From 06b391ef9ba35fdcee626e40a42d229884243f52 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Fri, 20 Sep 2019 11:14:16 +0100
Subject: [PATCH 001/232] docs: fix links

---
 docs/language/learn-ql/java/introduce-libraries-java.rst     | 2 +-
 docs/language/learn-ql/javascript/introduce-libraries-ts.rst | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/language/learn-ql/java/introduce-libraries-java.rst b/docs/language/learn-ql/java/introduce-libraries-java.rst
index 4757085cfe1..32863b099e0 100644
--- a/docs/language/learn-ql/java/introduce-libraries-java.rst
+++ b/docs/language/learn-ql/java/introduce-libraries-java.rst
@@ -369,7 +369,7 @@ Conversely, ``Callable.getAReference`` returns a ``Call`` that refers to it. So
    where not exists(c.getAReference())
    select c
 
-➤ `See this in the query console <https://lgtm.com/query/666680036/>`__. The LGTM.com demo projects all appear to have many methods that are not called directly, but this is unlikely to be the whole story. To explore this area further, see `Navigating the call graph <call-graph>`__.
+➤ `See this in the query console <https://lgtm.com/query/666680036/>`__. The LGTM.com demo projects all appear to have many methods that are not called directly, but this is unlikely to be the whole story. To explore this area further, see :doc:`Navigating the call graph <call-graph>`.
 
 For more information about callables and calls, see the :doc:`call graph tutorial <call-graph>`.
 
diff --git a/docs/language/learn-ql/javascript/introduce-libraries-ts.rst b/docs/language/learn-ql/javascript/introduce-libraries-ts.rst
index a31bf9ffad6..539d81fb016 100644
--- a/docs/language/learn-ql/javascript/introduce-libraries-ts.rst
+++ b/docs/language/learn-ql/javascript/introduce-libraries-ts.rst
@@ -134,7 +134,7 @@ The QL class `ClassOrInterface <https://help.semmle.com/qldoc/javascript/semmle/
 
 Note that the superclass of a class is an expression, not a type annotation. If the superclass has type arguments, it will be an expression of kind `ExpressionWithTypeArguments <https://help.semmle.com/qldoc/javascript/semmle/javascript/TypeScript.qll/type.TypeScript$ExpressionWithTypeArguments.html>`__.
 
-Also see the documentation for classes in the `Introduction to the QL libraries for JavaScript <introduce-libraries-js#classes>`__.
+Also see the documentation for classes in the `Introduction to the QL libraries for JavaScript <introduce-libraries-js.html#classes>`__.
 
 To select the type references to a class or an interface, use ``getTypeName()``.
 
@@ -443,6 +443,6 @@ A `LocalNamespaceName <https://help.semmle.com/qldoc/javascript/semmle/javascrip
 What next?
 ----------
 
--  Learn about the QL standard libraries used to write queries for JavaScript in :doc:`Introducing the Javacript libraries <introduce-libraries-js>`.
+-  Learn about the QL standard libraries used to write queries for JavaScript in :doc:`Introducing the JavaScript libraries <introduce-libraries-js>`.
 -  Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
 -  Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
\ No newline at end of file

From cd5f3b84a8a9b62100ef4f697fa9740b911083ab Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jonas@semmle.com>
Date: Mon, 23 Sep 2019 14:51:59 +0200
Subject: [PATCH 002/232] C++: Make sure there's a Instruction for each Expr

This change ensures that all `Expr`s (except parentheses) have a
`TranslatedExpr` with a `getResult` that's one of its own instructions,
not an instruction from one of its operands. This means that when we
translate back and forth between `Expr` and `Instruction`, like in
`DataFlow::exprNode`, we will not conflate `e` with `&e` or `... = e`.
---
 .../raw/internal/InstructionTag.qll           |    1 +
 .../raw/internal/TranslatedElement.qll        |   10 +
 .../raw/internal/TranslatedExpr.qll           |   94 +-
 .../ir/escape/points_to.expected              |   58 +
 .../test/library-tests/ir/ir/raw_ir.expected  | 3207 +++++++++--------
 .../ir/ssa/aliased_ssa_ir.expected            |  141 +-
 .../ir/ssa/unaliased_ssa_ir.expected          |  131 +-
 7 files changed, 2072 insertions(+), 1570 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
index ddac5692cdf..c18ff827992 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
@@ -44,6 +44,7 @@ newtype TInstructionTag =
   ConditionValueResultLoadTag() or
   BoolConversionConstantTag() or
   BoolConversionCompareTag() or
+  ResultCopyTag() or
   LoadTag() or // Implicit load due to lvalue-to-rvalue conversion
   CatchTag() or
   ThrowTag() or
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
index 23d3036ca15..b9a6d4c737d 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -8,6 +8,7 @@ private import InstructionTag
 private import TranslatedCondition
 private import TranslatedFunction
 private import TranslatedStmt
+private import TranslatedExpr
 private import IRConstruction
 
 /**
@@ -235,6 +236,15 @@ newtype TTranslatedElement =
     expr.hasLValueToRValueConversion() and
     not ignoreLoad(expr)
   } or
+  TTranslatedResultCopy(Expr expr) {
+    not ignoreExpr(expr) and
+    exprNeedsCopyIfNotLoaded(expr) and
+    // Doesn't have a TTranslatedLoad
+    not (
+      expr.hasLValueToRValueConversion() and
+      not ignoreLoad(expr)
+    )
+  } or
   // An expression most naturally translated as control flow.
   TTranslatedNativeCondition(Expr expr) {
     not ignoreExpr(expr) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index fa8eeb36adb..e9e7cf59cb0 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -85,11 +85,14 @@ abstract class TranslatedCoreExpr extends TranslatedExpr {
   final override predicate producesExprResult() {
     // If there's no load, then this is the only TranslatedExpr for this
     // expression.
-    not expr.hasLValueToRValueConversion()
-    or
-    // If we're supposed to ignore the load on this expression, then this
-    // is the only TranslatedExpr.
-    ignoreLoad(expr)
+    not hasLoad() and
+    // If there's a result copy, then this expression's result is the copy.
+    not exprNeedsCopyIfNotLoaded(expr)
+  }
+
+  private predicate hasLoad() {
+    expr.hasLValueToRValueConversion() and
+    not ignoreLoad(expr)
   }
 
   /**
@@ -106,7 +109,7 @@ abstract class TranslatedCoreExpr extends TranslatedExpr {
       or
       // If this TranslatedExpr doesn't produce the result, then it must represent
       // a glvalue that is then loaded by a TranslatedLoad.
-      not producesExprResult()
+      hasLoad()
     then result = true
     else result = false
   }
@@ -302,6 +305,51 @@ class TranslatedLoad extends TranslatedExpr, TTranslatedLoad {
   private TranslatedCoreExpr getOperand() { result.getExpr() = expr }
 }
 
+/**
+ * IR translation of an implicit lvalue-to-rvalue conversion on the result of
+ * an expression.
+ */
+class TranslatedResultCopy extends TranslatedExpr, TTranslatedResultCopy {
+  TranslatedResultCopy() { this = TTranslatedResultCopy(expr) }
+
+  override string toString() { result = "Result of " + expr.toString() }
+
+  override Instruction getFirstInstruction() { result = getOperand().getFirstInstruction() }
+
+  override TranslatedElement getChild(int id) { id = 0 and result = getOperand() }
+
+  override predicate hasInstruction(
+    Opcode opcode, InstructionTag tag, Type resultType, boolean isGLValue
+  ) {
+    tag = ResultCopyTag() and
+    opcode instanceof Opcode::CopyValue and
+    resultType = getOperand().getResultType() and
+    isGLValue = getOperand().isResultGLValue()
+  }
+
+  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
+    tag = ResultCopyTag() and
+    result = getParent().getChildSuccessor(this) and
+    kind instanceof GotoEdge
+  }
+
+  override Instruction getChildSuccessor(TranslatedElement child) {
+    child = getOperand() and result = getInstruction(ResultCopyTag())
+  }
+
+  override Instruction getResult() { result = getInstruction(ResultCopyTag()) }
+
+  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+    tag = ResultCopyTag() and
+    operandTag instanceof UnaryOperandTag and
+    result = getOperand().getResult()
+  }
+
+  final override predicate producesExprResult() { any() }
+
+  private TranslatedCoreExpr getOperand() { result.getExpr() = expr }
+}
+
 class TranslatedCommaExpr extends TranslatedNonConstantExpr {
   override CommaExpr expr;
 
@@ -2485,3 +2533,37 @@ class TranslatedErrorExpr extends TranslatedSingleInstructionExpr {
 
   final override Opcode getOpcode() { result instanceof Opcode::Error }
 }
+
+/**
+ * Holds if the translation of `expr` will not directly generate any
+ * `Instruction` for use as result. For such instructions we can synthesize a
+ * `CopyValue` instruction to ensure that there is a 1-to-1 mapping between
+ * expressions and result-bearing instructions.
+ */
+// This should ideally be a dispatch predicate on TranslatedNonConstantExpr,
+// but it doesn't look monotonic to QL.
+predicate exprNeedsCopyIfNotLoaded(Expr expr) {
+  expr instanceof AssignExpr
+  or
+  expr instanceof AssignOperation and
+  not expr.isPRValueCategory() // is C++
+  or
+  expr instanceof PrefixCrementOperation and
+  not expr.isPRValueCategory() // is C++
+  or
+  expr instanceof PointerDereferenceExpr
+  or
+  expr instanceof AddressOfExpr
+  or
+  expr instanceof BuiltInOperationBuiltInAddressOf
+  // No case for ParenthesisExpr to avoid getting too many instructions
+  or
+  expr instanceof ReferenceDereferenceExpr
+  or
+  expr instanceof ReferenceToExpr
+  or
+  expr instanceof CommaExpr
+  or
+  expr instanceof ConditionDeclExpr
+  // TODO: simplify TranslatedStmtExpr too
+}
diff --git a/cpp/ql/test/library-tests/ir/escape/points_to.expected b/cpp/ql/test/library-tests/ir/escape/points_to.expected
index f40460f4d91..e6fefda7bb5 100644
--- a/cpp/ql/test/library-tests/ir/escape/points_to.expected
+++ b/cpp/ql/test/library-tests/ir/escape/points_to.expected
@@ -1,47 +1,105 @@
+| escape.cpp:108:5:108:11 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:109:5:109:13 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:110:5:110:19 | CopyValue | no_result+0:0 | no_result+0:0 |
+| escape.cpp:111:5:111:21 | CopyValue | no_result+0:0 | no_result+0:0 |
+| escape.cpp:111:18:111:21 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:114:5:114:8 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:115:5:115:29 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:115:19:115:28 | PointerAdd[4] | no_+0:0 | no_+0:0 |
+| escape.cpp:115:20:115:23 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:116:5:116:29 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:116:19:116:28 | PointerSub[4] | no_+0:0 | no_+0:0 |
+| escape.cpp:116:20:116:23 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:117:5:117:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:117:19:117:26 | PointerAdd[4] | no_+0:0 | no_+0:0 |
+| escape.cpp:117:23:117:26 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:118:9:118:12 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:120:12:120:15 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:123:14:123:17 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:124:9:124:12 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:124:15:124:18 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:124:21:124:24 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:127:9:127:12 | CopyValue | no_+0:0 | no_+0:0 |
+| escape.cpp:129:12:129:15 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:134:5:134:18 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:134:11:134:18 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:135:5:135:12 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:135:5:135:15 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:136:5:136:15 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:136:7:136:14 | Convert | no_Array+0:0 | no_Array+0:0 |
+| escape.cpp:137:5:137:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:137:17:137:24 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:137:17:137:27 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
+| escape.cpp:138:5:138:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:138:17:138:27 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:138:19:138:26 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[x] | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:141:27:141:27 | FieldAddress[x] | no_Point+0:0 | no_Point+0:0 |
+| escape.cpp:142:5:142:21 | CopyValue | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:142:14:142:14 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
+| escape.cpp:143:19:143:27 | CopyValue | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:143:31:143:31 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
+| escape.cpp:144:5:144:25 | CopyValue | no_Point+4:0 | no_Point+4:0 |
+| escape.cpp:144:6:144:14 | CopyValue | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:144:18:144:18 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
+| escape.cpp:145:20:145:30 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:145:30:145:30 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
+| escape.cpp:146:5:146:18 | CopyValue | no_Point+8:0 | no_Point+8:0 |
+| escape.cpp:146:5:146:25 | CopyValue | no_Point+8:0 | no_Point+8:0 |
+| escape.cpp:146:7:146:17 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:17:146:17 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:149:5:149:14 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:149:5:149:14 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
+| escape.cpp:149:5:149:20 | CopyValue | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:149:16:149:16 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:18:150:27 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:18:150:27 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:29:150:29 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:151:5:151:14 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
+| escape.cpp:151:5:151:21 | CopyValue | no_Derived+16:0 | no_Derived+16:0 |
 | escape.cpp:151:16:151:17 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
 | escape.cpp:152:19:152:28 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
 | escape.cpp:152:30:152:31 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
+| escape.cpp:155:17:155:30 | CopyValue | no_ssa_addrOf+0:0 | no_ssa_addrOf+0:0 |
 | escape.cpp:155:17:155:30 | Store | no_ssa_addrOf+0:0 | no_ssa_addrOf+0:0 |
+| escape.cpp:158:17:158:28 | CopyValue | no_ssa_refTo+0:0 | no_ssa_refTo+0:0 |
 | escape.cpp:158:17:158:28 | Store | no_ssa_refTo+0:0 | no_ssa_refTo+0:0 |
 | escape.cpp:161:19:161:42 | Convert | no_ssa_refToArrayElement+0:0 | no_ssa_refToArrayElement+0:0 |
+| escape.cpp:161:19:161:45 | CopyValue | no_ssa_refToArrayElement+20:0 | no_ssa_refToArrayElement+20:0 |
 | escape.cpp:161:19:161:45 | PointerAdd[4] | no_ssa_refToArrayElement+20:0 | no_ssa_refToArrayElement+20:0 |
 | escape.cpp:161:19:161:45 | Store | no_ssa_refToArrayElement+20:0 | no_ssa_refToArrayElement+20:0 |
+| escape.cpp:164:24:164:40 | CopyValue | no_ssa_refToArray+0:0 | no_ssa_refToArray+0:0 |
 | escape.cpp:164:24:164:40 | Store | no_ssa_refToArray+0:0 | no_ssa_refToArray+0:0 |
+| escape.cpp:167:19:167:28 | CopyValue | passByPtr+0:0 | passByPtr+0:0 |
+| escape.cpp:170:21:170:29 | CopyValue | passByRef+0:0 | passByRef+0:0 |
+| escape.cpp:173:22:173:38 | CopyValue | no_ssa_passByPtr+0:0 | no_ssa_passByPtr+0:0 |
+| escape.cpp:176:24:176:39 | CopyValue | no_ssa_passByRef+0:0 | no_ssa_passByRef+0:0 |
+| escape.cpp:179:22:179:42 | CopyValue | no_ssa_passByPtr_ret+0:0 | no_ssa_passByPtr_ret+0:0 |
+| escape.cpp:182:24:182:43 | CopyValue | no_ssa_passByRef_ret+0:0 | no_ssa_passByRef_ret+0:0 |
+| escape.cpp:185:30:185:40 | CopyValue | passByPtr2+0:0 | passByPtr2+0:0 |
+| escape.cpp:188:32:188:41 | CopyValue | passByRef2+0:0 | passByRef2+0:0 |
 | escape.cpp:191:30:191:42 | Call | none | passByPtr3+0:0 |
+| escape.cpp:191:44:191:54 | CopyValue | passByPtr3+0:0 | passByPtr3+0:0 |
 | escape.cpp:194:32:194:46 | Call | none | passByRef3+0:0 |
+| escape.cpp:194:32:194:59 | CopyValue | none | passByRef3+0:0 |
+| escape.cpp:194:48:194:57 | CopyValue | passByRef3+0:0 | passByRef3+0:0 |
+| escape.cpp:199:17:199:34 | CopyValue | no_ssa_passByPtr4+0:0 | no_ssa_passByPtr4+0:0 |
+| escape.cpp:199:37:199:54 | CopyValue | no_ssa_passByPtr5+0:0 | no_ssa_passByPtr5+0:0 |
 | escape.cpp:202:5:202:19 | Call | none | passByRef6+0:0 |
+| escape.cpp:202:5:202:32 | CopyValue | none | passByRef6+0:0 |
+| escape.cpp:202:21:202:30 | CopyValue | passByRef6+0:0 | passByRef6+0:0 |
 | escape.cpp:205:5:205:19 | Call | none | no_ssa_passByRef7+0:0 |
+| escape.cpp:205:5:205:39 | CopyValue | none | no_ssa_passByRef7+0:0 |
+| escape.cpp:205:21:205:37 | CopyValue | no_ssa_passByRef7+0:0 | no_ssa_passByRef7+0:0 |
 | escape.cpp:209:14:209:25 | Call | none | no_ssa_c+0:0 |
+| escape.cpp:217:14:217:16 | CopyValue | c2+0:0 | c2+0:0 |
 | escape.cpp:221:8:221:19 | Call | none | c3+0:0 |
 | escape.cpp:225:17:225:28 | Call | none | c4+0:0 |
+| escape.cpp:247:2:247:27 | CopyValue | no_condTemp+0:0 | no_condTemp+0:0 |
 | escape.cpp:247:2:247:27 | Store | condEscape1+0:0 | condEscape1+0:0 |
+| escape.cpp:247:16:247:27 | CopyValue | condEscape1+0:0 | condEscape1+0:0 |
+| escape.cpp:249:9:249:34 | CopyValue | no_condTemp+0:0 | no_condTemp+0:0 |
 | escape.cpp:249:9:249:34 | Store | condEscape2+0:0 | condEscape2+0:0 |
+| escape.cpp:249:23:249:34 | CopyValue | condEscape2+0:0 | condEscape2+0:0 |
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 20f15e4f772..788e4a72663 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -40,13 +40,14 @@ bad_asts.cpp:
 #   27|     r0_5(glval<Point>)   = VariableAddress[b]     : 
 #   27|     r0_6(glval<Point &>) = VariableAddress[a]     : 
 #   27|     r0_7(Point &)        = Load                   : &:r0_6, ~mu0_2
-#   27|     r0_8(glval<Point>)   = Convert                : r0_7
-#   27|     r0_9(Point)          = Load                   : &:r0_8, ~mu0_2
-#   27|     mu0_10(Point)        = Store                  : &:r0_5, r0_9
-#   28|     v0_11(void)          = NoOp                   : 
-#   26|     v0_12(void)          = ReturnVoid             : 
-#   26|     v0_13(void)          = UnmodeledUse           : mu*
-#   26|     v0_14(void)          = ExitFunction           : 
+#   27|     r0_8(glval<Point>)   = CopyValue              : r0_7
+#   27|     r0_9(glval<Point>)   = Convert                : r0_8
+#   27|     r0_10(Point)         = Load                   : &:r0_9, ~mu0_2
+#   27|     mu0_11(Point)        = Store                  : &:r0_5, r0_10
+#   28|     v0_12(void)          = NoOp                   : 
+#   26|     v0_13(void)          = ReturnVoid             : 
+#   26|     v0_14(void)          = UnmodeledUse           : mu*
+#   26|     v0_15(void)          = ExitFunction           : 
 
 #   30| void Bad::errorExpr()
 #   30|   Block 0
@@ -63,10 +64,11 @@ bad_asts.cpp:
 #-----|     r0_10(error)       = Load                    : &:r0_9, ~mu0_2
 #   33|     r0_11(glval<int>)  = VariableAddress[x]      : 
 #   33|     mu0_12(int)        = Store                   : &:r0_11, r0_10
-#   34|     v0_13(void)        = NoOp                    : 
-#   30|     v0_14(void)        = ReturnVoid              : 
-#   30|     v0_15(void)        = UnmodeledUse            : mu*
-#   30|     v0_16(void)        = ExitFunction            : 
+#   33|     r0_13(glval<int>)  = CopyValue               : r0_11
+#   34|     v0_14(void)        = NoOp                    : 
+#   30|     v0_15(void)        = ReturnVoid              : 
+#   30|     v0_16(void)        = UnmodeledUse            : mu*
+#   30|     v0_17(void)        = ExitFunction            : 
 
 clang.cpp:
 #    5| int* globalIntAddress()
@@ -76,11 +78,12 @@ clang.cpp:
 #    5|     mu0_2(unknown)     = UnmodeledDefinition        : 
 #    6|     r0_3(glval<int *>) = VariableAddress[#return]   : 
 #    6|     r0_4(glval<int>)   = VariableAddress[globalInt] : 
-#    6|     mu0_5(int *)       = Store                      : &:r0_3, r0_4
-#    5|     r0_6(glval<int *>) = VariableAddress[#return]   : 
-#    5|     v0_7(void)         = ReturnValue                : &:r0_6, ~mu0_2
-#    5|     v0_8(void)         = UnmodeledUse               : mu*
-#    5|     v0_9(void)         = ExitFunction               : 
+#    6|     r0_5(int *)        = CopyValue                  : r0_4
+#    6|     mu0_6(int *)       = Store                      : &:r0_3, r0_5
+#    5|     r0_7(glval<int *>) = VariableAddress[#return]   : 
+#    5|     v0_8(void)         = ReturnValue                : &:r0_7, ~mu0_2
+#    5|     v0_9(void)         = UnmodeledUse               : mu*
+#    5|     v0_10(void)        = ExitFunction               : 
 
 ir.cpp:
 #    1| void Constants()
@@ -197,18 +200,20 @@ ir.cpp:
 #   46|     r0_15(short)        = Convert             : r0_14
 #   46|     r0_16(glval<short>) = VariableAddress[y]  : 
 #   46|     mu0_17(short)       = Store               : &:r0_16, r0_15
-#   47|     r0_18(glval<int>)   = VariableAddress[x]  : 
-#   47|     r0_19(int)          = Load                : &:r0_18, ~mu0_2
-#   47|     r0_20(glval<short>) = VariableAddress[y]  : 
-#   47|     r0_21(short)        = Load                : &:r0_20, ~mu0_2
-#   47|     r0_22(int)          = Convert             : r0_21
-#   47|     r0_23(int)          = Mul                 : r0_19, r0_22
-#   47|     r0_24(glval<int>)   = VariableAddress[x]  : 
-#   47|     mu0_25(int)         = Store               : &:r0_24, r0_23
-#   48|     v0_26(void)         = NoOp                : 
-#   43|     v0_27(void)         = ReturnVoid          : 
-#   43|     v0_28(void)         = UnmodeledUse        : mu*
-#   43|     v0_29(void)         = ExitFunction        : 
+#   46|     r0_18(glval<short>) = CopyValue           : r0_16
+#   47|     r0_19(glval<int>)   = VariableAddress[x]  : 
+#   47|     r0_20(int)          = Load                : &:r0_19, ~mu0_2
+#   47|     r0_21(glval<short>) = VariableAddress[y]  : 
+#   47|     r0_22(short)        = Load                : &:r0_21, ~mu0_2
+#   47|     r0_23(int)          = Convert             : r0_22
+#   47|     r0_24(int)          = Mul                 : r0_20, r0_23
+#   47|     r0_25(glval<int>)   = VariableAddress[x]  : 
+#   47|     mu0_26(int)         = Store               : &:r0_25, r0_24
+#   47|     r0_27(glval<int>)   = CopyValue           : r0_25
+#   48|     v0_28(void)         = NoOp                : 
+#   43|     v0_29(void)         = ReturnVoid          : 
+#   43|     v0_30(void)         = UnmodeledUse        : mu*
+#   43|     v0_31(void)         = ExitFunction        : 
 
