:0:0:0 | SideEffect | ~m2179_4 |
+| file://:0:0:0:0 | SideEffect | ~m2186_6 |
 | file://:0:0:0:0 | StoreValue | r0_1 |
 | file://:0:0:0:0 | StoreValue | r0_1 |
 | file://:0:0:0:0 | StoreValue | r0_1 |
@@ -949,9 +991,11 @@
 | file://:0:0:0:0 | Unary | r0_10 |
 | file://:0:0:0:0 | Unary | r0_10 |
 | file://:0:0:0:0 | Unary | r0_11 |
+| file://:0:0:0:0 | Unary | r0_11 |
 | file://:0:0:0:0 | Unary | r0_12 |
 | file://:0:0:0:0 | Unary | r0_14 |
 | file://:0:0:0:0 | Unary | r0_14 |
+| file://:0:0:0:0 | Unary | r0_14 |
 | file://:0:0:0:0 | Unary | r0_17 |
 | file://:0:0:0:0 | Unary | r0_18 |
 | file://:0:0:0:0 | Unary | r0_18 |
@@ -960,6 +1004,10 @@
 | file://:0:0:0:0 | Unary | r0_20 |
 | file://:0:0:0:0 | Unary | r0_21 |
 | file://:0:0:0:0 | Unary | r0_21 |
+| file://:0:0:0:0 | Unary | r0_21 |
+| file://:0:0:0:0 | Unary | r0_24 |
+| file://:0:0:0:0 | Unary | r0_31 |
+| file://:0:0:0:0 | Unary | r0_34 |
 | ir.c:7:6:7:17 | ChiPartial | partial:m7_3 |
 | ir.c:7:6:7:17 | ChiTotal | total:m7_2 |
 | ir.c:7:6:7:17 | SideEffect | ~m10_6 |
@@ -10187,177 +10235,567 @@
 | ir.cpp:2131:31:2131:31 | Address | &:r2131_11 |
 | ir.cpp:2131:31:2131:31 | Load | m2131_10 |
 | ir.cpp:2131:31:2131:31 | StoreValue | r2131_12 |
-| ir.cpp:2134:16:2134:50 | Address | &:r2134_3 |
-| ir.cpp:2134:16:2134:50 | SideEffect | ~m2134_6 |
-| ir.cpp:2134:54:2134:57 | ChiPartial | partial:m2134_5 |
-| ir.cpp:2134:54:2134:57 | ChiTotal | total:m2134_2 |
-| ir.cpp:2134:54:2134:57 | StoreValue | r2134_4 |
-| ir.cpp:2136:6:2136:35 | ChiPartial | partial:m2136_3 |
-| ir.cpp:2136:6:2136:35 | ChiTotal | total:m2136_2 |
-| ir.cpp:2136:6:2136:35 | SideEffect | ~m2153_29 |
-| ir.cpp:2136:42:2136:42 | Address | &:r2136_5 |
-| ir.cpp:2136:50:2136:50 | Address | &:r2136_7 |
-| ir.cpp:2137:29:2137:29 | Address | &:r2137_1 |
-| ir.cpp:2137:29:2137:29 | Address | &:r2137_1 |
-| ir.cpp:2137:29:2137:29 | Arg(this) | this:r2137_1 |
-| ir.cpp:2137:29:2137:29 | CallTarget | func:r2137_3 |
-| ir.cpp:2137:29:2137:29 | ChiPartial | partial:m2137_5 |
-| ir.cpp:2137:29:2137:29 | ChiPartial | partial:m2137_7 |
-| ir.cpp:2137:29:2137:29 | ChiTotal | total:m2136_4 |
-| ir.cpp:2137:29:2137:29 | ChiTotal | total:m2137_2 |
-| ir.cpp:2137:29:2137:29 | SideEffect | ~m2136_4 |
-| ir.cpp:2137:32:2137:32 | Address | &:r2137_9 |
-| ir.cpp:2137:32:2137:32 | Condition | r2137_10 |
-| ir.cpp:2137:32:2137:32 | Load | m2136_6 |
-| ir.cpp:2138:9:2138:9 | Address | &:r2138_1 |
-| ir.cpp:2138:9:2138:9 | Address | &:r2138_1 |
-| ir.cpp:2138:9:2138:9 | Arg(this) | this:r2138_1 |
-| ir.cpp:2138:9:2138:9 | ChiPartial | partial:m2138_8 |
-| ir.cpp:2138:9:2138:9 | ChiTotal | total:m2137_8 |
-| ir.cpp:2138:9:2138:9 | SideEffect | m2137_8 |
-| ir.cpp:2138:11:2138:15 | CallTarget | func:r2138_2 |
-| ir.cpp:2138:11:2138:15 | ChiPartial | partial:m2138_5 |
-| ir.cpp:2138:11:2138:15 | ChiTotal | total:m2137_6 |
-| ir.cpp:2138:11:2138:15 | SideEffect | ~m2137_6 |
-| ir.cpp:2138:17:2138:19 | Arg(0) | 0:r2138_3 |
-| ir.cpp:2140:39:2140:39 | Address | &:r2140_2 |
-| ir.cpp:2140:39:2140:39 | Address | &:r2140_2 |
-| ir.cpp:2140:39:2140:39 | Arg(this) | this:r2140_2 |
-| ir.cpp:2140:39:2140:39 | CallTarget | func:r2140_4 |
-| ir.cpp:2140:39:2140:39 | ChiPartial | partial:m2140_6 |
-| ir.cpp:2140:39:2140:39 | ChiPartial | partial:m2140_8 |
-| ir.cpp:2140:39:2140:39 | ChiTotal | total:m2140_1 |
-| ir.cpp:2140:39:2140:39 | ChiTotal | total:m2140_3 |
-| ir.cpp:2140:39:2140:39 | Phi | from 0:~m2137_6 |
-| ir.cpp:2140:39:2140:39 | Phi | from 1:~m2138_6 |
-| ir.cpp:2140:39:2140:39 | SideEffect | ~m2140_1 |
-| ir.cpp:2140:42:2140:76 | Condition | r2140_10 |
-| ir.cpp:2141:9:2141:9 | Address | &:r2141_1 |
-| ir.cpp:2141:9:2141:9 | Address | &:r2141_1 |
-| ir.cpp:2141:9:2141:9 | Arg(this) | this:r2141_1 |
-| ir.cpp:2141:9:2141:9 | ChiPartial | partial:m2141_8 |
-| ir.cpp:2141:9:2141:9 | ChiTotal | total:m2140_9 |
-| ir.cpp:2141:9:2141:9 | SideEffect | m2140_9 |
-| ir.cpp:2141:11:2141:15 | CallTarget | func:r2141_2 |
-| ir.cpp:2141:11:2141:15 | ChiPartial | partial:m2141_5 |
-| ir.cpp:2141:11:2141:15 | ChiTotal | total:m2140_7 |
-| ir.cpp:2141:11:2141:15 | SideEffect | ~m2140_7 |
-| ir.cpp:2141:17:2141:19 | Arg(0) | 0:r2141_3 |
-| ir.cpp:2143:32:2143:32 | Address | &:r2143_1 |
-| ir.cpp:2143:32:2143:32 | Address | &:r2143_1 |
-| ir.cpp:2143:32:2143:32 | Arg(this) | this:r2143_1 |
-| ir.cpp:2143:32:2143:32 | CallTarget | func:r2143_3 |
-| ir.cpp:2143:32:2143:32 | ChiPartial | partial:m2143_5 |
-| ir.cpp:2143:32:2143:32 | ChiPartial | partial:m2143_7 |
-| ir.cpp:2143:32:2143:32 | ChiTotal | total:m2141_6 |
-| ir.cpp:2143:32:2143:32 | ChiTotal | total:m2143_2 |
-| ir.cpp:2143:32:2143:32 | SideEffect | ~m2141_6 |
-| ir.cpp:2143:35:2143:35 | Address | &:r2143_9 |
-| ir.cpp:2143:35:2143:35 | Condition | r2143_11 |
-| ir.cpp:2143:35:2143:35 | Load | m2136_8 |
-| ir.cpp:2143:35:2143:35 | Unary | r2143_10 |
-| ir.cpp:2145:11:2145:11 | Address | &:r2145_1 |
-| ir.cpp:2145:11:2145:11 | Address | &:r2145_1 |
-| ir.cpp:2145:11:2145:11 | Arg(this) | this:r2145_1 |
-| ir.cpp:2145:11:2145:11 | ChiPartial | partial:m2145_8 |
-| ir.cpp:2145:11:2145:11 | ChiTotal | total:m2143_8 |
-| ir.cpp:2145:11:2145:11 | SideEffect | m2143_8 |
-| ir.cpp:2145:13:2145:17 | CallTarget | func:r2145_2 |
-| ir.cpp:2145:13:2145:17 | ChiPartial | partial:m2145_5 |
-| ir.cpp:2145:13:2145:17 | ChiTotal | total:m2143_6 |
-| ir.cpp:2145:13:2145:17 | SideEffect | ~m2143_6 |
-| ir.cpp:2145:19:2145:21 | Arg(0) | 0:r2145_3 |
-| ir.cpp:2148:11:2148:11 | Address | &:r2148_1 |
-| ir.cpp:2148:11:2148:11 | Address | &:r2148_1 |
-| ir.cpp:2148:11:2148:11 | Arg(this) | this:r2148_1 |
-| ir.cpp:2148:11:2148:11 | ChiPartial | partial:m2148_8 |
-| ir.cpp:2148:11:2148:11 | ChiTotal | total:m2143_8 |
-| ir.cpp:2148:11:2148:11 | SideEffect | m2143_8 |
-| ir.cpp:2148:13:2148:17 | CallTarget | func:r2148_2 |
-| ir.cpp:2148:13:2148:17 | ChiPartial | partial:m2148_5 |
-| ir.cpp:2148:13:2148:17 | ChiTotal | total:m2143_6 |
-| ir.cpp:2148:13:2148:17 | SideEffect | ~m2143_6 |
-| ir.cpp:2148:19:2148:21 | Arg(0) | 0:r2148_3 |
-| ir.cpp:2150:5:2150:5 | Phi | from 4:~m2145_6 |
-| ir.cpp:2150:5:2150:5 | Phi | from 5:~m2148_6 |
-| ir.cpp:2152:25:2152:25 | Address | &:r2152_1 |
-| ir.cpp:2152:25:2152:25 | Address | &:r2152_1 |
-| ir.cpp:2152:25:2152:25 | Arg(this) | this:r2152_1 |
-| ir.cpp:2152:25:2152:25 | CallTarget | func:r2152_3 |
-| ir.cpp:2152:25:2152:25 | ChiPartial | partial:m2152_5 |
-| ir.cpp:2152:25:2152:25 | ChiPartial | partial:m2152_7 |
-| ir.cpp:2152:25:2152:25 | ChiTotal | total:m2150_1 |
-| ir.cpp:2152:25:2152:25 | ChiTotal | total:m2152_2 |
-| ir.cpp:2152:25:2152:25 | SideEffect | ~m2150_1 |
-| ir.cpp:2153:5:2153:5 | Address | &:r2153_1 |
-| ir.cpp:2153:5:2153:5 | Address | &:r2153_5 |
-| ir.cpp:2153:5:2153:5 | Address | &:r2153_13 |
-| ir.cpp:2153:64:2153:64 | Address | &:r2153_31 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_6 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_14 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_25 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_34 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_39 |
-| ir.cpp:2153:68:2153:68 | Address | &:r2153_39 |
-| ir.cpp:2153:68:2153:68 | Arg(0) | 0:r2153_26 |
-| ir.cpp:2153:68:2153:68 | Arg(this) | this:r0_2 |
-| ir.cpp:2153:68:2153:68 | Arg(this) | this:r0_5 |
-| ir.cpp:2153:68:2153:68 | Arg(this) | this:r0_7 |
-| ir.cpp:2153:68:2153:68 | Arg(this) | this:r0_9 |
-| ir.cpp:2153:68:2153:68 | Arg(this) | this:r2153_39 |
-| ir.cpp:2153:68:2153:68 | CallTarget | func:r2153_8 |
-| ir.cpp:2153:68:2153:68 | CallTarget | func:r2153_16 |
-| ir.cpp:2153:68:2153:68 | CallTarget | func:r2153_24 |
-| ir.cpp:2153:68:2153:68 | CallTarget | func:r2153_33 |
-| ir.cpp:2153:68:2153:68 | CallTarget | func:r2153_40 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_10 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_18 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_28 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_35 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_42 |
-| ir.cpp:2153:68:2153:68 | ChiPartial | partial:m2153_45 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2152_6 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2153_11 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2153_21 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2153_22 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2153_29 |
-| ir.cpp:2153:68:2153:68 | ChiTotal | total:m2154_6 |
-| ir.cpp:2153:68:2153:68 | Condition | r2153_27 |
-| ir.cpp:2153:68:2153:68 | Load | m2153_4 |
-| ir.cpp:2153:68:2153:68 | Load | m2153_4 |
-| ir.cpp:2153:68:2153:68 | Load | m2153_20 |
-| ir.cpp:2153:68:2153:68 | Phi | from 6:m2153_12 |
-| ir.cpp:2153:68:2153:68 | Phi | from 6:~m2153_19 |
-| ir.cpp:2153:68:2153:68 | Phi | from 8:m2153_46 |
-| ir.cpp:2153:68:2153:68 | Phi | from 8:~m2153_43 |
-| ir.cpp:2153:68:2153:68 | SideEffect | m2153_21 |
-| ir.cpp:2153:68:2153:68 | SideEffect | ~m2152_6 |
-| ir.cpp:2153:68:2153:68 | SideEffect | ~m2153_11 |
-| ir.cpp:2153:68:2153:68 | SideEffect | ~m2153_22 |
-| ir.cpp:2153:68:2153:68 | SideEffect | ~m2153_29 |
-| ir.cpp:2153:68:2153:68 | SideEffect | ~m2154_6 |
-| ir.cpp:2153:68:2153:68 | StoreValue | r2153_9 |
-| ir.cpp:2153:68:2153:68 | StoreValue | r2153_17 |
-| ir.cpp:2153:68:2153:68 | Unary | r2153_7 |
-| ir.cpp:2153:68:2153:68 | Unary | r2153_15 |
-| ir.cpp:2153:68:2153:68 | Unary | r2153_23 |
-| ir.cpp:2153:68:2153:68 | Unary | r2153_32 |
-| ir.cpp:2153:68:2153:68 | Unary | r2153_41 |
-| ir.cpp:2153:68:2153:69 | StoreValue | r2153_3 |
-| ir.cpp:2153:68:2153:69 | Unary | r2153_2 |
-| ir.cpp:2153:68:2153:70 | Load | ~m2153_36 |
-| ir.cpp:2153:68:2153:70 | StoreValue | r2153_37 |
-| ir.cpp:2154:7:2154:7 | Address | &:r2154_1 |
-| ir.cpp:2154:7:2154:7 | Address | &:r2154_1 |
-| ir.cpp:2154:7:2154:7 | Arg(this) | this:r2154_1 |
-| ir.cpp:2154:7:2154:7 | ChiPartial | partial:m2154_8 |
-| ir.cpp:2154:7:2154:7 | ChiTotal | total:m2153_38 |
-| ir.cpp:2154:7:2154:7 | SideEffect | m2153_38 |
-| ir.cpp:2154:9:2154:13 | CallTarget | func:r2154_2 |
-| ir.cpp:2154:9:2154:13 | ChiPartial | partial:m2154_5 |
-| ir.cpp:2154:9:2154:13 | ChiTotal | total:m2153_36 |
-| ir.cpp:2154:9:2154:13 | SideEffect | ~m2153_36 |
-| ir.cpp:2154:15:2154:17 | Arg(0) | 0:r2154_3 |
+| ir.cpp:2132:10:2132:14 | Address | &:r2132_5 |
+| ir.cpp:2132:10:2132:14 | Address | &:r2132_5 |
+| ir.cpp:2132:10:2132:14 | Address | &:r2132_7 |
+| ir.cpp:2132:10:2132:14 | Address | &:r2132_7 |
+| ir.cpp:2132:10:2132:14 | Address | &:r2132_17 |
+| ir.cpp:2132:10:2132:14 | ChiPartial | partial:m2132_3 |
+| ir.cpp:2132:10:2132:14 | ChiTotal | total:m2132_2 |
+| ir.cpp:2132:10:2132:14 | Load | m2132_6 |
+| ir.cpp:2132:10:2132:14 | Load | m2132_15 |
+| ir.cpp:2132:10:2132:14 | SideEffect | m2132_3 |
+| ir.cpp:2132:10:2132:14 | SideEffect | m2132_8 |
+| ir.cpp:2132:20:2132:29 | Address | &:r2132_9 |
+| ir.cpp:2132:27:2132:28 | Load | ~m2132_4 |
+| ir.cpp:2132:27:2132:28 | StoreValue | r2132_14 |
+| ir.cpp:2132:28:2132:28 | Address | &:r2132_10 |
+| ir.cpp:2132:28:2132:28 | Address | &:r2132_12 |
+| ir.cpp:2132:28:2132:28 | Address | &:r2132_13 |
+| ir.cpp:2132:28:2132:28 | Load | m2132_6 |
+| ir.cpp:2132:28:2132:28 | Load | ~m2132_8 |
+| ir.cpp:2132:28:2132:28 | Unary | r2132_11 |
+| ir.cpp:2135:16:2135:50 | Address | &:r2135_3 |
+| ir.cpp:2135:16:2135:50 | SideEffect | ~m2135_6 |
+| ir.cpp:2135:54:2135:57 | ChiPartial | partial:m2135_5 |
+| ir.cpp:2135:54:2135:57 | ChiTotal | total:m2135_2 |
+| ir.cpp:2135:54:2135:57 | StoreValue | r2135_4 |
+| ir.cpp:2137:6:2137:35 | ChiPartial | partial:m2137_3 |
+| ir.cpp:2137:6:2137:35 | ChiTotal | total:m2137_2 |
+| ir.cpp:2137:6:2137:35 | Phi | from 14:~m2159_5 |
+| ir.cpp:2137:6:2137:35 | Phi | from 19:~m2163_54 |
+| ir.cpp:2137:6:2137:35 | Phi | from 23:~m2168_42 |
+| ir.cpp:2137:6:2137:35 | SideEffect | ~m2137_9 |
+| ir.cpp:2137:42:2137:42 | Address | &:r2137_5 |
+| ir.cpp:2137:50:2137:50 | Address | &:r2137_7 |
+| ir.cpp:2138:29:2138:29 | Address | &:r2138_1 |
+| ir.cpp:2138:29:2138:29 | Address | &:r2138_1 |
+| ir.cpp:2138:29:2138:29 | Arg(this) | this:r2138_1 |
+| ir.cpp:2138:29:2138:29 | CallTarget | func:r2138_3 |
+| ir.cpp:2138:29:2138:29 | ChiPartial | partial:m2138_5 |
+| ir.cpp:2138:29:2138:29 | ChiPartial | partial:m2138_7 |
+| ir.cpp:2138:29:2138:29 | ChiTotal | total:m2137_4 |
+| ir.cpp:2138:29:2138:29 | ChiTotal | total:m2138_2 |
+| ir.cpp:2138:29:2138:29 | SideEffect | ~m2137_4 |
+| ir.cpp:2138:32:2138:32 | Address | &:r2138_9 |
+| ir.cpp:2138:32:2138:32 | Condition | r2138_10 |
+| ir.cpp:2138:32:2138:32 | Load | m2137_6 |
+| ir.cpp:2139:9:2139:9 | Address | &:r2139_1 |
+| ir.cpp:2139:9:2139:9 | Address | &:r2139_1 |
+| ir.cpp:2139:9:2139:9 | Arg(this) | this:r2139_1 |
+| ir.cpp:2139:9:2139:9 | ChiPartial | partial:m2139_8 |
+| ir.cpp:2139:9:2139:9 | ChiTotal | total:m2138_8 |
+| ir.cpp:2139:9:2139:9 | SideEffect | m2138_8 |
+| ir.cpp:2139:11:2139:15 | CallTarget | func:r2139_2 |
+| ir.cpp:2139:11:2139:15 | ChiPartial | partial:m2139_5 |
+| ir.cpp:2139:11:2139:15 | ChiTotal | total:m2138_6 |
+| ir.cpp:2139:11:2139:15 | SideEffect | ~m2138_6 |
+| ir.cpp:2139:17:2139:19 | Arg(0) | 0:r2139_3 |
+| ir.cpp:2141:39:2141:39 | Address | &:r2141_2 |
+| ir.cpp:2141:39:2141:39 | Address | &:r2141_2 |
+| ir.cpp:2141:39:2141:39 | Arg(this) | this:r2141_2 |