 #   50| void IntegerOps(int, int)
 #   50|   Block 0
@@ -228,160 +233,185 @@ ir.cpp:
 #   53|     r0_13(int)         = Add                    : r0_10, r0_12
 #   53|     r0_14(glval<int>)  = VariableAddress[z]     : 
 #   53|     mu0_15(int)        = Store                  : &:r0_14, r0_13
-#   54|     r0_16(glval<int>)  = VariableAddress[x]     : 
-#   54|     r0_17(int)         = Load                   : &:r0_16, ~mu0_2
-#   54|     r0_18(glval<int>)  = VariableAddress[y]     : 
-#   54|     r0_19(int)         = Load                   : &:r0_18, ~mu0_2
-#   54|     r0_20(int)         = Sub                    : r0_17, r0_19
-#   54|     r0_21(glval<int>)  = VariableAddress[z]     : 
-#   54|     mu0_22(int)        = Store                  : &:r0_21, r0_20
-#   55|     r0_23(glval<int>)  = VariableAddress[x]     : 
-#   55|     r0_24(int)         = Load                   : &:r0_23, ~mu0_2
-#   55|     r0_25(glval<int>)  = VariableAddress[y]     : 
+#   53|     r0_16(glval<int>)  = CopyValue              : r0_14
+#   54|     r0_17(glval<int>)  = VariableAddress[x]     : 
+#   54|     r0_18(int)         = Load                   : &:r0_17, ~mu0_2
+#   54|     r0_19(glval<int>)  = VariableAddress[y]     : 
+#   54|     r0_20(int)         = Load                   : &:r0_19, ~mu0_2
+#   54|     r0_21(int)         = Sub                    : r0_18, r0_20
+#   54|     r0_22(glval<int>)  = VariableAddress[z]     : 
+#   54|     mu0_23(int)        = Store                  : &:r0_22, r0_21
+#   54|     r0_24(glval<int>)  = CopyValue              : r0_22
+#   55|     r0_25(glval<int>)  = VariableAddress[x]     : 
 #   55|     r0_26(int)         = Load                   : &:r0_25, ~mu0_2
-#   55|     r0_27(int)         = Mul                    : r0_24, r0_26
-#   55|     r0_28(glval<int>)  = VariableAddress[z]     : 
-#   55|     mu0_29(int)        = Store                  : &:r0_28, r0_27
-#   56|     r0_30(glval<int>)  = VariableAddress[x]     : 
-#   56|     r0_31(int)         = Load                   : &:r0_30, ~mu0_2
-#   56|     r0_32(glval<int>)  = VariableAddress[y]     : 
-#   56|     r0_33(int)         = Load                   : &:r0_32, ~mu0_2
-#   56|     r0_34(int)         = Div                    : r0_31, r0_33
-#   56|     r0_35(glval<int>)  = VariableAddress[z]     : 
-#   56|     mu0_36(int)        = Store                  : &:r0_35, r0_34
-#   57|     r0_37(glval<int>)  = VariableAddress[x]     : 
-#   57|     r0_38(int)         = Load                   : &:r0_37, ~mu0_2
-#   57|     r0_39(glval<int>)  = VariableAddress[y]     : 
-#   57|     r0_40(int)         = Load                   : &:r0_39, ~mu0_2
-#   57|     r0_41(int)         = Rem                    : r0_38, r0_40
-#   57|     r0_42(glval<int>)  = VariableAddress[z]     : 
-#   57|     mu0_43(int)        = Store                  : &:r0_42, r0_41
-#   59|     r0_44(glval<int>)  = VariableAddress[x]     : 
-#   59|     r0_45(int)         = Load                   : &:r0_44, ~mu0_2
-#   59|     r0_46(glval<int>)  = VariableAddress[y]     : 
-#   59|     r0_47(int)         = Load                   : &:r0_46, ~mu0_2
-#   59|     r0_48(int)         = BitAnd                 : r0_45, r0_47
-#   59|     r0_49(glval<int>)  = VariableAddress[z]     : 
-#   59|     mu0_50(int)        = Store                  : &:r0_49, r0_48
-#   60|     r0_51(glval<int>)  = VariableAddress[x]     : 
-#   60|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
-#   60|     r0_53(glval<int>)  = VariableAddress[y]     : 
-#   60|     r0_54(int)         = Load                   : &:r0_53, ~mu0_2
-#   60|     r0_55(int)         = BitOr                  : r0_52, r0_54
-#   60|     r0_56(glval<int>)  = VariableAddress[z]     : 
-#   60|     mu0_57(int)        = Store                  : &:r0_56, r0_55
-#   61|     r0_58(glval<int>)  = VariableAddress[x]     : 
-#   61|     r0_59(int)         = Load                   : &:r0_58, ~mu0_2
-#   61|     r0_60(glval<int>)  = VariableAddress[y]     : 
-#   61|     r0_61(int)         = Load                   : &:r0_60, ~mu0_2
-#   61|     r0_62(int)         = BitXor                 : r0_59, r0_61
-#   61|     r0_63(glval<int>)  = VariableAddress[z]     : 
-#   61|     mu0_64(int)        = Store                  : &:r0_63, r0_62
-#   63|     r0_65(glval<int>)  = VariableAddress[x]     : 
-#   63|     r0_66(int)         = Load                   : &:r0_65, ~mu0_2
-#   63|     r0_67(glval<int>)  = VariableAddress[y]     : 
-#   63|     r0_68(int)         = Load                   : &:r0_67, ~mu0_2
-#   63|     r0_69(int)         = ShiftLeft              : r0_66, r0_68
-#   63|     r0_70(glval<int>)  = VariableAddress[z]     : 
-#   63|     mu0_71(int)        = Store                  : &:r0_70, r0_69
-#   64|     r0_72(glval<int>)  = VariableAddress[x]     : 
-#   64|     r0_73(int)         = Load                   : &:r0_72, ~mu0_2
-#   64|     r0_74(glval<int>)  = VariableAddress[y]     : 
-#   64|     r0_75(int)         = Load                   : &:r0_74, ~mu0_2
-#   64|     r0_76(int)         = ShiftRight             : r0_73, r0_75
-#   64|     r0_77(glval<int>)  = VariableAddress[z]     : 
-#   64|     mu0_78(int)        = Store                  : &:r0_77, r0_76
-#   66|     r0_79(glval<int>)  = VariableAddress[x]     : 
-#   66|     r0_80(int)         = Load                   : &:r0_79, ~mu0_2
-#   66|     r0_81(glval<int>)  = VariableAddress[z]     : 
-#   66|     mu0_82(int)        = Store                  : &:r0_81, r0_80
-#   68|     r0_83(glval<int>)  = VariableAddress[x]     : 
-#   68|     r0_84(int)         = Load                   : &:r0_83, ~mu0_2
-#   68|     r0_85(glval<int>)  = VariableAddress[z]     : 
-#   68|     r0_86(int)         = Load                   : &:r0_85, ~mu0_2
-#   68|     r0_87(int)         = Add                    : r0_86, r0_84
-#   68|     mu0_88(int)        = Store                  : &:r0_85, r0_87
-#   69|     r0_89(glval<int>)  = VariableAddress[x]     : 
-#   69|     r0_90(int)         = Load                   : &:r0_89, ~mu0_2
-#   69|     r0_91(glval<int>)  = VariableAddress[z]     : 
-#   69|     r0_92(int)         = Load                   : &:r0_91, ~mu0_2
-#   69|     r0_93(int)         = Sub                    : r0_92, r0_90
-#   69|     mu0_94(int)        = Store                  : &:r0_91, r0_93
-#   70|     r0_95(glval<int>)  = VariableAddress[x]     : 
-#   70|     r0_96(int)         = Load                   : &:r0_95, ~mu0_2
-#   70|     r0_97(glval<int>)  = VariableAddress[z]     : 
-#   70|     r0_98(int)         = Load                   : &:r0_97, ~mu0_2
-#   70|     r0_99(int)         = Mul                    : r0_98, r0_96
-#   70|     mu0_100(int)       = Store                  : &:r0_97, r0_99
-#   71|     r0_101(glval<int>) = VariableAddress[x]     : 
-#   71|     r0_102(int)        = Load                   : &:r0_101, ~mu0_2
-#   71|     r0_103(glval<int>) = VariableAddress[z]     : 
-#   71|     r0_104(int)        = Load                   : &:r0_103, ~mu0_2
-#   71|     r0_105(int)        = Div                    : r0_104, r0_102
-#   71|     mu0_106(int)       = Store                  : &:r0_103, r0_105
-#   72|     r0_107(glval<int>) = VariableAddress[x]     : 
-#   72|     r0_108(int)        = Load                   : &:r0_107, ~mu0_2
-#   72|     r0_109(glval<int>) = VariableAddress[z]     : 
-#   72|     r0_110(int)        = Load                   : &:r0_109, ~mu0_2
-#   72|     r0_111(int)        = Rem                    : r0_110, r0_108
-#   72|     mu0_112(int)       = Store                  : &:r0_109, r0_111
-#   74|     r0_113(glval<int>) = VariableAddress[x]     : 
-#   74|     r0_114(int)        = Load                   : &:r0_113, ~mu0_2
-#   74|     r0_115(glval<int>) = VariableAddress[z]     : 
-#   74|     r0_116(int)        = Load                   : &:r0_115, ~mu0_2
-#   74|     r0_117(int)        = BitAnd                 : r0_116, r0_114
-#   74|     mu0_118(int)       = Store                  : &:r0_115, r0_117
-#   75|     r0_119(glval<int>) = VariableAddress[x]     : 
-#   75|     r0_120(int)        = Load                   : &:r0_119, ~mu0_2
-#   75|     r0_121(glval<int>) = VariableAddress[z]     : 
-#   75|     r0_122(int)        = Load                   : &:r0_121, ~mu0_2
-#   75|     r0_123(int)        = BitOr                  : r0_122, r0_120
-#   75|     mu0_124(int)       = Store                  : &:r0_121, r0_123
-#   76|     r0_125(glval<int>) = VariableAddress[x]     : 
-#   76|     r0_126(int)        = Load                   : &:r0_125, ~mu0_2
-#   76|     r0_127(glval<int>) = VariableAddress[z]     : 
-#   76|     r0_128(int)        = Load                   : &:r0_127, ~mu0_2
-#   76|     r0_129(int)        = BitXor                 : r0_128, r0_126
-#   76|     mu0_130(int)       = Store                  : &:r0_127, r0_129
-#   78|     r0_131(glval<int>) = VariableAddress[x]     : 
-#   78|     r0_132(int)        = Load                   : &:r0_131, ~mu0_2
-#   78|     r0_133(glval<int>) = VariableAddress[z]     : 
-#   78|     r0_134(int)        = Load                   : &:r0_133, ~mu0_2
-#   78|     r0_135(int)        = ShiftLeft              : r0_134, r0_132
-#   78|     mu0_136(int)       = Store                  : &:r0_133, r0_135
-#   79|     r0_137(glval<int>) = VariableAddress[x]     : 
-#   79|     r0_138(int)        = Load                   : &:r0_137, ~mu0_2
-#   79|     r0_139(glval<int>) = VariableAddress[z]     : 
-#   79|     r0_140(int)        = Load                   : &:r0_139, ~mu0_2
-#   79|     r0_141(int)        = ShiftRight             : r0_140, r0_138
-#   79|     mu0_142(int)       = Store                  : &:r0_139, r0_141
-#   81|     r0_143(glval<int>) = VariableAddress[x]     : 
-#   81|     r0_144(int)        = Load                   : &:r0_143, ~mu0_2
-#   81|     r0_145(int)        = CopyValue              : r0_144
-#   81|     r0_146(glval<int>) = VariableAddress[z]     : 
-#   81|     mu0_147(int)       = Store                  : &:r0_146, r0_145
-#   82|     r0_148(glval<int>) = VariableAddress[x]     : 
-#   82|     r0_149(int)        = Load                   : &:r0_148, ~mu0_2
-#   82|     r0_150(int)        = Negate                 : r0_149
-#   82|     r0_151(glval<int>) = VariableAddress[z]     : 
-#   82|     mu0_152(int)       = Store                  : &:r0_151, r0_150
-#   83|     r0_153(glval<int>) = VariableAddress[x]     : 
-#   83|     r0_154(int)        = Load                   : &:r0_153, ~mu0_2
-#   83|     r0_155(int)        = BitComplement          : r0_154
-#   83|     r0_156(glval<int>) = VariableAddress[z]     : 
-#   83|     mu0_157(int)       = Store                  : &:r0_156, r0_155
-#   84|     r0_158(glval<int>) = VariableAddress[x]     : 
-#   84|     r0_159(int)        = Load                   : &:r0_158, ~mu0_2
-#   84|     r0_160(int)        = Constant[0]            : 
-#   84|     r0_161(bool)       = CompareNE              : r0_159, r0_160
-#   84|     r0_162(bool)       = LogicalNot             : r0_161
-#   84|     r0_163(int)        = Convert                : r0_162
-#   84|     r0_164(glval<int>) = VariableAddress[z]     : 
-#   84|     mu0_165(int)       = Store                  : &:r0_164, r0_163
-#   85|     v0_166(void)       = NoOp                   : 
-#   50|     v0_167(void)       = ReturnVoid             : 
-#   50|     v0_168(void)       = UnmodeledUse           : mu*
-#   50|     v0_169(void)       = ExitFunction           : 
+#   55|     r0_27(glval<int>)  = VariableAddress[y]     : 
+#   55|     r0_28(int)         = Load                   : &:r0_27, ~mu0_2
+#   55|     r0_29(int)         = Mul                    : r0_26, r0_28
+#   55|     r0_30(glval<int>)  = VariableAddress[z]     : 
+#   55|     mu0_31(int)        = Store                  : &:r0_30, r0_29
+#   55|     r0_32(glval<int>)  = CopyValue              : r0_30
+#   56|     r0_33(glval<int>)  = VariableAddress[x]     : 
+#   56|     r0_34(int)         = Load                   : &:r0_33, ~mu0_2
+#   56|     r0_35(glval<int>)  = VariableAddress[y]     : 
+#   56|     r0_36(int)         = Load                   : &:r0_35, ~mu0_2
+#   56|     r0_37(int)         = Div                    : r0_34, r0_36
+#   56|     r0_38(glval<int>)  = VariableAddress[z]     : 
+#   56|     mu0_39(int)        = Store                  : &:r0_38, r0_37
+#   56|     r0_40(glval<int>)  = CopyValue              : r0_38
+#   57|     r0_41(glval<int>)  = VariableAddress[x]     : 
+#   57|     r0_42(int)         = Load                   : &:r0_41, ~mu0_2
+#   57|     r0_43(glval<int>)  = VariableAddress[y]     : 
+#   57|     r0_44(int)         = Load                   : &:r0_43, ~mu0_2
+#   57|     r0_45(int)         = Rem                    : r0_42, r0_44
+#   57|     r0_46(glval<int>)  = VariableAddress[z]     : 
+#   57|     mu0_47(int)        = Store                  : &:r0_46, r0_45
+#   57|     r0_48(glval<int>)  = CopyValue              : r0_46
+#   59|     r0_49(glval<int>)  = VariableAddress[x]     : 
+#   59|     r0_50(int)         = Load                   : &:r0_49, ~mu0_2
+#   59|     r0_51(glval<int>)  = VariableAddress[y]     : 
+#   59|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
+#   59|     r0_53(int)         = BitAnd                 : r0_50, r0_52
+#   59|     r0_54(glval<int>)  = VariableAddress[z]     : 
+#   59|     mu0_55(int)        = Store                  : &:r0_54, r0_53
+#   59|     r0_56(glval<int>)  = CopyValue              : r0_54
+#   60|     r0_57(glval<int>)  = VariableAddress[x]     : 
+#   60|     r0_58(int)         = Load                   : &:r0_57, ~mu0_2
+#   60|     r0_59(glval<int>)  = VariableAddress[y]     : 
+#   60|     r0_60(int)         = Load                   : &:r0_59, ~mu0_2
+#   60|     r0_61(int)         = BitOr                  : r0_58, r0_60
+#   60|     r0_62(glval<int>)  = VariableAddress[z]     : 
+#   60|     mu0_63(int)        = Store                  : &:r0_62, r0_61
+#   60|     r0_64(glval<int>)  = CopyValue              : r0_62
+#   61|     r0_65(glval<int>)  = VariableAddress[x]     : 
+#   61|     r0_66(int)         = Load                   : &:r0_65, ~mu0_2
+#   61|     r0_67(glval<int>)  = VariableAddress[y]     : 
+#   61|     r0_68(int)         = Load                   : &:r0_67, ~mu0_2
+#   61|     r0_69(int)         = BitXor                 : r0_66, r0_68
+#   61|     r0_70(glval<int>)  = VariableAddress[z]     : 
+#   61|     mu0_71(int)        = Store                  : &:r0_70, r0_69
+#   61|     r0_72(glval<int>)  = CopyValue              : r0_70
+#   63|     r0_73(glval<int>)  = VariableAddress[x]     : 
+#   63|     r0_74(int)         = Load                   : &:r0_73, ~mu0_2
+#   63|     r0_75(glval<int>)  = VariableAddress[y]     : 
+#   63|     r0_76(int)         = Load                   : &:r0_75, ~mu0_2
+#   63|     r0_77(int)         = ShiftLeft              : r0_74, r0_76
+#   63|     r0_78(glval<int>)  = VariableAddress[z]     : 
+#   63|     mu0_79(int)        = Store                  : &:r0_78, r0_77
+#   63|     r0_80(glval<int>)  = CopyValue              : r0_78
+#   64|     r0_81(glval<int>)  = VariableAddress[x]     : 
+#   64|     r0_82(int)         = Load                   : &:r0_81, ~mu0_2
+#   64|     r0_83(glval<int>)  = VariableAddress[y]     : 
+#   64|     r0_84(int)         = Load                   : &:r0_83, ~mu0_2
+#   64|     r0_85(int)         = ShiftRight             : r0_82, r0_84
+#   64|     r0_86(glval<int>)  = VariableAddress[z]     : 
+#   64|     mu0_87(int)        = Store                  : &:r0_86, r0_85
+#   64|     r0_88(glval<int>)  = CopyValue              : r0_86
+#   66|     r0_89(glval<int>)  = VariableAddress[x]     : 
+#   66|     r0_90(int)         = Load                   : &:r0_89, ~mu0_2
+#   66|     r0_91(glval<int>)  = VariableAddress[z]     : 
+#   66|     mu0_92(int)        = Store                  : &:r0_91, r0_90
+#   66|     r0_93(glval<int>)  = CopyValue              : r0_91
+#   68|     r0_94(glval<int>)  = VariableAddress[x]     : 
+#   68|     r0_95(int)         = Load                   : &:r0_94, ~mu0_2
+#   68|     r0_96(glval<int>)  = VariableAddress[z]     : 
+#   68|     r0_97(int)         = Load                   : &:r0_96, ~mu0_2
+#   68|     r0_98(int)         = Add                    : r0_97, r0_95
+#   68|     mu0_99(int)        = Store                  : &:r0_96, r0_98
+#   68|     r0_100(glval<int>) = CopyValue              : r0_96
+#   69|     r0_101(glval<int>) = VariableAddress[x]     : 
+#   69|     r0_102(int)        = Load                   : &:r0_101, ~mu0_2
+#   69|     r0_103(glval<int>) = VariableAddress[z]     : 
+#   69|     r0_104(int)        = Load                   : &:r0_103, ~mu0_2
+#   69|     r0_105(int)        = Sub                    : r0_104, r0_102
+#   69|     mu0_106(int)       = Store                  : &:r0_103, r0_105
+#   69|     r0_107(glval<int>) = CopyValue              : r0_103
+#   70|     r0_108(glval<int>) = VariableAddress[x]     : 
+#   70|     r0_109(int)        = Load                   : &:r0_108, ~mu0_2
+#   70|     r0_110(glval<int>) = VariableAddress[z]     : 
+#   70|     r0_111(int)        = Load                   : &:r0_110, ~mu0_2
+#   70|     r0_112(int)        = Mul                    : r0_111, r0_109
+#   70|     mu0_113(int)       = Store                  : &:r0_110, r0_112
+#   70|     r0_114(glval<int>) = CopyValue              : r0_110
+#   71|     r0_115(glval<int>) = VariableAddress[x]     : 
+#   71|     r0_116(int)        = Load                   : &:r0_115, ~mu0_2
+#   71|     r0_117(glval<int>) = VariableAddress[z]     : 
+#   71|     r0_118(int)        = Load                   : &:r0_117, ~mu0_2
+#   71|     r0_119(int)        = Div                    : r0_118, r0_116
+#   71|     mu0_120(int)       = Store                  : &:r0_117, r0_119
+#   71|     r0_121(glval<int>) = CopyValue              : r0_117
+#   72|     r0_122(glval<int>) = VariableAddress[x]     : 
+#   72|     r0_123(int)        = Load                   : &:r0_122, ~mu0_2
+#   72|     r0_124(glval<int>) = VariableAddress[z]     : 
+#   72|     r0_125(int)        = Load                   : &:r0_124, ~mu0_2
+#   72|     r0_126(int)        = Rem                    : r0_125, r0_123
+#   72|     mu0_127(int)       = Store                  : &:r0_124, r0_126
+#   72|     r0_128(glval<int>) = CopyValue              : r0_124
+#   74|     r0_129(glval<int>) = VariableAddress[x]     : 
+#   74|     r0_130(int)        = Load                   : &:r0_129, ~mu0_2
+#   74|     r0_131(glval<int>) = VariableAddress[z]     : 
+#   74|     r0_132(int)        = Load                   : &:r0_131, ~mu0_2
+#   74|     r0_133(int)        = BitAnd                 : r0_132, r0_130
+#   74|     mu0_134(int)       = Store                  : &:r0_131, r0_133
+#   74|     r0_135(glval<int>) = CopyValue              : r0_131
+#   75|     r0_136(glval<int>) = VariableAddress[x]     : 
+#   75|     r0_137(int)        = Load                   : &:r0_136, ~mu0_2
+#   75|     r0_138(glval<int>) = VariableAddress[z]     : 
+#   75|     r0_139(int)        = Load                   : &:r0_138, ~mu0_2
+#   75|     r0_140(int)        = BitOr                  : r0_139, r0_137
+#   75|     mu0_141(int)       = Store                  : &:r0_138, r0_140
+#   75|     r0_142(glval<int>) = CopyValue              : r0_138
+#   76|     r0_143(glval<int>) = VariableAddress[x]     : 
+#   76|     r0_144(int)        = Load                   : &:r0_143, ~mu0_2
+#   76|     r0_145(glval<int>) = VariableAddress[z]     : 
+#   76|     r0_146(int)        = Load                   : &:r0_145, ~mu0_2
+#   76|     r0_147(int)        = BitXor                 : r0_146, r0_144
+#   76|     mu0_148(int)       = Store                  : &:r0_145, r0_147
+#   76|     r0_149(glval<int>) = CopyValue              : r0_145
+#   78|     r0_150(glval<int>) = VariableAddress[x]     : 
+#   78|     r0_151(int)        = Load                   : &:r0_150, ~mu0_2
+#   78|     r0_152(glval<int>) = VariableAddress[z]     : 
+#   78|     r0_153(int)        = Load                   : &:r0_152, ~mu0_2
+#   78|     r0_154(int)        = ShiftLeft              : r0_153, r0_151
+#   78|     mu0_155(int)       = Store                  : &:r0_152, r0_154
+#   78|     r0_156(glval<int>) = CopyValue              : r0_152
+#   79|     r0_157(glval<int>) = VariableAddress[x]     : 
+#   79|     r0_158(int)        = Load                   : &:r0_157, ~mu0_2
+#   79|     r0_159(glval<int>) = VariableAddress[z]     : 
+#   79|     r0_160(int)        = Load                   : &:r0_159, ~mu0_2
+#   79|     r0_161(int)        = ShiftRight             : r0_160, r0_158
+#   79|     mu0_162(int)       = Store                  : &:r0_159, r0_161
+#   79|     r0_163(glval<int>) = CopyValue              : r0_159
+#   81|     r0_164(glval<int>) = VariableAddress[x]     : 
+#   81|     r0_165(int)        = Load                   : &:r0_164, ~mu0_2
+#   81|     r0_166(int)        = CopyValue              : r0_165
+#   81|     r0_167(glval<int>) = VariableAddress[z]     : 
+#   81|     mu0_168(int)       = Store                  : &:r0_167, r0_166
+#   81|     r0_169(glval<int>) = CopyValue              : r0_167
+#   82|     r0_170(glval<int>) = VariableAddress[x]     : 
+#   82|     r0_171(int)        = Load                   : &:r0_170, ~mu0_2
+#   82|     r0_172(int)        = Negate                 : r0_171
+#   82|     r0_173(glval<int>) = VariableAddress[z]     : 
+#   82|     mu0_174(int)       = Store                  : &:r0_173, r0_172
+#   82|     r0_175(glval<int>) = CopyValue              : r0_173
+#   83|     r0_176(glval<int>) = VariableAddress[x]     : 
+#   83|     r0_177(int)        = Load                   : &:r0_176, ~mu0_2
+#   83|     r0_178(int)        = BitComplement          : r0_177
+#   83|     r0_179(glval<int>) = VariableAddress[z]     : 
+#   83|     mu0_180(int)       = Store                  : &:r0_179, r0_178
+#   83|     r0_181(glval<int>) = CopyValue              : r0_179
+#   84|     r0_182(glval<int>) = VariableAddress[x]     : 
+#   84|     r0_183(int)        = Load                   : &:r0_182, ~mu0_2
+#   84|     r0_184(int)        = Constant[0]            : 
+#   84|     r0_185(bool)       = CompareNE              : r0_183, r0_184
+#   84|     r0_186(bool)       = LogicalNot             : r0_185
+#   84|     r0_187(int)        = Convert                : r0_186
+#   84|     r0_188(glval<int>) = VariableAddress[z]     : 
+#   84|     mu0_189(int)       = Store                  : &:r0_188, r0_187
+#   84|     r0_190(glval<int>) = CopyValue              : r0_188
+#   85|     v0_191(void)       = NoOp                   : 
+#   50|     v0_192(void)       = ReturnVoid             : 
+#   50|     v0_193(void)       = UnmodeledUse           : mu*
+#   50|     v0_194(void)       = ExitFunction           : 
 
 #   87| void IntegerCompare(int, int)
 #   87|   Block 0
@@ -401,45 +431,51 @@ ir.cpp:
 #   90|     r0_13(bool)        = CompareEQ              : r0_10, r0_12
 #   90|     r0_14(glval<bool>) = VariableAddress[b]     : 
 #   90|     mu0_15(bool)       = Store                  : &:r0_14, r0_13
-#   91|     r0_16(glval<int>)  = VariableAddress[x]     : 
-#   91|     r0_17(int)         = Load                   : &:r0_16, ~mu0_2
-#   91|     r0_18(glval<int>)  = VariableAddress[y]     : 
-#   91|     r0_19(int)         = Load                   : &:r0_18, ~mu0_2
-#   91|     r0_20(bool)        = CompareNE              : r0_17, r0_19
-#   91|     r0_21(glval<bool>) = VariableAddress[b]     : 
-#   91|     mu0_22(bool)       = Store                  : &:r0_21, r0_20
-#   92|     r0_23(glval<int>)  = VariableAddress[x]     : 
-#   92|     r0_24(int)         = Load                   : &:r0_23, ~mu0_2
-#   92|     r0_25(glval<int>)  = VariableAddress[y]     : 
+#   90|     r0_16(glval<bool>) = CopyValue              : r0_14
+#   91|     r0_17(glval<int>)  = VariableAddress[x]     : 
+#   91|     r0_18(int)         = Load                   : &:r0_17, ~mu0_2
+#   91|     r0_19(glval<int>)  = VariableAddress[y]     : 
+#   91|     r0_20(int)         = Load                   : &:r0_19, ~mu0_2
+#   91|     r0_21(bool)        = CompareNE              : r0_18, r0_20
+#   91|     r0_22(glval<bool>) = VariableAddress[b]     : 
+#   91|     mu0_23(bool)       = Store                  : &:r0_22, r0_21
+#   91|     r0_24(glval<bool>) = CopyValue              : r0_22
+#   92|     r0_25(glval<int>)  = VariableAddress[x]     : 
 #   92|     r0_26(int)         = Load                   : &:r0_25, ~mu0_2
-#   92|     r0_27(bool)        = CompareLT              : r0_24, r0_26
-#   92|     r0_28(glval<bool>) = VariableAddress[b]     : 
-#   92|     mu0_29(bool)       = Store                  : &:r0_28, r0_27
-#   93|     r0_30(glval<int>)  = VariableAddress[x]     : 
-#   93|     r0_31(int)         = Load                   : &:r0_30, ~mu0_2
-#   93|     r0_32(glval<int>)  = VariableAddress[y]     : 
-#   93|     r0_33(int)         = Load                   : &:r0_32, ~mu0_2
-#   93|     r0_34(bool)        = CompareGT              : r0_31, r0_33
-#   93|     r0_35(glval<bool>) = VariableAddress[b]     : 
-#   93|     mu0_36(bool)       = Store                  : &:r0_35, r0_34
-#   94|     r0_37(glval<int>)  = VariableAddress[x]     : 
-#   94|     r0_38(int)         = Load                   : &:r0_37, ~mu0_2
-#   94|     r0_39(glval<int>)  = VariableAddress[y]     : 
-#   94|     r0_40(int)         = Load                   : &:r0_39, ~mu0_2
-#   94|     r0_41(bool)        = CompareLE              : r0_38, r0_40
-#   94|     r0_42(glval<bool>) = VariableAddress[b]     : 
-#   94|     mu0_43(bool)       = Store                  : &:r0_42, r0_41
-#   95|     r0_44(glval<int>)  = VariableAddress[x]     : 
-#   95|     r0_45(int)         = Load                   : &:r0_44, ~mu0_2
-#   95|     r0_46(glval<int>)  = VariableAddress[y]     : 
-#   95|     r0_47(int)         = Load                   : &:r0_46, ~mu0_2
-#   95|     r0_48(bool)        = CompareGE              : r0_45, r0_47
-#   95|     r0_49(glval<bool>) = VariableAddress[b]     : 
-#   95|     mu0_50(bool)       = Store                  : &:r0_49, r0_48
-#   96|     v0_51(void)        = NoOp                   : 
-#   87|     v0_52(void)        = ReturnVoid             : 
-#   87|     v0_53(void)        = UnmodeledUse           : mu*
-#   87|     v0_54(void)        = ExitFunction           : 
+#   92|     r0_27(glval<int>)  = VariableAddress[y]     : 
+#   92|     r0_28(int)         = Load                   : &:r0_27, ~mu0_2
+#   92|     r0_29(bool)        = CompareLT              : r0_26, r0_28
+#   92|     r0_30(glval<bool>) = VariableAddress[b]     : 
+#   92|     mu0_31(bool)       = Store                  : &:r0_30, r0_29
+#   92|     r0_32(glval<bool>) = CopyValue              : r0_30
+#   93|     r0_33(glval<int>)  = VariableAddress[x]     : 
+#   93|     r0_34(int)         = Load                   : &:r0_33, ~mu0_2
+#   93|     r0_35(glval<int>)  = VariableAddress[y]     : 
+#   93|     r0_36(int)         = Load                   : &:r0_35, ~mu0_2
+#   93|     r0_37(bool)        = CompareGT              : r0_34, r0_36
+#   93|     r0_38(glval<bool>) = VariableAddress[b]     : 
+#   93|     mu0_39(bool)       = Store                  : &:r0_38, r0_37
+#   93|     r0_40(glval<bool>) = CopyValue              : r0_38
+#   94|     r0_41(glval<int>)  = VariableAddress[x]     : 
+#   94|     r0_42(int)         = Load                   : &:r0_41, ~mu0_2
+#   94|     r0_43(glval<int>)  = VariableAddress[y]     : 
+#   94|     r0_44(int)         = Load                   : &:r0_43, ~mu0_2
+#   94|     r0_45(bool)        = CompareLE              : r0_42, r0_44
+#   94|     r0_46(glval<bool>) = VariableAddress[b]     : 
+#   94|     mu0_47(bool)       = Store                  : &:r0_46, r0_45
+#   94|     r0_48(glval<bool>) = CopyValue              : r0_46
+#   95|     r0_49(glval<int>)  = VariableAddress[x]     : 
+#   95|     r0_50(int)         = Load                   : &:r0_49, ~mu0_2
+#   95|     r0_51(glval<int>)  = VariableAddress[y]     : 
+#   95|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
+#   95|     r0_53(bool)        = CompareGE              : r0_50, r0_52
+#   95|     r0_54(glval<bool>) = VariableAddress[b]     : 
+#   95|     mu0_55(bool)       = Store                  : &:r0_54, r0_53
+#   95|     r0_56(glval<bool>) = CopyValue              : r0_54
+#   96|     v0_57(void)        = NoOp                   : 
+#   87|     v0_58(void)        = ReturnVoid             : 
+#   87|     v0_59(void)        = UnmodeledUse           : mu*
+#   87|     v0_60(void)        = ExitFunction           : 
 
 #   98| void IntegerCrement(int)
 #   98|   Block 0
@@ -457,31 +493,35 @@ ir.cpp:
 #  101|     mu0_11(int)       = Store                  : &:r0_7, r0_10
 #  101|     r0_12(glval<int>) = VariableAddress[y]     : 
 #  101|     mu0_13(int)       = Store                  : &:r0_12, r0_10
-#  102|     r0_14(glval<int>) = VariableAddress[x]     : 
-#  102|     r0_15(int)        = Load                   : &:r0_14, ~mu0_2
-#  102|     r0_16(int)        = Constant[1]            : 
-#  102|     r0_17(int)        = Sub                    : r0_15, r0_16
-#  102|     mu0_18(int)       = Store                  : &:r0_14, r0_17
-#  102|     r0_19(glval<int>) = VariableAddress[y]     : 
-#  102|     mu0_20(int)       = Store                  : &:r0_19, r0_17
-#  103|     r0_21(glval<int>) = VariableAddress[x]     : 
-#  103|     r0_22(int)        = Load                   : &:r0_21, ~mu0_2
-#  103|     r0_23(int)        = Constant[1]            : 
-#  103|     r0_24(int)        = Add                    : r0_22, r0_23
-#  103|     mu0_25(int)       = Store                  : &:r0_21, r0_24
-#  103|     r0_26(glval<int>) = VariableAddress[y]     : 
-#  103|     mu0_27(int)       = Store                  : &:r0_26, r0_22
-#  104|     r0_28(glval<int>) = VariableAddress[x]     : 
-#  104|     r0_29(int)        = Load                   : &:r0_28, ~mu0_2
-#  104|     r0_30(int)        = Constant[1]            : 
-#  104|     r0_31(int)        = Sub                    : r0_29, r0_30
-#  104|     mu0_32(int)       = Store                  : &:r0_28, r0_31
-#  104|     r0_33(glval<int>) = VariableAddress[y]     : 
-#  104|     mu0_34(int)       = Store                  : &:r0_33, r0_29
-#  105|     v0_35(void)       = NoOp                   : 
-#   98|     v0_36(void)       = ReturnVoid             : 
-#   98|     v0_37(void)       = UnmodeledUse           : mu*
-#   98|     v0_38(void)       = ExitFunction           : 
+#  101|     r0_14(glval<int>) = CopyValue              : r0_12
+#  102|     r0_15(glval<int>) = VariableAddress[x]     : 
+#  102|     r0_16(int)        = Load                   : &:r0_15, ~mu0_2
+#  102|     r0_17(int)        = Constant[1]            : 
+#  102|     r0_18(int)        = Sub                    : r0_16, r0_17
+#  102|     mu0_19(int)       = Store                  : &:r0_15, r0_18
+#  102|     r0_20(glval<int>) = VariableAddress[y]     : 
+#  102|     mu0_21(int)       = Store                  : &:r0_20, r0_18
+#  102|     r0_22(glval<int>) = CopyValue              : r0_20
+#  103|     r0_23(glval<int>) = VariableAddress[x]     : 
+#  103|     r0_24(int)        = Load                   : &:r0_23, ~mu0_2
+#  103|     r0_25(int)        = Constant[1]            : 
+#  103|     r0_26(int)        = Add                    : r0_24, r0_25
+#  103|     mu0_27(int)       = Store                  : &:r0_23, r0_26
+#  103|     r0_28(glval<int>) = VariableAddress[y]     : 
+#  103|     mu0_29(int)       = Store                  : &:r0_28, r0_24
+#  103|     r0_30(glval<int>) = CopyValue              : r0_28
+#  104|     r0_31(glval<int>) = VariableAddress[x]     : 
+#  104|     r0_32(int)        = Load                   : &:r0_31, ~mu0_2
+#  104|     r0_33(int)        = Constant[1]            : 
+#  104|     r0_34(int)        = Sub                    : r0_32, r0_33
+#  104|     mu0_35(int)       = Store                  : &:r0_31, r0_34
+#  104|     r0_36(glval<int>) = VariableAddress[y]     : 
+#  104|     mu0_37(int)       = Store                  : &:r0_36, r0_32
+#  104|     r0_38(glval<int>) = CopyValue              : r0_36
+#  105|     v0_39(void)       = NoOp                   : 
+#   98|     v0_40(void)       = ReturnVoid             : 
+#   98|     v0_41(void)       = UnmodeledUse           : mu*
+#   98|     v0_42(void)       = ExitFunction           : 
 
 #  107| void IntegerCrement_LValue(int)
 #  107|   Block 0
@@ -497,19 +537,25 @@ ir.cpp:
 #  110|     r0_9(int)           = Constant[1]            : 
 #  110|     r0_10(int)          = Add                    : r0_8, r0_9
 #  110|     mu0_11(int)         = Store                  : &:r0_7, r0_10
-#  110|     r0_12(glval<int *>) = VariableAddress[p]     : 
-#  110|     mu0_13(int *)       = Store                  : &:r0_12, r0_7
-#  111|     r0_14(glval<int>)   = VariableAddress[x]     : 
-#  111|     r0_15(int)          = Load                   : &:r0_14, ~mu0_2
-#  111|     r0_16(int)          = Constant[1]            : 
-#  111|     r0_17(int)          = Sub                    : r0_15, r0_16
-#  111|     mu0_18(int)         = Store                  : &:r0_14, r0_17
-#  111|     r0_19(glval<int *>) = VariableAddress[p]     : 
-#  111|     mu0_20(int *)       = Store                  : &:r0_19, r0_14
-#  112|     v0_21(void)         = NoOp                   : 
-#  107|     v0_22(void)         = ReturnVoid             : 
-#  107|     v0_23(void)         = UnmodeledUse           : mu*
-#  107|     v0_24(void)         = ExitFunction           : 
+#  110|     r0_12(glval<int>)   = CopyValue              : r0_7
+#  110|     r0_13(int *)        = CopyValue              : r0_12
+#  110|     r0_14(glval<int *>) = VariableAddress[p]     : 
+#  110|     mu0_15(int *)       = Store                  : &:r0_14, r0_13
+#  110|     r0_16(glval<int *>) = CopyValue              : r0_14
+#  111|     r0_17(glval<int>)   = VariableAddress[x]     : 
+#  111|     r0_18(int)          = Load                   : &:r0_17, ~mu0_2
+#  111|     r0_19(int)          = Constant[1]            : 
+#  111|     r0_20(int)          = Sub                    : r0_18, r0_19
+#  111|     mu0_21(int)         = Store                  : &:r0_17, r0_20
+#  111|     r0_22(glval<int>)   = CopyValue              : r0_17
+#  111|     r0_23(int *)        = CopyValue              : r0_22
+#  111|     r0_24(glval<int *>) = VariableAddress[p]     : 
+#  111|     mu0_25(int *)       = Store                  : &:r0_24, r0_23
+#  111|     r0_26(glval<int *>) = CopyValue              : r0_24
+#  112|     v0_27(void)         = NoOp                   : 
+#  107|     v0_28(void)         = ReturnVoid             : 
+#  107|     v0_29(void)         = UnmodeledUse           : mu*
+#  107|     v0_30(void)         = ExitFunction           : 
 
 #  114| void FloatOps(double, double)
 #  114|   Block 0
@@ -529,69 +575,80 @@ ir.cpp:
 #  117|     r0_13(double)        = Add                    : r0_10, r0_12
 #  117|     r0_14(glval<double>) = VariableAddress[z]     : 
 #  117|     mu0_15(double)       = Store                  : &:r0_14, r0_13
-#  118|     r0_16(glval<double>) = VariableAddress[x]     : 
-#  118|     r0_17(double)        = Load                   : &:r0_16, ~mu0_2
-#  118|     r0_18(glval<double>) = VariableAddress[y]     : 
-#  118|     r0_19(double)        = Load                   : &:r0_18, ~mu0_2
-#  118|     r0_20(double)        = Sub                    : r0_17, r0_19
-#  118|     r0_21(glval<double>) = VariableAddress[z]     : 
-#  118|     mu0_22(double)       = Store                  : &:r0_21, r0_20
-#  119|     r0_23(glval<double>) = VariableAddress[x]     : 
-#  119|     r0_24(double)        = Load                   : &:r0_23, ~mu0_2
-#  119|     r0_25(glval<double>) = VariableAddress[y]     : 
+#  117|     r0_16(glval<double>) = CopyValue              : r0_14
+#  118|     r0_17(glval<double>) = VariableAddress[x]     : 
+#  118|     r0_18(double)        = Load                   : &:r0_17, ~mu0_2
+#  118|     r0_19(glval<double>) = VariableAddress[y]     : 
+#  118|     r0_20(double)        = Load                   : &:r0_19, ~mu0_2
+#  118|     r0_21(double)        = Sub                    : r0_18, r0_20
+#  118|     r0_22(glval<double>) = VariableAddress[z]     : 
+#  118|     mu0_23(double)       = Store                  : &:r0_22, r0_21
+#  118|     r0_24(glval<double>) = CopyValue              : r0_22
+#  119|     r0_25(glval<double>) = VariableAddress[x]     : 
 #  119|     r0_26(double)        = Load                   : &:r0_25, ~mu0_2
-#  119|     r0_27(double)        = Mul                    : r0_24, r0_26
-#  119|     r0_28(glval<double>) = VariableAddress[z]     : 
-#  119|     mu0_29(double)       = Store                  : &:r0_28, r0_27
-#  120|     r0_30(glval<double>) = VariableAddress[x]     : 
-#  120|     r0_31(double)        = Load                   : &:r0_30, ~mu0_2
-#  120|     r0_32(glval<double>) = VariableAddress[y]     : 
-#  120|     r0_33(double)        = Load                   : &:r0_32, ~mu0_2
-#  120|     r0_34(double)        = Div                    : r0_31, r0_33
-#  120|     r0_35(glval<double>) = VariableAddress[z]     : 
-#  120|     mu0_36(double)       = Store                  : &:r0_35, r0_34
-#  122|     r0_37(glval<double>) = VariableAddress[x]     : 
-#  122|     r0_38(double)        = Load                   : &:r0_37, ~mu0_2
-#  122|     r0_39(glval<double>) = VariableAddress[z]     : 
-#  122|     mu0_40(double)       = Store                  : &:r0_39, r0_38
-#  124|     r0_41(glval<double>) = VariableAddress[x]     : 
-#  124|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
-#  124|     r0_43(glval<double>) = VariableAddress[z]     : 
-#  124|     r0_44(double)        = Load                   : &:r0_43, ~mu0_2
-#  124|     r0_45(double)        = Add                    : r0_44, r0_42
-#  124|     mu0_46(double)       = Store                  : &:r0_43, r0_45
-#  125|     r0_47(glval<double>) = VariableAddress[x]     : 
-#  125|     r0_48(double)        = Load                   : &:r0_47, ~mu0_2
-#  125|     r0_49(glval<double>) = VariableAddress[z]     : 
-#  125|     r0_50(double)        = Load                   : &:r0_49, ~mu0_2
-#  125|     r0_51(double)        = Sub                    : r0_50, r0_48
-#  125|     mu0_52(double)       = Store                  : &:r0_49, r0_51
-#  126|     r0_53(glval<double>) = VariableAddress[x]     : 
-#  126|     r0_54(double)        = Load                   : &:r0_53, ~mu0_2
-#  126|     r0_55(glval<double>) = VariableAddress[z]     : 
-#  126|     r0_56(double)        = Load                   : &:r0_55, ~mu0_2
-#  126|     r0_57(double)        = Mul                    : r0_56, r0_54
-#  126|     mu0_58(double)       = Store                  : &:r0_55, r0_57
-#  127|     r0_59(glval<double>) = VariableAddress[x]     : 
-#  127|     r0_60(double)        = Load                   : &:r0_59, ~mu0_2
-#  127|     r0_61(glval<double>) = VariableAddress[z]     : 
-#  127|     r0_62(double)        = Load                   : &:r0_61, ~mu0_2
-#  127|     r0_63(double)        = Div                    : r0_62, r0_60
-#  127|     mu0_64(double)       = Store                  : &:r0_61, r0_63
-#  129|     r0_65(glval<double>) = VariableAddress[x]     : 
-#  129|     r0_66(double)        = Load                   : &:r0_65, ~mu0_2
-#  129|     r0_67(double)        = CopyValue              : r0_66
-#  129|     r0_68(glval<double>) = VariableAddress[z]     : 
-#  129|     mu0_69(double)       = Store                  : &:r0_68, r0_67
-#  130|     r0_70(glval<double>) = VariableAddress[x]     : 
-#  130|     r0_71(double)        = Load                   : &:r0_70, ~mu0_2
-#  130|     r0_72(double)        = Negate                 : r0_71
-#  130|     r0_73(glval<double>) = VariableAddress[z]     : 
-#  130|     mu0_74(double)       = Store                  : &:r0_73, r0_72
-#  131|     v0_75(void)          = NoOp                   : 
-#  114|     v0_76(void)          = ReturnVoid             : 
-#  114|     v0_77(void)          = UnmodeledUse           : mu*
-#  114|     v0_78(void)          = ExitFunction           : 
+#  119|     r0_27(glval<double>) = VariableAddress[y]     : 
+#  119|     r0_28(double)        = Load                   : &:r0_27, ~mu0_2
+#  119|     r0_29(double)        = Mul                    : r0_26, r0_28
+#  119|     r0_30(glval<double>) = VariableAddress[z]     : 
+#  119|     mu0_31(double)       = Store                  : &:r0_30, r0_29
+#  119|     r0_32(glval<double>) = CopyValue              : r0_30
+#  120|     r0_33(glval<double>) = VariableAddress[x]     : 
+#  120|     r0_34(double)        = Load                   : &:r0_33, ~mu0_2
+#  120|     r0_35(glval<double>) = VariableAddress[y]     : 
+#  120|     r0_36(double)        = Load                   : &:r0_35, ~mu0_2
+#  120|     r0_37(double)        = Div                    : r0_34, r0_36
+#  120|     r0_38(glval<double>) = VariableAddress[z]     : 
+#  120|     mu0_39(double)       = Store                  : &:r0_38, r0_37
+#  120|     r0_40(glval<double>) = CopyValue              : r0_38
+#  122|     r0_41(glval<double>) = VariableAddress[x]     : 
+#  122|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
+#  122|     r0_43(glval<double>) = VariableAddress[z]     : 
+#  122|     mu0_44(double)       = Store                  : &:r0_43, r0_42
+#  122|     r0_45(glval<double>) = CopyValue              : r0_43
+#  124|     r0_46(glval<double>) = VariableAddress[x]     : 
+#  124|     r0_47(double)        = Load                   : &:r0_46, ~mu0_2
+#  124|     r0_48(glval<double>) = VariableAddress[z]     : 
+#  124|     r0_49(double)        = Load                   : &:r0_48, ~mu0_2
+#  124|     r0_50(double)        = Add                    : r0_49, r0_47
+#  124|     mu0_51(double)       = Store                  : &:r0_48, r0_50
+#  124|     r0_52(glval<double>) = CopyValue              : r0_48
+#  125|     r0_53(glval<double>) = VariableAddress[x]     : 
+#  125|     r0_54(double)        = Load                   : &:r0_53, ~mu0_2
+#  125|     r0_55(glval<double>) = VariableAddress[z]     : 
+#  125|     r0_56(double)        = Load                   : &:r0_55, ~mu0_2
+#  125|     r0_57(double)        = Sub                    : r0_56, r0_54
+#  125|     mu0_58(double)       = Store                  : &:r0_55, r0_57
+#  125|     r0_59(glval<double>) = CopyValue              : r0_55
+#  126|     r0_60(glval<double>) = VariableAddress[x]     : 
+#  126|     r0_61(double)        = Load                   : &:r0_60, ~mu0_2
+#  126|     r0_62(glval<double>) = VariableAddress[z]     : 
+#  126|     r0_63(double)        = Load                   : &:r0_62, ~mu0_2
+#  126|     r0_64(double)        = Mul                    : r0_63, r0_61
+#  126|     mu0_65(double)       = Store                  : &:r0_62, r0_64
+#  126|     r0_66(glval<double>) = CopyValue              : r0_62
+#  127|     r0_67(glval<double>) = VariableAddress[x]     : 
+#  127|     r0_68(double)        = Load                   : &:r0_67, ~mu0_2
+#  127|     r0_69(glval<double>) = VariableAddress[z]     : 
+#  127|     r0_70(double)        = Load                   : &:r0_69, ~mu0_2
+#  127|     r0_71(double)        = Div                    : r0_70, r0_68
+#  127|     mu0_72(double)       = Store                  : &:r0_69, r0_71
+#  127|     r0_73(glval<double>) = CopyValue              : r0_69
+#  129|     r0_74(glval<double>) = VariableAddress[x]     : 
+#  129|     r0_75(double)        = Load                   : &:r0_74, ~mu0_2
+#  129|     r0_76(double)        = CopyValue              : r0_75
+#  129|     r0_77(glval<double>) = VariableAddress[z]     : 
+#  129|     mu0_78(double)       = Store                  : &:r0_77, r0_76
+#  129|     r0_79(glval<double>) = CopyValue              : r0_77
+#  130|     r0_80(glval<double>) = VariableAddress[x]     : 
+#  130|     r0_81(double)        = Load                   : &:r0_80, ~mu0_2
+#  130|     r0_82(double)        = Negate                 : r0_81
+#  130|     r0_83(glval<double>) = VariableAddress[z]     : 
+#  130|     mu0_84(double)       = Store                  : &:r0_83, r0_82
+#  130|     r0_85(glval<double>) = CopyValue              : r0_83
+#  131|     v0_86(void)          = NoOp                   : 
+#  114|     v0_87(void)          = ReturnVoid             : 
+#  114|     v0_88(void)          = UnmodeledUse           : mu*
+#  114|     v0_89(void)          = ExitFunction           : 
 
 #  133| void FloatCompare(double, double)
 #  133|   Block 0
@@ -611,45 +668,51 @@ ir.cpp:
 #  136|     r0_13(bool)          = CompareEQ              : r0_10, r0_12
 #  136|     r0_14(glval<bool>)   = VariableAddress[b]     : 
 #  136|     mu0_15(bool)         = Store                  : &:r0_14, r0_13
-#  137|     r0_16(glval<double>) = VariableAddress[x]     : 
-#  137|     r0_17(double)        = Load                   : &:r0_16, ~mu0_2
-#  137|     r0_18(glval<double>) = VariableAddress[y]     : 
-#  137|     r0_19(double)        = Load                   : &:r0_18, ~mu0_2
-#  137|     r0_20(bool)          = CompareNE              : r0_17, r0_19
-#  137|     r0_21(glval<bool>)   = VariableAddress[b]     : 
-#  137|     mu0_22(bool)         = Store                  : &:r0_21, r0_20
-#  138|     r0_23(glval<double>) = VariableAddress[x]     : 
-#  138|     r0_24(double)        = Load                   : &:r0_23, ~mu0_2
-#  138|     r0_25(glval<double>) = VariableAddress[y]     : 
+#  136|     r0_16(glval<bool>)   = CopyValue              : r0_14
+#  137|     r0_17(glval<double>) = VariableAddress[x]     : 
+#  137|     r0_18(double)        = Load                   : &:r0_17, ~mu0_2
+#  137|     r0_19(glval<double>) = VariableAddress[y]     : 
+#  137|     r0_20(double)        = Load                   : &:r0_19, ~mu0_2
+#  137|     r0_21(bool)          = CompareNE              : r0_18, r0_20
+#  137|     r0_22(glval<bool>)   = VariableAddress[b]     : 
+#  137|     mu0_23(bool)         = Store                  : &:r0_22, r0_21
+#  137|     r0_24(glval<bool>)   = CopyValue              : r0_22
+#  138|     r0_25(glval<double>) = VariableAddress[x]     : 
 #  138|     r0_26(double)        = Load                   : &:r0_25, ~mu0_2
-#  138|     r0_27(bool)          = CompareLT              : r0_24, r0_26
-#  138|     r0_28(glval<bool>)   = VariableAddress[b]     : 
-#  138|     mu0_29(bool)         = Store                  : &:r0_28, r0_27
-#  139|     r0_30(glval<double>) = VariableAddress[x]     : 
-#  139|     r0_31(double)        = Load                   : &:r0_30, ~mu0_2
-#  139|     r0_32(glval<double>) = VariableAddress[y]     : 
-#  139|     r0_33(double)        = Load                   : &:r0_32, ~mu0_2
-#  139|     r0_34(bool)          = CompareGT              : r0_31, r0_33
-#  139|     r0_35(glval<bool>)   = VariableAddress[b]     : 
-#  139|     mu0_36(bool)         = Store                  : &:r0_35, r0_34
-#  140|     r0_37(glval<double>) = VariableAddress[x]     : 
-#  140|     r0_38(double)        = Load                   : &:r0_37, ~mu0_2
-#  140|     r0_39(glval<double>) = VariableAddress[y]     : 
-#  140|     r0_40(double)        = Load                   : &:r0_39, ~mu0_2
-#  140|     r0_41(bool)          = CompareLE              : r0_38, r0_40
-#  140|     r0_42(glval<bool>)   = VariableAddress[b]     : 
-#  140|     mu0_43(bool)         = Store                  : &:r0_42, r0_41
-#  141|     r0_44(glval<double>) = VariableAddress[x]     : 
-#  141|     r0_45(double)        = Load                   : &:r0_44, ~mu0_2
-#  141|     r0_46(glval<double>) = VariableAddress[y]     : 
-#  141|     r0_47(double)        = Load                   : &:r0_46, ~mu0_2
-#  141|     r0_48(bool)          = CompareGE              : r0_45, r0_47
-#  141|     r0_49(glval<bool>)   = VariableAddress[b]     : 
-#  141|     mu0_50(bool)         = Store                  : &:r0_49, r0_48
-#  142|     v0_51(void)          = NoOp                   : 
-#  133|     v0_52(void)          = ReturnVoid             : 
-#  133|     v0_53(void)          = UnmodeledUse           : mu*
-#  133|     v0_54(void)          = ExitFunction           : 
+#  138|     r0_27(glval<double>) = VariableAddress[y]     : 
+#  138|     r0_28(double)        = Load                   : &:r0_27, ~mu0_2
+#  138|     r0_29(bool)          = CompareLT              : r0_26, r0_28
+#  138|     r0_30(glval<bool>)   = VariableAddress[b]     : 
+#  138|     mu0_31(bool)         = Store                  : &:r0_30, r0_29
+#  138|     r0_32(glval<bool>)   = CopyValue              : r0_30
+#  139|     r0_33(glval<double>) = VariableAddress[x]     : 
+#  139|     r0_34(double)        = Load                   : &:r0_33, ~mu0_2
+#  139|     r0_35(glval<double>) = VariableAddress[y]     : 
+#  139|     r0_36(double)        = Load                   : &:r0_35, ~mu0_2
+#  139|     r0_37(bool)          = CompareGT              : r0_34, r0_36
+#  139|     r0_38(glval<bool>)   = VariableAddress[b]     : 
+#  139|     mu0_39(bool)         = Store                  : &:r0_38, r0_37
+#  139|     r0_40(glval<bool>)   = CopyValue              : r0_38
+#  140|     r0_41(glval<double>) = VariableAddress[x]     : 
+#  140|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
+#  140|     r0_43(glval<double>) = VariableAddress[y]     : 
+#  140|     r0_44(double)        = Load                   : &:r0_43, ~mu0_2
+#  140|     r0_45(bool)          = CompareLE              : r0_42, r0_44
+#  140|     r0_46(glval<bool>)   = VariableAddress[b]     : 
+#  140|     mu0_47(bool)         = Store                  : &:r0_46, r0_45
+#  140|     r0_48(glval<bool>)   = CopyValue              : r0_46
+#  141|     r0_49(glval<double>) = VariableAddress[x]     : 
+#  141|     r0_50(double)        = Load                   : &:r0_49, ~mu0_2
+#  141|     r0_51(glval<double>) = VariableAddress[y]     : 
+#  141|     r0_52(double)        = Load                   : &:r0_51, ~mu0_2
+#  141|     r0_53(bool)          = CompareGE              : r0_50, r0_52
+#  141|     r0_54(glval<bool>)   = VariableAddress[b]     : 
+#  141|     mu0_55(bool)         = Store                  : &:r0_54, r0_53
+#  141|     r0_56(glval<bool>)   = CopyValue              : r0_54
+#  142|     v0_57(void)          = NoOp                   : 
+#  133|     v0_58(void)          = ReturnVoid             : 
+#  133|     v0_59(void)          = UnmodeledUse           : mu*
+#  133|     v0_60(void)          = ExitFunction           : 
 