+| ir.cpp:2141:39:2141:39 | CallTarget | func:r2141_4 |
+| ir.cpp:2141:39:2141:39 | ChiPartial | partial:m2141_6 |
+| ir.cpp:2141:39:2141:39 | ChiPartial | partial:m2141_8 |
+| ir.cpp:2141:39:2141:39 | ChiTotal | total:m2141_1 |
+| ir.cpp:2141:39:2141:39 | ChiTotal | total:m2141_3 |
+| ir.cpp:2141:39:2141:39 | Phi | from 0:~m2138_6 |
+| ir.cpp:2141:39:2141:39 | Phi | from 2:~m2139_6 |
+| ir.cpp:2141:39:2141:39 | SideEffect | ~m2141_1 |
+| ir.cpp:2141:42:2141:76 | Condition | r2141_10 |
+| ir.cpp:2142:9:2142:9 | Address | &:r2142_1 |
+| ir.cpp:2142:9:2142:9 | Address | &:r2142_1 |
+| ir.cpp:2142:9:2142:9 | Arg(this) | this:r2142_1 |
+| ir.cpp:2142:9:2142:9 | ChiPartial | partial:m2142_8 |
+| ir.cpp:2142:9:2142:9 | ChiTotal | total:m2141_9 |
+| ir.cpp:2142:9:2142:9 | SideEffect | m2141_9 |
+| ir.cpp:2142:11:2142:15 | CallTarget | func:r2142_2 |
+| ir.cpp:2142:11:2142:15 | ChiPartial | partial:m2142_5 |
+| ir.cpp:2142:11:2142:15 | ChiTotal | total:m2141_7 |
+| ir.cpp:2142:11:2142:15 | SideEffect | ~m2141_7 |
+| ir.cpp:2142:17:2142:19 | Arg(0) | 0:r2142_3 |
+| ir.cpp:2144:32:2144:32 | Address | &:r2144_1 |
+| ir.cpp:2144:32:2144:32 | Address | &:r2144_1 |
+| ir.cpp:2144:32:2144:32 | Arg(this) | this:r2144_1 |
+| ir.cpp:2144:32:2144:32 | CallTarget | func:r2144_3 |
+| ir.cpp:2144:32:2144:32 | ChiPartial | partial:m2144_5 |
+| ir.cpp:2144:32:2144:32 | ChiPartial | partial:m2144_7 |
+| ir.cpp:2144:32:2144:32 | ChiTotal | total:m2142_6 |
+| ir.cpp:2144:32:2144:32 | ChiTotal | total:m2144_2 |
+| ir.cpp:2144:32:2144:32 | SideEffect | ~m2142_6 |
+| ir.cpp:2144:35:2144:35 | Address | &:r2144_9 |
+| ir.cpp:2144:35:2144:35 | Condition | r2144_11 |
+| ir.cpp:2144:35:2144:35 | Load | m2137_8 |
+| ir.cpp:2144:35:2144:35 | Unary | r2144_10 |
+| ir.cpp:2146:11:2146:11 | Address | &:r2146_1 |
+| ir.cpp:2146:11:2146:11 | Address | &:r2146_1 |
+| ir.cpp:2146:11:2146:11 | Arg(this) | this:r2146_1 |
+| ir.cpp:2146:11:2146:11 | ChiPartial | partial:m2146_8 |
+| ir.cpp:2146:11:2146:11 | ChiTotal | total:m2144_8 |
+| ir.cpp:2146:11:2146:11 | SideEffect | m2144_8 |
+| ir.cpp:2146:13:2146:17 | CallTarget | func:r2146_2 |
+| ir.cpp:2146:13:2146:17 | ChiPartial | partial:m2146_5 |
+| ir.cpp:2146:13:2146:17 | ChiTotal | total:m2144_6 |
+| ir.cpp:2146:13:2146:17 | SideEffect | ~m2144_6 |
+| ir.cpp:2146:19:2146:21 | Arg(0) | 0:r2146_3 |
+| ir.cpp:2149:11:2149:11 | Address | &:r2149_1 |
+| ir.cpp:2149:11:2149:11 | Address | &:r2149_1 |
+| ir.cpp:2149:11:2149:11 | Arg(this) | this:r2149_1 |
+| ir.cpp:2149:11:2149:11 | ChiPartial | partial:m2149_8 |
+| ir.cpp:2149:11:2149:11 | ChiTotal | total:m2144_8 |
+| ir.cpp:2149:11:2149:11 | SideEffect | m2144_8 |
+| ir.cpp:2149:13:2149:17 | CallTarget | func:r2149_2 |
+| ir.cpp:2149:13:2149:17 | ChiPartial | partial:m2149_5 |
+| ir.cpp:2149:13:2149:17 | ChiTotal | total:m2144_6 |
+| ir.cpp:2149:13:2149:17 | SideEffect | ~m2144_6 |
+| ir.cpp:2149:19:2149:21 | Arg(0) | 0:r2149_3 |
+| ir.cpp:2151:5:2151:5 | Phi | from 5:~m2146_6 |
+| ir.cpp:2151:5:2151:5 | Phi | from 6:~m2149_6 |
+| ir.cpp:2153:25:2153:25 | Address | &:r2153_1 |
+| ir.cpp:2153:25:2153:25 | Address | &:r2153_1 |
+| ir.cpp:2153:25:2153:25 | Arg(this) | this:r2153_1 |
+| ir.cpp:2153:25:2153:25 | CallTarget | func:r2153_3 |
+| ir.cpp:2153:25:2153:25 | ChiPartial | partial:m2153_5 |
+| ir.cpp:2153:25:2153:25 | ChiPartial | partial:m2153_7 |
+| ir.cpp:2153:25:2153:25 | ChiTotal | total:m2151_1 |
+| ir.cpp:2153:25:2153:25 | ChiTotal | total:m2153_2 |
+| ir.cpp:2153:25:2153:25 | SideEffect | ~m2151_1 |
+| ir.cpp:2154:5:2154:5 | Address | &:r2154_14 |
+| ir.cpp:2154:5:2154:5 | Address | &:r2154_18 |
+| ir.cpp:2154:5:2154:5 | Address | &:r2154_26 |
+| ir.cpp:2154:37:2154:38 | Address | &:r2154_1 |
+| ir.cpp:2154:37:2154:38 | Address | &:r2154_1 |
+| ir.cpp:2154:37:2154:38 | Arg(this) | this:r2154_1 |
+| ir.cpp:2154:40:2154:40 | Address | &:r2154_4 |
+| ir.cpp:2154:40:2154:40 | Address | &:r2154_4 |
+| ir.cpp:2154:40:2154:40 | Address | &:r2154_5 |
+| ir.cpp:2154:40:2154:40 | Arg(0) | 0:r2154_8 |
+| ir.cpp:2154:40:2154:40 | Load | m2153_8 |
+| ir.cpp:2154:40:2154:40 | Load | m2154_7 |
+| ir.cpp:2154:40:2154:40 | StoreValue | r2154_6 |
+| ir.cpp:2154:40:2154:41 | CallTarget | func:r2154_3 |
+| ir.cpp:2154:40:2154:41 | ChiPartial | partial:m2154_10 |
+| ir.cpp:2154:40:2154:41 | ChiPartial | partial:m2154_12 |
+| ir.cpp:2154:40:2154:41 | ChiTotal | total:m2153_6 |
+| ir.cpp:2154:40:2154:41 | ChiTotal | total:m2154_2 |
+| ir.cpp:2154:40:2154:41 | SideEffect | ~m2153_6 |
+| ir.cpp:2154:64:2154:64 | Address | &:r2154_44 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_19 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_27 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_38 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_47 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_52 |
+| ir.cpp:2154:68:2154:68 | Address | &:r2154_52 |
+| ir.cpp:2154:68:2154:68 | Arg(0) | 0:r2154_39 |
+| ir.cpp:2154:68:2154:68 | Arg(this) | this:r0_2 |
+| ir.cpp:2154:68:2154:68 | Arg(this) | this:r0_5 |
+| ir.cpp:2154:68:2154:68 | Arg(this) | this:r0_7 |
+| ir.cpp:2154:68:2154:68 | Arg(this) | this:r0_9 |
+| ir.cpp:2154:68:2154:68 | Arg(this) | this:r2154_52 |
+| ir.cpp:2154:68:2154:68 | CallTarget | func:r2154_21 |
+| ir.cpp:2154:68:2154:68 | CallTarget | func:r2154_29 |
+| ir.cpp:2154:68:2154:68 | CallTarget | func:r2154_37 |
+| ir.cpp:2154:68:2154:68 | CallTarget | func:r2154_46 |
+| ir.cpp:2154:68:2154:68 | CallTarget | func:r2154_53 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_23 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_31 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_41 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_48 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_55 |
+| ir.cpp:2154:68:2154:68 | ChiPartial | partial:m2154_58 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2154_11 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2154_24 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2154_34 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2154_35 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2154_42 |
+| ir.cpp:2154:68:2154:68 | ChiTotal | total:m2155_6 |
+| ir.cpp:2154:68:2154:68 | Condition | r2154_40 |
+| ir.cpp:2154:68:2154:68 | Load | m2154_17 |
+| ir.cpp:2154:68:2154:68 | Load | m2154_17 |
+| ir.cpp:2154:68:2154:68 | Load | m2154_33 |
+| ir.cpp:2154:68:2154:68 | Phi | from 7:m2154_25 |
+| ir.cpp:2154:68:2154:68 | Phi | from 7:~m2154_32 |
+| ir.cpp:2154:68:2154:68 | Phi | from 9:m2154_59 |
+| ir.cpp:2154:68:2154:68 | Phi | from 9:~m2154_56 |
+| ir.cpp:2154:68:2154:68 | SideEffect | m2154_34 |
+| ir.cpp:2154:68:2154:68 | SideEffect | ~m2154_11 |
+| ir.cpp:2154:68:2154:68 | SideEffect | ~m2154_24 |
+| ir.cpp:2154:68:2154:68 | SideEffect | ~m2154_35 |
+| ir.cpp:2154:68:2154:68 | SideEffect | ~m2154_42 |
+| ir.cpp:2154:68:2154:68 | SideEffect | ~m2155_6 |
+| ir.cpp:2154:68:2154:68 | StoreValue | r2154_22 |
+| ir.cpp:2154:68:2154:68 | StoreValue | r2154_30 |
+| ir.cpp:2154:68:2154:68 | Unary | r2154_20 |
+| ir.cpp:2154:68:2154:68 | Unary | r2154_28 |
+| ir.cpp:2154:68:2154:68 | Unary | r2154_36 |
+| ir.cpp:2154:68:2154:68 | Unary | r2154_45 |
+| ir.cpp:2154:68:2154:68 | Unary | r2154_54 |
+| ir.cpp:2154:68:2154:69 | StoreValue | r2154_16 |
+| ir.cpp:2154:68:2154:69 | Unary | r2154_15 |
+| ir.cpp:2154:68:2154:70 | Load | ~m2154_49 |
+| ir.cpp:2154:68:2154:70 | StoreValue | r2154_50 |
+| ir.cpp:2155:7:2155:7 | Address | &:r2155_1 |
+| ir.cpp:2155:7:2155:7 | Address | &:r2155_1 |
+| ir.cpp:2155:7:2155:7 | Arg(this) | this:r2155_1 |
+| ir.cpp:2155:7:2155:7 | ChiPartial | partial:m2155_8 |
+| ir.cpp:2155:7:2155:7 | ChiTotal | total:m2154_51 |
+| ir.cpp:2155:7:2155:7 | SideEffect | m2154_51 |
+| ir.cpp:2155:9:2155:13 | CallTarget | func:r2155_2 |
+| ir.cpp:2155:9:2155:13 | ChiPartial | partial:m2155_5 |
+| ir.cpp:2155:9:2155:13 | ChiTotal | total:m2154_49 |
+| ir.cpp:2155:9:2155:13 | SideEffect | ~m2154_49 |
+| ir.cpp:2155:15:2155:17 | Arg(0) | 0:r2155_3 |
+| ir.cpp:2157:5:2157:5 | Address | &:r2157_14 |
+| ir.cpp:2157:5:2157:5 | Address | &:r2157_18 |
+| ir.cpp:2157:5:2157:5 | Address | &:r2157_26 |
+| ir.cpp:2157:37:2157:38 | Address | &:r2157_1 |
+| ir.cpp:2157:37:2157:38 | Address | &:r2157_1 |
+| ir.cpp:2157:37:2157:38 | Arg(this) | this:r2157_1 |
+| ir.cpp:2157:40:2157:40 | Address | &:r2157_4 |
+| ir.cpp:2157:40:2157:40 | Address | &:r2157_4 |
+| ir.cpp:2157:40:2157:40 | Address | &:r2157_5 |
+| ir.cpp:2157:40:2157:40 | Arg(0) | 0:r2157_8 |
+| ir.cpp:2157:40:2157:40 | Load | m2153_8 |
+| ir.cpp:2157:40:2157:40 | Load | m2157_7 |
+| ir.cpp:2157:40:2157:40 | StoreValue | r2157_6 |
+| ir.cpp:2157:40:2157:41 | CallTarget | func:r2157_3 |
+| ir.cpp:2157:40:2157:41 | ChiPartial | partial:m2157_10 |
+| ir.cpp:2157:40:2157:41 | ChiPartial | partial:m2157_12 |
+| ir.cpp:2157:40:2157:41 | ChiTotal | total:m2154_42 |
+| ir.cpp:2157:40:2157:41 | ChiTotal | total:m2157_2 |
+| ir.cpp:2157:40:2157:41 | SideEffect | ~m2154_42 |
+| ir.cpp:2157:64:2157:64 | Address | &:r2157_53 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_19 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_27 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_38 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_44 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_44 |
+| ir.cpp:2157:68:2157:68 | Address | &:r2157_56 |
+| ir.cpp:2157:68:2157:68 | Arg(0) | 0:r2157_39 |
+| ir.cpp:2157:68:2157:68 | Arg(this) | this:r0_12 |
+| ir.cpp:2157:68:2157:68 | Arg(this) | this:r0_15 |
+| ir.cpp:2157:68:2157:68 | Arg(this) | this:r0_17 |
+| ir.cpp:2157:68:2157:68 | Arg(this) | this:r0_19 |
+| ir.cpp:2157:68:2157:68 | Arg(this) | this:r2157_44 |
+| ir.cpp:2157:68:2157:68 | CallTarget | func:r2157_21 |
+| ir.cpp:2157:68:2157:68 | CallTarget | func:r2157_29 |
+| ir.cpp:2157:68:2157:68 | CallTarget | func:r2157_37 |
+| ir.cpp:2157:68:2157:68 | CallTarget | func:r2157_45 |
+| ir.cpp:2157:68:2157:68 | CallTarget | func:r2157_55 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_23 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_31 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_41 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_47 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_50 |
+| ir.cpp:2157:68:2157:68 | ChiPartial | partial:m2157_57 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2157_11 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2157_24 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2157_34 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2157_35 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2157_42 |
+| ir.cpp:2157:68:2157:68 | ChiTotal | total:m2159_5 |
+| ir.cpp:2157:68:2157:68 | Condition | r2157_40 |
+| ir.cpp:2157:68:2157:68 | Load | m2157_17 |
+| ir.cpp:2157:68:2157:68 | Load | m2157_17 |
+| ir.cpp:2157:68:2157:68 | Load | m2157_33 |
+| ir.cpp:2157:68:2157:68 | Phi | from 10:m2157_25 |
+| ir.cpp:2157:68:2157:68 | Phi | from 10:~m2157_32 |
+| ir.cpp:2157:68:2157:68 | Phi | from 12:m2157_51 |
+| ir.cpp:2157:68:2157:68 | Phi | from 12:~m2157_48 |
+| ir.cpp:2157:68:2157:68 | SideEffect | m2157_34 |
+| ir.cpp:2157:68:2157:68 | SideEffect | ~m2157_11 |
+| ir.cpp:2157:68:2157:68 | SideEffect | ~m2157_24 |
+| ir.cpp:2157:68:2157:68 | SideEffect | ~m2157_35 |
+| ir.cpp:2157:68:2157:68 | SideEffect | ~m2157_42 |
+| ir.cpp:2157:68:2157:68 | SideEffect | ~m2159_5 |
+| ir.cpp:2157:68:2157:68 | StoreValue | r2157_22 |
+| ir.cpp:2157:68:2157:68 | StoreValue | r2157_30 |
+| ir.cpp:2157:68:2157:68 | Unary | r2157_20 |
+| ir.cpp:2157:68:2157:68 | Unary | r2157_28 |
+| ir.cpp:2157:68:2157:68 | Unary | r2157_36 |
+| ir.cpp:2157:68:2157:68 | Unary | r2157_46 |
+| ir.cpp:2157:68:2157:68 | Unary | r2157_54 |
+| ir.cpp:2157:68:2157:69 | StoreValue | r2157_16 |
+| ir.cpp:2157:68:2157:69 | Unary | r2157_15 |
+| ir.cpp:2157:68:2157:70 | Load | ~m2157_58 |
+| ir.cpp:2157:68:2157:70 | StoreValue | r2157_59 |
+| ir.cpp:2158:7:2158:7 | Address | &:r2158_1 |
+| ir.cpp:2158:7:2158:7 | Address | &:r2158_1 |
+| ir.cpp:2158:7:2158:7 | Arg(this) | this:r2158_1 |
+| ir.cpp:2158:7:2158:7 | ChiPartial | partial:m2158_8 |
+| ir.cpp:2158:7:2158:7 | ChiTotal | total:m2157_60 |
+| ir.cpp:2158:7:2158:7 | SideEffect | m2157_60 |
+| ir.cpp:2158:9:2158:13 | CallTarget | func:r2158_2 |
+| ir.cpp:2158:9:2158:13 | ChiPartial | partial:m2158_5 |
+| ir.cpp:2158:9:2158:13 | ChiTotal | total:m2157_58 |
+| ir.cpp:2158:9:2158:13 | SideEffect | ~m2157_58 |
+| ir.cpp:2158:15:2158:17 | Arg(0) | 0:r2158_3 |
+| ir.cpp:2159:11:2159:11 | Address | &:r2159_1 |
+| ir.cpp:2159:11:2159:11 | Address | &:r2159_1 |
+| ir.cpp:2159:11:2159:11 | Arg(this) | this:r2159_1 |
+| ir.cpp:2159:11:2159:11 | ChiPartial | partial:m2159_7 |
+| ir.cpp:2159:11:2159:11 | ChiTotal | total:m2158_9 |
+| ir.cpp:2159:11:2159:11 | SideEffect | m2158_9 |
+| ir.cpp:2159:11:2159:19 | Left | r2159_9 |
+| ir.cpp:2159:11:2159:26 | Condition | r2159_11 |
+| ir.cpp:2159:13:2159:17 | CallTarget | func:r2159_2 |
+| ir.cpp:2159:13:2159:17 | ChiPartial | partial:m2159_4 |
+| ir.cpp:2159:13:2159:17 | ChiTotal | total:m2158_6 |
+| ir.cpp:2159:13:2159:17 | SideEffect | ~m2158_6 |
+| ir.cpp:2159:13:2159:17 | Unary | r2159_3 |
+| ir.cpp:2159:24:2159:26 | Right | r2159_10 |
+| ir.cpp:2163:5:2163:5 | Address | &:r2163_10 |
+| ir.cpp:2163:5:2163:5 | Address | &:r2163_14 |
+| ir.cpp:2163:5:2163:5 | Address | &:r2163_22 |
+| ir.cpp:2163:21:2163:22 | Address | &:r2163_1 |
+| ir.cpp:2163:21:2163:22 | Address | &:r2163_1 |
+| ir.cpp:2163:21:2163:22 | Arg(this) | this:r2163_1 |
+| ir.cpp:2163:24:2163:24 | Arg(0) | 0:r2163_4 |
+| ir.cpp:2163:24:2163:25 | CallTarget | func:r2163_3 |
+| ir.cpp:2163:24:2163:25 | ChiPartial | partial:m2163_6 |
+| ir.cpp:2163:24:2163:25 | ChiPartial | partial:m2163_8 |
+| ir.cpp:2163:24:2163:25 | ChiTotal | total:m2157_42 |
+| ir.cpp:2163:24:2163:25 | ChiTotal | total:m2163_2 |
+| ir.cpp:2163:24:2163:25 | SideEffect | ~m2157_42 |
+| ir.cpp:2163:32:2163:32 | Address | &:r2163_49 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_15 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_23 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_34 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_40 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_40 |
+| ir.cpp:2163:36:2163:36 | Address | &:r2163_52 |
+| ir.cpp:2163:36:2163:36 | Arg(0) | 0:r2163_35 |
+| ir.cpp:2163:36:2163:36 | Arg(this) | this:r0_22 |
+| ir.cpp:2163:36:2163:36 | Arg(this) | this:r0_25 |
+| ir.cpp:2163:36:2163:36 | Arg(this) | this:r0_27 |
+| ir.cpp:2163:36:2163:36 | Arg(this) | this:r0_29 |
+| ir.cpp:2163:36:2163:36 | Arg(this) | this:r2163_40 |
+| ir.cpp:2163:36:2163:36 | CallTarget | func:r2163_17 |
+| ir.cpp:2163:36:2163:36 | CallTarget | func:r2163_25 |
+| ir.cpp:2163:36:2163:36 | CallTarget | func:r2163_33 |
+| ir.cpp:2163:36:2163:36 | CallTarget | func:r2163_41 |
+| ir.cpp:2163:36:2163:36 | CallTarget | func:r2163_51 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_19 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_27 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_37 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_43 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_46 |
+| ir.cpp:2163:36:2163:36 | ChiPartial | partial:m2163_53 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_7 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_20 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_30 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_31 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_38 |
+| ir.cpp:2163:36:2163:36 | ChiTotal | total:m2163_54 |
+| ir.cpp:2163:36:2163:36 | Condition | r2163_36 |
+| ir.cpp:2163:36:2163:36 | Load | m2163_13 |
+| ir.cpp:2163:36:2163:36 | Load | m2163_13 |
+| ir.cpp:2163:36:2163:36 | Load | m2163_29 |
+| ir.cpp:2163:36:2163:36 | Phi | from 15:m2163_21 |
+| ir.cpp:2163:36:2163:36 | Phi | from 15:~m2163_28 |
+| ir.cpp:2163:36:2163:36 | Phi | from 17:m2163_47 |
+| ir.cpp:2163:36:2163:36 | Phi | from 17:~m2163_44 |
+| ir.cpp:2163:36:2163:36 | SideEffect | m2163_30 |
+| ir.cpp:2163:36:2163:36 | SideEffect | ~m2163_7 |
+| ir.cpp:2163:36:2163:36 | SideEffect | ~m2163_20 |
+| ir.cpp:2163:36:2163:36 | SideEffect | ~m2163_31 |
+| ir.cpp:2163:36:2163:36 | SideEffect | ~m2163_38 |
+| ir.cpp:2163:36:2163:36 | SideEffect | ~m2163_54 |
+| ir.cpp:2163:36:2163:36 | StoreValue | r2163_18 |
+| ir.cpp:2163:36:2163:36 | StoreValue | r2163_26 |
+| ir.cpp:2163:36:2163:36 | Unary | r2163_16 |
+| ir.cpp:2163:36:2163:36 | Unary | r2163_24 |
+| ir.cpp:2163:36:2163:36 | Unary | r2163_32 |
+| ir.cpp:2163:36:2163:36 | Unary | r2163_42 |
+| ir.cpp:2163:36:2163:36 | Unary | r2163_50 |
+| ir.cpp:2163:36:2163:37 | StoreValue | r2163_12 |
+| ir.cpp:2163:36:2163:37 | Unary | r2163_11 |
+| ir.cpp:2163:36:2163:38 | Load | ~m2163_54 |
+| ir.cpp:2163:36:2163:38 | StoreValue | r2163_55 |
+| ir.cpp:2164:11:2164:11 | Address | &:r2164_1 |
+| ir.cpp:2164:11:2164:11 | Left | r2164_2 |
+| ir.cpp:2164:11:2164:11 | Load | m2163_56 |
+| ir.cpp:2164:11:2164:16 | Condition | r2164_4 |
+| ir.cpp:2164:16:2164:16 | Right | r2164_3 |
+| ir.cpp:2168:5:2168:5 | Address | &:r2168_14 |
+| ir.cpp:2168:5:2168:5 | Address | &:r2168_18 |
+| ir.cpp:2168:5:2168:5 | Address | &:r2168_26 |
+| ir.cpp:2168:37:2168:38 | Address | &:r2168_1 |
+| ir.cpp:2168:37:2168:38 | Address | &:r2168_1 |
+| ir.cpp:2168:37:2168:38 | Arg(this) | this:r2168_1 |
+| ir.cpp:2168:40:2168:40 | Address | &:r2168_4 |
+| ir.cpp:2168:40:2168:40 | Address | &:r2168_4 |
+| ir.cpp:2168:40:2168:40 | Address | &:r2168_5 |
+| ir.cpp:2168:40:2168:40 | Arg(0) | 0:r2168_8 |
+| ir.cpp:2168:40:2168:40 | Load | m2153_8 |
+| ir.cpp:2168:40:2168:40 | Load | m2168_7 |
+| ir.cpp:2168:40:2168:40 | StoreValue | r2168_6 |
+| ir.cpp:2168:40:2168:41 | CallTarget | func:r2168_3 |
+| ir.cpp:2168:40:2168:41 | ChiPartial | partial:m2168_10 |
+| ir.cpp:2168:40:2168:41 | ChiPartial | partial:m2168_12 |
+| ir.cpp:2168:40:2168:41 | ChiTotal | total:m2163_38 |
+| ir.cpp:2168:40:2168:41 | ChiTotal | total:m2168_2 |
+| ir.cpp:2168:40:2168:41 | SideEffect | ~m2163_38 |
+| ir.cpp:2168:64:2168:64 | Address | &:r2168_44 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_19 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_27 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_38 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_47 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_52 |
+| ir.cpp:2168:68:2168:68 | Address | &:r2168_52 |
+| ir.cpp:2168:68:2168:68 | Arg(0) | 0:r2168_39 |
+| ir.cpp:2168:68:2168:68 | Arg(this) | this:r0_32 |
+| ir.cpp:2168:68:2168:68 | Arg(this) | this:r0_35 |
+| ir.cpp:2168:68:2168:68 | Arg(this) | this:r0_37 |
+| ir.cpp:2168:68:2168:68 | Arg(this) | this:r0_39 |
+| ir.cpp:2168:68:2168:68 | Arg(this) | this:r2168_52 |
+| ir.cpp:2168:68:2168:68 | CallTarget | func:r2168_21 |
+| ir.cpp:2168:68:2168:68 | CallTarget | func:r2168_29 |
+| ir.cpp:2168:68:2168:68 | CallTarget | func:r2168_37 |
+| ir.cpp:2168:68:2168:68 | CallTarget | func:r2168_46 |
+| ir.cpp:2168:68:2168:68 | CallTarget | func:r2168_53 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_23 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_31 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_41 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_48 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_55 |
+| ir.cpp:2168:68:2168:68 | ChiPartial | partial:m2168_58 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2168_11 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2168_24 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2168_34 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2168_35 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2168_42 |
+| ir.cpp:2168:68:2168:68 | ChiTotal | total:m2170_6 |
+| ir.cpp:2168:68:2168:68 | Condition | r2168_40 |
+| ir.cpp:2168:68:2168:68 | Load | m2168_17 |
+| ir.cpp:2168:68:2168:68 | Load | m2168_17 |
+| ir.cpp:2168:68:2168:68 | Load | m2168_33 |
+| ir.cpp:2168:68:2168:68 | Phi | from 20:m2168_25 |
+| ir.cpp:2168:68:2168:68 | Phi | from 20:~m2168_32 |
+| ir.cpp:2168:68:2168:68 | Phi | from 22:m2168_59 |
+| ir.cpp:2168:68:2168:68 | Phi | from 22:~m2168_56 |
+| ir.cpp:2168:68:2168:68 | SideEffect | m2168_34 |
+| ir.cpp:2168:68:2168:68 | SideEffect | ~m2168_11 |
+| ir.cpp:2168:68:2168:68 | SideEffect | ~m2168_24 |
+| ir.cpp:2168:68:2168:68 | SideEffect | ~m2168_35 |
+| ir.cpp:2168:68:2168:68 | SideEffect | ~m2168_42 |
+| ir.cpp:2168:68:2168:68 | SideEffect | ~m2170_6 |
+| ir.cpp:2168:68:2168:68 | StoreValue | r2168_22 |
+| ir.cpp:2168:68:2168:68 | StoreValue | r2168_30 |
+| ir.cpp:2168:68:2168:68 | Unary | r2168_20 |
+| ir.cpp:2168:68:2168:68 | Unary | r2168_28 |
+| ir.cpp:2168:68:2168:68 | Unary | r2168_36 |
+| ir.cpp:2168:68:2168:68 | Unary | r2168_45 |
+| ir.cpp:2168:68:2168:68 | Unary | r2168_54 |
+| ir.cpp:2168:68:2168:69 | StoreValue | r2168_16 |
+| ir.cpp:2168:68:2168:69 | Unary | r2168_15 |
+| ir.cpp:2168:68:2168:70 | Load | ~m2168_49 |
+| ir.cpp:2168:68:2168:70 | StoreValue | r2168_50 |
+| ir.cpp:2169:27:2169:28 | Address | &:r2169_1 |
+| ir.cpp:2169:27:2169:28 | Address | &:r2169_1 |
+| ir.cpp:2169:27:2169:28 | Arg(this) | this:r2169_1 |
+| ir.cpp:2169:27:2169:28 | CallTarget | func:r2169_3 |
+| ir.cpp:2169:27:2169:28 | ChiPartial | partial:m2169_5 |
+| ir.cpp:2169:27:2169:28 | ChiPartial | partial:m2169_7 |
+| ir.cpp:2169:27:2169:28 | ChiTotal | total:m2168_49 |
+| ir.cpp:2169:27:2169:28 | ChiTotal | total:m2169_2 |
+| ir.cpp:2169:27:2169:28 | SideEffect | ~m2168_49 |
+| ir.cpp:2170:27:2170:28 | Address | &:r2170_1 |
+| ir.cpp:2170:27:2170:28 | Address | &:r2170_1 |
+| ir.cpp:2170:27:2170:28 | Arg(this) | this:r2170_1 |
+| ir.cpp:2170:27:2170:28 | CallTarget | func:r2170_3 |
+| ir.cpp:2170:27:2170:28 | ChiPartial | partial:m2170_5 |
+| ir.cpp:2170:27:2170:28 | ChiPartial | partial:m2170_7 |
+| ir.cpp:2170:27:2170:28 | ChiTotal | total:m2169_6 |
+| ir.cpp:2170:27:2170:28 | ChiTotal | total:m2170_2 |
+| ir.cpp:2170:27:2170:28 | SideEffect | ~m2169_6 |
+| ir.cpp:2174:6:2174:38 | ChiPartial | partial:m2174_3 |
+| ir.cpp:2174:6:2174:38 | ChiTotal | total:m2174_2 |
+| ir.cpp:2174:6:2174:38 | SideEffect | ~m2177_1 |
+| ir.cpp:2175:25:2175:25 | Address | &:r2175_1 |
+| ir.cpp:2175:25:2175:25 | Address | &:r2175_1 |
+| ir.cpp:2175:25:2175:25 | Arg(this) | this:r2175_1 |
+| ir.cpp:2175:25:2175:25 | CallTarget | func:r2175_3 |
+| ir.cpp:2175:25:2175:25 | ChiPartial | partial:m2175_5 |
+| ir.cpp:2175:25:2175:25 | ChiPartial | partial:m2175_7 |
+| ir.cpp:2175:25:2175:25 | ChiTotal | total:m2174_4 |
+| ir.cpp:2175:25:2175:25 | ChiTotal | total:m2175_2 |
+| ir.cpp:2175:25:2175:25 | SideEffect | ~m2174_4 |
+| ir.cpp:2176:32:2176:32 | Address | &:r2176_1 |
+| ir.cpp:2176:32:2176:32 | Address | &:r2176_1 |
+| ir.cpp:2176:32:2176:32 | Address | &:r2176_4 |
+| ir.cpp:2176:32:2176:32 | Arg(this) | this:r2176_4 |
+| ir.cpp:2176:32:2176:32 | ChiPartial | partial:m2176_6 |
+| ir.cpp:2176:32:2176:32 | ChiTotal | total:m0_6 |
+| ir.cpp:2176:32:2176:32 | Condition | r2176_2 |
+| ir.cpp:2176:32:2176:32 | Load | ~m2175_6 |
+| ir.cpp:2176:32:2176:32 | StoreValue | r2176_5 |
+| ir.cpp:2177:1:2177:1 | Phi | from 0:~m2175_6 |
+| ir.cpp:2177:1:2177:1 | Phi | from 1:~m2176_7 |
+| ir.cpp:2179:6:2179:38 | ChiPartial | partial:m2179_3 |
+| ir.cpp:2179:6:2179:38 | ChiTotal | total:m2179_2 |
+| ir.cpp:2179:6:2179:38 | SideEffect | ~m2181_7 |
+| ir.cpp:2180:32:2180:32 | Address | &:r2180_1 |
+| ir.cpp:2180:32:2180:32 | Address | &:r2180_1 |
+| ir.cpp:2180:32:2180:32 | Address | &:r2180_4 |
+| ir.cpp:2180:32:2180:32 | Arg(this) | this:r2180_4 |
+| ir.cpp:2180:32:2180:32 | ChiPartial | partial:m2180_6 |
+| ir.cpp:2180:32:2180:32 | ChiTotal | total:m0_6 |
+| ir.cpp:2180:32:2180:32 | Condition | r2180_2 |
+| ir.cpp:2180:32:2180:32 | Load | ~m2179_3 |
+| ir.cpp:2180:32:2180:32 | StoreValue | r2180_5 |
+| ir.cpp:2181:25:2181:25 | Address | &:r2181_2 |
+| ir.cpp:2181:25:2181:25 | Address | &:r2181_2 |
+| ir.cpp:2181:25:2181:25 | Arg(this) | this:r2181_2 |
+| ir.cpp:2181:25:2181:25 | CallTarget | func:r2181_4 |
+| ir.cpp:2181:25:2181:25 | ChiPartial | partial:m2181_6 |
+| ir.cpp:2181:25:2181:25 | ChiPartial | partial:m2181_8 |
+| ir.cpp:2181:25:2181:25 | ChiTotal | total:m2181_1 |
+| ir.cpp:2181:25:2181:25 | ChiTotal | total:m2181_3 |
+| ir.cpp:2181:25:2181:25 | Phi | from 0:~m2179_4 |
+| ir.cpp:2181:25:2181:25 | Phi | from 1:~m2180_7 |
+| ir.cpp:2181:25:2181:25 | SideEffect | ~m2181_1 |
+| ir.cpp:2184:6:2184:38 | ChiPartial | partial:m2184_3 |
+| ir.cpp:2184:6:2184:38 | ChiTotal | total:m2184_2 |
+| ir.cpp:2184:6:2184:38 | SideEffect | ~m2188_1 |
+| ir.cpp:2185:25:2185:25 | Address | &:r2185_1 |
+| ir.cpp:2185:25:2185:25 | Address | &:r2185_1 |
+| ir.cpp:2185:25:2185:25 | Arg(this) | this:r2185_1 |
+| ir.cpp:2185:25:2185:25 | CallTarget | func:r2185_3 |
+| ir.cpp:2185:25:2185:25 | ChiPartial | partial:m2185_5 |
+| ir.cpp:2185:25:2185:25 | ChiPartial | partial:m2185_7 |
+| ir.cpp:2185:25:2185:25 | ChiTotal | total:m2184_4 |
+| ir.cpp:2185:25:2185:25 | ChiTotal | total:m2185_2 |
+| ir.cpp:2185:25:2185:25 | SideEffect | ~m2184_4 |
+| ir.cpp:2186:25:2186:25 | Address | &:r2186_1 |
+| ir.cpp:2186:25:2186:25 | Address | &:r2186_1 |
+| ir.cpp:2186:25:2186:25 | Arg(this) | this:r2186_1 |
+| ir.cpp:2186:25:2186:25 | CallTarget | func:r2186_3 |
+| ir.cpp:2186:25:2186:25 | ChiPartial | partial:m2186_5 |
+| ir.cpp:2186:25:2186:25 | ChiPartial | partial:m2186_7 |
+| ir.cpp:2186:25:2186:25 | ChiTotal | total:m2185_6 |
+| ir.cpp:2186:25:2186:25 | ChiTotal | total:m2186_2 |
+| ir.cpp:2186:25:2186:25 | SideEffect | ~m2185_6 |
+| ir.cpp:2187:32:2187:32 | Address | &:r2187_1 |
+| ir.cpp:2187:32:2187:32 | Address | &:r2187_1 |
+| ir.cpp:2187:32:2187:32 | Address | &:r2187_4 |
+| ir.cpp:2187:32:2187:32 | Arg(this) | this:r2187_4 |
+| ir.cpp:2187:32:2187:32 | ChiPartial | partial:m2187_6 |
+| ir.cpp:2187:32:2187:32 | ChiTotal | total:m0_6 |
+| ir.cpp:2187:32:2187:32 | Condition | r2187_2 |
+| ir.cpp:2187:32:2187:32 | Load | ~m2186_6 |
+| ir.cpp:2187:32:2187:32 | StoreValue | r2187_5 |
+| ir.cpp:2188:1:2188:1 | Phi | from 0:~m2186_6 |
+| ir.cpp:2188:1:2188:1 | Phi | from 1:~m2187_7 |
+| ir.cpp:2190:28:2190:55 | Address | &:r2190_3 |
+| ir.cpp:2190:28:2190:55 | Arg(this) | this:r2190_3 |
+| ir.cpp:2190:28:2190:55 | CallTarget | func:r2190_4 |
+| ir.cpp:2190:28:2190:55 | ChiPartial | partial:m2190_6 |
+| ir.cpp:2190:28:2190:55 | ChiPartial | partial:m2190_8 |
+| ir.cpp:2190:28:2190:55 | ChiTotal | total:m2190_2 |
+| ir.cpp:2190:28:2190:55 | ChiTotal | total:m2190_7 |
+| ir.cpp:2190:28:2190:55 | SideEffect | ~m2190_2 |
+| ir.cpp:2190:28:2190:55 | SideEffect | ~m2190_9 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |

cpp/ql/test/library-tests/ir/ir/raw_consistency.expected

@@ -37,5 +37,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-| ir.cpp:2153:68:2153:69 | VariableAddress: ys | Variable address instruction 'VariableAddress: ys' has no associated variable, in function '$@'. | ir.cpp:2136:6:2136:35 | void initialization_with_destructor(bool, char) | void initialization_with_destructor(bool, char) |
 missingCppType

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -11775,186 +11775,596 @@ ir.cpp:
 # 2131|     v2131_21(void)                       = AliasedUse                   : ~m?
 # 2131|     v2131_22(void)                       = ExitFunction                 : 
 
-# 2134| bool initialization_with_destructor_bool
-# 2134|   Block 0
-# 2134|     v2134_1(void)        = EnterFunction                                        : 
-# 2134|     mu2134_2(unknown)    = AliasedDefinition                                    : 
-# 2134|     r2134_3(glval<bool>) = VariableAddress[initialization_with_destructor_bool] : 
-# 2134|     r2134_4(bool)        = Constant[1]                                          : 
-# 2134|     mu2134_5(bool)       = Store[initialization_with_destructor_bool]           : &:r2134_3, r2134_4
-# 2134|     v2134_6(void)        = ReturnVoid                                           : 
-# 2134|     v2134_7(void)        = AliasedUse                                           : ~m?
-# 2134|     v2134_8(void)        = ExitFunction                                         : 
+# 2132| char ClassWithDestructor::get_x()
+# 2132|   Block 0
+# 2132|     v2132_1(void)                        = EnterFunction                : 
+# 2132|     mu2132_2(unknown)                    = AliasedDefinition            : 
+# 2132|     mu2132_3(unknown)                    = InitializeNonLocal           : 
+# 2132|     r2132_4(glval<unknown>)              = VariableAddress[#this]       : 
+# 2132|     mu2132_5(glval<ClassWithDestructor>) = InitializeParameter[#this]   : &:r2132_4
+# 2132|     r2132_6(glval<ClassWithDestructor>)  = Load[#this]                  : &:r2132_4, ~m?
+# 2132|     mu2132_7(ClassWithDestructor)        = InitializeIndirection[#this] : &:r2132_6
+# 2132|     r2132_8(glval<char>)                 = VariableAddress[#return]     : 
+# 2132|     r2132_9(glval<unknown>)              = VariableAddress[#this]       : 
+# 2132|     r2132_10(ClassWithDestructor *)      = Load[#this]                  : &:r2132_9, ~m?
+# 2132|     r2132_11(glval<char *>)              = FieldAddress[x]              : r2132_10
+# 2132|     r2132_12(char *)                     = Load[?]                      : &:r2132_11, ~m?
+# 2132|     r2132_13(char)                       = Load[?]                      : &:r2132_12, ~m?
+# 2132|     mu2132_14(char)                      = Store[#return]               : &:r2132_8, r2132_13
+# 2132|     v2132_15(void)                       = ReturnIndirection[#this]     : &:r2132_6, ~m?
+# 2132|     r2132_16(glval<char>)                = VariableAddress[#return]     : 
+# 2132|     v2132_17(void)                       = ReturnValue                  : &:r2132_16, ~m?
+# 2132|     v2132_18(void)                       = AliasedUse                   : ~m?
+# 2132|     v2132_19(void)                       = ExitFunction                 : 
 
-# 2136| void initialization_with_destructor(bool, char)
-# 2136|   Block 0
-# 2136|     v2136_1(void)                       = EnterFunction                        : 
-# 2136|     mu2136_2(unknown)                   = AliasedDefinition                    : 
-# 2136|     mu2136_3(unknown)                   = InitializeNonLocal                   : 
-# 2136|     r2136_4(glval<bool>)                = VariableAddress[b]                   : 
-# 2136|     mu2136_5(bool)                      = InitializeParameter[b]               : &:r2136_4
-# 2136|     r2136_6(glval<char>)                = VariableAddress[c]                   : 
-# 2136|     mu2136_7(char)                      = InitializeParameter[c]               : &:r2136_6
-# 2137|     r2137_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2137|     mu2137_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2137_1
-# 2137|     r2137_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2137|     v2137_4(void)                       = Call[ClassWithDestructor]            : func:r2137_3, this:r2137_1
-# 2137|     mu2137_5(unknown)                   = ^CallSideEffect                      : ~m?
-# 2137|     mu2137_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2137_1
-# 2137|     r2137_7(glval<bool>)                = VariableAddress[b]                   : 
-# 2137|     r2137_8(bool)                       = Load[b]                              : &:r2137_7, ~m?
-# 2137|     v2137_9(void)                       = ConditionalBranch                    : r2137_8
-#-----|   False -> Block 2
-#-----|   True -> Block 1
+# 2135| bool initialization_with_destructor_bool
+# 2135|   Block 0
+# 2135|     v2135_1(void)        = EnterFunction                                        : 
+# 2135|     mu2135_2(unknown)    = AliasedDefinition                                    : 
+# 2135|     r2135_3(glval<bool>) = VariableAddress[initialization_with_destructor_bool] : 
+# 2135|     r2135_4(bool)        = Constant[1]                                          : 
+# 2135|     mu2135_5(bool)       = Store[initialization_with_destructor_bool]           : &:r2135_3, r2135_4
+# 2135|     v2135_6(void)        = ReturnVoid                                           : 
+# 2135|     v2135_7(void)        = AliasedUse                                           : ~m?
+# 2135|     v2135_8(void)        = ExitFunction                                         : 
 
-# 2138|   Block 1
-# 2138|     r2138_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2138|     r2138_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2138|     r2138_3(char)                       = Constant[97]                    : 
-# 2138|     v2138_4(void)                       = Call[set_x]                     : func:r2138_2, this:r2138_1, 0:r2138_3
-# 2138|     mu2138_5(unknown)                   = ^CallSideEffect                 : ~m?
-# 2138|     v2138_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2138_1, ~m?
-# 2138|     mu2138_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2138_1
-#-----|   Goto -> Block 2
+# 2137| void initialization_with_destructor(bool, char)
+# 2137|   Block 0
+# 2137|     v2137_1(void)                       = EnterFunction                        : 
+# 2137|     mu2137_2(unknown)                   = AliasedDefinition                    : 
+# 2137|     mu2137_3(unknown)                   = InitializeNonLocal                   : 
+# 2137|     r2137_4(glval<bool>)                = VariableAddress[b]                   : 
+# 2137|     mu2137_5(bool)                      = InitializeParameter[b]               : &:r2137_4
+# 2137|     r2137_6(glval<char>)                = VariableAddress[c]                   : 
+# 2137|     mu2137_7(char)                      = InitializeParameter[c]               : &:r2137_6
+# 2138|     r2138_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2138|     mu2138_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2138_1
+# 2138|     r2138_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2138|     v2138_4(void)                       = Call[ClassWithDestructor]            : func:r2138_3, this:r2138_1
+# 2138|     mu2138_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2138|     mu2138_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2138_1
+# 2138|     r2138_7(glval<bool>)                = VariableAddress[b]                   : 
+# 2138|     r2138_8(bool)                       = Load[b]                              : &:r2138_7, ~m?
+# 2138|     v2138_9(void)                       = ConditionalBranch                    : r2138_8
+#-----|   False -> Block 3
+#-----|   True -> Block 2
 
-# 2140|   Block 2
-# 2140|     r2140_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2140|     mu2140_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2140_1
-# 2140|     r2140_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2140|     v2140_4(void)                       = Call[ClassWithDestructor]            : func:r2140_3, this:r2140_1
-# 2140|     mu2140_5(unknown)                   = ^CallSideEffect                      : ~m?
-# 2140|     mu2140_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2140_1
-# 2140|     r2140_7(bool)                       = Constant[1]                          : 
-# 2140|     v2140_8(void)                       = ConditionalBranch                    : r2140_7
-#-----|   False -> Block 4
-#-----|   True -> Block 3
+# 2137|   Block 1
+# 2137|     v2137_8(void)  = ReturnVoid   : 
+# 2137|     v2137_9(void)  = AliasedUse   : ~m?
+# 2137|     v2137_10(void) = ExitFunction : 
+
+# 2139|   Block 2
+# 2139|     r2139_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2139|     r2139_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2139|     r2139_3(char)                       = Constant[97]                    : 
+# 2139|     v2139_4(void)                       = Call[set_x]                     : func:r2139_2, this:r2139_1, 0:r2139_3
+# 2139|     mu2139_5(unknown)                   = ^CallSideEffect                 : ~m?
+# 2139|     v2139_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2139_1, ~m?
+# 2139|     mu2139_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2139_1
+#-----|   Goto -> Block 3
 
 # 2141|   Block 3
-# 2141|     r2141_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2141|     r2141_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2141|     r2141_3(char)                       = Constant[97]                    : 
-# 2141|     v2141_4(void)                       = Call[set_x]                     : func:r2141_2, this:r2141_1, 0:r2141_3
-# 2141|     mu2141_5(unknown)                   = ^CallSideEffect                 : ~m?
-# 2141|     v2141_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2141_1, ~m?
-# 2141|     mu2141_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2141_1
-#-----|   Goto -> Block 4
+# 2141|     r2141_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2141|     mu2141_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2141_1
+# 2141|     r2141_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2141|     v2141_4(void)                       = Call[ClassWithDestructor]            : func:r2141_3, this:r2141_1
+# 2141|     mu2141_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2141|     mu2141_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2141_1
+# 2141|     r2141_7(bool)                       = Constant[1]                          : 
+# 2141|     v2141_8(void)                       = ConditionalBranch                    : r2141_7
+#-----|   False -> Block 5
+#-----|   True -> Block 4
 
-# 2143|   Block 4
-# 2143|     r2143_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
-# 2143|     mu2143_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2143_1
-# 2143|     r2143_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
-# 2143|     v2143_4(void)                       = Call[ClassWithDestructor]            : func:r2143_3, this:r2143_1
-# 2143|     mu2143_5(unknown)                   = ^CallSideEffect                      : ~m?
-# 2143|     mu2143_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2143_1
-# 2143|     r2143_7(glval<char>)                = VariableAddress[c]                   : 
-# 2143|     r2143_8(char)                       = Load[c]                              : &:r2143_7, ~m?
-# 2143|     r2143_9(int)                        = Convert                              : r2143_8
-# 2143|     v2143_10(void)                      = Switch                               : r2143_9
-#-----|   Case[97] -> Block 5
-#-----|   Default -> Block 6
+# 2142|   Block 4
+# 2142|     r2142_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2142|     r2142_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2142|     r2142_3(char)                       = Constant[97]                    : 
+# 2142|     v2142_4(void)                       = Call[set_x]                     : func:r2142_2, this:r2142_1, 0:r2142_3
+# 2142|     mu2142_5(unknown)                   = ^CallSideEffect                 : ~m?
+# 2142|     v2142_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2142_1, ~m?
+# 2142|     mu2142_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2142_1
+#-----|   Goto -> Block 5
 