 #  144| void FloatCrement(float)
 #  144|   Block 0
@@ -667,31 +730,35 @@ ir.cpp:
 #  147|     mu0_11(float)       = Store                  : &:r0_7, r0_10
 #  147|     r0_12(glval<float>) = VariableAddress[y]     : 
 #  147|     mu0_13(float)       = Store                  : &:r0_12, r0_10
-#  148|     r0_14(glval<float>) = VariableAddress[x]     : 
-#  148|     r0_15(float)        = Load                   : &:r0_14, ~mu0_2
-#  148|     r0_16(float)        = Constant[1.0]          : 
-#  148|     r0_17(float)        = Sub                    : r0_15, r0_16
-#  148|     mu0_18(float)       = Store                  : &:r0_14, r0_17
-#  148|     r0_19(glval<float>) = VariableAddress[y]     : 
-#  148|     mu0_20(float)       = Store                  : &:r0_19, r0_17
-#  149|     r0_21(glval<float>) = VariableAddress[x]     : 
-#  149|     r0_22(float)        = Load                   : &:r0_21, ~mu0_2
-#  149|     r0_23(float)        = Constant[1.0]          : 
-#  149|     r0_24(float)        = Add                    : r0_22, r0_23
-#  149|     mu0_25(float)       = Store                  : &:r0_21, r0_24
-#  149|     r0_26(glval<float>) = VariableAddress[y]     : 
-#  149|     mu0_27(float)       = Store                  : &:r0_26, r0_22
-#  150|     r0_28(glval<float>) = VariableAddress[x]     : 
-#  150|     r0_29(float)        = Load                   : &:r0_28, ~mu0_2
-#  150|     r0_30(float)        = Constant[1.0]          : 
-#  150|     r0_31(float)        = Sub                    : r0_29, r0_30
-#  150|     mu0_32(float)       = Store                  : &:r0_28, r0_31
-#  150|     r0_33(glval<float>) = VariableAddress[y]     : 
-#  150|     mu0_34(float)       = Store                  : &:r0_33, r0_29
-#  151|     v0_35(void)         = NoOp                   : 
-#  144|     v0_36(void)         = ReturnVoid             : 
-#  144|     v0_37(void)         = UnmodeledUse           : mu*
-#  144|     v0_38(void)         = ExitFunction           : 
+#  147|     r0_14(glval<float>) = CopyValue              : r0_12
+#  148|     r0_15(glval<float>) = VariableAddress[x]     : 
+#  148|     r0_16(float)        = Load                   : &:r0_15, ~mu0_2
+#  148|     r0_17(float)        = Constant[1.0]          : 
+#  148|     r0_18(float)        = Sub                    : r0_16, r0_17
+#  148|     mu0_19(float)       = Store                  : &:r0_15, r0_18
+#  148|     r0_20(glval<float>) = VariableAddress[y]     : 
+#  148|     mu0_21(float)       = Store                  : &:r0_20, r0_18
+#  148|     r0_22(glval<float>) = CopyValue              : r0_20
+#  149|     r0_23(glval<float>) = VariableAddress[x]     : 
+#  149|     r0_24(float)        = Load                   : &:r0_23, ~mu0_2
+#  149|     r0_25(float)        = Constant[1.0]          : 
+#  149|     r0_26(float)        = Add                    : r0_24, r0_25
+#  149|     mu0_27(float)       = Store                  : &:r0_23, r0_26
+#  149|     r0_28(glval<float>) = VariableAddress[y]     : 
+#  149|     mu0_29(float)       = Store                  : &:r0_28, r0_24
+#  149|     r0_30(glval<float>) = CopyValue              : r0_28
+#  150|     r0_31(glval<float>) = VariableAddress[x]     : 
+#  150|     r0_32(float)        = Load                   : &:r0_31, ~mu0_2
+#  150|     r0_33(float)        = Constant[1.0]          : 
+#  150|     r0_34(float)        = Sub                    : r0_32, r0_33
+#  150|     mu0_35(float)       = Store                  : &:r0_31, r0_34
+#  150|     r0_36(glval<float>) = VariableAddress[y]     : 
+#  150|     mu0_37(float)       = Store                  : &:r0_36, r0_32
+#  150|     r0_38(glval<float>) = CopyValue              : r0_36
+#  151|     v0_39(void)         = NoOp                   : 
+#  144|     v0_40(void)         = ReturnVoid             : 
+#  144|     v0_41(void)         = UnmodeledUse           : mu*
+#  144|     v0_42(void)         = ExitFunction           : 
 
 #  153| void PointerOps(int*, int)
 #  153|   Block 0
@@ -713,61 +780,70 @@ ir.cpp:
 #  157|     r0_15(int *)        = PointerAdd[4]          : r0_12, r0_14
 #  157|     r0_16(glval<int *>) = VariableAddress[q]     : 
 #  157|     mu0_17(int *)       = Store                  : &:r0_16, r0_15
-#  158|     r0_18(glval<int>)   = VariableAddress[i]     : 
-#  158|     r0_19(int)          = Load                   : &:r0_18, ~mu0_2
-#  158|     r0_20(glval<int *>) = VariableAddress[p]     : 
-#  158|     r0_21(int *)        = Load                   : &:r0_20, ~mu0_2
-#  158|     r0_22(int *)        = PointerAdd[4]          : r0_21, r0_19
-#  158|     r0_23(glval<int *>) = VariableAddress[q]     : 
-#  158|     mu0_24(int *)       = Store                  : &:r0_23, r0_22
-#  159|     r0_25(glval<int *>) = VariableAddress[p]     : 
-#  159|     r0_26(int *)        = Load                   : &:r0_25, ~mu0_2
-#  159|     r0_27(glval<int>)   = VariableAddress[i]     : 
-#  159|     r0_28(int)          = Load                   : &:r0_27, ~mu0_2
-#  159|     r0_29(int *)        = PointerSub[4]          : r0_26, r0_28
-#  159|     r0_30(glval<int *>) = VariableAddress[q]     : 
-#  159|     mu0_31(int *)       = Store                  : &:r0_30, r0_29
-#  160|     r0_32(glval<int *>) = VariableAddress[p]     : 
-#  160|     r0_33(int *)        = Load                   : &:r0_32, ~mu0_2
-#  160|     r0_34(glval<int *>) = VariableAddress[q]     : 
-#  160|     r0_35(int *)        = Load                   : &:r0_34, ~mu0_2
-#  160|     r0_36(long)         = PointerDiff[4]         : r0_33, r0_35
-#  160|     r0_37(int)          = Convert                : r0_36
-#  160|     r0_38(glval<int>)   = VariableAddress[i]     : 
-#  160|     mu0_39(int)         = Store                  : &:r0_38, r0_37
-#  162|     r0_40(glval<int *>) = VariableAddress[p]     : 
-#  162|     r0_41(int *)        = Load                   : &:r0_40, ~mu0_2
-#  162|     r0_42(glval<int *>) = VariableAddress[q]     : 
-#  162|     mu0_43(int *)       = Store                  : &:r0_42, r0_41
-#  164|     r0_44(glval<int>)   = VariableAddress[i]     : 
-#  164|     r0_45(int)          = Load                   : &:r0_44, ~mu0_2
-#  164|     r0_46(glval<int *>) = VariableAddress[q]     : 
-#  164|     r0_47(int *)        = Load                   : &:r0_46, ~mu0_2
-#  164|     r0_48(int *)        = PointerAdd[4]          : r0_47, r0_45
-#  164|     mu0_49(int *)       = Store                  : &:r0_46, r0_48
-#  165|     r0_50(glval<int>)   = VariableAddress[i]     : 
-#  165|     r0_51(int)          = Load                   : &:r0_50, ~mu0_2
-#  165|     r0_52(glval<int *>) = VariableAddress[q]     : 
-#  165|     r0_53(int *)        = Load                   : &:r0_52, ~mu0_2
-#  165|     r0_54(int *)        = PointerSub[4]          : r0_53, r0_51
-#  165|     mu0_55(int *)       = Store                  : &:r0_52, r0_54
-#  167|     r0_56(glval<int *>) = VariableAddress[p]     : 
-#  167|     r0_57(int *)        = Load                   : &:r0_56, ~mu0_2
-#  167|     r0_58(int *)        = Constant[0]            : 
-#  167|     r0_59(bool)         = CompareNE              : r0_57, r0_58
-#  167|     r0_60(glval<bool>)  = VariableAddress[b]     : 
-#  167|     mu0_61(bool)        = Store                  : &:r0_60, r0_59
-#  168|     r0_62(glval<int *>) = VariableAddress[p]     : 
-#  168|     r0_63(int *)        = Load                   : &:r0_62, ~mu0_2
-#  168|     r0_64(int *)        = Constant[0]            : 
-#  168|     r0_65(bool)         = CompareNE              : r0_63, r0_64
-#  168|     r0_66(bool)         = LogicalNot             : r0_65
-#  168|     r0_67(glval<bool>)  = VariableAddress[b]     : 
-#  168|     mu0_68(bool)        = Store                  : &:r0_67, r0_66
-#  169|     v0_69(void)         = NoOp                   : 
-#  153|     v0_70(void)         = ReturnVoid             : 
-#  153|     v0_71(void)         = UnmodeledUse           : mu*
-#  153|     v0_72(void)         = ExitFunction           : 
+#  157|     r0_18(glval<int *>) = CopyValue              : r0_16
+#  158|     r0_19(glval<int>)   = VariableAddress[i]     : 
+#  158|     r0_20(int)          = Load                   : &:r0_19, ~mu0_2
+#  158|     r0_21(glval<int *>) = VariableAddress[p]     : 
+#  158|     r0_22(int *)        = Load                   : &:r0_21, ~mu0_2
+#  158|     r0_23(int *)        = PointerAdd[4]          : r0_22, r0_20
+#  158|     r0_24(glval<int *>) = VariableAddress[q]     : 
+#  158|     mu0_25(int *)       = Store                  : &:r0_24, r0_23
+#  158|     r0_26(glval<int *>) = CopyValue              : r0_24
+#  159|     r0_27(glval<int *>) = VariableAddress[p]     : 
+#  159|     r0_28(int *)        = Load                   : &:r0_27, ~mu0_2
+#  159|     r0_29(glval<int>)   = VariableAddress[i]     : 
+#  159|     r0_30(int)          = Load                   : &:r0_29, ~mu0_2
+#  159|     r0_31(int *)        = PointerSub[4]          : r0_28, r0_30
+#  159|     r0_32(glval<int *>) = VariableAddress[q]     : 
+#  159|     mu0_33(int *)       = Store                  : &:r0_32, r0_31
+#  159|     r0_34(glval<int *>) = CopyValue              : r0_32
+#  160|     r0_35(glval<int *>) = VariableAddress[p]     : 
+#  160|     r0_36(int *)        = Load                   : &:r0_35, ~mu0_2
+#  160|     r0_37(glval<int *>) = VariableAddress[q]     : 
+#  160|     r0_38(int *)        = Load                   : &:r0_37, ~mu0_2
+#  160|     r0_39(long)         = PointerDiff[4]         : r0_36, r0_38
+#  160|     r0_40(int)          = Convert                : r0_39
+#  160|     r0_41(glval<int>)   = VariableAddress[i]     : 
+#  160|     mu0_42(int)         = Store                  : &:r0_41, r0_40
+#  160|     r0_43(glval<int>)   = CopyValue              : r0_41
+#  162|     r0_44(glval<int *>) = VariableAddress[p]     : 
+#  162|     r0_45(int *)        = Load                   : &:r0_44, ~mu0_2
+#  162|     r0_46(glval<int *>) = VariableAddress[q]     : 
+#  162|     mu0_47(int *)       = Store                  : &:r0_46, r0_45
+#  162|     r0_48(glval<int *>) = CopyValue              : r0_46
+#  164|     r0_49(glval<int>)   = VariableAddress[i]     : 
+#  164|     r0_50(int)          = Load                   : &:r0_49, ~mu0_2
+#  164|     r0_51(glval<int *>) = VariableAddress[q]     : 
+#  164|     r0_52(int *)        = Load                   : &:r0_51, ~mu0_2
+#  164|     r0_53(int *)        = PointerAdd[4]          : r0_52, r0_50
+#  164|     mu0_54(int *)       = Store                  : &:r0_51, r0_53
+#  164|     r0_55(glval<int *>) = CopyValue              : r0_51
+#  165|     r0_56(glval<int>)   = VariableAddress[i]     : 
+#  165|     r0_57(int)          = Load                   : &:r0_56, ~mu0_2
+#  165|     r0_58(glval<int *>) = VariableAddress[q]     : 
+#  165|     r0_59(int *)        = Load                   : &:r0_58, ~mu0_2
+#  165|     r0_60(int *)        = PointerSub[4]          : r0_59, r0_57
+#  165|     mu0_61(int *)       = Store                  : &:r0_58, r0_60
+#  165|     r0_62(glval<int *>) = CopyValue              : r0_58
+#  167|     r0_63(glval<int *>) = VariableAddress[p]     : 
+#  167|     r0_64(int *)        = Load                   : &:r0_63, ~mu0_2
+#  167|     r0_65(int *)        = Constant[0]            : 
+#  167|     r0_66(bool)         = CompareNE              : r0_64, r0_65
+#  167|     r0_67(glval<bool>)  = VariableAddress[b]     : 
+#  167|     mu0_68(bool)        = Store                  : &:r0_67, r0_66
+#  167|     r0_69(glval<bool>)  = CopyValue              : r0_67
+#  168|     r0_70(glval<int *>) = VariableAddress[p]     : 
+#  168|     r0_71(int *)        = Load                   : &:r0_70, ~mu0_2
+#  168|     r0_72(int *)        = Constant[0]            : 
+#  168|     r0_73(bool)         = CompareNE              : r0_71, r0_72
+#  168|     r0_74(bool)         = LogicalNot             : r0_73
+#  168|     r0_75(glval<bool>)  = VariableAddress[b]     : 
+#  168|     mu0_76(bool)        = Store                  : &:r0_75, r0_74
+#  168|     r0_77(glval<bool>)  = CopyValue              : r0_75
+#  169|     v0_78(void)         = NoOp                   : 
+#  153|     v0_79(void)         = ReturnVoid             : 
+#  153|     v0_80(void)         = UnmodeledUse           : mu*
+#  153|     v0_81(void)         = ExitFunction           : 
 
 #  171| void ArrayAccess(int*, int)
 #  171|   Block 0
@@ -788,68 +864,76 @@ ir.cpp:
 #  174|     r0_14(int)            = Load                   : &:r0_13, ~mu0_2
 #  174|     r0_15(glval<int>)     = VariableAddress[x]     : 
 #  174|     mu0_16(int)           = Store                  : &:r0_15, r0_14
-#  175|     r0_17(glval<int *>)   = VariableAddress[p]     : 
-#  175|     r0_18(int *)          = Load                   : &:r0_17, ~mu0_2
-#  175|     r0_19(glval<int>)     = VariableAddress[i]     : 
-#  175|     r0_20(int)            = Load                   : &:r0_19, ~mu0_2
-#  175|     r0_21(glval<int>)     = PointerAdd[4]          : r0_18, r0_20
-#  175|     r0_22(int)            = Load                   : &:r0_21, ~mu0_2
-#  175|     r0_23(glval<int>)     = VariableAddress[x]     : 
-#  175|     mu0_24(int)           = Store                  : &:r0_23, r0_22
-#  177|     r0_25(glval<int>)     = VariableAddress[x]     : 
-#  177|     r0_26(int)            = Load                   : &:r0_25, ~mu0_2
-#  177|     r0_27(glval<int *>)   = VariableAddress[p]     : 
-#  177|     r0_28(int *)          = Load                   : &:r0_27, ~mu0_2
-#  177|     r0_29(glval<int>)     = VariableAddress[i]     : 
-#  177|     r0_30(int)            = Load                   : &:r0_29, ~mu0_2
-#  177|     r0_31(glval<int>)     = PointerAdd[4]          : r0_28, r0_30
-#  177|     mu0_32(int)           = Store                  : &:r0_31, r0_26
-#  178|     r0_33(glval<int>)     = VariableAddress[x]     : 
-#  178|     r0_34(int)            = Load                   : &:r0_33, ~mu0_2
-#  178|     r0_35(glval<int *>)   = VariableAddress[p]     : 
-#  178|     r0_36(int *)          = Load                   : &:r0_35, ~mu0_2
-#  178|     r0_37(glval<int>)     = VariableAddress[i]     : 
-#  178|     r0_38(int)            = Load                   : &:r0_37, ~mu0_2
-#  178|     r0_39(glval<int>)     = PointerAdd[4]          : r0_36, r0_38
-#  178|     mu0_40(int)           = Store                  : &:r0_39, r0_34
-#  180|     r0_41(glval<int[10]>) = VariableAddress[a]     : 
-#  180|     mu0_42(int[10])       = Uninitialized[a]       : &:r0_41
-#  181|     r0_43(glval<int[10]>) = VariableAddress[a]     : 
-#  181|     r0_44(int *)          = Convert                : r0_43
-#  181|     r0_45(glval<int>)     = VariableAddress[i]     : 
-#  181|     r0_46(int)            = Load                   : &:r0_45, ~mu0_2
-#  181|     r0_47(glval<int>)     = PointerAdd[4]          : r0_44, r0_46
-#  181|     r0_48(int)            = Load                   : &:r0_47, ~mu0_2
-#  181|     r0_49(glval<int>)     = VariableAddress[x]     : 
-#  181|     mu0_50(int)           = Store                  : &:r0_49, r0_48
-#  182|     r0_51(glval<int[10]>) = VariableAddress[a]     : 
-#  182|     r0_52(int *)          = Convert                : r0_51
-#  182|     r0_53(glval<int>)     = VariableAddress[i]     : 
-#  182|     r0_54(int)            = Load                   : &:r0_53, ~mu0_2
-#  182|     r0_55(glval<int>)     = PointerAdd[4]          : r0_52, r0_54
-#  182|     r0_56(int)            = Load                   : &:r0_55, ~mu0_2
-#  182|     r0_57(glval<int>)     = VariableAddress[x]     : 
-#  182|     mu0_58(int)           = Store                  : &:r0_57, r0_56
-#  183|     r0_59(glval<int>)     = VariableAddress[x]     : 
-#  183|     r0_60(int)            = Load                   : &:r0_59, ~mu0_2
-#  183|     r0_61(glval<int[10]>) = VariableAddress[a]     : 
-#  183|     r0_62(int *)          = Convert                : r0_61
-#  183|     r0_63(glval<int>)     = VariableAddress[i]     : 
-#  183|     r0_64(int)            = Load                   : &:r0_63, ~mu0_2
-#  183|     r0_65(glval<int>)     = PointerAdd[4]          : r0_62, r0_64
-#  183|     mu0_66(int)           = Store                  : &:r0_65, r0_60
-#  184|     r0_67(glval<int>)     = VariableAddress[x]     : 
-#  184|     r0_68(int)            = Load                   : &:r0_67, ~mu0_2
-#  184|     r0_69(glval<int[10]>) = VariableAddress[a]     : 
-#  184|     r0_70(int *)          = Convert                : r0_69
-#  184|     r0_71(glval<int>)     = VariableAddress[i]     : 
-#  184|     r0_72(int)            = Load                   : &:r0_71, ~mu0_2
-#  184|     r0_73(glval<int>)     = PointerAdd[4]          : r0_70, r0_72
-#  184|     mu0_74(int)           = Store                  : &:r0_73, r0_68
-#  185|     v0_75(void)           = NoOp                   : 
-#  171|     v0_76(void)           = ReturnVoid             : 
-#  171|     v0_77(void)           = UnmodeledUse           : mu*
-#  171|     v0_78(void)           = ExitFunction           : 
+#  174|     r0_17(glval<int>)     = CopyValue              : r0_15
+#  175|     r0_18(glval<int *>)   = VariableAddress[p]     : 
+#  175|     r0_19(int *)          = Load                   : &:r0_18, ~mu0_2
+#  175|     r0_20(glval<int>)     = VariableAddress[i]     : 
+#  175|     r0_21(int)            = Load                   : &:r0_20, ~mu0_2
+#  175|     r0_22(glval<int>)     = PointerAdd[4]          : r0_19, r0_21
+#  175|     r0_23(int)            = Load                   : &:r0_22, ~mu0_2
+#  175|     r0_24(glval<int>)     = VariableAddress[x]     : 
+#  175|     mu0_25(int)           = Store                  : &:r0_24, r0_23
+#  175|     r0_26(glval<int>)     = CopyValue              : r0_24
+#  177|     r0_27(glval<int>)     = VariableAddress[x]     : 
+#  177|     r0_28(int)            = Load                   : &:r0_27, ~mu0_2
+#  177|     r0_29(glval<int *>)   = VariableAddress[p]     : 
+#  177|     r0_30(int *)          = Load                   : &:r0_29, ~mu0_2
+#  177|     r0_31(glval<int>)     = VariableAddress[i]     : 
+#  177|     r0_32(int)            = Load                   : &:r0_31, ~mu0_2
+#  177|     r0_33(glval<int>)     = PointerAdd[4]          : r0_30, r0_32
+#  177|     mu0_34(int)           = Store                  : &:r0_33, r0_28
+#  177|     r0_35(glval<int>)     = CopyValue              : r0_33
+#  178|     r0_36(glval<int>)     = VariableAddress[x]     : 
+#  178|     r0_37(int)            = Load                   : &:r0_36, ~mu0_2
+#  178|     r0_38(glval<int *>)   = VariableAddress[p]     : 
+#  178|     r0_39(int *)          = Load                   : &:r0_38, ~mu0_2
+#  178|     r0_40(glval<int>)     = VariableAddress[i]     : 
+#  178|     r0_41(int)            = Load                   : &:r0_40, ~mu0_2
+#  178|     r0_42(glval<int>)     = PointerAdd[4]          : r0_39, r0_41
+#  178|     mu0_43(int)           = Store                  : &:r0_42, r0_37
+#  178|     r0_44(glval<int>)     = CopyValue              : r0_42
+#  180|     r0_45(glval<int[10]>) = VariableAddress[a]     : 
+#  180|     mu0_46(int[10])       = Uninitialized[a]       : &:r0_45
+#  181|     r0_47(glval<int[10]>) = VariableAddress[a]     : 
+#  181|     r0_48(int *)          = Convert                : r0_47
+#  181|     r0_49(glval<int>)     = VariableAddress[i]     : 
+#  181|     r0_50(int)            = Load                   : &:r0_49, ~mu0_2
+#  181|     r0_51(glval<int>)     = PointerAdd[4]          : r0_48, r0_50
+#  181|     r0_52(int)            = Load                   : &:r0_51, ~mu0_2
+#  181|     r0_53(glval<int>)     = VariableAddress[x]     : 
+#  181|     mu0_54(int)           = Store                  : &:r0_53, r0_52
+#  181|     r0_55(glval<int>)     = CopyValue              : r0_53
+#  182|     r0_56(glval<int[10]>) = VariableAddress[a]     : 
+#  182|     r0_57(int *)          = Convert                : r0_56
+#  182|     r0_58(glval<int>)     = VariableAddress[i]     : 
+#  182|     r0_59(int)            = Load                   : &:r0_58, ~mu0_2
+#  182|     r0_60(glval<int>)     = PointerAdd[4]          : r0_57, r0_59
+#  182|     r0_61(int)            = Load                   : &:r0_60, ~mu0_2
+#  182|     r0_62(glval<int>)     = VariableAddress[x]     : 
+#  182|     mu0_63(int)           = Store                  : &:r0_62, r0_61
+#  182|     r0_64(glval<int>)     = CopyValue              : r0_62
+#  183|     r0_65(glval<int>)     = VariableAddress[x]     : 
+#  183|     r0_66(int)            = Load                   : &:r0_65, ~mu0_2
+#  183|     r0_67(glval<int[10]>) = VariableAddress[a]     : 
+#  183|     r0_68(int *)          = Convert                : r0_67
+#  183|     r0_69(glval<int>)     = VariableAddress[i]     : 
+#  183|     r0_70(int)            = Load                   : &:r0_69, ~mu0_2
+#  183|     r0_71(glval<int>)     = PointerAdd[4]          : r0_68, r0_70
+#  183|     mu0_72(int)           = Store                  : &:r0_71, r0_66
+#  183|     r0_73(glval<int>)     = CopyValue              : r0_71
+#  184|     r0_74(glval<int>)     = VariableAddress[x]     : 
+#  184|     r0_75(int)            = Load                   : &:r0_74, ~mu0_2
+#  184|     r0_76(glval<int[10]>) = VariableAddress[a]     : 
+#  184|     r0_77(int *)          = Convert                : r0_76
+#  184|     r0_78(glval<int>)     = VariableAddress[i]     : 
+#  184|     r0_79(int)            = Load                   : &:r0_78, ~mu0_2
+#  184|     r0_80(glval<int>)     = PointerAdd[4]          : r0_77, r0_79
+#  184|     mu0_81(int)           = Store                  : &:r0_80, r0_75
+#  184|     r0_82(glval<int>)     = CopyValue              : r0_80
+#  185|     v0_83(void)           = NoOp                   : 
+#  171|     v0_84(void)           = ReturnVoid             : 
+#  171|     v0_85(void)           = UnmodeledUse           : mu*
+#  171|     v0_86(void)           = ExitFunction           : 
 