 # 2144|   Block 5
-# 2144|     v2144_1(void)                       = NoOp                            : 
-# 2145|     r2145_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2145|     r2145_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2145|     r2145_3(char)                       = Constant[97]                    : 
-# 2145|     v2145_4(void)                       = Call[set_x]                     : func:r2145_2, this:r2145_1, 0:r2145_3
-# 2145|     mu2145_5(unknown)                   = ^CallSideEffect                 : ~m?
-# 2145|     v2145_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2145_1, ~m?
-# 2145|     mu2145_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2145_1
-# 2146|     v2146_1(void)                       = NoOp                            : 
-#-----|   Goto -> Block 7
+# 2144|     r2144_1(glval<ClassWithDestructor>) = VariableAddress[x]                   : 
+# 2144|     mu2144_2(ClassWithDestructor)       = Uninitialized[x]                     : &:r2144_1
+# 2144|     r2144_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2144|     v2144_4(void)                       = Call[ClassWithDestructor]            : func:r2144_3, this:r2144_1
+# 2144|     mu2144_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2144|     mu2144_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2144_1
+# 2144|     r2144_7(glval<char>)                = VariableAddress[c]                   : 
+# 2144|     r2144_8(char)                       = Load[c]                              : &:r2144_7, ~m?
+# 2144|     r2144_9(int)                        = Convert                              : r2144_8
+# 2144|     v2144_10(void)                      = Switch                               : r2144_9
+#-----|   Case[97] -> Block 6
+#-----|   Default -> Block 7
 
-# 2147|   Block 6
+# 2145|   Block 6
+# 2145|     v2145_1(void)                       = NoOp                            : 
+# 2146|     r2146_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2146|     r2146_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2146|     r2146_3(char)                       = Constant[97]                    : 
+# 2146|     v2146_4(void)                       = Call[set_x]                     : func:r2146_2, this:r2146_1, 0:r2146_3
+# 2146|     mu2146_5(unknown)                   = ^CallSideEffect                 : ~m?
+# 2146|     v2146_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2146_1, ~m?
+# 2146|     mu2146_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2146_1
 # 2147|     v2147_1(void)                       = NoOp                            : 
-# 2148|     r2148_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
-# 2148|     r2148_2(glval<unknown>)             = FunctionAddress[set_x]          : 
-# 2148|     r2148_3(char)                       = Constant[98]                    : 
-# 2148|     v2148_4(void)                       = Call[set_x]                     : func:r2148_2, this:r2148_1, 0:r2148_3
-# 2148|     mu2148_5(unknown)                   = ^CallSideEffect                 : ~m?
-# 2148|     v2148_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2148_1, ~m?
-# 2148|     mu2148_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2148_1
-# 2149|     v2149_1(void)                       = NoOp                            : 
-#-----|   Goto -> Block 7
-
-# 2150|   Block 7
-# 2150|     v2150_1(void)                                  = NoOp                                 : 
-# 2152|     r2152_1(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
-# 2152|     mu2152_2(ClassWithDestructor)                  = Uninitialized[x]                     : &:r2152_1
-# 2152|     r2152_3(glval<unknown>)                        = FunctionAddress[ClassWithDestructor] : 
-# 2152|     v2152_4(void)                                  = Call[ClassWithDestructor]            : func:r2152_3, this:r2152_1
-# 2152|     mu2152_5(unknown)                              = ^CallSideEffect                      : ~m?
-# 2152|     mu2152_6(ClassWithDestructor)                  = ^IndirectMayWriteSideEffect[-1]      : &:r2152_1
-# 2153|     r2153_1(glval<vector<ClassWithDestructor> &>)  = VariableAddress[(__range)]           : 
-# 2153|     r2153_2(glval<vector<ClassWithDestructor>>)    = VariableAddress                      : 
-# 2153|     r2153_3(vector<ClassWithDestructor> &)         = CopyValue                            : r2153_2
-# 2153|     mu2153_4(vector<ClassWithDestructor> &)        = Store[(__range)]                     : &:r2153_1, r2153_3
-# 2153|     r2153_5(glval<iterator>)                       = VariableAddress[(__begin)]           : 
-# 2153|     r2153_6(glval<vector<ClassWithDestructor> &>)  = VariableAddress[(__range)]           : 
-# 2153|     r2153_7(vector<ClassWithDestructor> &)         = Load[(__range)]                      : &:r2153_6, ~m?
-#-----|     r0_1(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2153_7
-#-----|     r0_2(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_1
-# 2153|     r2153_8(glval<unknown>)                        = FunctionAddress[begin]               : 
-# 2153|     r2153_9(iterator)                              = Call[begin]                          : func:r2153_8, this:r0_2
-# 2153|     mu2153_10(unknown)                             = ^CallSideEffect                      : ~m?
-#-----|     v0_3(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_2, ~m?
-# 2153|     mu2153_11(iterator)                            = Store[(__begin)]                     : &:r2153_5, r2153_9
-# 2153|     r2153_12(glval<iterator>)                      = VariableAddress[(__end)]             : 
-# 2153|     r2153_13(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
-# 2153|     r2153_14(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2153_13, ~m?
-#-----|     r0_4(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2153_14
-#-----|     r0_5(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_4
-# 2153|     r2153_15(glval<unknown>)                       = FunctionAddress[end]                 : 
-# 2153|     r2153_16(iterator)                             = Call[end]                            : func:r2153_15, this:r0_5
-# 2153|     mu2153_17(unknown)                             = ^CallSideEffect                      : ~m?
-#-----|     v0_6(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_5, ~m?
-# 2153|     mu2153_18(iterator)                            = Store[(__end)]                       : &:r2153_12, r2153_16
 #-----|   Goto -> Block 8
 
-# 2153|   Block 8
-# 2153|     r2153_19(glval<iterator>) = VariableAddress[(__begin)]  : 
-#-----|     r0_7(glval<iterator>)     = Convert                     : r2153_19
-# 2153|     r2153_20(glval<unknown>)  = FunctionAddress[operator!=] : 
-# 2153|     r2153_21(glval<iterator>) = VariableAddress[(__end)]    : 
-# 2153|     r2153_22(iterator)        = Load[(__end)]               : &:r2153_21, ~m?
-# 2153|     r2153_23(bool)            = Call[operator!=]            : func:r2153_20, this:r0_7, 0:r2153_22
-# 2153|     mu2153_24(unknown)        = ^CallSideEffect             : ~m?
+# 2148|   Block 7
+# 2148|     v2148_1(void)                       = NoOp                            : 
+# 2149|     r2149_1(glval<ClassWithDestructor>) = VariableAddress[x]              : 
+# 2149|     r2149_2(glval<unknown>)             = FunctionAddress[set_x]          : 
+# 2149|     r2149_3(char)                       = Constant[98]                    : 
+# 2149|     v2149_4(void)                       = Call[set_x]                     : func:r2149_2, this:r2149_1, 0:r2149_3
+# 2149|     mu2149_5(unknown)                   = ^CallSideEffect                 : ~m?
+# 2149|     v2149_6(void)                       = ^IndirectReadSideEffect[-1]     : &:r2149_1, ~m?
+# 2149|     mu2149_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1] : &:r2149_1
+# 2150|     v2150_1(void)                       = NoOp                            : 
+#-----|   Goto -> Block 8
+
+# 2151|   Block 8
+# 2151|     v2151_1(void)                                  = NoOp                                 : 
+# 2153|     r2153_1(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
+# 2153|     mu2153_2(ClassWithDestructor)                  = Uninitialized[x]                     : &:r2153_1
+# 2153|     r2153_3(glval<unknown>)                        = FunctionAddress[ClassWithDestructor] : 
+# 2153|     v2153_4(void)                                  = Call[ClassWithDestructor]            : func:r2153_3, this:r2153_1
+# 2153|     mu2153_5(unknown)                              = ^CallSideEffect                      : ~m?
+# 2153|     mu2153_6(ClassWithDestructor)                  = ^IndirectMayWriteSideEffect[-1]      : &:r2153_1
+# 2154|     r2154_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]                  : 
+# 2154|     mu2154_2(vector<ClassWithDestructor>)          = Uninitialized[ys]                    : &:r2154_1
+# 2154|     r2154_3(glval<unknown>)                        = FunctionAddress[vector]              : 
+# 2154|     r2154_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2154:40]        : 
+# 2154|     r2154_5(glval<ClassWithDestructor>)            = VariableAddress[x]                   : 
+# 2154|     r2154_6(ClassWithDestructor)                   = Load[x]                              : &:r2154_5, ~m?
+# 2154|     mu2154_7(ClassWithDestructor)                  = Store[#temp2154:40]                  : &:r2154_4, r2154_6
+# 2154|     r2154_8(ClassWithDestructor)                   = Load[#temp2154:40]                   : &:r2154_4, ~m?
+# 2154|     v2154_9(void)                                  = Call[vector]                         : func:r2154_3, this:r2154_1, 0:r2154_8
+# 2154|     mu2154_10(unknown)                             = ^CallSideEffect                      : ~m?
+# 2154|     mu2154_11(vector<ClassWithDestructor>)         = ^IndirectMayWriteSideEffect[-1]      : &:r2154_1
+# 2154|     r2154_12(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_13(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]                  : 
+# 2154|     r2154_14(vector<ClassWithDestructor> &)        = CopyValue                            : r2154_13
+# 2154|     mu2154_15(vector<ClassWithDestructor> &)       = Store[(__range)]                     : &:r2154_12, r2154_14
+# 2154|     r2154_16(glval<iterator>)                      = VariableAddress[(__begin)]           : 
+# 2154|     r2154_17(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_18(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2154_17, ~m?
+#-----|     r0_1(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2154_18
+#-----|     r0_2(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_1
+# 2154|     r2154_19(glval<unknown>)                       = FunctionAddress[begin]               : 
+# 2154|     r2154_20(iterator)                             = Call[begin]                          : func:r2154_19, this:r0_2
+# 2154|     mu2154_21(unknown)                             = ^CallSideEffect                      : ~m?
+#-----|     v0_3(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_2, ~m?
+# 2154|     mu2154_22(iterator)                            = Store[(__begin)]                     : &:r2154_16, r2154_20
+# 2154|     r2154_23(glval<iterator>)                      = VariableAddress[(__end)]             : 
+# 2154|     r2154_24(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]           : 
+# 2154|     r2154_25(vector<ClassWithDestructor> &)        = Load[(__range)]                      : &:r2154_24, ~m?
+#-----|     r0_4(glval<vector<ClassWithDestructor>>)       = CopyValue                            : r2154_25
+#-----|     r0_5(glval<vector<ClassWithDestructor>>)       = Convert                              : r0_4
+# 2154|     r2154_26(glval<unknown>)                       = FunctionAddress[end]                 : 
+# 2154|     r2154_27(iterator)                             = Call[end]                            : func:r2154_26, this:r0_5
+# 2154|     mu2154_28(unknown)                             = ^CallSideEffect                      : ~m?
+#-----|     v0_6(void)                                     = ^IndirectReadSideEffect[-1]          : &:r0_5, ~m?
+# 2154|     mu2154_29(iterator)                            = Store[(__end)]                       : &:r2154_23, r2154_27
+#-----|   Goto -> Block 9
+
+# 2154|   Block 9
+# 2154|     r2154_30(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_7(glval<iterator>)     = Convert                     : r2154_30
+# 2154|     r2154_31(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2154|     r2154_32(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2154|     r2154_33(iterator)        = Load[(__end)]               : &:r2154_32, ~m?
+# 2154|     r2154_34(bool)            = Call[operator!=]            : func:r2154_31, this:r0_7, 0:r2154_33
+# 2154|     mu2154_35(unknown)        = ^CallSideEffect             : ~m?
 #-----|     v0_8(void)                = ^IndirectReadSideEffect[-1] : &:r0_7, ~m?
-# 2153|     v2153_25(void)            = ConditionalBranch           : r2153_23
-#-----|   False -> Block 10
-#-----|   True -> Block 9
+# 2154|     v2154_36(void)            = ConditionalBranch           : r2154_34
+#-----|   False -> Block 11
+#-----|   True -> Block 10
 
-# 2153|   Block 9
-# 2153|     r2153_26(glval<ClassWithDestructor>) = VariableAddress[y]              : 
-# 2153|     r2153_27(glval<iterator>)            = VariableAddress[(__begin)]      : 
-#-----|     r0_9(glval<iterator>)                = Convert                         : r2153_27
-# 2153|     r2153_28(glval<unknown>)             = FunctionAddress[operator*]      : 
-# 2153|     r2153_29(ClassWithDestructor &)      = Call[operator*]                 : func:r2153_28, this:r0_9
-# 2153|     mu2153_30(unknown)                   = ^CallSideEffect                 : ~m?
+# 2154|   Block 10
+# 2154|     r2154_37(glval<ClassWithDestructor>) = VariableAddress[y]              : 
+# 2154|     r2154_38(glval<iterator>)            = VariableAddress[(__begin)]      : 
+#-----|     r0_9(glval<iterator>)                = Convert                         : r2154_38
+# 2154|     r2154_39(glval<unknown>)             = FunctionAddress[operator*]      : 
+# 2154|     r2154_40(ClassWithDestructor &)      = Call[operator*]                 : func:r2154_39, this:r0_9
+# 2154|     mu2154_41(unknown)                   = ^CallSideEffect                 : ~m?
 #-----|     v0_10(void)                          = ^IndirectReadSideEffect[-1]     : &:r0_9, ~m?
-# 2153|     r2153_31(ClassWithDestructor)        = Load[?]                         : &:r2153_29, ~m?
-# 2153|     mu2153_32(ClassWithDestructor)       = Store[y]                        : &:r2153_26, r2153_31
-# 2154|     r2154_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
-# 2154|     r2154_2(glval<unknown>)              = FunctionAddress[set_x]          : 
-# 2154|     r2154_3(char)                        = Constant[97]                    : 
-# 2154|     v2154_4(void)                        = Call[set_x]                     : func:r2154_2, this:r2154_1, 0:r2154_3
-# 2154|     mu2154_5(unknown)                    = ^CallSideEffect                 : ~m?
-# 2154|     v2154_6(void)                        = ^IndirectReadSideEffect[-1]     : &:r2154_1, ~m?
-# 2154|     mu2154_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2154_1
-# 2153|     r2153_33(glval<iterator>)            = VariableAddress[(__begin)]      : 
-# 2153|     r2153_34(glval<unknown>)             = FunctionAddress[operator++]     : 
-# 2153|     r2153_35(iterator &)                 = Call[operator++]                : func:r2153_34, this:r2153_33
-# 2153|     mu2153_36(unknown)                   = ^CallSideEffect                 : ~m?
-# 2153|     v2153_37(void)                       = ^IndirectReadSideEffect[-1]     : &:r2153_33, ~m?
-# 2153|     mu2153_38(iterator)                  = ^IndirectMayWriteSideEffect[-1] : &:r2153_33
-# 2153|     r2153_39(glval<iterator>)            = CopyValue                       : r2153_35
-#-----|   Goto (back edge) -> Block 8
+# 2154|     r2154_42(ClassWithDestructor)        = Load[?]                         : &:r2154_40, ~m?
+# 2154|     mu2154_43(ClassWithDestructor)       = Store[y]                        : &:r2154_37, r2154_42
+# 2155|     r2155_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2155|     r2155_2(glval<unknown>)              = FunctionAddress[set_x]          : 
+# 2155|     r2155_3(char)                        = Constant[97]                    : 
+# 2155|     v2155_4(void)                        = Call[set_x]                     : func:r2155_2, this:r2155_1, 0:r2155_3
+# 2155|     mu2155_5(unknown)                    = ^CallSideEffect                 : ~m?
+# 2155|     v2155_6(void)                        = ^IndirectReadSideEffect[-1]     : &:r2155_1, ~m?
+# 2155|     mu2155_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2155_1
+# 2154|     r2154_44(glval<iterator>)            = VariableAddress[(__begin)]      : 
+# 2154|     r2154_45(glval<unknown>)             = FunctionAddress[operator++]     : 
+# 2154|     r2154_46(iterator &)                 = Call[operator++]                : func:r2154_45, this:r2154_44
+# 2154|     mu2154_47(unknown)                   = ^CallSideEffect                 : ~m?
+# 2154|     v2154_48(void)                       = ^IndirectReadSideEffect[-1]     : &:r2154_44, ~m?
+# 2154|     mu2154_49(iterator)                  = ^IndirectMayWriteSideEffect[-1] : &:r2154_44
+# 2154|     r2154_50(glval<iterator>)            = CopyValue                       : r2154_46
+#-----|   Goto (back edge) -> Block 9
 