 #  187| void StringLiteral(int)
 #  187|   Block 0
@@ -902,45 +986,51 @@ ir.cpp:
 #  196|     r0_13(bool)         = CompareEQ              : r0_10, r0_12
 #  196|     r0_14(glval<bool>)  = VariableAddress[b]     : 
 #  196|     mu0_15(bool)        = Store                  : &:r0_14, r0_13
-#  197|     r0_16(glval<int *>) = VariableAddress[p]     : 
-#  197|     r0_17(int *)        = Load                   : &:r0_16, ~mu0_2
-#  197|     r0_18(glval<int *>) = VariableAddress[q]     : 
-#  197|     r0_19(int *)        = Load                   : &:r0_18, ~mu0_2
-#  197|     r0_20(bool)         = CompareNE              : r0_17, r0_19
-#  197|     r0_21(glval<bool>)  = VariableAddress[b]     : 
-#  197|     mu0_22(bool)        = Store                  : &:r0_21, r0_20
-#  198|     r0_23(glval<int *>) = VariableAddress[p]     : 
-#  198|     r0_24(int *)        = Load                   : &:r0_23, ~mu0_2
-#  198|     r0_25(glval<int *>) = VariableAddress[q]     : 
+#  196|     r0_16(glval<bool>)  = CopyValue              : r0_14
+#  197|     r0_17(glval<int *>) = VariableAddress[p]     : 
+#  197|     r0_18(int *)        = Load                   : &:r0_17, ~mu0_2
+#  197|     r0_19(glval<int *>) = VariableAddress[q]     : 
+#  197|     r0_20(int *)        = Load                   : &:r0_19, ~mu0_2
+#  197|     r0_21(bool)         = CompareNE              : r0_18, r0_20
+#  197|     r0_22(glval<bool>)  = VariableAddress[b]     : 
+#  197|     mu0_23(bool)        = Store                  : &:r0_22, r0_21
+#  197|     r0_24(glval<bool>)  = CopyValue              : r0_22
+#  198|     r0_25(glval<int *>) = VariableAddress[p]     : 
 #  198|     r0_26(int *)        = Load                   : &:r0_25, ~mu0_2
-#  198|     r0_27(bool)         = CompareLT              : r0_24, r0_26
-#  198|     r0_28(glval<bool>)  = VariableAddress[b]     : 
-#  198|     mu0_29(bool)        = Store                  : &:r0_28, r0_27
-#  199|     r0_30(glval<int *>) = VariableAddress[p]     : 
-#  199|     r0_31(int *)        = Load                   : &:r0_30, ~mu0_2
-#  199|     r0_32(glval<int *>) = VariableAddress[q]     : 
-#  199|     r0_33(int *)        = Load                   : &:r0_32, ~mu0_2
-#  199|     r0_34(bool)         = CompareGT              : r0_31, r0_33
-#  199|     r0_35(glval<bool>)  = VariableAddress[b]     : 
-#  199|     mu0_36(bool)        = Store                  : &:r0_35, r0_34
-#  200|     r0_37(glval<int *>) = VariableAddress[p]     : 
-#  200|     r0_38(int *)        = Load                   : &:r0_37, ~mu0_2
-#  200|     r0_39(glval<int *>) = VariableAddress[q]     : 
-#  200|     r0_40(int *)        = Load                   : &:r0_39, ~mu0_2
-#  200|     r0_41(bool)         = CompareLE              : r0_38, r0_40
-#  200|     r0_42(glval<bool>)  = VariableAddress[b]     : 
-#  200|     mu0_43(bool)        = Store                  : &:r0_42, r0_41
-#  201|     r0_44(glval<int *>) = VariableAddress[p]     : 
-#  201|     r0_45(int *)        = Load                   : &:r0_44, ~mu0_2
-#  201|     r0_46(glval<int *>) = VariableAddress[q]     : 
-#  201|     r0_47(int *)        = Load                   : &:r0_46, ~mu0_2
-#  201|     r0_48(bool)         = CompareGE              : r0_45, r0_47
-#  201|     r0_49(glval<bool>)  = VariableAddress[b]     : 
-#  201|     mu0_50(bool)        = Store                  : &:r0_49, r0_48
-#  202|     v0_51(void)         = NoOp                   : 
-#  193|     v0_52(void)         = ReturnVoid             : 
-#  193|     v0_53(void)         = UnmodeledUse           : mu*
-#  193|     v0_54(void)         = ExitFunction           : 
+#  198|     r0_27(glval<int *>) = VariableAddress[q]     : 
+#  198|     r0_28(int *)        = Load                   : &:r0_27, ~mu0_2
+#  198|     r0_29(bool)         = CompareLT              : r0_26, r0_28
+#  198|     r0_30(glval<bool>)  = VariableAddress[b]     : 
+#  198|     mu0_31(bool)        = Store                  : &:r0_30, r0_29
+#  198|     r0_32(glval<bool>)  = CopyValue              : r0_30
+#  199|     r0_33(glval<int *>) = VariableAddress[p]     : 
+#  199|     r0_34(int *)        = Load                   : &:r0_33, ~mu0_2
+#  199|     r0_35(glval<int *>) = VariableAddress[q]     : 
+#  199|     r0_36(int *)        = Load                   : &:r0_35, ~mu0_2
+#  199|     r0_37(bool)         = CompareGT              : r0_34, r0_36
+#  199|     r0_38(glval<bool>)  = VariableAddress[b]     : 
+#  199|     mu0_39(bool)        = Store                  : &:r0_38, r0_37
+#  199|     r0_40(glval<bool>)  = CopyValue              : r0_38
+#  200|     r0_41(glval<int *>) = VariableAddress[p]     : 
+#  200|     r0_42(int *)        = Load                   : &:r0_41, ~mu0_2
+#  200|     r0_43(glval<int *>) = VariableAddress[q]     : 
+#  200|     r0_44(int *)        = Load                   : &:r0_43, ~mu0_2
+#  200|     r0_45(bool)         = CompareLE              : r0_42, r0_44
+#  200|     r0_46(glval<bool>)  = VariableAddress[b]     : 
+#  200|     mu0_47(bool)        = Store                  : &:r0_46, r0_45
+#  200|     r0_48(glval<bool>)  = CopyValue              : r0_46
+#  201|     r0_49(glval<int *>) = VariableAddress[p]     : 
+#  201|     r0_50(int *)        = Load                   : &:r0_49, ~mu0_2
+#  201|     r0_51(glval<int *>) = VariableAddress[q]     : 
+#  201|     r0_52(int *)        = Load                   : &:r0_51, ~mu0_2
+#  201|     r0_53(bool)         = CompareGE              : r0_50, r0_52
+#  201|     r0_54(glval<bool>)  = VariableAddress[b]     : 
+#  201|     mu0_55(bool)        = Store                  : &:r0_54, r0_53
+#  201|     r0_56(glval<bool>)  = CopyValue              : r0_54
+#  202|     v0_57(void)         = NoOp                   : 
+#  193|     v0_58(void)         = ReturnVoid             : 
+#  193|     v0_59(void)         = UnmodeledUse           : mu*
+#  193|     v0_60(void)         = ExitFunction           : 
 
 #  204| void PointerCrement(int*)
 #  204|   Block 0
@@ -958,31 +1048,35 @@ ir.cpp:
 #  207|     mu0_11(int *)       = Store                  : &:r0_7, r0_10
 #  207|     r0_12(glval<int *>) = VariableAddress[q]     : 
 #  207|     mu0_13(int *)       = Store                  : &:r0_12, r0_10
-#  208|     r0_14(glval<int *>) = VariableAddress[p]     : 
-#  208|     r0_15(int *)        = Load                   : &:r0_14, ~mu0_2
-#  208|     r0_16(int)          = Constant[1]            : 
-#  208|     r0_17(int *)        = PointerSub[4]          : r0_15, r0_16
-#  208|     mu0_18(int *)       = Store                  : &:r0_14, r0_17
-#  208|     r0_19(glval<int *>) = VariableAddress[q]     : 
-#  208|     mu0_20(int *)       = Store                  : &:r0_19, r0_17
-#  209|     r0_21(glval<int *>) = VariableAddress[p]     : 
-#  209|     r0_22(int *)        = Load                   : &:r0_21, ~mu0_2
-#  209|     r0_23(int)          = Constant[1]            : 
-#  209|     r0_24(int *)        = PointerAdd[4]          : r0_22, r0_23
-#  209|     mu0_25(int *)       = Store                  : &:r0_21, r0_24
-#  209|     r0_26(glval<int *>) = VariableAddress[q]     : 
-#  209|     mu0_27(int *)       = Store                  : &:r0_26, r0_22
-#  210|     r0_28(glval<int *>) = VariableAddress[p]     : 
-#  210|     r0_29(int *)        = Load                   : &:r0_28, ~mu0_2
-#  210|     r0_30(int)          = Constant[1]            : 
-#  210|     r0_31(int *)        = PointerSub[4]          : r0_29, r0_30
-#  210|     mu0_32(int *)       = Store                  : &:r0_28, r0_31
-#  210|     r0_33(glval<int *>) = VariableAddress[q]     : 
-#  210|     mu0_34(int *)       = Store                  : &:r0_33, r0_29
-#  211|     v0_35(void)         = NoOp                   : 
-#  204|     v0_36(void)         = ReturnVoid             : 
-#  204|     v0_37(void)         = UnmodeledUse           : mu*
-#  204|     v0_38(void)         = ExitFunction           : 
+#  207|     r0_14(glval<int *>) = CopyValue              : r0_12
+#  208|     r0_15(glval<int *>) = VariableAddress[p]     : 
+#  208|     r0_16(int *)        = Load                   : &:r0_15, ~mu0_2
+#  208|     r0_17(int)          = Constant[1]            : 
+#  208|     r0_18(int *)        = PointerSub[4]          : r0_16, r0_17
+#  208|     mu0_19(int *)       = Store                  : &:r0_15, r0_18
+#  208|     r0_20(glval<int *>) = VariableAddress[q]     : 
+#  208|     mu0_21(int *)       = Store                  : &:r0_20, r0_18
+#  208|     r0_22(glval<int *>) = CopyValue              : r0_20
+#  209|     r0_23(glval<int *>) = VariableAddress[p]     : 
+#  209|     r0_24(int *)        = Load                   : &:r0_23, ~mu0_2
+#  209|     r0_25(int)          = Constant[1]            : 
+#  209|     r0_26(int *)        = PointerAdd[4]          : r0_24, r0_25
+#  209|     mu0_27(int *)       = Store                  : &:r0_23, r0_26
+#  209|     r0_28(glval<int *>) = VariableAddress[q]     : 
+#  209|     mu0_29(int *)       = Store                  : &:r0_28, r0_24
+#  209|     r0_30(glval<int *>) = CopyValue              : r0_28
+#  210|     r0_31(glval<int *>) = VariableAddress[p]     : 
+#  210|     r0_32(int *)        = Load                   : &:r0_31, ~mu0_2
+#  210|     r0_33(int)          = Constant[1]            : 
+#  210|     r0_34(int *)        = PointerSub[4]          : r0_32, r0_33
+#  210|     mu0_35(int *)       = Store                  : &:r0_31, r0_34
+#  210|     r0_36(glval<int *>) = VariableAddress[q]     : 
+#  210|     mu0_37(int *)       = Store                  : &:r0_36, r0_32
+#  210|     r0_38(glval<int *>) = CopyValue              : r0_36
+#  211|     v0_39(void)         = NoOp                   : 
+#  204|     v0_40(void)         = ReturnVoid             : 
+#  204|     v0_41(void)         = UnmodeledUse           : mu*
+#  204|     v0_42(void)         = ExitFunction           : 
 
 #  213| void CompoundAssignment()
 #  213|   Block 0
@@ -997,36 +1091,40 @@ ir.cpp:
 #  216|     r0_8(int)           = Load                : &:r0_7, ~mu0_2
 #  216|     r0_9(int)           = Add                 : r0_8, r0_6
 #  216|     mu0_10(int)         = Store               : &:r0_7, r0_9
-#  219|     r0_11(glval<short>) = VariableAddress[y]  : 
-#  219|     r0_12(short)        = Constant[5]         : 
-#  219|     mu0_13(short)       = Store               : &:r0_11, r0_12
-#  220|     r0_14(glval<int>)   = VariableAddress[x]  : 
-#  220|     r0_15(int)          = Load                : &:r0_14, ~mu0_2
-#  220|     r0_16(glval<short>) = VariableAddress[y]  : 
-#  220|     r0_17(short)        = Load                : &:r0_16, ~mu0_2
-#  220|     r0_18(int)          = Convert             : r0_17
-#  220|     r0_19(int)          = Add                 : r0_18, r0_15
-#  220|     r0_20(short)        = Convert             : r0_19
-#  220|     mu0_21(short)       = Store               : &:r0_16, r0_20
-#  223|     r0_22(int)          = Constant[1]         : 
-#  223|     r0_23(glval<short>) = VariableAddress[y]  : 
-#  223|     r0_24(short)        = Load                : &:r0_23, ~mu0_2
-#  223|     r0_25(short)        = ShiftLeft           : r0_24, r0_22
-#  223|     mu0_26(short)       = Store               : &:r0_23, r0_25
-#  226|     r0_27(glval<long>)  = VariableAddress[z]  : 
-#  226|     r0_28(long)         = Constant[7]         : 
-#  226|     mu0_29(long)        = Store               : &:r0_27, r0_28
-#  227|     r0_30(float)        = Constant[2.0]       : 
-#  227|     r0_31(glval<long>)  = VariableAddress[z]  : 
-#  227|     r0_32(long)         = Load                : &:r0_31, ~mu0_2
-#  227|     r0_33(float)        = Convert             : r0_32
-#  227|     r0_34(float)        = Add                 : r0_33, r0_30
-#  227|     r0_35(long)         = Convert             : r0_34
-#  227|     mu0_36(long)        = Store               : &:r0_31, r0_35
-#  228|     v0_37(void)         = NoOp                : 
-#  213|     v0_38(void)         = ReturnVoid          : 
-#  213|     v0_39(void)         = UnmodeledUse        : mu*
-#  213|     v0_40(void)         = ExitFunction        : 
+#  216|     r0_11(glval<int>)   = CopyValue           : r0_7
+#  219|     r0_12(glval<short>) = VariableAddress[y]  : 
+#  219|     r0_13(short)        = Constant[5]         : 
+#  219|     mu0_14(short)       = Store               : &:r0_12, r0_13
+#  220|     r0_15(glval<int>)   = VariableAddress[x]  : 
+#  220|     r0_16(int)          = Load                : &:r0_15, ~mu0_2
+#  220|     r0_17(glval<short>) = VariableAddress[y]  : 
+#  220|     r0_18(short)        = Load                : &:r0_17, ~mu0_2
+#  220|     r0_19(int)          = Convert             : r0_18
+#  220|     r0_20(int)          = Add                 : r0_19, r0_16
+#  220|     r0_21(short)        = Convert             : r0_20
+#  220|     mu0_22(short)       = Store               : &:r0_17, r0_21
+#  220|     r0_23(glval<short>) = CopyValue           : r0_17
+#  223|     r0_24(int)          = Constant[1]         : 
+#  223|     r0_25(glval<short>) = VariableAddress[y]  : 
+#  223|     r0_26(short)        = Load                : &:r0_25, ~mu0_2
+#  223|     r0_27(short)        = ShiftLeft           : r0_26, r0_24
+#  223|     mu0_28(short)       = Store               : &:r0_25, r0_27
+#  223|     r0_29(glval<short>) = CopyValue           : r0_25
+#  226|     r0_30(glval<long>)  = VariableAddress[z]  : 
+#  226|     r0_31(long)         = Constant[7]         : 
+#  226|     mu0_32(long)        = Store               : &:r0_30, r0_31
+#  227|     r0_33(float)        = Constant[2.0]       : 
+#  227|     r0_34(glval<long>)  = VariableAddress[z]  : 
+#  227|     r0_35(long)         = Load                : &:r0_34, ~mu0_2
+#  227|     r0_36(float)        = Convert             : r0_35
+#  227|     r0_37(float)        = Add                 : r0_36, r0_33
+#  227|     r0_38(long)         = Convert             : r0_37
+#  227|     mu0_39(long)        = Store               : &:r0_34, r0_38
+#  227|     r0_40(glval<long>)  = CopyValue           : r0_34
+#  228|     v0_41(void)         = NoOp                : 
+#  213|     v0_42(void)         = ReturnVoid          : 
+#  213|     v0_43(void)         = UnmodeledUse        : mu*
+#  213|     v0_44(void)         = ExitFunction        : 
 
 #  230| void UninitializedVariables()
 #  230|   Block 0
@@ -1094,6 +1192,7 @@ ir.cpp:
 #  244|     r2_1(int)        = Load               : &:r2_0, ~mu0_2
 #  244|     r2_2(glval<int>) = VariableAddress[x] : 
 #  244|     mu2_3(int)       = Store              : &:r2_2, r2_1
+#  244|     r2_4(glval<int>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  247|   Block 3
@@ -1109,12 +1208,14 @@ ir.cpp:
 #  248|     r4_0(int)        = Constant[2]        : 
 #  248|     r4_1(glval<int>) = VariableAddress[x] : 
 #  248|     mu4_2(int)       = Store              : &:r4_1, r4_0
+#  248|     r4_3(glval<int>) = CopyValue          : r4_1
 #-----|   Goto -> Block 6
 
 #  250|   Block 5
 #  250|     r5_0(int)        = Constant[7]        : 
 #  250|     r5_1(glval<int>) = VariableAddress[x] : 
 #  250|     mu5_2(int)       = Store              : &:r5_1, r5_0
+#  250|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 6
 
 #  251|   Block 6
@@ -1142,6 +1243,7 @@ ir.cpp:
 #  255|     r1_2(int)        = Load               : &:r1_1, ~mu0_2
 #  255|     r1_3(int)        = Sub                : r1_2, r1_0
 #  255|     mu1_4(int)       = Store              : &:r1_1, r1_3
+#  255|     r1_5(glval<int>) = CopyValue          : r1_1
 #-----|   Goto (back edge) -> Block 3
 
 #  257|   Block 2
@@ -1174,11 +1276,12 @@ ir.cpp:
 #  261|     r1_2(int)        = Load               : &:r1_1, ~mu0_2
 #  261|     r1_3(int)        = Sub                : r1_2, r1_0
 #  261|     mu1_4(int)       = Store              : &:r1_1, r1_3
-#  262|     r1_5(glval<int>) = VariableAddress[n] : 
-#  262|     r1_6(int)        = Load               : &:r1_5, ~mu0_2
-#  262|     r1_7(int)        = Constant[0]        : 
-#  262|     r1_8(bool)       = CompareGT          : r1_6, r1_7
-#  262|     v1_9(void)       = ConditionalBranch  : r1_8
+#  261|     r1_5(glval<int>) = CopyValue          : r1_1
+#  262|     r1_6(glval<int>) = VariableAddress[n] : 
+#  262|     r1_7(int)        = Load               : &:r1_6, ~mu0_2
+#  262|     r1_8(int)        = Constant[0]        : 
+#  262|     r1_9(bool)       = CompareGT          : r1_7, r1_8
+#  262|     v1_10(void)      = ConditionalBranch  : r1_9
 #-----|   False -> Block 2
 #-----|   True (back edge) -> Block 1
 
@@ -1276,6 +1379,7 @@ ir.cpp:
 #  287|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  287|     r2_4(int)        = Add                : r2_3, r2_1
 #  287|     mu2_5(int)       = Store              : &:r2_2, r2_4
+#  287|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 2
 
 #  292| void For_InitCondition()
@@ -1329,6 +1433,7 @@ ir.cpp:
 #  299|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  299|     r2_4(int)        = Add                : r2_3, r2_1
 #  299|     mu2_5(int)       = Store              : &:r2_2, r2_4
+#  299|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 2
 
 #  304| void For_ConditionUpdate()
@@ -1357,6 +1462,7 @@ ir.cpp:
 #  306|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  306|     r2_4(int)        = Add                : r2_3, r2_1
 #  306|     mu2_5(int)       = Store              : &:r2_2, r2_4
+#  306|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 1
 
 #  309|   Block 3
@@ -1391,6 +1497,7 @@ ir.cpp:
 #  312|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  312|     r2_4(int)        = Add                : r2_3, r2_1
 #  312|     mu2_5(int)       = Store              : &:r2_2, r2_4
+#  312|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 1
 
 #  315|   Block 3
@@ -1424,6 +1531,7 @@ ir.cpp:
 #  318|     r2_2(int)        = Load               : &:r2_1, ~mu0_2
 #  318|     r2_3(int)        = Add                : r2_2, r2_0
 #  318|     mu2_4(int)       = Store              : &:r2_1, r2_3
+#  318|     r2_5(glval<int>) = CopyValue          : r2_1
 #-----|   Goto (back edge) -> Block 1
 
 #  319|   Block 3
@@ -1485,6 +1593,7 @@ ir.cpp:
 #  326|     r4_3(int)        = Load               : &:r4_2, ~mu0_2
 #  326|     r4_4(int)        = Add                : r4_3, r4_1
 #  326|     mu4_5(int)       = Store              : &:r4_2, r4_4
+#  326|     r4_6(glval<int>) = CopyValue          : r4_2
 #-----|   Goto (back edge) -> Block 1
 
 #  331|   Block 5
@@ -1545,16 +1654,18 @@ ir.cpp:
 #  342|     r0_5(int)           = Constant[1]              : 
 #  342|     r0_6(glval<int *>)  = VariableAddress[p]       : 
 #  342|     r0_7(int *)         = Load                     : &:r0_6, ~mu0_2
-#  342|     mu0_8(int)          = Store                    : &:r0_7, r0_5
-#  343|     r0_9(glval<int>)    = VariableAddress[#return] : 
-#  343|     r0_10(glval<int *>) = VariableAddress[p]       : 
-#  343|     r0_11(int *)        = Load                     : &:r0_10, ~mu0_2
-#  343|     r0_12(int)          = Load                     : &:r0_11, ~mu0_2
-#  343|     mu0_13(int)         = Store                    : &:r0_9, r0_12
-#  341|     r0_14(glval<int>)   = VariableAddress[#return] : 
-#  341|     v0_15(void)         = ReturnValue              : &:r0_14, ~mu0_2
-#  341|     v0_16(void)         = UnmodeledUse             : mu*
-#  341|     v0_17(void)         = ExitFunction             : 
+#  342|     r0_8(glval<int>)    = CopyValue                : r0_7
+#  342|     mu0_9(int)          = Store                    : &:r0_8, r0_5
+#  342|     r0_10(glval<int>)   = CopyValue                : r0_8
+#  343|     r0_11(glval<int>)   = VariableAddress[#return] : 
+#  343|     r0_12(glval<int *>) = VariableAddress[p]       : 
+#  343|     r0_13(int *)        = Load                     : &:r0_12, ~mu0_2
+#  343|     r0_14(int)          = Load                     : &:r0_13, ~mu0_2
+#  343|     mu0_15(int)         = Store                    : &:r0_11, r0_14
+#  341|     r0_16(glval<int>)   = VariableAddress[#return] : 
+#  341|     v0_17(void)         = ReturnValue              : &:r0_16, ~mu0_2
+#  341|     v0_18(void)         = UnmodeledUse             : mu*
+#  341|     v0_19(void)         = ExitFunction             : 
 
 #  348| int* AddressOf()
 #  348|   Block 0
@@ -1563,11 +1674,12 @@ ir.cpp:
 #  348|     mu0_2(unknown)     = UnmodeledDefinition      : 
 #  349|     r0_3(glval<int *>) = VariableAddress[#return] : 
 #  349|     r0_4(glval<int>)   = VariableAddress[g]       : 
-#  349|     mu0_5(int *)       = Store                    : &:r0_3, r0_4
-#  348|     r0_6(glval<int *>) = VariableAddress[#return] : 
-#  348|     v0_7(void)         = ReturnValue              : &:r0_6, ~mu0_2
-#  348|     v0_8(void)         = UnmodeledUse             : mu*
-#  348|     v0_9(void)         = ExitFunction             : 
+#  349|     r0_5(int *)        = CopyValue                : r0_4
+#  349|     mu0_6(int *)       = Store                    : &:r0_3, r0_5
+#  348|     r0_7(glval<int *>) = VariableAddress[#return] : 
+#  348|     v0_8(void)         = ReturnValue              : &:r0_7, ~mu0_2
+#  348|     v0_9(void)         = UnmodeledUse             : mu*
+#  348|     v0_10(void)        = ExitFunction             : 
 
 #  352| void Break(int)
 #  352|   Block 0
@@ -1597,6 +1709,7 @@ ir.cpp:
 #  356|     r3_2(int)        = Load               : &:r3_1, ~mu0_2
 #  356|     r3_3(int)        = Sub                : r3_2, r3_0
 #  356|     mu3_4(int)       = Store              : &:r3_1, r3_3
+#  356|     r3_5(glval<int>) = CopyValue          : r3_1
 #-----|   Goto (back edge) -> Block 5
 
 #  357|   Block 4
@@ -1643,6 +1756,7 @@ ir.cpp:
 #  365|     r3_2(int)        = Load               : &:r3_1, ~mu0_2
 #  365|     r3_3(int)        = Sub                : r3_2, r3_0
 #  365|     mu3_4(int)       = Store              : &:r3_1, r3_3
+#  365|     r3_5(glval<int>) = CopyValue          : r3_1
 #-----|   Goto -> Block 4
 
 #  361|   Block 4
@@ -1717,11 +1831,12 @@ ir.cpp:
 #  381|     r0_15(int)            = Load                      : &:r0_14, ~mu0_2
 #  381|     r0_16(int)            = Call                      : func:r0_11, 0:r0_13, 1:r0_15
 #  381|     mu0_17(unknown)       = ^CallSideEffect           : ~mu0_2
-#  381|     mu0_18(int)           = Store                     : &:r0_7, r0_16
-#  380|     r0_19(glval<int>)     = VariableAddress[#return]  : 
-#  380|     v0_20(void)           = ReturnValue               : &:r0_19, ~mu0_2
-#  380|     v0_21(void)           = UnmodeledUse              : mu*
-#  380|     v0_22(void)           = ExitFunction              : 
+#  381|     r0_18(int)            = CopyValue                 : r0_16
+#  381|     mu0_19(int)           = Store                     : &:r0_7, r0_18
+#  380|     r0_20(glval<int>)     = VariableAddress[#return]  : 
+#  380|     v0_21(void)           = ReturnValue               : &:r0_20, ~mu0_2
+#  380|     v0_22(void)           = UnmodeledUse              : mu*
+#  380|     v0_23(void)           = ExitFunction              : 
 
 #  384| void Switch(int)
 #  384|   Block 0
@@ -1746,6 +1861,7 @@ ir.cpp:
 #  387|     r1_0(int)        = Constant[1234]     : 
 #  387|     r1_1(glval<int>) = VariableAddress[y] : 
 #  387|     mu1_2(int)       = Store              : &:r1_1, r1_0
+#  387|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 2
 
 #  389|   Block 2
@@ -1753,7 +1869,8 @@ ir.cpp:
 #  390|     r2_1(int)        = Constant[-1]       : 
 #  390|     r2_2(glval<int>) = VariableAddress[y] : 
 #  390|     mu2_3(int)       = Store              : &:r2_2, r2_1
-#  391|     v2_4(void)       = NoOp               : 
+#  390|     r2_4(glval<int>) = CopyValue          : r2_2
+#  391|     v2_5(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  393|   Block 3
@@ -1765,7 +1882,8 @@ ir.cpp:
 #  395|     r4_1(int)        = Constant[1]        : 
 #  395|     r4_2(glval<int>) = VariableAddress[y] : 
 #  395|     mu4_3(int)       = Store              : &:r4_2, r4_1
-#  396|     v4_4(void)       = NoOp               : 
+#  395|     r4_4(glval<int>) = CopyValue          : r4_2
+#  396|     v4_5(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  398|   Block 5
@@ -1773,6 +1891,7 @@ ir.cpp:
 #  399|     r5_1(int)        = Constant[3]        : 
 #  399|     r5_2(glval<int>) = VariableAddress[y] : 
 #  399|     mu5_3(int)       = Store              : &:r5_2, r5_1
+#  399|     r5_4(glval<int>) = CopyValue          : r5_2
 #-----|   Goto -> Block 6
 
 #  400|   Block 6
@@ -1780,7 +1899,8 @@ ir.cpp:
 #  401|     r6_1(int)        = Constant[4]        : 
 #  401|     r6_2(glval<int>) = VariableAddress[y] : 
 #  401|     mu6_3(int)       = Store              : &:r6_2, r6_1
-#  402|     v6_4(void)       = NoOp               : 
+#  401|     r6_4(glval<int>) = CopyValue          : r6_2
+#  402|     v6_5(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  404|   Block 7
@@ -1788,13 +1908,15 @@ ir.cpp:
 #  405|     r7_1(int)        = Constant[0]        : 
 #  405|     r7_2(glval<int>) = VariableAddress[y] : 
 #  405|     mu7_3(int)       = Store              : &:r7_2, r7_1
-#  406|     v7_4(void)       = NoOp               : 
+#  405|     r7_4(glval<int>) = CopyValue          : r7_2
+#  406|     v7_5(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  408|   Block 8
 #  408|     r8_0(int)        = Constant[5678]     : 
 #  408|     r8_1(glval<int>) = VariableAddress[y] : 
 #  408|     mu8_2(int)       = Store              : &:r8_1, r8_0
+#  408|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 9
 
 #  409|   Block 9
@@ -1831,20 +1953,23 @@ ir.cpp:
 #  428|     r0_6(glval<Point>)  = VariableAddress[pt] : 
 #  428|     r0_7(glval<int>)    = FieldAddress[x]     : r0_6
 #  428|     mu0_8(int)          = Store               : &:r0_7, r0_5
-#  429|     r0_9(glval<Point>)  = VariableAddress[pt] : 
-#  429|     r0_10(glval<int>)   = FieldAddress[x]     : r0_9
-#  429|     r0_11(int)          = Load                : &:r0_10, ~mu0_2
-#  429|     r0_12(glval<Point>) = VariableAddress[pt] : 
-#  429|     r0_13(glval<int>)   = FieldAddress[y]     : r0_12
-#  429|     mu0_14(int)         = Store               : &:r0_13, r0_11
-#  430|     r0_15(glval<int *>) = VariableAddress[p]  : 
-#  430|     r0_16(glval<Point>) = VariableAddress[pt] : 
-#  430|     r0_17(glval<int>)   = FieldAddress[y]     : r0_16
-#  430|     mu0_18(int *)       = Store               : &:r0_15, r0_17
-#  431|     v0_19(void)         = NoOp                : 
-#  426|     v0_20(void)         = ReturnVoid          : 
-#  426|     v0_21(void)         = UnmodeledUse        : mu*
-#  426|     v0_22(void)         = ExitFunction        : 
+#  428|     r0_9(glval<int>)    = CopyValue           : r0_7
+#  429|     r0_10(glval<Point>) = VariableAddress[pt] : 
+#  429|     r0_11(glval<int>)   = FieldAddress[x]     : r0_10
+#  429|     r0_12(int)          = Load                : &:r0_11, ~mu0_2
+#  429|     r0_13(glval<Point>) = VariableAddress[pt] : 
+#  429|     r0_14(glval<int>)   = FieldAddress[y]     : r0_13
+#  429|     mu0_15(int)         = Store               : &:r0_14, r0_12
+#  429|     r0_16(glval<int>)   = CopyValue           : r0_14
+#  430|     r0_17(glval<int *>) = VariableAddress[p]  : 
+#  430|     r0_18(glval<Point>) = VariableAddress[pt] : 
+#  430|     r0_19(glval<int>)   = FieldAddress[y]     : r0_18
+#  430|     r0_20(int *)        = CopyValue           : r0_19
+#  430|     mu0_21(int *)       = Store               : &:r0_17, r0_20
+#  431|     v0_22(void)         = NoOp                : 
+#  426|     v0_23(void)         = ReturnVoid          : 
+#  426|     v0_24(void)         = UnmodeledUse        : mu*
+#  426|     v0_25(void)         = ExitFunction        : 
 
 #  433| void LogicalOr(bool, bool)
 #  433|   Block 0
@@ -1874,6 +1999,7 @@ ir.cpp:
 #  436|     r2_0(int)        = Constant[7]        : 
 #  436|     r2_1(glval<int>) = VariableAddress[x] : 
 #  436|     mu2_2(int)       = Store              : &:r2_1, r2_0
+#  436|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #  439|   Block 3
@@ -1894,12 +2020,14 @@ ir.cpp:
 #  440|     r5_0(int)        = Constant[1]        : 
 #  440|     r5_1(glval<int>) = VariableAddress[x] : 
 #  440|     mu5_2(int)       = Store              : &:r5_1, r5_0
+#  440|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 7
 
 #  443|   Block 6
 #  443|     r6_0(int)        = Constant[5]        : 
 #  443|     r6_1(glval<int>) = VariableAddress[x] : 
 #  443|     mu6_2(int)       = Store              : &:r6_1, r6_0
+#  443|     r6_3(glval<int>) = CopyValue          : r6_1
 #-----|   Goto -> Block 7
 
 #  445|   Block 7
@@ -1936,6 +2064,7 @@ ir.cpp:
 #  450|     r2_0(int)        = Constant[7]        : 
 #  450|     r2_1(glval<int>) = VariableAddress[x] : 
 #  450|     mu2_2(int)       = Store              : &:r2_1, r2_0
+#  450|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #  453|   Block 3
@@ -1956,12 +2085,14 @@ ir.cpp:
 #  454|     r5_0(int)        = Constant[1]        : 
 #  454|     r5_1(glval<int>) = VariableAddress[x] : 
 #  454|     mu5_2(int)       = Store              : &:r5_1, r5_0
+#  454|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 7
 
 #  457|   Block 6
 #  457|     r6_0(int)        = Constant[5]        : 
 #  457|     r6_1(glval<int>) = VariableAddress[x] : 
 #  457|     mu6_2(int)       = Store              : &:r6_1, r6_0
+#  457|     r6_3(glval<int>) = CopyValue          : r6_1
 #-----|   Goto -> Block 7
 
 #  459|   Block 7
@@ -1991,6 +2122,7 @@ ir.cpp:
 #  464|     r1_0(int)        = Constant[1]        : 
 #  464|     r1_1(glval<int>) = VariableAddress[x] : 
 #  464|     mu1_2(int)       = Store              : &:r1_1, r1_0
+#  464|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 2
 
 #  467|   Block 2
@@ -2011,12 +2143,14 @@ ir.cpp:
 #  468|     r4_0(int)        = Constant[2]        : 
 #  468|     r4_1(glval<int>) = VariableAddress[x] : 
 #  468|     mu4_2(int)       = Store              : &:r4_1, r4_0
+#  468|     r4_3(glval<int>) = CopyValue          : r4_1
 #-----|   Goto -> Block 6
 
 #  471|   Block 5
 #  471|     r5_0(int)        = Constant[3]        : 
 #  471|     r5_1(glval<int>) = VariableAddress[x] : 
 #  471|     mu5_2(int)       = Store              : &:r5_1, r5_0
+#  471|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 6
 
 #  473|   Block 6
@@ -2060,9 +2194,10 @@ ir.cpp:
 #  478|     r3_1(bool)        = Load                        : &:r3_0, ~mu0_2
 #  478|     r3_2(glval<bool>) = VariableAddress[x]          : 
 #  478|     mu3_3(bool)       = Store                       : &:r3_2, r3_1
-#  479|     r3_4(glval<bool>) = VariableAddress[a]          : 
-#  479|     r3_5(bool)        = Load                        : &:r3_4, ~mu0_2
-#  479|     v3_6(void)        = ConditionalBranch           : r3_5
+#  478|     r3_4(glval<bool>) = CopyValue                   : r3_2
+#  479|     r3_5(glval<bool>) = VariableAddress[a]          : 
+#  479|     r3_6(bool)        = Load                        : &:r3_5, ~mu0_2
+#  479|     v3_7(void)        = ConditionalBranch           : r3_6
 #-----|   False -> Block 9
 #-----|   True -> Block 8
 
@@ -2091,10 +2226,11 @@ ir.cpp:
 #  479|     r7_2(bool)        = LogicalNot                   : r7_1
 #  479|     r7_3(glval<bool>) = VariableAddress[x]           : 
 #  479|     mu7_4(bool)       = Store                        : &:r7_3, r7_2
-#  480|     v7_5(void)        = NoOp                         : 
-#  475|     v7_6(void)        = ReturnVoid                   : 
-#  475|     v7_7(void)        = UnmodeledUse                 : mu*
-#  475|     v7_8(void)        = ExitFunction                 : 
+#  479|     r7_5(glval<bool>) = CopyValue                    : r7_3
+#  480|     v7_6(void)        = NoOp                         : 
+#  475|     v7_7(void)        = ReturnVoid                   : 
+#  475|     v7_8(void)        = UnmodeledUse                 : mu*
+#  475|     v7_9(void)        = ExitFunction                 : 
 
 #  479|   Block 8
 #  479|     r8_0(glval<bool>) = VariableAddress[#temp479:11] : 
@@ -2120,9 +2256,10 @@ ir.cpp:
 #  477|     r11_1(bool)        = Load                        : &:r11_0, ~mu0_2
 #  477|     r11_2(glval<bool>) = VariableAddress[x]          : 
 #  477|     mu11_3(bool)       = Store                       : &:r11_2, r11_1
-#  478|     r11_4(glval<bool>) = VariableAddress[a]          : 
-#  478|     r11_5(bool)        = Load                        : &:r11_4, ~mu0_2
-#  478|     v11_6(void)        = ConditionalBranch           : r11_5
+#  477|     r11_4(glval<bool>) = CopyValue                   : r11_2
+#  478|     r11_5(glval<bool>) = VariableAddress[a]          : 
+#  478|     r11_6(bool)        = Load                        : &:r11_5, ~mu0_2
+#  478|     v11_7(void)        = ConditionalBranch           : r11_6
 #-----|   False -> Block 5
 #-----|   True -> Block 4
 
@@ -2195,10 +2332,11 @@ ir.cpp:
 #  489|     r1_0(glval<int>) = VariableAddress[#temp489:6] : 
 #  489|     r1_1(glval<int>) = Load                        : &:r1_0, ~mu0_2
 #  489|     mu1_2(int)       = Store                       : &:r1_1, r0_9
-#  490|     v1_3(void)       = NoOp                        : 
-#  486|     v1_4(void)       = ReturnVoid                  : 
-#  486|     v1_5(void)       = UnmodeledUse                : mu*
-#  486|     v1_6(void)       = ExitFunction                : 
+#  489|     r1_3(glval<int>) = CopyValue                   : r1_1
+#  490|     v1_4(void)       = NoOp                        : 
+#  486|     v1_5(void)       = ReturnVoid                  : 
+#  486|     v1_6(void)       = UnmodeledUse                : mu*
+#  486|     v1_7(void)       = ExitFunction                : 
 
 #  489|   Block 2
 #  489|     r2_0(glval<int>) = VariableAddress[x]          : 
@@ -2257,13 +2395,15 @@ ir.cpp:
 #  499|     r0_9(int *)         = Constant[0]         : 
 #  499|     r0_10(glval<int *>) = VariableAddress[p]  : 
 #  499|     mu0_11(int *)       = Store               : &:r0_10, r0_9
-#  500|     r0_12(int *)        = Constant[0]         : 
-#  500|     r0_13(glval<int *>) = VariableAddress[q]  : 
-#  500|     mu0_14(int *)       = Store               : &:r0_13, r0_12
-#  501|     v0_15(void)         = NoOp                : 
-#  496|     v0_16(void)         = ReturnVoid          : 
-#  496|     v0_17(void)         = UnmodeledUse        : mu*
-#  496|     v0_18(void)         = ExitFunction        : 
+#  499|     r0_12(glval<int *>) = CopyValue           : r0_10
+#  500|     r0_13(int *)        = Constant[0]         : 
+#  500|     r0_14(glval<int *>) = VariableAddress[q]  : 
+#  500|     mu0_15(int *)       = Store               : &:r0_14, r0_13
+#  500|     r0_16(glval<int *>) = CopyValue           : r0_14
+#  501|     v0_17(void)         = NoOp                : 
+#  496|     v0_18(void)         = ReturnVoid          : 
+#  496|     v0_19(void)         = UnmodeledUse        : mu*
+#  496|     v0_20(void)         = ExitFunction        : 
 
 #  503| void InitList(int, float)
 #  503|   Block 0
@@ -2491,7 +2631,8 @@ ir.cpp:
 #  540|     r3_1(int)        = Load               : &:r3_0, ~mu0_2
 #  540|     r3_2(glval<int>) = VariableAddress[y] : 
 #  540|     mu3_3(int)       = Store              : &:r3_2, r3_1
-#  541|     v3_4(void)       = NoOp               : 
+#  540|     r3_4(glval<int>) = CopyValue          : r3_2
+#  541|     v3_5(void)       = NoOp               : 
 #-----|   Goto -> Block 1
 
 #  543| int EarlyReturnValue(int, int)
@@ -2687,18 +2828,27 @@ ir.cpp:
 #  591|     r0_4(glval<..(*)(..)>)  = FunctionAddress[FuncPtrTarget] : 
 #  591|     mu0_5(..(*)(..))        = Store                          : &:r0_3, r0_4
 #  592|     r0_6(glval<..()(..)>)   = FunctionAddress[FuncPtrTarget] : 
-#  592|     r0_7(glval<..(*)(..)>)  = VariableAddress[pfn]           : 
-#  592|     mu0_8(..(*)(..))        = Store                          : &:r0_7, r0_6
-#  593|     r0_9(glval<..(*)(..)>)  = FunctionAddress[FuncPtrTarget] : 
-#  593|     r0_10(glval<..(*)(..)>) = VariableAddress[pfn]           : 
-#  593|     mu0_11(..(*)(..))       = Store                          : &:r0_10, r0_9
-#  594|     r0_12(glval<..()(..)>)  = FunctionAddress[FuncPtrTarget] : 
-#  594|     r0_13(glval<..(*)(..)>) = VariableAddress[pfn]           : 
-#  594|     mu0_14(..(*)(..))       = Store                          : &:r0_13, r0_12
-#  595|     v0_15(void)             = NoOp                           : 
-#  590|     v0_16(void)             = ReturnVoid                     : 
-#  590|     v0_17(void)             = UnmodeledUse                   : mu*
-#  590|     v0_18(void)             = ExitFunction                   : 
+#  592|     r0_7(..(*)(..))         = CopyValue                      : r0_6
+#  592|     r0_8(glval<..(*)(..)>)  = VariableAddress[pfn]           : 
+#  592|     mu0_9(..(*)(..))        = Store                          : &:r0_8, r0_7
+#  592|     r0_10(glval<..(*)(..)>) = CopyValue                      : r0_8
+#  593|     r0_11(glval<..(*)(..)>) = FunctionAddress[FuncPtrTarget] : 
+#  593|     r0_12(..(*)(..))        = CopyValue                      : r0_11
+#  593|     r0_13(glval<..(*)(..)>) = VariableAddress[pfn]           : 
+#  593|     mu0_14(..(*)(..))       = Store                          : &:r0_13, r0_12
+#  593|     r0_15(glval<..(*)(..)>) = CopyValue                      : r0_13
+#  594|     r0_16(glval<..()(..)>)  = FunctionAddress[FuncPtrTarget] : 
+#  594|     r0_17(..(*)(..))        = CopyValue                      : r0_16
+#  594|     r0_18(..(*)(..))        = CopyValue                      : r0_17
+#  594|     r0_19(..(*)(..))        = CopyValue                      : r0_18
+#  594|     r0_20(..(*)(..))        = CopyValue                      : r0_19
+#  594|     r0_21(glval<..(*)(..)>) = VariableAddress[pfn]           : 
+#  594|     mu0_22(..(*)(..))       = Store                          : &:r0_21, r0_20
+#  594|     r0_23(glval<..(*)(..)>) = CopyValue                      : r0_21
+#  595|     v0_24(void)             = NoOp                           : 
+#  590|     v0_25(void)             = ReturnVoid                     : 
+#  590|     v0_26(void)             = UnmodeledUse                   : mu*
+#  590|     v0_27(void)             = ExitFunction                   : 
 
 #  615| void DeclareObject()
 #  615|   Block 0
@@ -2744,25 +2894,26 @@ ir.cpp:
 #  622|     mu0_8(String)          = InitializeParameter[s] : &:r0_7
 #  623|     r0_9(glval<String &>)  = VariableAddress[r]     : 
 #  623|     r0_10(String &)        = Load                   : &:r0_9, ~mu0_2
-#  623|     r0_11(glval<String>)   = Convert                : r0_10
-#  623|     r0_12(glval<unknown>)  = FunctionAddress[c_str] : 
-#  623|     r0_13(char *)          = Call                   : func:r0_12, this:r0_11
-#  623|     mu0_14(unknown)        = ^CallSideEffect        : ~mu0_2
-#  624|     r0_15(glval<String *>) = VariableAddress[p]     : 
-#  624|     r0_16(String *)        = Load                   : &:r0_15, ~mu0_2
-#  624|     r0_17(String *)        = Convert                : r0_16
-#  624|     r0_18(glval<unknown>)  = FunctionAddress[c_str] : 
-#  624|     r0_19(char *)          = Call                   : func:r0_18, this:r0_17
-#  624|     mu0_20(unknown)        = ^CallSideEffect        : ~mu0_2
-#  625|     r0_21(glval<String>)   = VariableAddress[s]     : 
-#  625|     r0_22(glval<String>)   = Convert                : r0_21
-#  625|     r0_23(glval<unknown>)  = FunctionAddress[c_str] : 
-#  625|     r0_24(char *)          = Call                   : func:r0_23, this:r0_22
-#  625|     mu0_25(unknown)        = ^CallSideEffect        : ~mu0_2
-#  626|     v0_26(void)            = NoOp                   : 
-#  622|     v0_27(void)            = ReturnVoid             : 
-#  622|     v0_28(void)            = UnmodeledUse           : mu*
-#  622|     v0_29(void)            = ExitFunction           : 
+#  623|     r0_11(glval<String>)   = CopyValue              : r0_10
+#  623|     r0_12(glval<String>)   = Convert                : r0_11
+#  623|     r0_13(glval<unknown>)  = FunctionAddress[c_str] : 
+#  623|     r0_14(char *)          = Call                   : func:r0_13, this:r0_12
+#  623|     mu0_15(unknown)        = ^CallSideEffect        : ~mu0_2
+#  624|     r0_16(glval<String *>) = VariableAddress[p]     : 
+#  624|     r0_17(String *)        = Load                   : &:r0_16, ~mu0_2
+#  624|     r0_18(String *)        = Convert                : r0_17
+#  624|     r0_19(glval<unknown>)  = FunctionAddress[c_str] : 
+#  624|     r0_20(char *)          = Call                   : func:r0_19, this:r0_18
+#  624|     mu0_21(unknown)        = ^CallSideEffect        : ~mu0_2
+#  625|     r0_22(glval<String>)   = VariableAddress[s]     : 
+#  625|     r0_23(glval<String>)   = Convert                : r0_22
+#  625|     r0_24(glval<unknown>)  = FunctionAddress[c_str] : 
+#  625|     r0_25(char *)          = Call                   : func:r0_24, this:r0_23
+#  625|     mu0_26(unknown)        = ^CallSideEffect        : ~mu0_2
+#  626|     v0_27(void)            = NoOp                   : 
+#  622|     v0_28(void)            = ReturnVoid             : 
+#  622|     v0_29(void)            = UnmodeledUse           : mu*
+#  622|     v0_30(void)            = ExitFunction           : 
 
 #  630| int C::StaticMemberFunction(int)
 #  630|   Block 0
@@ -2824,35 +2975,43 @@ ir.cpp:
 #  643|     r0_5(C *)         = CopyValue           : r0_3
 #  643|     r0_6(glval<int>)  = FieldAddress[m_a]   : r0_5
 #  643|     mu0_7(int)        = Store               : &:r0_6, r0_4
-#  644|     r0_8(int)         = Constant[1]         : 
-#  644|     r0_9(C *)         = CopyValue           : r0_3
-#  644|     r0_10(glval<int>) = FieldAddress[m_a]   : r0_9
-#  644|     mu0_11(int)       = Store               : &:r0_10, r0_8
-#  645|     r0_12(int)        = Constant[2]         : 
-#-----|     r0_13(C *)        = CopyValue           : r0_3
-#  645|     r0_14(glval<int>) = FieldAddress[m_a]   : r0_13
-#  645|     mu0_15(int)       = Store               : &:r0_14, r0_12
-#  646|     r0_16(glval<int>) = VariableAddress[x]  : 
-#  646|     mu0_17(int)       = Uninitialized[x]    : &:r0_16
-#  647|     r0_18(C *)        = CopyValue           : r0_3
-#  647|     r0_19(glval<int>) = FieldAddress[m_a]   : r0_18
-#  647|     r0_20(int)        = Load                : &:r0_19, ~mu0_2
-#  647|     r0_21(glval<int>) = VariableAddress[x]  : 
-#  647|     mu0_22(int)       = Store               : &:r0_21, r0_20
-#  648|     r0_23(C *)        = CopyValue           : r0_3
-#  648|     r0_24(glval<int>) = FieldAddress[m_a]   : r0_23
-#  648|     r0_25(int)        = Load                : &:r0_24, ~mu0_2
-#  648|     r0_26(glval<int>) = VariableAddress[x]  : 
-#  648|     mu0_27(int)       = Store               : &:r0_26, r0_25
-#-----|     r0_28(C *)        = CopyValue           : r0_3
-#  649|     r0_29(glval<int>) = FieldAddress[m_a]   : r0_28
-#  649|     r0_30(int)        = Load                : &:r0_29, ~mu0_2
-#  649|     r0_31(glval<int>) = VariableAddress[x]  : 
-#  649|     mu0_32(int)       = Store               : &:r0_31, r0_30
-#  650|     v0_33(void)       = NoOp                : 
-#  642|     v0_34(void)       = ReturnVoid          : 
-#  642|     v0_35(void)       = UnmodeledUse        : mu*
-#  642|     v0_36(void)       = ExitFunction        : 
+#  643|     r0_8(glval<int>)  = CopyValue           : r0_6
+#  644|     r0_9(int)         = Constant[1]         : 
+#  644|     r0_10(C *)        = CopyValue           : r0_3
+#  644|     r0_11(glval<C>)   = CopyValue           : r0_10
+#  644|     r0_12(glval<int>) = FieldAddress[m_a]   : r0_11
+#  644|     mu0_13(int)       = Store               : &:r0_12, r0_9
+#  644|     r0_14(glval<int>) = CopyValue           : r0_12
+#  645|     r0_15(int)        = Constant[2]         : 
+#-----|     r0_16(C *)        = CopyValue           : r0_3
+#  645|     r0_17(glval<int>) = FieldAddress[m_a]   : r0_16
+#  645|     mu0_18(int)       = Store               : &:r0_17, r0_15
+#  645|     r0_19(glval<int>) = CopyValue           : r0_17
+#  646|     r0_20(glval<int>) = VariableAddress[x]  : 
+#  646|     mu0_21(int)       = Uninitialized[x]    : &:r0_20
+#  647|     r0_22(C *)        = CopyValue           : r0_3
+#  647|     r0_23(glval<int>) = FieldAddress[m_a]   : r0_22
+#  647|     r0_24(int)        = Load                : &:r0_23, ~mu0_2
+#  647|     r0_25(glval<int>) = VariableAddress[x]  : 
+#  647|     mu0_26(int)       = Store               : &:r0_25, r0_24
+#  647|     r0_27(glval<int>) = CopyValue           : r0_25
+#  648|     r0_28(C *)        = CopyValue           : r0_3
+#  648|     r0_29(glval<C>)   = CopyValue           : r0_28
+#  648|     r0_30(glval<int>) = FieldAddress[m_a]   : r0_29
+#  648|     r0_31(int)        = Load                : &:r0_30, ~mu0_2
+#  648|     r0_32(glval<int>) = VariableAddress[x]  : 
+#  648|     mu0_33(int)       = Store               : &:r0_32, r0_31
+#  648|     r0_34(glval<int>) = CopyValue           : r0_32
+#-----|     r0_35(C *)        = CopyValue           : r0_3
+#  649|     r0_36(glval<int>) = FieldAddress[m_a]   : r0_35
+#  649|     r0_37(int)        = Load                : &:r0_36, ~mu0_2
+#  649|     r0_38(glval<int>) = VariableAddress[x]  : 
+#  649|     mu0_39(int)       = Store               : &:r0_38, r0_37
+#  649|     r0_40(glval<int>) = CopyValue           : r0_38
+#  650|     v0_41(void)       = NoOp                : 
+#  642|     v0_42(void)       = ReturnVoid          : 
+#  642|     v0_43(void)       = UnmodeledUse        : mu*
+#  642|     v0_44(void)       = ExitFunction        : 
 
 #  652| void C::MethodCalls()
 #  652|   Block 0
@@ -2866,19 +3025,20 @@ ir.cpp:
 #  653|     r0_7(int)             = Call                                    : func:r0_5, this:r0_4, 0:r0_6
 #  653|     mu0_8(unknown)        = ^CallSideEffect                         : ~mu0_2
 #  654|     r0_9(C *)             = CopyValue                               : r0_3
-#  654|     r0_10(glval<unknown>) = FunctionAddress[InstanceMemberFunction] : 
-#  654|     r0_11(int)            = Constant[1]                             : 
-#  654|     r0_12(int)            = Call                                    : func:r0_10, this:r0_9, 0:r0_11
-#  654|     mu0_13(unknown)       = ^CallSideEffect                         : ~mu0_2
-#-----|     r0_14(C *)            = CopyValue                               : r0_3
-#  655|     r0_15(glval<unknown>) = FunctionAddress[InstanceMemberFunction] : 
-#  655|     r0_16(int)            = Constant[2]                             : 
-#  655|     r0_17(int)            = Call                                    : func:r0_15, this:r0_14, 0:r0_16
-#  655|     mu0_18(unknown)       = ^CallSideEffect                         : ~mu0_2
-#  656|     v0_19(void)           = NoOp                                    : 
-#  652|     v0_20(void)           = ReturnVoid                              : 
-#  652|     v0_21(void)           = UnmodeledUse                            : mu*
-#  652|     v0_22(void)           = ExitFunction                            : 
+#  654|     r0_10(glval<C>)       = CopyValue                               : r0_9
+#  654|     r0_11(glval<unknown>) = FunctionAddress[InstanceMemberFunction] : 
+#  654|     r0_12(int)            = Constant[1]                             : 
+#  654|     r0_13(int)            = Call                                    : func:r0_11, this:r0_10, 0:r0_12
+#  654|     mu0_14(unknown)       = ^CallSideEffect                         : ~mu0_2
+#-----|     r0_15(C *)            = CopyValue                               : r0_3
+#  655|     r0_16(glval<unknown>) = FunctionAddress[InstanceMemberFunction] : 
+#  655|     r0_17(int)            = Constant[2]                             : 
+#  655|     r0_18(int)            = Call                                    : func:r0_16, this:r0_15, 0:r0_17
+#  655|     mu0_19(unknown)       = ^CallSideEffect                         : ~mu0_2
+#  656|     v0_20(void)           = NoOp                                    : 
+#  652|     v0_21(void)           = ReturnVoid                              : 
+#  652|     v0_22(void)           = UnmodeledUse                            : mu*
+#  652|     v0_23(void)           = ExitFunction                            : 
 
 #  658| void C::C()
 #  658|   Block 0
@@ -2934,11 +3094,12 @@ ir.cpp:
 #  679|     mu0_2(unknown)     = UnmodeledDefinition      : 
 #  680|     r0_3(glval<int &>) = VariableAddress[#return] : 
 #  680|     r0_4(glval<int>)   = VariableAddress[g]       : 
-#  680|     mu0_5(int &)       = Store                    : &:r0_3, r0_4
-#  679|     r0_6(glval<int &>) = VariableAddress[#return] : 
-#  679|     v0_7(void)         = ReturnValue              : &:r0_6, ~mu0_2
-#  679|     v0_8(void)         = UnmodeledUse             : mu*
-#  679|     v0_9(void)         = ExitFunction             : 
+#  680|     r0_5(int &)        = CopyValue                : r0_4
+#  680|     mu0_6(int &)       = Store                    : &:r0_3, r0_5
+#  679|     r0_7(glval<int &>) = VariableAddress[#return] : 
+#  679|     v0_8(void)         = ReturnValue              : &:r0_7, ~mu0_2
+#  679|     v0_9(void)         = UnmodeledUse             : mu*
+#  679|     v0_10(void)        = ExitFunction             : 
 
 #  685| void InitReference(int)
 #  685|   Block 0
@@ -2949,44 +3110,51 @@ ir.cpp:
 #  685|     mu0_4(int)             = InitializeParameter[x]           : &:r0_3
 #  686|     r0_5(glval<int &>)     = VariableAddress[r]               : 
 #  686|     r0_6(glval<int>)       = VariableAddress[x]               : 
-#  686|     mu0_7(int &)           = Store                            : &:r0_5, r0_6
-#  687|     r0_8(glval<int &>)     = VariableAddress[r2]              : 
-#  687|     r0_9(glval<int &>)     = VariableAddress[r]               : 
-#  687|     r0_10(int &)           = Load                             : &:r0_9, ~mu0_2
-#  687|     mu0_11(int &)          = Store                            : &:r0_8, r0_10
-#  688|     r0_12(glval<String &>) = VariableAddress[r3]              : 
-#  688|     r0_13(glval<unknown>)  = FunctionAddress[ReturnReference] : 
-#  688|     r0_14(String &)        = Call                             : func:r0_13
-#  688|     mu0_15(unknown)        = ^CallSideEffect                  : ~mu0_2
-#  688|     r0_16(glval<String>)   = Convert                          : r0_14
-#  688|     mu0_17(String &)       = Store                            : &:r0_12, r0_16
-#  689|     v0_18(void)            = NoOp                             : 
-#  685|     v0_19(void)            = ReturnVoid                       : 
-#  685|     v0_20(void)            = UnmodeledUse                     : mu*
-#  685|     v0_21(void)            = ExitFunction                     : 
+#  686|     r0_7(int &)            = CopyValue                        : r0_6
+#  686|     mu0_8(int &)           = Store                            : &:r0_5, r0_7
+#  687|     r0_9(glval<int &>)     = VariableAddress[r2]              : 
+#  687|     r0_10(glval<int &>)    = VariableAddress[r]               : 
+#  687|     r0_11(int &)           = Load                             : &:r0_10, ~mu0_2
+#  687|     r0_12(glval<int>)      = CopyValue                        : r0_11
+#  687|     r0_13(int &)           = CopyValue                        : r0_12
+#  687|     mu0_14(int &)          = Store                            : &:r0_9, r0_13
+#  688|     r0_15(glval<String &>) = VariableAddress[r3]              : 
+#  688|     r0_16(glval<unknown>)  = FunctionAddress[ReturnReference] : 
+#  688|     r0_17(String &)        = Call                             : func:r0_16
+#  688|     mu0_18(unknown)        = ^CallSideEffect                  : ~mu0_2
+#  688|     r0_19(glval<String>)   = CopyValue                        : r0_17
+#  688|     r0_20(glval<String>)   = Convert                          : r0_19
+#  688|     r0_21(String &)        = CopyValue                        : r0_20
+#  688|     mu0_22(String &)       = Store                            : &:r0_15, r0_21
+#  689|     v0_23(void)            = NoOp                             : 
+#  685|     v0_24(void)            = ReturnVoid                       : 
+#  685|     v0_25(void)            = UnmodeledUse                     : mu*
+#  685|     v0_26(void)            = ExitFunction                     : 
 