-# 2155|   Block 10
-# 2155|     v2155_1(void)  = NoOp         : 
-# 2136|     v2136_8(void)  = ReturnVoid   : 
-# 2136|     v2136_9(void)  = AliasedUse   : ~m?
-# 2136|     v2136_10(void) = ExitFunction : 
+# 2157|   Block 11
+# 2157|     r2157_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]             : 
+# 2157|     mu2157_2(vector<ClassWithDestructor>)          = Uninitialized[ys]               : &:r2157_1
+# 2157|     r2157_3(glval<unknown>)                        = FunctionAddress[vector]         : 
+# 2157|     r2157_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2157:40]   : 
+# 2157|     r2157_5(glval<ClassWithDestructor>)            = VariableAddress[x]              : 
+# 2157|     r2157_6(ClassWithDestructor)                   = Load[x]                         : &:r2157_5, ~m?
+# 2157|     mu2157_7(ClassWithDestructor)                  = Store[#temp2157:40]             : &:r2157_4, r2157_6
+# 2157|     r2157_8(ClassWithDestructor)                   = Load[#temp2157:40]              : &:r2157_4, ~m?
+# 2157|     v2157_9(void)                                  = Call[vector]                    : func:r2157_3, this:r2157_1, 0:r2157_8
+# 2157|     mu2157_10(unknown)                             = ^CallSideEffect                 : ~m?
+# 2157|     mu2157_11(vector<ClassWithDestructor>)         = ^IndirectMayWriteSideEffect[-1] : &:r2157_1
+# 2157|     r2157_12(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_13(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]             : 
+# 2157|     r2157_14(vector<ClassWithDestructor> &)        = CopyValue                       : r2157_13
+# 2157|     mu2157_15(vector<ClassWithDestructor> &)       = Store[(__range)]                : &:r2157_12, r2157_14
+# 2157|     r2157_16(glval<iterator>)                      = VariableAddress[(__begin)]      : 
+# 2157|     r2157_17(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_18(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2157_17, ~m?
+#-----|     r0_11(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2157_18
+#-----|     r0_12(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_11
+# 2157|     r2157_19(glval<unknown>)                       = FunctionAddress[begin]          : 
+# 2157|     r2157_20(iterator)                             = Call[begin]                     : func:r2157_19, this:r0_12
+# 2157|     mu2157_21(unknown)                             = ^CallSideEffect                 : ~m?
+#-----|     v0_13(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_12, ~m?
+# 2157|     mu2157_22(iterator)                            = Store[(__begin)]                : &:r2157_16, r2157_20
+# 2157|     r2157_23(glval<iterator>)                      = VariableAddress[(__end)]        : 
+# 2157|     r2157_24(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2157|     r2157_25(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2157_24, ~m?
+#-----|     r0_14(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2157_25
+#-----|     r0_15(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_14
+# 2157|     r2157_26(glval<unknown>)                       = FunctionAddress[end]            : 
+# 2157|     r2157_27(iterator)                             = Call[end]                       : func:r2157_26, this:r0_15
+# 2157|     mu2157_28(unknown)                             = ^CallSideEffect                 : ~m?
+#-----|     v0_16(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_15, ~m?
+# 2157|     mu2157_29(iterator)                            = Store[(__end)]                  : &:r2157_23, r2157_27
+#-----|   Goto -> Block 12
+
+# 2157|   Block 12
+# 2157|     r2157_30(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_17(glval<iterator>)    = Convert                     : r2157_30
+# 2157|     r2157_31(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2157|     r2157_32(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2157|     r2157_33(iterator)        = Load[(__end)]               : &:r2157_32, ~m?
+# 2157|     r2157_34(bool)            = Call[operator!=]            : func:r2157_31, this:r0_17, 0:r2157_33
+# 2157|     mu2157_35(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_18(void)               = ^IndirectReadSideEffect[-1] : &:r0_17, ~m?
+# 2157|     v2157_36(void)            = ConditionalBranch           : r2157_34
+#-----|   False -> Block 16
+#-----|   True -> Block 14
+
+# 2157|   Block 13
+# 2157|     r2157_37(glval<iterator>) = VariableAddress[(__begin)]      : 
+# 2157|     r2157_38(glval<unknown>)  = FunctionAddress[operator++]     : 
+# 2157|     r2157_39(iterator &)      = Call[operator++]                : func:r2157_38, this:r2157_37
+# 2157|     mu2157_40(unknown)        = ^CallSideEffect                 : ~m?
+# 2157|     v2157_41(void)            = ^IndirectReadSideEffect[-1]     : &:r2157_37, ~m?
+# 2157|     mu2157_42(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r2157_37
+# 2157|     r2157_43(glval<iterator>) = CopyValue                       : r2157_39
+#-----|   Goto (back edge) -> Block 12
+
+# 2157|   Block 14
+# 2157|     r2157_44(glval<ClassWithDestructor>) = VariableAddress[y]              : 
+# 2157|     r2157_45(glval<iterator>)            = VariableAddress[(__begin)]      : 
+#-----|     r0_19(glval<iterator>)               = Convert                         : r2157_45
+# 2157|     r2157_46(glval<unknown>)             = FunctionAddress[operator*]      : 
+# 2157|     r2157_47(ClassWithDestructor &)      = Call[operator*]                 : func:r2157_46, this:r0_19
+# 2157|     mu2157_48(unknown)                   = ^CallSideEffect                 : ~m?
+#-----|     v0_20(void)                          = ^IndirectReadSideEffect[-1]     : &:r0_19, ~m?
+# 2157|     r2157_49(ClassWithDestructor)        = Load[?]                         : &:r2157_47, ~m?
+# 2157|     mu2157_50(ClassWithDestructor)       = Store[y]                        : &:r2157_44, r2157_49
+# 2158|     r2158_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2158|     r2158_2(glval<unknown>)              = FunctionAddress[set_x]          : 
+# 2158|     r2158_3(char)                        = Constant[97]                    : 
+# 2158|     v2158_4(void)                        = Call[set_x]                     : func:r2158_2, this:r2158_1, 0:r2158_3
+# 2158|     mu2158_5(unknown)                    = ^CallSideEffect                 : ~m?
+# 2158|     v2158_6(void)                        = ^IndirectReadSideEffect[-1]     : &:r2158_1, ~m?
+# 2158|     mu2158_7(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2158_1
+# 2159|     r2159_1(glval<ClassWithDestructor>)  = VariableAddress[y]              : 
+# 2159|     r2159_2(glval<unknown>)              = FunctionAddress[get_x]          : 
+# 2159|     r2159_3(char)                        = Call[get_x]                     : func:r2159_2, this:r2159_1
+# 2159|     mu2159_4(unknown)                    = ^CallSideEffect                 : ~m?
+# 2159|     v2159_5(void)                        = ^IndirectReadSideEffect[-1]     : &:r2159_1, ~m?
+# 2159|     mu2159_6(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1] : &:r2159_1
+# 2159|     r2159_7(int)                         = Convert                         : r2159_3
+# 2159|     r2159_8(int)                         = Constant[98]                    : 
+# 2159|     r2159_9(bool)                        = CompareEQ                       : r2159_7, r2159_8
+# 2159|     v2159_10(void)                       = ConditionalBranch               : r2159_9
+#-----|   False -> Block 13
+#-----|   True -> Block 15
+
+# 2160|   Block 15
+# 2160|     v2160_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2163|   Block 16
+# 2163|     r2163_1(glval<vector<int>>)    = VariableAddress[ys]             : 
+# 2163|     mu2163_2(vector<int>)          = Uninitialized[ys]               : &:r2163_1
+# 2163|     r2163_3(glval<unknown>)        = FunctionAddress[vector]         : 
+# 2163|     r2163_4(int)                   = Constant[1]                     : 
+# 2163|     v2163_5(void)                  = Call[vector]                    : func:r2163_3, this:r2163_1, 0:r2163_4
+# 2163|     mu2163_6(unknown)              = ^CallSideEffect                 : ~m?
+# 2163|     mu2163_7(vector<int>)          = ^IndirectMayWriteSideEffect[-1] : &:r2163_1
+# 2163|     r2163_8(glval<vector<int> &>)  = VariableAddress[(__range)]      : 
+# 2163|     r2163_9(glval<vector<int>>)    = VariableAddress[ys]             : 
+# 2163|     r2163_10(vector<int> &)        = CopyValue                       : r2163_9
+# 2163|     mu2163_11(vector<int> &)       = Store[(__range)]                : &:r2163_8, r2163_10
+# 2163|     r2163_12(glval<iterator>)      = VariableAddress[(__begin)]      : 
+# 2163|     r2163_13(glval<vector<int> &>) = VariableAddress[(__range)]      : 
+# 2163|     r2163_14(vector<int> &)        = Load[(__range)]                 : &:r2163_13, ~m?
+#-----|     r0_21(glval<vector<int>>)      = CopyValue                       : r2163_14
+#-----|     r0_22(glval<vector<int>>)      = Convert                         : r0_21
+# 2163|     r2163_15(glval<unknown>)       = FunctionAddress[begin]          : 
+# 2163|     r2163_16(iterator)             = Call[begin]                     : func:r2163_15, this:r0_22
+# 2163|     mu2163_17(unknown)             = ^CallSideEffect                 : ~m?
+#-----|     v0_23(void)                    = ^IndirectReadSideEffect[-1]     : &:r0_22, ~m?
+# 2163|     mu2163_18(iterator)            = Store[(__begin)]                : &:r2163_12, r2163_16
+# 2163|     r2163_19(glval<iterator>)      = VariableAddress[(__end)]        : 
+# 2163|     r2163_20(glval<vector<int> &>) = VariableAddress[(__range)]      : 
+# 2163|     r2163_21(vector<int> &)        = Load[(__range)]                 : &:r2163_20, ~m?
+#-----|     r0_24(glval<vector<int>>)      = CopyValue                       : r2163_21
+#-----|     r0_25(glval<vector<int>>)      = Convert                         : r0_24
+# 2163|     r2163_22(glval<unknown>)       = FunctionAddress[end]            : 
+# 2163|     r2163_23(iterator)             = Call[end]                       : func:r2163_22, this:r0_25
+# 2163|     mu2163_24(unknown)             = ^CallSideEffect                 : ~m?
+#-----|     v0_26(void)                    = ^IndirectReadSideEffect[-1]     : &:r0_25, ~m?
+# 2163|     mu2163_25(iterator)            = Store[(__end)]                  : &:r2163_19, r2163_23
+#-----|   Goto -> Block 17
+
+# 2163|   Block 17
+# 2163|     r2163_26(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_27(glval<iterator>)    = Convert                     : r2163_26
+# 2163|     r2163_27(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2163|     r2163_28(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2163|     r2163_29(iterator)        = Load[(__end)]               : &:r2163_28, ~m?
+# 2163|     r2163_30(bool)            = Call[operator!=]            : func:r2163_27, this:r0_27, 0:r2163_29
+# 2163|     mu2163_31(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_28(void)               = ^IndirectReadSideEffect[-1] : &:r0_27, ~m?
+# 2163|     v2163_32(void)            = ConditionalBranch           : r2163_30
+#-----|   False -> Block 21
+#-----|   True -> Block 19
+
+# 2163|   Block 18
+# 2163|     r2163_33(glval<iterator>) = VariableAddress[(__begin)]      : 
+# 2163|     r2163_34(glval<unknown>)  = FunctionAddress[operator++]     : 
+# 2163|     r2163_35(iterator &)      = Call[operator++]                : func:r2163_34, this:r2163_33
+# 2163|     mu2163_36(unknown)        = ^CallSideEffect                 : ~m?
+# 2163|     v2163_37(void)            = ^IndirectReadSideEffect[-1]     : &:r2163_33, ~m?
+# 2163|     mu2163_38(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r2163_33
+# 2163|     r2163_39(glval<iterator>) = CopyValue                       : r2163_35
+#-----|   Goto (back edge) -> Block 17
+
+# 2163|   Block 19
+# 2163|     r2163_40(glval<int>)      = VariableAddress[y]          : 
+# 2163|     r2163_41(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_29(glval<iterator>)    = Convert                     : r2163_41
+# 2163|     r2163_42(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 2163|     r2163_43(int &)           = Call[operator*]             : func:r2163_42, this:r0_29
+# 2163|     mu2163_44(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_30(void)               = ^IndirectReadSideEffect[-1] : &:r0_29, ~m?
+# 2163|     r2163_45(int)             = Load[?]                     : &:r2163_43, ~m?
+# 2163|     mu2163_46(int)            = Store[y]                    : &:r2163_40, r2163_45
+# 2164|     r2164_1(glval<int>)       = VariableAddress[y]          : 
+# 2164|     r2164_2(int)              = Load[y]                     : &:r2164_1, ~m?
+# 2164|     r2164_3(int)              = Constant[1]                 : 
+# 2164|     r2164_4(bool)             = CompareEQ                   : r2164_2, r2164_3
+# 2164|     v2164_5(void)             = ConditionalBranch           : r2164_4
+#-----|   False -> Block 18
+#-----|   True -> Block 20
+
+# 2165|   Block 20
+# 2165|     v2165_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2168|   Block 21
+# 2168|     r2168_1(glval<vector<ClassWithDestructor>>)    = VariableAddress[ys]             : 
+# 2168|     mu2168_2(vector<ClassWithDestructor>)          = Uninitialized[ys]               : &:r2168_1
+# 2168|     r2168_3(glval<unknown>)                        = FunctionAddress[vector]         : 
+# 2168|     r2168_4(glval<ClassWithDestructor>)            = VariableAddress[#temp2168:40]   : 
+# 2168|     r2168_5(glval<ClassWithDestructor>)            = VariableAddress[x]              : 
+# 2168|     r2168_6(ClassWithDestructor)                   = Load[x]                         : &:r2168_5, ~m?
+# 2168|     mu2168_7(ClassWithDestructor)                  = Store[#temp2168:40]             : &:r2168_4, r2168_6
+# 2168|     r2168_8(ClassWithDestructor)                   = Load[#temp2168:40]              : &:r2168_4, ~m?
+# 2168|     v2168_9(void)                                  = Call[vector]                    : func:r2168_3, this:r2168_1, 0:r2168_8
+# 2168|     mu2168_10(unknown)                             = ^CallSideEffect                 : ~m?
+# 2168|     mu2168_11(vector<ClassWithDestructor>)         = ^IndirectMayWriteSideEffect[-1] : &:r2168_1
+# 2168|     r2168_12(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_13(glval<vector<ClassWithDestructor>>)   = VariableAddress[ys]             : 
+# 2168|     r2168_14(vector<ClassWithDestructor> &)        = CopyValue                       : r2168_13
+# 2168|     mu2168_15(vector<ClassWithDestructor> &)       = Store[(__range)]                : &:r2168_12, r2168_14
+# 2168|     r2168_16(glval<iterator>)                      = VariableAddress[(__begin)]      : 
+# 2168|     r2168_17(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_18(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2168_17, ~m?
+#-----|     r0_31(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2168_18
+#-----|     r0_32(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_31
+# 2168|     r2168_19(glval<unknown>)                       = FunctionAddress[begin]          : 
+# 2168|     r2168_20(iterator)                             = Call[begin]                     : func:r2168_19, this:r0_32
+# 2168|     mu2168_21(unknown)                             = ^CallSideEffect                 : ~m?
+#-----|     v0_33(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_32, ~m?
+# 2168|     mu2168_22(iterator)                            = Store[(__begin)]                : &:r2168_16, r2168_20
+# 2168|     r2168_23(glval<iterator>)                      = VariableAddress[(__end)]        : 
+# 2168|     r2168_24(glval<vector<ClassWithDestructor> &>) = VariableAddress[(__range)]      : 
+# 2168|     r2168_25(vector<ClassWithDestructor> &)        = Load[(__range)]                 : &:r2168_24, ~m?
+#-----|     r0_34(glval<vector<ClassWithDestructor>>)      = CopyValue                       : r2168_25
+#-----|     r0_35(glval<vector<ClassWithDestructor>>)      = Convert                         : r0_34
+# 2168|     r2168_26(glval<unknown>)                       = FunctionAddress[end]            : 
+# 2168|     r2168_27(iterator)                             = Call[end]                       : func:r2168_26, this:r0_35
+# 2168|     mu2168_28(unknown)                             = ^CallSideEffect                 : ~m?
+#-----|     v0_36(void)                                    = ^IndirectReadSideEffect[-1]     : &:r0_35, ~m?
+# 2168|     mu2168_29(iterator)                            = Store[(__end)]                  : &:r2168_23, r2168_27
+#-----|   Goto -> Block 22
+
+# 2168|   Block 22
+# 2168|     r2168_30(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_37(glval<iterator>)    = Convert                     : r2168_30
+# 2168|     r2168_31(glval<unknown>)  = FunctionAddress[operator!=] : 
+# 2168|     r2168_32(glval<iterator>) = VariableAddress[(__end)]    : 
+# 2168|     r2168_33(iterator)        = Load[(__end)]               : &:r2168_32, ~m?
+# 2168|     r2168_34(bool)            = Call[operator!=]            : func:r2168_31, this:r0_37, 0:r2168_33
+# 2168|     mu2168_35(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_38(void)               = ^IndirectReadSideEffect[-1] : &:r0_37, ~m?
+# 2168|     v2168_36(void)            = ConditionalBranch           : r2168_34
+#-----|   False -> Block 24
+#-----|   True -> Block 23
+
+# 2168|   Block 23
+# 2168|     r2168_37(glval<ClassWithDestructor>) = VariableAddress[y]                   : 
+# 2168|     r2168_38(glval<iterator>)            = VariableAddress[(__begin)]           : 
+#-----|     r0_39(glval<iterator>)               = Convert                              : r2168_38
+# 2168|     r2168_39(glval<unknown>)             = FunctionAddress[operator*]           : 
+# 2168|     r2168_40(ClassWithDestructor &)      = Call[operator*]                      : func:r2168_39, this:r0_39
+# 2168|     mu2168_41(unknown)                   = ^CallSideEffect                      : ~m?
+#-----|     v0_40(void)                          = ^IndirectReadSideEffect[-1]          : &:r0_39, ~m?
+# 2168|     r2168_42(ClassWithDestructor)        = Load[?]                              : &:r2168_40, ~m?
+# 2168|     mu2168_43(ClassWithDestructor)       = Store[y]                             : &:r2168_37, r2168_42
+# 2169|     r2169_1(glval<ClassWithDestructor>)  = VariableAddress[z1]                  : 
+# 2169|     mu2169_2(ClassWithDestructor)        = Uninitialized[z1]                    : &:r2169_1
+# 2169|     r2169_3(glval<unknown>)              = FunctionAddress[ClassWithDestructor] : 
+# 2169|     v2169_4(void)                        = Call[ClassWithDestructor]            : func:r2169_3, this:r2169_1
+# 2169|     mu2169_5(unknown)                    = ^CallSideEffect                      : ~m?
+# 2169|     mu2169_6(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2169_1
+# 2170|     r2170_1(glval<ClassWithDestructor>)  = VariableAddress[z2]                  : 
+# 2170|     mu2170_2(ClassWithDestructor)        = Uninitialized[z2]                    : &:r2170_1
+# 2170|     r2170_3(glval<unknown>)              = FunctionAddress[ClassWithDestructor] : 
+# 2170|     v2170_4(void)                        = Call[ClassWithDestructor]            : func:r2170_3, this:r2170_1
+# 2170|     mu2170_5(unknown)                    = ^CallSideEffect                      : ~m?
+# 2170|     mu2170_6(ClassWithDestructor)        = ^IndirectMayWriteSideEffect[-1]      : &:r2170_1
+# 2168|     r2168_44(glval<iterator>)            = VariableAddress[(__begin)]           : 
+# 2168|     r2168_45(glval<unknown>)             = FunctionAddress[operator++]          : 
+# 2168|     r2168_46(iterator &)                 = Call[operator++]                     : func:r2168_45, this:r2168_44
+# 2168|     mu2168_47(unknown)                   = ^CallSideEffect                      : ~m?
+# 2168|     v2168_48(void)                       = ^IndirectReadSideEffect[-1]          : &:r2168_44, ~m?
+# 2168|     mu2168_49(iterator)                  = ^IndirectMayWriteSideEffect[-1]      : &:r2168_44
+# 2168|     r2168_50(glval<iterator>)            = CopyValue                            : r2168_46
+#-----|   Goto (back edge) -> Block 22
+
+# 2172|   Block 24
+# 2172|     v2172_1(void) = NoOp : 
+#-----|   Goto -> Block 1
+
+# 2174| void static_variable_with_destructor_1()
+# 2174|   Block 0
+# 2174|     v2174_1(void)                       = EnterFunction                        : 
+# 2174|     mu2174_2(unknown)                   = AliasedDefinition                    : 
+# 2174|     mu2174_3(unknown)                   = InitializeNonLocal                   : 
+# 2175|     r2175_1(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+# 2175|     mu2175_2(ClassWithDestructor)       = Uninitialized[a]                     : &:r2175_1
+# 2175|     r2175_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2175|     v2175_4(void)                       = Call[ClassWithDestructor]            : func:r2175_3, this:r2175_1
+# 2175|     mu2175_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2175|     mu2175_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2175_1
+# 2176|     r2176_1(glval<bool>)                = VariableAddress[b#init]              : 
+# 2176|     r2176_2(bool)                       = Load[b#init]                         : &:r2176_1, ~m?
+# 2176|     v2176_3(void)                       = ConditionalBranch                    : r2176_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2176|   Block 1
+# 2176|     r2176_4(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2176_4
+#-----|     mu0_3(unknown)                      = ^CallSideEffect                      : ~m?
+#-----|     mu0_4(ClassWithDestructor)          = ^IndirectMayWriteSideEffect[-1]      : &:r2176_4
+# 2176|     r2176_5(bool)                       = Constant[1]                          : 
+# 2176|     mu2176_6(bool)                      = Store[b#init]                        : &:r2176_1, r2176_5
+#-----|   Goto -> Block 2
+
+# 2177|   Block 2
+# 2177|     v2177_1(void) = NoOp         : 
+# 2174|     v2174_4(void) = ReturnVoid   : 
+# 2174|     v2174_5(void) = AliasedUse   : ~m?
+# 2174|     v2174_6(void) = ExitFunction : 
+
+# 2179| void static_variable_with_destructor_2()
+# 2179|   Block 0
+# 2179|     v2179_1(void)        = EnterFunction           : 
+# 2179|     mu2179_2(unknown)    = AliasedDefinition       : 
+# 2179|     mu2179_3(unknown)    = InitializeNonLocal      : 
+# 2180|     r2180_1(glval<bool>) = VariableAddress[a#init] : 
+# 2180|     r2180_2(bool)        = Load[a#init]            : &:r2180_1, ~m?
+# 2180|     v2180_3(void)        = ConditionalBranch       : r2180_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2180|   Block 1
+# 2180|     r2180_4(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2180_4
+#-----|     mu0_3(unknown)                      = ^CallSideEffect                      : ~m?
+#-----|     mu0_4(ClassWithDestructor)          = ^IndirectMayWriteSideEffect[-1]      : &:r2180_4
+# 2180|     r2180_5(bool)                       = Constant[1]                          : 
+# 2180|     mu2180_6(bool)                      = Store[a#init]                        : &:r2180_1, r2180_5
+#-----|   Goto -> Block 2
+
+# 2181|   Block 2
+# 2181|     r2181_1(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+# 2181|     mu2181_2(ClassWithDestructor)       = Uninitialized[b]                     : &:r2181_1
+# 2181|     r2181_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2181|     v2181_4(void)                       = Call[ClassWithDestructor]            : func:r2181_3, this:r2181_1
+# 2181|     mu2181_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2181|     mu2181_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2181_1
+# 2182|     v2182_1(void)                       = NoOp                                 : 
+# 2179|     v2179_4(void)                       = ReturnVoid                           : 
+# 2179|     v2179_5(void)                       = AliasedUse                           : ~m?
+# 2179|     v2179_6(void)                       = ExitFunction                         : 
+
+# 2184| void static_variable_with_destructor_3()
+# 2184|   Block 0
+# 2184|     v2184_1(void)                       = EnterFunction                        : 
+# 2184|     mu2184_2(unknown)                   = AliasedDefinition                    : 
+# 2184|     mu2184_3(unknown)                   = InitializeNonLocal                   : 
+# 2185|     r2185_1(glval<ClassWithDestructor>) = VariableAddress[a]                   : 
+# 2185|     mu2185_2(ClassWithDestructor)       = Uninitialized[a]                     : &:r2185_1
+# 2185|     r2185_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2185|     v2185_4(void)                       = Call[ClassWithDestructor]            : func:r2185_3, this:r2185_1
+# 2185|     mu2185_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2185|     mu2185_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2185_1
+# 2186|     r2186_1(glval<ClassWithDestructor>) = VariableAddress[b]                   : 
+# 2186|     mu2186_2(ClassWithDestructor)       = Uninitialized[b]                     : &:r2186_1
+# 2186|     r2186_3(glval<unknown>)             = FunctionAddress[ClassWithDestructor] : 
+# 2186|     v2186_4(void)                       = Call[ClassWithDestructor]            : func:r2186_3, this:r2186_1
+# 2186|     mu2186_5(unknown)                   = ^CallSideEffect                      : ~m?
+# 2186|     mu2186_6(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]      : &:r2186_1
+# 2187|     r2187_1(glval<bool>)                = VariableAddress[c#init]              : 
+# 2187|     r2187_2(bool)                       = Load[c#init]                         : &:r2187_1, ~m?
+# 2187|     v2187_3(void)                       = ConditionalBranch                    : r2187_2
+#-----|   False -> Block 1
+#-----|   True -> Block 2
+
+# 2187|   Block 1
+# 2187|     r2187_4(glval<ClassWithDestructor>) = VariableAddress[c]                   : 
+#-----|     r0_1(glval<unknown>)                = FunctionAddress[ClassWithDestructor] : 
+#-----|     v0_2(void)                          = Call[ClassWithDestructor]            : func:r0_1, this:r2187_4
+#-----|     mu0_3(unknown)                      = ^CallSideEffect                      : ~m?
+#-----|     mu0_4(ClassWithDestructor)          = ^IndirectMayWriteSideEffect[-1]      : &:r2187_4
+# 2187|     r2187_5(bool)                       = Constant[1]                          : 
+# 2187|     mu2187_6(bool)                      = Store[c#init]                        : &:r2187_1, r2187_5
+#-----|   Goto -> Block 2
+
+# 2188|   Block 2
+# 2188|     v2188_1(void) = NoOp         : 
+# 2184|     v2184_4(void) = ReturnVoid   : 
+# 2184|     v2184_5(void) = AliasedUse   : ~m?
+# 2184|     v2184_6(void) = ExitFunction : 
+
+# 2190| ClassWithDestructor global_class_with_destructor
+# 2190|   Block 0
+# 2190|     v2190_1(void)                       = EnterFunction                                 : 
+# 2190|     mu2190_2(unknown)                   = AliasedDefinition                             : 
+# 2190|     r2190_3(glval<ClassWithDestructor>) = VariableAddress[global_class_with_destructor] : 
+# 2190|     r2190_4(glval<unknown>)             = FunctionAddress[ClassWithDestructor]          : 
+# 2190|     v2190_5(void)                       = Call[ClassWithDestructor]                     : func:r2190_4, this:r2190_3
+# 2190|     mu2190_6(unknown)                   = ^CallSideEffect                               : ~m?
+# 2190|     mu2190_7(ClassWithDestructor)       = ^IndirectMayWriteSideEffect[-1]               : &:r2190_3
+# 2190|     v2190_8(void)                       = ReturnVoid                                    : 
+# 2190|     v2190_9(void)                       = AliasedUse                                    : ~m?
+# 2190|     v2190_10(void)                      = ExitFunction                                  : 
 
 perf-regression.cpp:
 #    6| void Big::Big()

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected

@@ -28,5 +28,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-| ir.cpp:2153:68:2153:69 | VariableAddress: ys | Variable address instruction 'VariableAddress: ys' has no associated variable, in function '$@'. | ir.cpp:2136:6:2136:35 | void initialization_with_destructor(bool, char) | void initialization_with_destructor(bool, char) |
 missingCppType

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected

@@ -28,5 +28,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-| ir.cpp:2153:68:2153:69 | VariableAddress: ys | Variable address instruction 'VariableAddress: ys' has no associated variable, in function '$@'. | ir.cpp:2136:6:2136:35 | void initialization_with_destructor(bool, char) | void initialization_with_destructor(bool, char) |
 missingCppType

cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c

@@ -23,7 +23,7 @@ extern char *dcngettext (const char *__domainname, const char *__msgid1,
 extern char *any_random_function(const char *);
 
 #define NULL ((void*)0)
-#define _(X) any_random_function((X))
+#define _(X) gettext(X)
 
 int main(int argc, char **argv) {
 	if(argc > 1)
@@ -40,10 +40,9 @@ int main(int argc, char **argv) {
 	printf(gettext("%d arguments\n"), argc-1); // GOOD
 	printf(any_random_function("%d arguments\n"), argc-1); // BAD
 
-	// Even though `_` is mapped to `some_random_function` above,
-	// the following call should not  be flagged.
-	printf(_(any_random_function("%d arguments\n")),
-			argc-1); // GOOD
+
+
+	printf(_(any_random_function("%d arguments\n")), argc-1); // BAD
 
 	return 0;
 }

cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected

@@ -1,24 +1,21 @@
 | NonConstantFormat.c:30:10:30:16 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | NonConstantFormat.c:41:9:41:27 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| NonConstantFormat.c:45:9:45:48 | call to gettext | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | nested.cpp:21:23:21:26 | fmt0 | The format string argument to snprintf should be constant to prevent security issues and other potential errors. |
 | nested.cpp:79:32:79:38 | call to get_fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
 | nested.cpp:87:18:87:20 | fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
 | test.cpp:51:10:51:21 | call to make_message | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:57:12:57:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:60:12:60:21 | call to const_wash | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:61:12:61:26 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:62:12:62:17 | + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:63:12:63:18 | * ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:64:12:64:18 | & ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:65:12:65:39 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:67:10:67:35 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:70:12:70:20 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:76:12:76:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:82:12:82:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:88:12:88:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:93:12:93:18 | ++ ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:100:12:100:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:110:12:110:24 | new[] | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| test.cpp:115:12:115:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | test.cpp:130:20:130:26 | access to array | The format string argument to sprintf should be constant to prevent security issues and other potential errors. |
 | test.cpp:157:12:157:15 | data | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:170:12:170:14 | res | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:195:31:195:33 | str | The format string argument to StringCchPrintfW should be constant to prevent security issues and other potential errors. |
+| test.cpp:197:11:197:14 | wstr | The format string argument to wprintf should be constant to prevent security issues and other potential errors. |
+| test.cpp:205:12:205:20 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:206:12:206:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:211:12:211:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:217:12:217:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:223:12:223:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:228:12:228:18 | ++ ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:235:12:235:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:242:12:242:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| test.cpp:247:12:247:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |

cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/nested.cpp

@@ -18,7 +18,7 @@ extern "C" int snprintf ( char * s, int n, const char * format, ... );
 struct A {
   void do_print(const char *fmt0) {
     char buf[32];
-    snprintf(buf, 32, fmt0); // GOOD [FALSE POSITIVE]
+    snprintf(buf, 32, fmt0); // BAD, all paths from unknown const char*, not assuming literal
   }
 };
 
@@ -34,12 +34,12 @@ struct C {
   void do_some_printing(const char *fmt) {
     b.do_printing(fmt);
   }
-  const char *ext_fmt_str(void);
+  const char *ext_fmt_str(void); // NOTE: not assuming result is literal
 };
 
 void foo(void) {
   C c;
-  c.do_some_printing(c.ext_fmt_str()); // BAD [NOT DETECTED]
+  c.do_some_printing(c.ext_fmt_str()); 
 }
 
 struct some_class {
@@ -76,12 +76,12 @@ void diagnostic(const char *fmt, ...)
 }
 
 void bar(void) {
-    diagnostic (some_instance->get_fmt());  // BAD
+    diagnostic (some_instance->get_fmt());  // BAD const char* but not assuming literal
 }
 
 namespace ns {
 
-  class blab {
+  class blab { 
     void out1(void) {
       char *fmt = (char *)__builtin_alloca(10);
       diagnostic(fmt);  // BAD

cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp

@@ -54,66 +54,66 @@ int main(int argc, char **argv) {
   {
     char hello[] = "hello, World\n";
     hello[0] = 'H';
-    printf(hello); // BAD
+    printf(hello); // GOOD
     printf(_(hello)); // GOOD
     printf(gettext(hello)); // GOOD
-    printf(const_wash(hello)); // BAD
-    printf((hello + 1) + 1); // BAD
-    printf(+hello); // BAD
-    printf(*&hello); // BAD
-    printf(&*hello); // BAD
-    printf((char*)(void*)+(hello+1) + 1); // BAD
+    printf(const_wash(hello)); // GOOD
+    printf((hello + 1) + 1); // GOOD
+    printf(+hello); // GOOD
+    printf(*&hello); // GOOD
+    printf(&*hello); // GOOD
+    printf((char*)(void*)+(hello+1) + 1); // GOOD
   }
-  printf(("Hello, World\n" + 1) + 1); // BAD
+  printf(("Hello, World\n" + 1) + 1); // GOOD
   {
     const char *hello = "Hello, World\n";
-    printf(hello + 1); // BAD
+    printf(hello + 1); // GOOD
     printf(hello); // GOOD
   }
   {
     const char *hello = "Hello, World\n";
     hello += 1;
-    printf(hello); // BAD
+    printf(hello); // GOOD
   }
   {
     // Same as above block but using "x = x + 1" syntax
     const char *hello = "Hello, World\n";
     hello = hello + 1;
-    printf(hello); // BAD
+    printf(hello); // GOOD
   }
   {
     // Same as above block but using "x++" syntax
     const char *hello = "Hello, World\n";
     hello++;
-    printf(hello); // BAD
+    printf(hello); // GOOD
   }
   {
     // Same as above block but using "++x" as subexpression
     const char *hello = "Hello, World\n";
-    printf(++hello); // BAD
+    printf(++hello); // GOOD
   }
   {
     // Same as above block but through a pointer
     const char *hello = "Hello, World\n";
     const char **p = &hello;
     (*p)++;
-    printf(hello); // BAD
+    printf(hello); // GOOD
   }
   {
     // Same as above block but through a C++ reference
     const char *hello = "Hello, World\n";
     const char *&p = hello;
     p++;
-    printf(hello); // BAD [NOT DETECTED]
+    printf(hello); // GOOD
   }
   if (gettext_debug) {
-    printf(new char[100]); // BAD
+    printf(new char[100]); // BAD [FALSE NEGATIVE: uninitialized value not considered a source]
   }
   {
     const char *hello = "Hello, World\n";
-    const char *const *p = &hello; // harmless reference to const pointer
-    printf(hello); // GOOD [FALSE POSITIVE]
-    hello++; // modification comes after use and so does no harm
+    const char *const *p = &hello; 
+    printf(hello); // GOOD
+    hello++; 
   }
   printf(argc > 2 ? "More than one\n" : _("Only one\n")); // GOOD
 