 #  691| void ArrayReferences()
 #  691|   Block 0
-#  691|     v0_0(void)              = EnterFunction       : 
-#  691|     mu0_1(unknown)          = AliasedDefinition   : 
-#  691|     mu0_2(unknown)          = UnmodeledDefinition : 
-#  692|     r0_3(glval<int[10]>)    = VariableAddress[a]  : 
-#  692|     mu0_4(int[10])          = Uninitialized[a]    : &:r0_3
-#  693|     r0_5(glval<int(&)[10]>) = VariableAddress[ra] : 
-#  693|     r0_6(glval<int[10]>)    = VariableAddress[a]  : 
-#  693|     mu0_7(int(&)[10])       = Store               : &:r0_5, r0_6
-#  694|     r0_8(glval<int>)        = VariableAddress[x]  : 
-#  694|     r0_9(glval<int(&)[10]>) = VariableAddress[ra] : 
-#  694|     r0_10(int(&)[10])       = Load                : &:r0_9, ~mu0_2
-#  694|     r0_11(int *)            = Convert             : r0_10
-#  694|     r0_12(int)              = Constant[5]         : 
-#  694|     r0_13(glval<int>)       = PointerAdd[4]       : r0_11, r0_12
-#  694|     r0_14(int)              = Load                : &:r0_13, ~mu0_2
-#  694|     mu0_15(int)             = Store               : &:r0_8, r0_14
-#  695|     v0_16(void)             = NoOp                : 
-#  691|     v0_17(void)             = ReturnVoid          : 
-#  691|     v0_18(void)             = UnmodeledUse        : mu*
-#  691|     v0_19(void)             = ExitFunction        : 
+#  691|     v0_0(void)               = EnterFunction       : 
+#  691|     mu0_1(unknown)           = AliasedDefinition   : 
+#  691|     mu0_2(unknown)           = UnmodeledDefinition : 
+#  692|     r0_3(glval<int[10]>)     = VariableAddress[a]  : 
+#  692|     mu0_4(int[10])           = Uninitialized[a]    : &:r0_3
+#  693|     r0_5(glval<int(&)[10]>)  = VariableAddress[ra] : 
+#  693|     r0_6(glval<int[10]>)     = VariableAddress[a]  : 
+#  693|     r0_7(int(&)[10])         = CopyValue           : r0_6
+#  693|     mu0_8(int(&)[10])        = Store               : &:r0_5, r0_7
+#  694|     r0_9(glval<int>)         = VariableAddress[x]  : 
+#  694|     r0_10(glval<int(&)[10]>) = VariableAddress[ra] : 
+#  694|     r0_11(int(&)[10])        = Load                : &:r0_10, ~mu0_2
+#  694|     r0_12(glval<int[10]>)    = CopyValue           : r0_11
+#  694|     r0_13(int *)             = Convert             : r0_12
+#  694|     r0_14(int)               = Constant[5]         : 
+#  694|     r0_15(glval<int>)        = PointerAdd[4]       : r0_13, r0_14
+#  694|     r0_16(int)               = Load                : &:r0_15, ~mu0_2
+#  694|     mu0_17(int)              = Store               : &:r0_9, r0_16
+#  695|     v0_18(void)              = NoOp                : 
+#  691|     v0_19(void)              = ReturnVoid          : 
+#  691|     v0_20(void)              = UnmodeledUse        : mu*
+#  691|     v0_21(void)              = ExitFunction        : 
 
 #  697| void FunctionReferences()
 #  697|   Block 0
@@ -2995,20 +3163,23 @@ ir.cpp:
 #  697|     mu0_2(unknown)          = UnmodeledDefinition            : 
 #  698|     r0_3(glval<..(&)(..)>)  = VariableAddress[rfn]           : 
 #  698|     r0_4(glval<..()(..)>)   = FunctionAddress[FuncPtrTarget] : 
-#  698|     mu0_5(..(&)(..))        = Store                          : &:r0_3, r0_4
-#  699|     r0_6(glval<..(*)(..)>)  = VariableAddress[pfn]           : 
-#  699|     r0_7(glval<..(&)(..)>)  = VariableAddress[rfn]           : 
-#  699|     r0_8(..(&)(..))         = Load                           : &:r0_7, ~mu0_2
-#  699|     mu0_9(..(*)(..))        = Store                          : &:r0_6, r0_8
-#  700|     r0_10(glval<..(&)(..)>) = VariableAddress[rfn]           : 
-#  700|     r0_11(..(&)(..))        = Load                           : &:r0_10, ~mu0_2
-#  700|     r0_12(int)              = Constant[5]                    : 
-#  700|     r0_13(int)              = Call                           : func:r0_11, 0:r0_12
-#  700|     mu0_14(unknown)         = ^CallSideEffect                : ~mu0_2
-#  701|     v0_15(void)             = NoOp                           : 
-#  697|     v0_16(void)             = ReturnVoid                     : 
-#  697|     v0_17(void)             = UnmodeledUse                   : mu*
-#  697|     v0_18(void)             = ExitFunction                   : 
+#  698|     r0_5(..(&)(..))         = CopyValue                      : r0_4
+#  698|     mu0_6(..(&)(..))        = Store                          : &:r0_3, r0_5
+#  699|     r0_7(glval<..(*)(..)>)  = VariableAddress[pfn]           : 
+#  699|     r0_8(glval<..(&)(..)>)  = VariableAddress[rfn]           : 
+#  699|     r0_9(..(&)(..))         = Load                           : &:r0_8, ~mu0_2
+#  699|     r0_10(..(*)(..))        = CopyValue                      : r0_9
+#  699|     mu0_11(..(*)(..))       = Store                          : &:r0_7, r0_10
+#  700|     r0_12(glval<..(&)(..)>) = VariableAddress[rfn]           : 
+#  700|     r0_13(..(&)(..))        = Load                           : &:r0_12, ~mu0_2
+#  700|     r0_14(..(*)(..))        = CopyValue                      : r0_13
+#  700|     r0_15(int)              = Constant[5]                    : 
+#  700|     r0_16(int)              = Call                           : func:r0_14, 0:r0_15
+#  700|     mu0_17(unknown)         = ^CallSideEffect                : ~mu0_2
+#  701|     v0_18(void)             = NoOp                           : 
+#  697|     v0_19(void)             = ReturnVoid                     : 
+#  697|     v0_20(void)             = UnmodeledUse                   : mu*
+#  697|     v0_21(void)             = ExitFunction                   : 
 
 #  704| int min<int>(int, int)
 #  704|   Block 0
@@ -3166,6 +3337,7 @@ ir.cpp:
 #  731|     r6_4(int)        = Load                         : &:r6_3, ~mu0_2
 #  731|     r6_5(glval<int>) = VariableAddress[x]           : 
 #  731|     mu6_6(int)       = Store                        : &:r6_5, r6_4
+#  731|     r6_7(glval<int>) = CopyValue                    : r6_5
 #-----|   Goto -> Block 8
 
 #  731|   Block 7
@@ -3182,6 +3354,7 @@ ir.cpp:
 #  733|     r8_0(int)        = Constant[7]        : 
 #  733|     r8_1(glval<int>) = VariableAddress[x] : 
 #  733|     mu8_2(int)       = Store              : &:r8_1, r8_0
+#  733|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 14
 
 #  735|   Block 9
@@ -3232,19 +3405,25 @@ ir.cpp:
 #-----|     mu0_5(Base &)        = InitializeParameter[p#0]   : &:r0_4
 #-----|     r0_6(Base *)         = CopyValue                  : r0_3
 #-----|     r0_7(glval<String>)  = FieldAddress[base_s]       : r0_6
-#  745|     r0_8(glval<unknown>) = FunctionAddress[operator=] : 
-#-----|     r0_9(glval<Base &>)  = VariableAddress[p#0]       : 
-#-----|     r0_10(Base &)        = Load                       : &:r0_9, ~mu0_2
-#-----|     r0_11(glval<String>) = FieldAddress[base_s]       : r0_10
-#  745|     r0_12(String &)      = Call                       : func:r0_8, this:r0_7, 0:r0_11
-#  745|     mu0_13(unknown)      = ^CallSideEffect            : ~mu0_2
-#-----|     r0_14(glval<Base &>) = VariableAddress[#return]   : 
-#-----|     r0_15(Base *)        = CopyValue                  : r0_3
-#-----|     mu0_16(Base &)       = Store                      : &:r0_14, r0_15
-#  745|     r0_17(glval<Base &>) = VariableAddress[#return]   : 
-#  745|     v0_18(void)          = ReturnValue                : &:r0_17, ~mu0_2
-#  745|     v0_19(void)          = UnmodeledUse               : mu*
-#  745|     v0_20(void)          = ExitFunction               : 
+#-----|     r0_8(String *)       = CopyValue                  : r0_7
+#  745|     r0_9(glval<unknown>) = FunctionAddress[operator=] : 
+#-----|     r0_10(glval<Base &>) = VariableAddress[p#0]       : 
+#-----|     r0_11(Base &)        = Load                       : &:r0_10, ~mu0_2
+#-----|     r0_12(glval<Base>)   = CopyValue                  : r0_11
+#-----|     r0_13(glval<String>) = FieldAddress[base_s]       : r0_12
+#-----|     r0_14(String &)      = CopyValue                  : r0_13
+#  745|     r0_15(String &)      = Call                       : func:r0_9, this:r0_8, 0:r0_14
+#  745|     mu0_16(unknown)      = ^CallSideEffect            : ~mu0_2
+#-----|     r0_17(glval<String>) = CopyValue                  : r0_15
+#-----|     r0_18(glval<Base &>) = VariableAddress[#return]   : 
+#-----|     r0_19(Base *)        = CopyValue                  : r0_3
+#-----|     r0_20(glval<Base>)   = CopyValue                  : r0_19
+#-----|     r0_21(Base &)        = CopyValue                  : r0_20
+#-----|     mu0_22(Base &)       = Store                      : &:r0_18, r0_21
+#  745|     r0_23(glval<Base &>) = VariableAddress[#return]   : 
+#  745|     v0_24(void)          = ReturnValue                : &:r0_23, ~mu0_2
+#  745|     v0_25(void)          = UnmodeledUse               : mu*
+#  745|     v0_26(void)          = ExitFunction               : 
 
 #  745| void Base::Base(Base const&)
 #  745|   Block 0
@@ -3306,24 +3485,35 @@ ir.cpp:
 #  754|     r0_8(glval<unknown>)   = FunctionAddress[operator=]   : 
 #-----|     r0_9(glval<Middle &>)  = VariableAddress[p#0]         : 
 #-----|     r0_10(Middle &)        = Load                         : &:r0_9, ~mu0_2
-#-----|     r0_11(Base *)          = ConvertToBase[Middle : Base] : r0_10
-#  754|     r0_12(Base &)          = Call                         : func:r0_8, this:r0_7, 0:r0_11
-#  754|     mu0_13(unknown)        = ^CallSideEffect              : ~mu0_2
-#-----|     r0_14(Middle *)        = CopyValue                    : r0_3
-#-----|     r0_15(glval<String>)   = FieldAddress[middle_s]       : r0_14
-#  754|     r0_16(glval<unknown>)  = FunctionAddress[operator=]   : 
-#-----|     r0_17(glval<Middle &>) = VariableAddress[p#0]         : 
-#-----|     r0_18(Middle &)        = Load                         : &:r0_17, ~mu0_2
-#-----|     r0_19(glval<String>)   = FieldAddress[middle_s]       : r0_18
-#  754|     r0_20(String &)        = Call                         : func:r0_16, this:r0_15, 0:r0_19
-#  754|     mu0_21(unknown)        = ^CallSideEffect              : ~mu0_2
-#-----|     r0_22(glval<Middle &>) = VariableAddress[#return]     : 
-#-----|     r0_23(Middle *)        = CopyValue                    : r0_3
-#-----|     mu0_24(Middle &)       = Store                        : &:r0_22, r0_23
-#  754|     r0_25(glval<Middle &>) = VariableAddress[#return]     : 
-#  754|     v0_26(void)            = ReturnValue                  : &:r0_25, ~mu0_2
-#  754|     v0_27(void)            = UnmodeledUse                 : mu*
-#  754|     v0_28(void)            = ExitFunction                 : 
+#-----|     r0_11(glval<Middle>)   = CopyValue                    : r0_10
+#-----|     r0_12(Middle *)        = CopyValue                    : r0_11
+#-----|     r0_13(Base *)          = ConvertToBase[Middle : Base] : r0_12
+#-----|     r0_14(glval<Base>)     = CopyValue                    : r0_13
+#-----|     r0_15(Base &)          = CopyValue                    : r0_14
+#  754|     r0_16(Base &)          = Call                         : func:r0_8, this:r0_7, 0:r0_15
+#  754|     mu0_17(unknown)        = ^CallSideEffect              : ~mu0_2
+#-----|     r0_18(glval<Base>)     = CopyValue                    : r0_16
+#-----|     r0_19(Middle *)        = CopyValue                    : r0_3
+#-----|     r0_20(glval<String>)   = FieldAddress[middle_s]       : r0_19
+#-----|     r0_21(String *)        = CopyValue                    : r0_20
+#  754|     r0_22(glval<unknown>)  = FunctionAddress[operator=]   : 
+#-----|     r0_23(glval<Middle &>) = VariableAddress[p#0]         : 
+#-----|     r0_24(Middle &)        = Load                         : &:r0_23, ~mu0_2
+#-----|     r0_25(glval<Middle>)   = CopyValue                    : r0_24
+#-----|     r0_26(glval<String>)   = FieldAddress[middle_s]       : r0_25
+#-----|     r0_27(String &)        = CopyValue                    : r0_26
+#  754|     r0_28(String &)        = Call                         : func:r0_22, this:r0_21, 0:r0_27
+#  754|     mu0_29(unknown)        = ^CallSideEffect              : ~mu0_2
+#-----|     r0_30(glval<String>)   = CopyValue                    : r0_28
+#-----|     r0_31(glval<Middle &>) = VariableAddress[#return]     : 
+#-----|     r0_32(Middle *)        = CopyValue                    : r0_3
+#-----|     r0_33(glval<Middle>)   = CopyValue                    : r0_32
+#-----|     r0_34(Middle &)        = CopyValue                    : r0_33
+#-----|     mu0_35(Middle &)       = Store                        : &:r0_31, r0_34
+#  754|     r0_36(glval<Middle &>) = VariableAddress[#return]     : 
+#  754|     v0_37(void)            = ReturnValue                  : &:r0_36, ~mu0_2
+#  754|     v0_38(void)            = UnmodeledUse                 : mu*
+#  754|     v0_39(void)            = ExitFunction                 : 
 
 #  757| void Middle::Middle()
 #  757|   Block 0
@@ -3376,24 +3566,35 @@ ir.cpp:
 #  763|     r0_8(glval<unknown>)    = FunctionAddress[operator=]      : 
 #-----|     r0_9(glval<Derived &>)  = VariableAddress[p#0]            : 
 #-----|     r0_10(Derived &)        = Load                            : &:r0_9, ~mu0_2
-#-----|     r0_11(Middle *)         = ConvertToBase[Derived : Middle] : r0_10
-#  763|     r0_12(Middle &)         = Call                            : func:r0_8, this:r0_7, 0:r0_11
-#  763|     mu0_13(unknown)         = ^CallSideEffect                 : ~mu0_2
-#-----|     r0_14(Derived *)        = CopyValue                       : r0_3
-#-----|     r0_15(glval<String>)    = FieldAddress[derived_s]         : r0_14
-#  763|     r0_16(glval<unknown>)   = FunctionAddress[operator=]      : 
-#-----|     r0_17(glval<Derived &>) = VariableAddress[p#0]            : 
-#-----|     r0_18(Derived &)        = Load                            : &:r0_17, ~mu0_2
-#-----|     r0_19(glval<String>)    = FieldAddress[derived_s]         : r0_18
-#  763|     r0_20(String &)         = Call                            : func:r0_16, this:r0_15, 0:r0_19
-#  763|     mu0_21(unknown)         = ^CallSideEffect                 : ~mu0_2
-#-----|     r0_22(glval<Derived &>) = VariableAddress[#return]        : 
-#-----|     r0_23(Derived *)        = CopyValue                       : r0_3
-#-----|     mu0_24(Derived &)       = Store                           : &:r0_22, r0_23
-#  763|     r0_25(glval<Derived &>) = VariableAddress[#return]        : 
-#  763|     v0_26(void)             = ReturnValue                     : &:r0_25, ~mu0_2
-#  763|     v0_27(void)             = UnmodeledUse                    : mu*
-#  763|     v0_28(void)             = ExitFunction                    : 
+#-----|     r0_11(glval<Derived>)   = CopyValue                       : r0_10
+#-----|     r0_12(Derived *)        = CopyValue                       : r0_11
+#-----|     r0_13(Middle *)         = ConvertToBase[Derived : Middle] : r0_12
+#-----|     r0_14(glval<Middle>)    = CopyValue                       : r0_13
+#-----|     r0_15(Middle &)         = CopyValue                       : r0_14
+#  763|     r0_16(Middle &)         = Call                            : func:r0_8, this:r0_7, 0:r0_15
+#  763|     mu0_17(unknown)         = ^CallSideEffect                 : ~mu0_2
+#-----|     r0_18(glval<Middle>)    = CopyValue                       : r0_16
+#-----|     r0_19(Derived *)        = CopyValue                       : r0_3
+#-----|     r0_20(glval<String>)    = FieldAddress[derived_s]         : r0_19
+#-----|     r0_21(String *)         = CopyValue                       : r0_20
+#  763|     r0_22(glval<unknown>)   = FunctionAddress[operator=]      : 
+#-----|     r0_23(glval<Derived &>) = VariableAddress[p#0]            : 
+#-----|     r0_24(Derived &)        = Load                            : &:r0_23, ~mu0_2
+#-----|     r0_25(glval<Derived>)   = CopyValue                       : r0_24
+#-----|     r0_26(glval<String>)    = FieldAddress[derived_s]         : r0_25
+#-----|     r0_27(String &)         = CopyValue                       : r0_26
+#  763|     r0_28(String &)         = Call                            : func:r0_22, this:r0_21, 0:r0_27
+#  763|     mu0_29(unknown)         = ^CallSideEffect                 : ~mu0_2
+#-----|     r0_30(glval<String>)    = CopyValue                       : r0_28
+#-----|     r0_31(glval<Derived &>) = VariableAddress[#return]        : 
+#-----|     r0_32(Derived *)        = CopyValue                       : r0_3
+#-----|     r0_33(glval<Derived>)   = CopyValue                       : r0_32
+#-----|     r0_34(Derived &)        = CopyValue                       : r0_33
+#-----|     mu0_35(Derived &)       = Store                           : &:r0_31, r0_34
+#  763|     r0_36(glval<Derived &>) = VariableAddress[#return]        : 
+#  763|     v0_37(void)             = ReturnValue                     : &:r0_36, ~mu0_2
+#  763|     v0_38(void)             = UnmodeledUse                    : mu*
+#  763|     v0_39(void)             = ExitFunction                    : 
 