@@ -154,7 +154,7 @@ void print_ith_message() {
 
 void fmt_via_strcpy(char *data) {
     strcpy(data, "some string");
-    printf(data); // BAD
+    printf(data); // GOOD [FALSE POSITIVE: Due to inaccurate dataflow killers]
 }
 
 void fmt_with_assignment() {
@@ -163,3 +163,107 @@ void fmt_with_assignment() {
   x = y = "a";
   printf(y); // GOOD
 }
+
+void fmt_via_strcpy_bad(char *data) {
+    char res[100]; 
+    strcpy(res, data);
+    printf(res); // BAD
+}
+
+
+int wprintf(const wchar_t *format,...);
+typedef wchar_t *STRSAFE_LPWSTR;
+typedef const wchar_t *STRSAFE_LPCWSTR;
+typedef unsigned int size_t;
+
+void StringCchPrintfW(
+  STRSAFE_LPWSTR  pszDest,
+  size_t          cchDest,
+  STRSAFE_LPCWSTR pszFormat,
+   ...             
+);
+
+void wchar_t_test_good(){
+  wchar_t wstr[100];
+  StringCchPrintfW(wstr, 100, L"STRING"); // GOOD
+
+  wprintf(wstr); // GOOD 
+}
+
+void wchar_t_test_bad(wchar_t* str){
+  wchar_t wstr[100];
+  StringCchPrintfW(wstr, 100, str); // BAD
+
+  wprintf(wstr); // BAD
+}
+
+char* get_string();
+
+void pointer_arithmetic_test_on_bad_string(){
+   {
+    const char *hello = get_string();
+    printf(hello + 1); // BAD
+    printf(hello); // BAD
+  }
+  {
+    const char *hello = get_string();
+    hello += 1;
+    printf(hello); // BAD
+  }
+  {
+    // Same as above block but using "x = x + 1" syntax
+    const char *hello = get_string();
+    hello = hello + 1;
+    printf(hello); // BAD
+  }
+  {
+    // Same as above block but using "x++" syntax
+    const char *hello = get_string();
+    hello++;
+    printf(hello); // BAD
+  }
+  {
+    // Same as above block but using "++x" as subexpression
+    const char *hello = get_string();
+    printf(++hello); // BAD
+  }
+  {
+    // Same as above block but through a pointer
+    const char *hello = get_string();
+    const char **p = &hello;
+    (*p)++;
+    printf(hello); // BAD
+  }
+  {
+    // Same as above block but through a C++ reference
+    const char *hello = get_string();
+    const char *&p = hello;
+    p++;
+    printf(hello); // BAD
+  }
+  {
+    const char *hello = get_string();
+    const char *const *p = &hello; 
+    printf(hello); // BAD
+  }
+}
+
+struct struct1 {
+  char *non_const;
+  const char* const_member = "TEST";
+  char * const_member2 = "TEST";
+  struct struct2{
+    char *nested_non_const;
+    const char* nested_const_member = "TEST";
+    char * nested_const_member2 = "TEST";
+  } nested;
+};
+
+int test_uncalled_func_with_struct_param(struct struct1 *s) {
+  printf(s->non_const); // BAD [FALSE NEGATIVE]
+  printf(s->const_member); // GOOD
+  printf(s->const_member2); // GOOD
+  printf(s->nested.nested_non_const); // BAD [FALSE NEGATIVE]
+  printf(s->nested.nested_const_member); // GOOD
+  printf(s->nested.nested_const_member2); // GOOD
+}

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected

@@ -1,4 +1,3 @@
-| consts.cpp:81:9:81:10 | c8 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | consts.cpp:86:9:86:10 | v1 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | consts.cpp:91:9:91:10 | v2 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | consts.cpp:95:9:95:10 | v3 | The format string argument to printf should be constant to prevent security issues and other potential errors. |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/consts.cpp

@@ -75,7 +75,7 @@ void a() {
  // GOOD: constFuncToArray() always returns a value from gc1, which is always constant
  printf(constFuncToArray(0));
   
- // BAD: format string is not constant
+ // BAD: format string is not constant [NOT DETECTED]
  char c8[10];
  sprintf(c8, "%d", 1);
  printf(c8);

cpp/ql/test/successor-tests/forstmt/rangebasedforstmt/cfg.expected

@@ -0,0 +1,85 @@
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const iterator)... | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const iterator)... | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const vector<int>)... | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const vector<int>)... | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (reference dereference) | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (reference dereference) | <none> |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 5 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__range) | 4: declaration |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 9 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__begin) | 5: (__range) |
+|  | forstmt01.cpp:3:6:3:14 | for_loop1 | 0 | 12 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__end) | 5: (__end) |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const iterator)... | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const iterator)... | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const vector<int>)... | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (const vector<int>)... | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (reference dereference) | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 1 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (reference dereference) | <none> |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 8 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__range) | 4: declaration |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 12 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__begin) | 6: (__range) |
+|  | forstmt02.cpp:3:6:3:14 | for_loop2 | 0 | 15 | file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | initializer for (__end) | 6: (__end) |
+| forstmt | forstmt.h:2:8:2:8 | operator= | 2 | 1 | forstmt.h:2:8:2:8 | forstmt.h:2:8:2:8 | forstmt.h:2:8:2:8 | operator= | <none> |
+| forstmt | forstmt.h:2:8:2:8 | operator= | 2 | 1 | forstmt.h:2:8:2:8 | forstmt.h:2:8:2:8 | forstmt.h:2:8:2:8 | operator= | <none> |
+| forstmt | forstmt.h:3:12:3:12 | operator= | 3 | 1 | forstmt.h:3:12:3:12 | forstmt.h:3:12:3:12 | forstmt.h:3:12:3:12 | operator= | <none> |
+| forstmt | forstmt.h:3:12:3:12 | operator= | 3 | 1 | forstmt.h:3:12:3:12 | forstmt.h:3:12:3:12 | forstmt.h:3:12:3:12 | operator= | <none> |
+| forstmt | forstmt.h:4:19:4:28 | operator++ | 4 | 1 | forstmt.h:4:19:4:28 | forstmt.h:4:19:4:28 | forstmt.h:4:19:4:28 | operator++ | <none> |
+| forstmt | forstmt.h:4:19:4:28 | operator++ | 4 | 1 | forstmt.h:4:19:4:28 | forstmt.h:4:19:4:28 | forstmt.h:4:19:4:28 | operator++ | <none> |
+| forstmt | forstmt.h:5:12:5:20 | operator* | 5 | 1 | forstmt.h:5:12:5:20 | forstmt.h:5:12:5:20 | forstmt.h:5:12:5:20 | operator* | <none> |
+| forstmt | forstmt.h:5:12:5:20 | operator* | 5 | 1 | forstmt.h:5:12:5:20 | forstmt.h:5:12:5:20 | forstmt.h:5:12:5:20 | operator* | <none> |
+| forstmt | forstmt.h:7:14:7:23 | operator!= | 7 | 1 | forstmt.h:7:14:7:23 | forstmt.h:7:14:7:23 | forstmt.h:7:14:7:23 | operator!= | <none> |
+| forstmt | forstmt.h:7:14:7:23 | operator!= | 7 | 1 | forstmt.h:7:14:7:23 | forstmt.h:7:14:7:23 | forstmt.h:7:14:7:23 | operator!= | <none> |
+| forstmt | forstmt.h:10:14:10:18 | begin | 10 | 1 | forstmt.h:10:14:10:18 | forstmt.h:10:14:10:18 | forstmt.h:10:14:10:18 | begin | <none> |
+| forstmt | forstmt.h:10:14:10:18 | begin | 10 | 1 | forstmt.h:10:14:10:18 | forstmt.h:10:14:10:18 | forstmt.h:10:14:10:18 | begin | <none> |
+| forstmt | forstmt.h:11:14:11:16 | end | 11 | 1 | forstmt.h:11:14:11:16 | forstmt.h:11:14:11:16 | forstmt.h:11:14:11:16 | end | <none> |
+| forstmt | forstmt.h:11:14:11:16 | end | 11 | 1 | forstmt.h:11:14:11:16 | forstmt.h:11:14:11:16 | forstmt.h:11:14:11:16 | end | <none> |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 3 | 1 | forstmt01.cpp:3:39:9:1 | forstmt01.cpp:3:39:9:1 | forstmt01.cpp:3:39:9:1 | { ... } | 4: for(...:...) ... |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 4 | 2 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | for(...:...) ... | 4: declaration |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 4 | 3 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | declaration | 5: zs |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 4 | 6 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | declaration | 5: (__range) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 4 | 22 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | forstmt01.cpp:4:5:8:9 | declaration | 5: (__begin) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 1 | forstmt01.cpp:5:18:5:19 | forstmt01.cpp:5:18:5:19 | forstmt01.cpp:5:18:5:19 | (reference to) | <none> |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 1 | forstmt01.cpp:5:18:6:9 | forstmt01.cpp:5:18:6:9 | forstmt01.cpp:5:18:6:9 | (reference dereference) | <none> |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 1 | forstmt01.cpp:5:18:6:9 | forstmt01.cpp:5:18:6:9 | forstmt01.cpp:5:18:6:9 | (reference dereference) | <none> |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 4 | forstmt01.cpp:5:18:5:19 | forstmt01.cpp:5:18:5:19 | forstmt01.cpp:5:18:5:19 | zs | 0: initializer for (__range) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 7 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__range) | 5: call to begin |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 8 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to begin | 0: initializer for (__begin) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 10 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__range) | 5: call to end |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 11 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to end | 0: initializer for (__end) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:14:5:14 | forstmt01.cpp:5:14:5:14 | forstmt01.cpp:5:14:5:14 | initializer for z | 7: { ... } |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__begin) | 5: call to operator!= |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__begin) | 5: call to operator* |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__begin) | 5: call to operator++ |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | (__end) | 5: (__begin) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to operator!= | <false> 9: return ... |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to operator!= | <true> 4: declaration |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to operator* | 5: initializer for z |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 5 | 22 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | forstmt01.cpp:5:18:5:18 | call to operator++ | 5: (__end) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 7 | 22 | forstmt01.cpp:7:9:8:9 | forstmt01.cpp:7:9:8:9 | forstmt01.cpp:7:9:8:9 | { ... } | 5: (__begin) |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 9 | 23 | forstmt01.cpp:9:1:9:1 | forstmt01.cpp:9:1:9:1 | forstmt01.cpp:9:1:9:1 | return ... | 9: for_loop1 |
+| forstmt01 | forstmt01.cpp:3:6:3:14 | for_loop1 | 9 | 24 | forstmt01.cpp:3:6:3:14 | forstmt01.cpp:3:6:3:14 | forstmt01.cpp:3:6:3:14 | for_loop1 | <none> |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 3 | 1 | forstmt02.cpp:3:39:10:1 | forstmt02.cpp:3:39:10:1 | forstmt02.cpp:3:39:10:1 | { ... } | 4: for(...:...) ... |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 4 | 2 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | for(...:...) ... | 5: declaration |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 4 | 6 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | declaration | 6: zs |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 4 | 9 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | declaration | 6: (__range) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 4 | 25 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | forstmt02.cpp:4:5:9:9 | declaration | 6: (__begin) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 5 | 3 | forstmt02.cpp:5:9:5:18 | forstmt02.cpp:5:9:5:18 | forstmt02.cpp:5:9:5:18 | declaration | 5: initializer for y |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 5 | 4 | forstmt02.cpp:5:16:5:17 | forstmt02.cpp:5:16:5:17 | forstmt02.cpp:5:16:5:17 | initializer for y | 5: x |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 5 | 5 | forstmt02.cpp:5:17:5:17 | forstmt02.cpp:5:17:5:17 | forstmt02.cpp:5:17:5:17 | x | 4: declaration |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 1 | forstmt02.cpp:6:18:6:19 | forstmt02.cpp:6:18:6:19 | forstmt02.cpp:6:18:6:19 | (reference to) | <none> |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 1 | forstmt02.cpp:6:18:7:9 | forstmt02.cpp:6:18:7:9 | forstmt02.cpp:6:18:7:9 | (reference dereference) | <none> |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 1 | forstmt02.cpp:6:18:7:9 | forstmt02.cpp:6:18:7:9 | forstmt02.cpp:6:18:7:9 | (reference dereference) | <none> |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 7 | forstmt02.cpp:6:18:6:19 | forstmt02.cpp:6:18:6:19 | forstmt02.cpp:6:18:6:19 | zs | 0: initializer for (__range) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 10 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__range) | 6: call to begin |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 11 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to begin | 0: initializer for (__begin) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 13 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__range) | 6: call to end |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 14 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to end | 0: initializer for (__end) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:14:6:14 | forstmt02.cpp:6:14:6:14 | forstmt02.cpp:6:14:6:14 | initializer for z | 8: { ... } |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__begin) | 6: call to operator!= |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__begin) | 6: call to operator* |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__begin) | 6: call to operator++ |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | (__end) | 6: (__begin) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to operator!= | <false> 10: return ... |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to operator!= | <true> 4: declaration |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to operator* | 6: initializer for z |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 6 | 25 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | forstmt02.cpp:6:18:6:18 | call to operator++ | 6: (__end) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 8 | 25 | forstmt02.cpp:8:9:9:9 | forstmt02.cpp:8:9:9:9 | forstmt02.cpp:8:9:9:9 | { ... } | 6: (__begin) |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 10 | 26 | forstmt02.cpp:10:1:10:1 | forstmt02.cpp:10:1:10:1 | forstmt02.cpp:10:1:10:1 | return ... | 10: for_loop2 |
+| forstmt02 | forstmt02.cpp:3:6:3:14 | for_loop2 | 10 | 27 | forstmt02.cpp:3:6:3:14 | forstmt02.cpp:3:6:3:14 | forstmt02.cpp:3:6:3:14 | for_loop2 | <none> |

cpp/ql/test/successor-tests/forstmt/rangebasedforstmt/cfg.ql

@@ -0,0 +1,28 @@
+import cpp
+
+int getCFLine(ControlFlowNode n) {
+  if n instanceof Function
+  then
+    // Functions appear at the end of the control flow, so we get
+    // nicer results if we take the last position in the function,
+    // rather than the function's position (which is the start).
+    result = max(ControlFlowNode c | c.getControlFlowScope() = n | c.getLocation().getStartLine())
+  else result = n.getLocation().getStartLine()
+}
+
+string getASuccessorOrNone(ControlFlowNode n) {
+  if exists(n.getASuccessor())
+  then
+    exists(ControlFlowNode s, string trueSucc, string falseSucc |
+      s = n.getASuccessor() and
+      (if s = n.getATrueSuccessor() then trueSucc = "<true> " else trueSucc = "") and
+      (if s = n.getAFalseSuccessor() then falseSucc = "<false> " else falseSucc = "") and
+      result = trueSucc + falseSucc + getCFLine(s) + ": " + s.toString()
+    )
+  else result = "<none>"
+}
+
+from ControlFlowNode n
+select n.getLocation().getFile().getShortName(), n.getControlFlowScope(), getCFLine(n),
+  count(n.getAPredecessor*()), // This helps order things sensibly
+  n.getLocation(), n, getASuccessorOrNone(n)

cpp/ql/test/successor-tests/forstmt/rangebasedforstmt/forstmt.h

@@ -0,0 +1,12 @@
+template<typename T>
+struct vector {
+    struct iterator {
+        iterator& operator++();
+        T& operator*() const;
+
+        bool operator!=(iterator right) const;
+    };
+
+    iterator begin() const;
+    iterator end() const;
+};

cpp/ql/test/successor-tests/forstmt/rangebasedforstmt/forstmt01.cpp

@@ -0,0 +1,9 @@
+#include "forstmt.h"
+
+void for_loop1(int x, vector<int> zs) {
+    for (
+        auto z : zs
+        )
+        {
+        }
+}

cpp/ql/test/successor-tests/forstmt/rangebasedforstmt/forstmt02.cpp

@@ -0,0 +1,12 @@
+#include "forstmt.h"
+
+void for_loop2(int x, vector<int> zs) {
+    for (
+        int y = x;
+        auto z : zs
+        )
+        {
+        }
+}
+
+// semmle-extractor-options: -std=c++20

cpp/ql/test/successor-tests/staticlocals/no_dynamic_init/exprs.expected

@@ -2,5 +2,3 @@
 | no_dynamic_init.cpp:5:12:5:35 | no_dynamic_init.cpp:5:12:5:35 | no_dynamic_init.cpp:5:12:5:35 | Goodbye cruel world.\n |
 | no_dynamic_init.cpp:5:12:5:35 | no_dynamic_init.cpp:5:12:5:35 | no_dynamic_init.cpp:5:12:5:35 | array to pointer conversion |
 | no_dynamic_init.cpp:11:10:11:10 | no_dynamic_init.cpp:11:10:11:10 | no_dynamic_init.cpp:11:10:11:10 | 0 |
-| no_dynamic_init.cpp:12:1:12:1 | no_dynamic_init.cpp:12:1:12:1 | no_dynamic_init.cpp:12:1:12:1 | call to ~Magic |
-| no_dynamic_init.cpp:12:1:12:1 | no_dynamic_init.cpp:12:1:12:1 | no_dynamic_init.cpp:12:1:12:1 | m |