 #  766| void Derived::Derived()
 #  766|   Block 0
@@ -3582,193 +3783,236 @@ ir.cpp:
 #  802|     mu0_14(unknown)            = ^CallSideEffect                        : ~mu0_2
 #  804|     r0_15(glval<Base *>)       = VariableAddress[pb]                    : 
 #  804|     r0_16(glval<Base>)         = VariableAddress[b]                     : 
-#  804|     mu0_17(Base *)             = Store                                  : &:r0_15, r0_16
-#  805|     r0_18(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  805|     r0_19(glval<Middle>)       = VariableAddress[m]                     : 
-#  805|     mu0_20(Middle *)           = Store                                  : &:r0_18, r0_19
-#  806|     r0_21(glval<Derived *>)    = VariableAddress[pd]                    : 
-#  806|     r0_22(glval<Derived>)      = VariableAddress[d]                     : 
-#  806|     mu0_23(Derived *)          = Store                                  : &:r0_21, r0_22
-#  808|     r0_24(glval<Base>)         = VariableAddress[b]                     : 
-#  808|     r0_25(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  808|     r0_26(glval<Middle>)       = VariableAddress[m]                     : 
-#  808|     r0_27(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_26
-#  808|     r0_28(Base &)              = Call                                   : func:r0_25, this:r0_24, 0:r0_27
-#  808|     mu0_29(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  809|     r0_30(glval<Base>)         = VariableAddress[b]                     : 
-#  809|     r0_31(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  809|     r0_32(glval<unknown>)      = FunctionAddress[Base]                  : 
-#  809|     r0_33(glval<Middle>)       = VariableAddress[m]                     : 
-#  809|     r0_34(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_33
-#  809|     v0_35(void)                = Call                                   : func:r0_32, 0:r0_34
-#  809|     mu0_36(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  809|     r0_37(glval<Base>)         = Convert                                : v0_35
-#  809|     r0_38(Base &)              = Call                                   : func:r0_31, this:r0_30, 0:r0_37
-#  809|     mu0_39(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  810|     r0_40(glval<Base>)         = VariableAddress[b]                     : 
-#  810|     r0_41(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  810|     r0_42(glval<unknown>)      = FunctionAddress[Base]                  : 
-#  810|     r0_43(glval<Middle>)       = VariableAddress[m]                     : 
-#  810|     r0_44(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_43
-#  810|     v0_45(void)                = Call                                   : func:r0_42, 0:r0_44
-#  810|     mu0_46(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  810|     r0_47(glval<Base>)         = Convert                                : v0_45
-#  810|     r0_48(Base &)              = Call                                   : func:r0_41, this:r0_40, 0:r0_47
-#  810|     mu0_49(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  811|     r0_50(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  811|     r0_51(Middle *)            = Load                                   : &:r0_50, ~mu0_2
-#  811|     r0_52(Base *)              = ConvertToBase[Middle : Base]           : r0_51
-#  811|     r0_53(glval<Base *>)       = VariableAddress[pb]                    : 
-#  811|     mu0_54(Base *)             = Store                                  : &:r0_53, r0_52
-#  812|     r0_55(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  812|     r0_56(Middle *)            = Load                                   : &:r0_55, ~mu0_2
-#  812|     r0_57(Base *)              = ConvertToBase[Middle : Base]           : r0_56
-#  812|     r0_58(glval<Base *>)       = VariableAddress[pb]                    : 
-#  812|     mu0_59(Base *)             = Store                                  : &:r0_58, r0_57
-#  813|     r0_60(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  813|     r0_61(Middle *)            = Load                                   : &:r0_60, ~mu0_2
-#  813|     r0_62(Base *)              = ConvertToBase[Middle : Base]           : r0_61
-#  813|     r0_63(glval<Base *>)       = VariableAddress[pb]                    : 
-#  813|     mu0_64(Base *)             = Store                                  : &:r0_63, r0_62
-#  814|     r0_65(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  814|     r0_66(Middle *)            = Load                                   : &:r0_65, ~mu0_2
-#  814|     r0_67(Base *)              = Convert                                : r0_66
-#  814|     r0_68(glval<Base *>)       = VariableAddress[pb]                    : 
-#  814|     mu0_69(Base *)             = Store                                  : &:r0_68, r0_67
-#  816|     r0_70(glval<Middle>)       = VariableAddress[m]                     : 
-#  816|     r0_71(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  816|     r0_72(glval<Base>)         = VariableAddress[b]                     : 
-#  816|     r0_73(glval<Middle>)       = ConvertToDerived[Middle : Base]        : r0_72
-#  816|     r0_74(glval<Middle>)       = Convert                                : r0_73
-#  816|     r0_75(Middle &)            = Call                                   : func:r0_71, this:r0_70, 0:r0_74
-#  816|     mu0_76(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  817|     r0_77(glval<Middle>)       = VariableAddress[m]                     : 
-#  817|     r0_78(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  817|     r0_79(glval<Base>)         = VariableAddress[b]                     : 
-#  817|     r0_80(glval<Middle>)       = ConvertToDerived[Middle : Base]        : r0_79
-#  817|     r0_81(glval<Middle>)       = Convert                                : r0_80
-#  817|     r0_82(Middle &)            = Call                                   : func:r0_78, this:r0_77, 0:r0_81
-#  817|     mu0_83(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  818|     r0_84(glval<Base *>)       = VariableAddress[pb]                    : 
-#  818|     r0_85(Base *)              = Load                                   : &:r0_84, ~mu0_2
-#  818|     r0_86(Middle *)            = ConvertToDerived[Middle : Base]        : r0_85
-#  818|     r0_87(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  818|     mu0_88(Middle *)           = Store                                  : &:r0_87, r0_86
-#  819|     r0_89(glval<Base *>)       = VariableAddress[pb]                    : 
-#  819|     r0_90(Base *)              = Load                                   : &:r0_89, ~mu0_2
-#  819|     r0_91(Middle *)            = ConvertToDerived[Middle : Base]        : r0_90
-#  819|     r0_92(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  819|     mu0_93(Middle *)           = Store                                  : &:r0_92, r0_91
-#  820|     r0_94(glval<Base *>)       = VariableAddress[pb]                    : 
-#  820|     r0_95(Base *)              = Load                                   : &:r0_94, ~mu0_2
-#  820|     r0_96(Middle *)            = Convert                                : r0_95
-#  820|     r0_97(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  820|     mu0_98(Middle *)           = Store                                  : &:r0_97, r0_96
-#  822|     r0_99(glval<Base>)         = VariableAddress[b]                     : 
-#  822|     r0_100(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  822|     r0_101(glval<Derived>)     = VariableAddress[d]                     : 
-#  822|     r0_102(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_101
-#  822|     r0_103(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_102
-#  822|     r0_104(Base &)             = Call                                   : func:r0_100, this:r0_99, 0:r0_103
-#  822|     mu0_105(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     r0_106(glval<Base>)        = VariableAddress[b]                     : 
-#  823|     r0_107(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  823|     r0_108(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  823|     r0_109(glval<Derived>)     = VariableAddress[d]                     : 
-#  823|     r0_110(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_109
-#  823|     r0_111(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_110
-#  823|     v0_112(void)               = Call                                   : func:r0_108, 0:r0_111
-#  823|     mu0_113(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     r0_114(glval<Base>)        = Convert                                : v0_112
-#  823|     r0_115(Base &)             = Call                                   : func:r0_107, this:r0_106, 0:r0_114
-#  823|     mu0_116(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     r0_117(glval<Base>)        = VariableAddress[b]                     : 
-#  824|     r0_118(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  824|     r0_119(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  824|     r0_120(glval<Derived>)     = VariableAddress[d]                     : 
-#  824|     r0_121(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_120
-#  824|     r0_122(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_121
-#  824|     v0_123(void)               = Call                                   : func:r0_119, 0:r0_122
-#  824|     mu0_124(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     r0_125(glval<Base>)        = Convert                                : v0_123
-#  824|     r0_126(Base &)             = Call                                   : func:r0_118, this:r0_117, 0:r0_125
-#  824|     mu0_127(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  825|     r0_128(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  825|     r0_129(Derived *)          = Load                                   : &:r0_128, ~mu0_2
-#  825|     r0_130(Middle *)           = ConvertToBase[Derived : Middle]        : r0_129
-#  825|     r0_131(Base *)             = ConvertToBase[Middle : Base]           : r0_130
-#  825|     r0_132(glval<Base *>)      = VariableAddress[pb]                    : 
-#  825|     mu0_133(Base *)            = Store                                  : &:r0_132, r0_131
-#  826|     r0_134(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  826|     r0_135(Derived *)          = Load                                   : &:r0_134, ~mu0_2
-#  826|     r0_136(Middle *)           = ConvertToBase[Derived : Middle]        : r0_135
-#  826|     r0_137(Base *)             = ConvertToBase[Middle : Base]           : r0_136
-#  826|     r0_138(glval<Base *>)      = VariableAddress[pb]                    : 
-#  826|     mu0_139(Base *)            = Store                                  : &:r0_138, r0_137
-#  827|     r0_140(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  827|     r0_141(Derived *)          = Load                                   : &:r0_140, ~mu0_2
-#  827|     r0_142(Middle *)           = ConvertToBase[Derived : Middle]        : r0_141
-#  827|     r0_143(Base *)             = ConvertToBase[Middle : Base]           : r0_142
-#  827|     r0_144(glval<Base *>)      = VariableAddress[pb]                    : 
-#  827|     mu0_145(Base *)            = Store                                  : &:r0_144, r0_143
-#  828|     r0_146(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  828|     r0_147(Derived *)          = Load                                   : &:r0_146, ~mu0_2
-#  828|     r0_148(Base *)             = Convert                                : r0_147
-#  828|     r0_149(glval<Base *>)      = VariableAddress[pb]                    : 
-#  828|     mu0_150(Base *)            = Store                                  : &:r0_149, r0_148
-#  830|     r0_151(glval<Derived>)     = VariableAddress[d]                     : 
-#  830|     r0_152(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  830|     r0_153(glval<Base>)        = VariableAddress[b]                     : 
-#  830|     r0_154(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_153
-#  830|     r0_155(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_154
-#  830|     r0_156(glval<Derived>)     = Convert                                : r0_155
-#  830|     r0_157(Derived &)          = Call                                   : func:r0_152, this:r0_151, 0:r0_156
-#  830|     mu0_158(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  831|     r0_159(glval<Derived>)     = VariableAddress[d]                     : 
-#  831|     r0_160(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  831|     r0_161(glval<Base>)        = VariableAddress[b]                     : 
-#  831|     r0_162(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_161
-#  831|     r0_163(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_162
-#  831|     r0_164(glval<Derived>)     = Convert                                : r0_163
-#  831|     r0_165(Derived &)          = Call                                   : func:r0_160, this:r0_159, 0:r0_164
-#  831|     mu0_166(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  832|     r0_167(glval<Base *>)      = VariableAddress[pb]                    : 
-#  832|     r0_168(Base *)             = Load                                   : &:r0_167, ~mu0_2
-#  832|     r0_169(Middle *)           = ConvertToDerived[Middle : Base]        : r0_168
-#  832|     r0_170(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_169
-#  832|     r0_171(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  832|     mu0_172(Derived *)         = Store                                  : &:r0_171, r0_170
-#  833|     r0_173(glval<Base *>)      = VariableAddress[pb]                    : 
-#  833|     r0_174(Base *)             = Load                                   : &:r0_173, ~mu0_2
-#  833|     r0_175(Middle *)           = ConvertToDerived[Middle : Base]        : r0_174
-#  833|     r0_176(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_175
-#  833|     r0_177(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  833|     mu0_178(Derived *)         = Store                                  : &:r0_177, r0_176
-#  834|     r0_179(glval<Base *>)      = VariableAddress[pb]                    : 
-#  834|     r0_180(Base *)             = Load                                   : &:r0_179, ~mu0_2
-#  834|     r0_181(Derived *)          = Convert                                : r0_180
-#  834|     r0_182(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  834|     mu0_183(Derived *)         = Store                                  : &:r0_182, r0_181
-#  836|     r0_184(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  836|     r0_185(MiddleVB1 *)        = Constant[0]                            : 
-#  836|     mu0_186(MiddleVB1 *)       = Store                                  : &:r0_184, r0_185
-#  837|     r0_187(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  837|     r0_188(DerivedVB *)        = Constant[0]                            : 
-#  837|     mu0_189(DerivedVB *)       = Store                                  : &:r0_187, r0_188
-#  838|     r0_190(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  838|     r0_191(MiddleVB1 *)        = Load                                   : &:r0_190, ~mu0_2
-#  838|     r0_192(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base] : r0_191
-#  838|     r0_193(glval<Base *>)      = VariableAddress[pb]                    : 
-#  838|     mu0_194(Base *)            = Store                                  : &:r0_193, r0_192
-#  839|     r0_195(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  839|     r0_196(DerivedVB *)        = Load                                   : &:r0_195, ~mu0_2
-#  839|     r0_197(Base *)             = ConvertToVirtualBase[DerivedVB : Base] : r0_196
-#  839|     r0_198(glval<Base *>)      = VariableAddress[pb]                    : 
-#  839|     mu0_199(Base *)            = Store                                  : &:r0_198, r0_197
-#  840|     v0_200(void)               = NoOp                                   : 
-#  799|     v0_201(void)               = ReturnVoid                             : 
-#  799|     v0_202(void)               = UnmodeledUse                           : mu*
-#  799|     v0_203(void)               = ExitFunction                           : 
+#  804|     r0_17(Base *)              = CopyValue                              : r0_16
+#  804|     mu0_18(Base *)             = Store                                  : &:r0_15, r0_17
+#  805|     r0_19(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  805|     r0_20(glval<Middle>)       = VariableAddress[m]                     : 
+#  805|     r0_21(Middle *)            = CopyValue                              : r0_20
+#  805|     mu0_22(Middle *)           = Store                                  : &:r0_19, r0_21
+#  806|     r0_23(glval<Derived *>)    = VariableAddress[pd]                    : 
+#  806|     r0_24(glval<Derived>)      = VariableAddress[d]                     : 
+#  806|     r0_25(Derived *)           = CopyValue                              : r0_24
+#  806|     mu0_26(Derived *)          = Store                                  : &:r0_23, r0_25
+#  808|     r0_27(glval<Base>)         = VariableAddress[b]                     : 
+#  808|     r0_28(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  808|     r0_29(glval<Middle>)       = VariableAddress[m]                     : 
+#  808|     r0_30(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_29
+#  808|     r0_31(Base &)              = CopyValue                              : r0_30
+#  808|     r0_32(Base &)              = Call                                   : func:r0_28, this:r0_27, 0:r0_31
+#  808|     mu0_33(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  808|     r0_34(glval<Base>)         = CopyValue                              : r0_32
+#  809|     r0_35(glval<Base>)         = VariableAddress[b]                     : 
+#  809|     r0_36(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  809|     r0_37(glval<unknown>)      = FunctionAddress[Base]                  : 
+#  809|     r0_38(glval<Middle>)       = VariableAddress[m]                     : 
+#  809|     r0_39(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_38
+#  809|     r0_40(Base &)              = CopyValue                              : r0_39
+#  809|     v0_41(void)                = Call                                   : func:r0_37, 0:r0_40
+#  809|     mu0_42(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  809|     r0_43(glval<Base>)         = Convert                                : v0_41
+#  809|     r0_44(Base &)              = CopyValue                              : r0_43
+#  809|     r0_45(Base &)              = Call                                   : func:r0_36, this:r0_35, 0:r0_44
+#  809|     mu0_46(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  809|     r0_47(glval<Base>)         = CopyValue                              : r0_45
+#  810|     r0_48(glval<Base>)         = VariableAddress[b]                     : 
+#  810|     r0_49(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  810|     r0_50(glval<unknown>)      = FunctionAddress[Base]                  : 
+#  810|     r0_51(glval<Middle>)       = VariableAddress[m]                     : 
+#  810|     r0_52(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_51
+#  810|     r0_53(Base &)              = CopyValue                              : r0_52
+#  810|     v0_54(void)                = Call                                   : func:r0_50, 0:r0_53
+#  810|     mu0_55(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  810|     r0_56(glval<Base>)         = Convert                                : v0_54
+#  810|     r0_57(Base &)              = CopyValue                              : r0_56
+#  810|     r0_58(Base &)              = Call                                   : func:r0_49, this:r0_48, 0:r0_57
+#  810|     mu0_59(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  810|     r0_60(glval<Base>)         = CopyValue                              : r0_58
+#  811|     r0_61(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  811|     r0_62(Middle *)            = Load                                   : &:r0_61, ~mu0_2
+#  811|     r0_63(Base *)              = ConvertToBase[Middle : Base]           : r0_62
+#  811|     r0_64(glval<Base *>)       = VariableAddress[pb]                    : 
+#  811|     mu0_65(Base *)             = Store                                  : &:r0_64, r0_63
+#  811|     r0_66(glval<Base *>)       = CopyValue                              : r0_64
+#  812|     r0_67(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  812|     r0_68(Middle *)            = Load                                   : &:r0_67, ~mu0_2
+#  812|     r0_69(Base *)              = ConvertToBase[Middle : Base]           : r0_68
+#  812|     r0_70(glval<Base *>)       = VariableAddress[pb]                    : 
+#  812|     mu0_71(Base *)             = Store                                  : &:r0_70, r0_69
+#  812|     r0_72(glval<Base *>)       = CopyValue                              : r0_70
+#  813|     r0_73(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  813|     r0_74(Middle *)            = Load                                   : &:r0_73, ~mu0_2
+#  813|     r0_75(Base *)              = ConvertToBase[Middle : Base]           : r0_74
+#  813|     r0_76(glval<Base *>)       = VariableAddress[pb]                    : 
+#  813|     mu0_77(Base *)             = Store                                  : &:r0_76, r0_75
+#  813|     r0_78(glval<Base *>)       = CopyValue                              : r0_76
+#  814|     r0_79(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  814|     r0_80(Middle *)            = Load                                   : &:r0_79, ~mu0_2
+#  814|     r0_81(Base *)              = Convert                                : r0_80
+#  814|     r0_82(glval<Base *>)       = VariableAddress[pb]                    : 
+#  814|     mu0_83(Base *)             = Store                                  : &:r0_82, r0_81
+#  814|     r0_84(glval<Base *>)       = CopyValue                              : r0_82
+#  816|     r0_85(glval<Middle>)       = VariableAddress[m]                     : 
+#  816|     r0_86(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  816|     r0_87(glval<Base>)         = VariableAddress[b]                     : 
+#  816|     r0_88(glval<Middle>)       = ConvertToDerived[Middle : Base]        : r0_87
+#  816|     r0_89(glval<Middle>)       = Convert                                : r0_88
+#  816|     r0_90(Middle &)            = CopyValue                              : r0_89
+#  816|     r0_91(Middle &)            = Call                                   : func:r0_86, this:r0_85, 0:r0_90
+#  816|     mu0_92(unknown)            = ^CallSideEffect                        : ~mu0_2
+#  816|     r0_93(glval<Middle>)       = CopyValue                              : r0_91
+#  817|     r0_94(glval<Middle>)       = VariableAddress[m]                     : 
+#  817|     r0_95(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  817|     r0_96(glval<Base>)         = VariableAddress[b]                     : 
+#  817|     r0_97(glval<Middle>)       = ConvertToDerived[Middle : Base]        : r0_96
+#  817|     r0_98(glval<Middle>)       = Convert                                : r0_97
+#  817|     r0_99(Middle &)            = CopyValue                              : r0_98
+#  817|     r0_100(Middle &)           = Call                                   : func:r0_95, this:r0_94, 0:r0_99
+#  817|     mu0_101(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  817|     r0_102(glval<Middle>)      = CopyValue                              : r0_100
+#  818|     r0_103(glval<Base *>)      = VariableAddress[pb]                    : 
+#  818|     r0_104(Base *)             = Load                                   : &:r0_103, ~mu0_2
+#  818|     r0_105(Middle *)           = ConvertToDerived[Middle : Base]        : r0_104
+#  818|     r0_106(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  818|     mu0_107(Middle *)          = Store                                  : &:r0_106, r0_105
+#  818|     r0_108(glval<Middle *>)    = CopyValue                              : r0_106
+#  819|     r0_109(glval<Base *>)      = VariableAddress[pb]                    : 
+#  819|     r0_110(Base *)             = Load                                   : &:r0_109, ~mu0_2
+#  819|     r0_111(Middle *)           = ConvertToDerived[Middle : Base]        : r0_110
+#  819|     r0_112(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  819|     mu0_113(Middle *)          = Store                                  : &:r0_112, r0_111
+#  819|     r0_114(glval<Middle *>)    = CopyValue                              : r0_112
+#  820|     r0_115(glval<Base *>)      = VariableAddress[pb]                    : 
+#  820|     r0_116(Base *)             = Load                                   : &:r0_115, ~mu0_2
+#  820|     r0_117(Middle *)           = Convert                                : r0_116
+#  820|     r0_118(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  820|     mu0_119(Middle *)          = Store                                  : &:r0_118, r0_117
+#  820|     r0_120(glval<Middle *>)    = CopyValue                              : r0_118
+#  822|     r0_121(glval<Base>)        = VariableAddress[b]                     : 
+#  822|     r0_122(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  822|     r0_123(glval<Derived>)     = VariableAddress[d]                     : 
+#  822|     r0_124(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_123
+#  822|     r0_125(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_124
+#  822|     r0_126(Base &)             = CopyValue                              : r0_125
+#  822|     r0_127(Base &)             = Call                                   : func:r0_122, this:r0_121, 0:r0_126
+#  822|     mu0_128(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  822|     r0_129(glval<Base>)        = CopyValue                              : r0_127
+#  823|     r0_130(glval<Base>)        = VariableAddress[b]                     : 
+#  823|     r0_131(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  823|     r0_132(glval<unknown>)     = FunctionAddress[Base]                  : 
+#  823|     r0_133(glval<Derived>)     = VariableAddress[d]                     : 
+#  823|     r0_134(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_133
+#  823|     r0_135(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_134
+#  823|     r0_136(Base &)             = CopyValue                              : r0_135
+#  823|     v0_137(void)               = Call                                   : func:r0_132, 0:r0_136
+#  823|     mu0_138(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  823|     r0_139(glval<Base>)        = Convert                                : v0_137
+#  823|     r0_140(Base &)             = CopyValue                              : r0_139
+#  823|     r0_141(Base &)             = Call                                   : func:r0_131, this:r0_130, 0:r0_140
+#  823|     mu0_142(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  823|     r0_143(glval<Base>)        = CopyValue                              : r0_141
+#  824|     r0_144(glval<Base>)        = VariableAddress[b]                     : 
+#  824|     r0_145(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  824|     r0_146(glval<unknown>)     = FunctionAddress[Base]                  : 
+#  824|     r0_147(glval<Derived>)     = VariableAddress[d]                     : 
+#  824|     r0_148(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_147
+#  824|     r0_149(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_148
+#  824|     r0_150(Base &)             = CopyValue                              : r0_149
+#  824|     v0_151(void)               = Call                                   : func:r0_146, 0:r0_150
+#  824|     mu0_152(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  824|     r0_153(glval<Base>)        = Convert                                : v0_151
+#  824|     r0_154(Base &)             = CopyValue                              : r0_153
+#  824|     r0_155(Base &)             = Call                                   : func:r0_145, this:r0_144, 0:r0_154
+#  824|     mu0_156(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  824|     r0_157(glval<Base>)        = CopyValue                              : r0_155
+#  825|     r0_158(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  825|     r0_159(Derived *)          = Load                                   : &:r0_158, ~mu0_2
+#  825|     r0_160(Middle *)           = ConvertToBase[Derived : Middle]        : r0_159
+#  825|     r0_161(Base *)             = ConvertToBase[Middle : Base]           : r0_160
+#  825|     r0_162(glval<Base *>)      = VariableAddress[pb]                    : 
+#  825|     mu0_163(Base *)            = Store                                  : &:r0_162, r0_161
+#  825|     r0_164(glval<Base *>)      = CopyValue                              : r0_162
+#  826|     r0_165(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  826|     r0_166(Derived *)          = Load                                   : &:r0_165, ~mu0_2
+#  826|     r0_167(Middle *)           = ConvertToBase[Derived : Middle]        : r0_166
+#  826|     r0_168(Base *)             = ConvertToBase[Middle : Base]           : r0_167
+#  826|     r0_169(glval<Base *>)      = VariableAddress[pb]                    : 
+#  826|     mu0_170(Base *)            = Store                                  : &:r0_169, r0_168
+#  826|     r0_171(glval<Base *>)      = CopyValue                              : r0_169
+#  827|     r0_172(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  827|     r0_173(Derived *)          = Load                                   : &:r0_172, ~mu0_2
+#  827|     r0_174(Middle *)           = ConvertToBase[Derived : Middle]        : r0_173
+#  827|     r0_175(Base *)             = ConvertToBase[Middle : Base]           : r0_174
+#  827|     r0_176(glval<Base *>)      = VariableAddress[pb]                    : 
+#  827|     mu0_177(Base *)            = Store                                  : &:r0_176, r0_175
+#  827|     r0_178(glval<Base *>)      = CopyValue                              : r0_176
+#  828|     r0_179(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  828|     r0_180(Derived *)          = Load                                   : &:r0_179, ~mu0_2
+#  828|     r0_181(Base *)             = Convert                                : r0_180
+#  828|     r0_182(glval<Base *>)      = VariableAddress[pb]                    : 
+#  828|     mu0_183(Base *)            = Store                                  : &:r0_182, r0_181
+#  828|     r0_184(glval<Base *>)      = CopyValue                              : r0_182
+#  830|     r0_185(glval<Derived>)     = VariableAddress[d]                     : 
+#  830|     r0_186(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  830|     r0_187(glval<Base>)        = VariableAddress[b]                     : 
+#  830|     r0_188(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_187
+#  830|     r0_189(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_188
+#  830|     r0_190(glval<Derived>)     = Convert                                : r0_189
+#  830|     r0_191(Derived &)          = CopyValue                              : r0_190
+#  830|     r0_192(Derived &)          = Call                                   : func:r0_186, this:r0_185, 0:r0_191
+#  830|     mu0_193(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  830|     r0_194(glval<Derived>)     = CopyValue                              : r0_192
+#  831|     r0_195(glval<Derived>)     = VariableAddress[d]                     : 
+#  831|     r0_196(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  831|     r0_197(glval<Base>)        = VariableAddress[b]                     : 
+#  831|     r0_198(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_197
+#  831|     r0_199(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_198
+#  831|     r0_200(glval<Derived>)     = Convert                                : r0_199
+#  831|     r0_201(Derived &)          = CopyValue                              : r0_200
+#  831|     r0_202(Derived &)          = Call                                   : func:r0_196, this:r0_195, 0:r0_201
+#  831|     mu0_203(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  831|     r0_204(glval<Derived>)     = CopyValue                              : r0_202
+#  832|     r0_205(glval<Base *>)      = VariableAddress[pb]                    : 
+#  832|     r0_206(Base *)             = Load                                   : &:r0_205, ~mu0_2
+#  832|     r0_207(Middle *)           = ConvertToDerived[Middle : Base]        : r0_206
+#  832|     r0_208(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_207
+#  832|     r0_209(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  832|     mu0_210(Derived *)         = Store                                  : &:r0_209, r0_208
+#  832|     r0_211(glval<Derived *>)   = CopyValue                              : r0_209
+#  833|     r0_212(glval<Base *>)      = VariableAddress[pb]                    : 
+#  833|     r0_213(Base *)             = Load                                   : &:r0_212, ~mu0_2
+#  833|     r0_214(Middle *)           = ConvertToDerived[Middle : Base]        : r0_213
+#  833|     r0_215(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_214
+#  833|     r0_216(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  833|     mu0_217(Derived *)         = Store                                  : &:r0_216, r0_215
+#  833|     r0_218(glval<Derived *>)   = CopyValue                              : r0_216
+#  834|     r0_219(glval<Base *>)      = VariableAddress[pb]                    : 
+#  834|     r0_220(Base *)             = Load                                   : &:r0_219, ~mu0_2
+#  834|     r0_221(Derived *)          = Convert                                : r0_220
+#  834|     r0_222(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  834|     mu0_223(Derived *)         = Store                                  : &:r0_222, r0_221
+#  834|     r0_224(glval<Derived *>)   = CopyValue                              : r0_222
+#  836|     r0_225(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
+#  836|     r0_226(MiddleVB1 *)        = Constant[0]                            : 
+#  836|     mu0_227(MiddleVB1 *)       = Store                                  : &:r0_225, r0_226
+#  837|     r0_228(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
+#  837|     r0_229(DerivedVB *)        = Constant[0]                            : 
+#  837|     mu0_230(DerivedVB *)       = Store                                  : &:r0_228, r0_229
+#  838|     r0_231(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
+#  838|     r0_232(MiddleVB1 *)        = Load                                   : &:r0_231, ~mu0_2
+#  838|     r0_233(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base] : r0_232
+#  838|     r0_234(glval<Base *>)      = VariableAddress[pb]                    : 
+#  838|     mu0_235(Base *)            = Store                                  : &:r0_234, r0_233
+#  838|     r0_236(glval<Base *>)      = CopyValue                              : r0_234
+#  839|     r0_237(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
+#  839|     r0_238(DerivedVB *)        = Load                                   : &:r0_237, ~mu0_2
+#  839|     r0_239(Base *)             = ConvertToVirtualBase[DerivedVB : Base] : r0_238
+#  839|     r0_240(glval<Base *>)      = VariableAddress[pb]                    : 
+#  839|     mu0_241(Base *)            = Store                                  : &:r0_240, r0_239
+#  839|     r0_242(glval<Base *>)      = CopyValue                              : r0_240
+#  840|     v0_243(void)               = NoOp                                   : 
+#  799|     v0_244(void)               = ReturnVoid                             : 
+#  799|     v0_245(void)               = UnmodeledUse                           : mu*
+#  799|     v0_246(void)               = ExitFunction                           : 
 
 #  842| void PolymorphicBase::PolymorphicBase()
 #  842|   Block 0
@@ -3826,42 +4070,48 @@ ir.cpp:
 #  851|     mu0_10(unknown)                    = ^CallSideEffect                     : ~mu0_2
 #  853|     r0_11(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
 #  853|     r0_12(glval<PolymorphicBase>)      = VariableAddress[b]                  : 
-#  853|     mu0_13(PolymorphicBase *)          = Store                               : &:r0_11, r0_12
-#  854|     r0_14(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  854|     r0_15(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
-#  854|     mu0_16(PolymorphicDerived *)       = Store                               : &:r0_14, r0_15
-#  857|     r0_17(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  857|     r0_18(PolymorphicDerived *)        = Load                                : &:r0_17, ~mu0_2
-#  857|     r0_19(PolymorphicBase *)           = CheckedConvertOrNull                : r0_18
-#  857|     r0_20(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
-#  857|     mu0_21(PolymorphicBase *)          = Store                               : &:r0_20, r0_19
-#  858|     r0_22(glval<PolymorphicBase &>)    = VariableAddress[rb]                 : 
-#  858|     r0_23(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
-#  858|     r0_24(glval<PolymorphicBase>)      = CheckedConvertOrThrow               : r0_23
-#  858|     mu0_25(PolymorphicBase &)          = Store                               : &:r0_22, r0_24
-#  860|     r0_26(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
-#  860|     r0_27(PolymorphicBase *)           = Load                                : &:r0_26, ~mu0_2
-#  860|     r0_28(PolymorphicDerived *)        = CheckedConvertOrNull                : r0_27
-#  860|     r0_29(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  860|     mu0_30(PolymorphicDerived *)       = Store                               : &:r0_29, r0_28
-#  861|     r0_31(glval<PolymorphicDerived &>) = VariableAddress[rd]                 : 
-#  861|     r0_32(glval<PolymorphicBase>)      = VariableAddress[b]                  : 
-#  861|     r0_33(glval<PolymorphicDerived>)   = CheckedConvertOrThrow               : r0_32
-#  861|     mu0_34(PolymorphicDerived &)       = Store                               : &:r0_31, r0_33
-#  863|     r0_35(glval<void *>)               = VariableAddress[pv]                 : 
-#  863|     r0_36(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
-#  863|     r0_37(PolymorphicBase *)           = Load                                : &:r0_36, ~mu0_2
-#  863|     r0_38(void *)                      = DynamicCastToVoid                   : r0_37
-#  863|     mu0_39(void *)                     = Store                               : &:r0_35, r0_38
-#  864|     r0_40(glval<void *>)               = VariableAddress[pcv]                : 
-#  864|     r0_41(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  864|     r0_42(PolymorphicDerived *)        = Load                                : &:r0_41, ~mu0_2
-#  864|     r0_43(void *)                      = DynamicCastToVoid                   : r0_42
-#  864|     mu0_44(void *)                     = Store                               : &:r0_40, r0_43
-#  865|     v0_45(void)                        = NoOp                                : 
-#  849|     v0_46(void)                        = ReturnVoid                          : 
-#  849|     v0_47(void)                        = UnmodeledUse                        : mu*
-#  849|     v0_48(void)                        = ExitFunction                        : 
+#  853|     r0_13(PolymorphicBase *)           = CopyValue                           : r0_12
+#  853|     mu0_14(PolymorphicBase *)          = Store                               : &:r0_11, r0_13
+#  854|     r0_15(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  854|     r0_16(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
+#  854|     r0_17(PolymorphicDerived *)        = CopyValue                           : r0_16
+#  854|     mu0_18(PolymorphicDerived *)       = Store                               : &:r0_15, r0_17
+#  857|     r0_19(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  857|     r0_20(PolymorphicDerived *)        = Load                                : &:r0_19, ~mu0_2
+#  857|     r0_21(PolymorphicBase *)           = CheckedConvertOrNull                : r0_20
+#  857|     r0_22(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
+#  857|     mu0_23(PolymorphicBase *)          = Store                               : &:r0_22, r0_21
+#  857|     r0_24(glval<PolymorphicBase *>)    = CopyValue                           : r0_22
+#  858|     r0_25(glval<PolymorphicBase &>)    = VariableAddress[rb]                 : 
+#  858|     r0_26(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
+#  858|     r0_27(glval<PolymorphicBase>)      = CheckedConvertOrThrow               : r0_26
+#  858|     r0_28(PolymorphicBase &)           = CopyValue                           : r0_27
+#  858|     mu0_29(PolymorphicBase &)          = Store                               : &:r0_25, r0_28
+#  860|     r0_30(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
+#  860|     r0_31(PolymorphicBase *)           = Load                                : &:r0_30, ~mu0_2
+#  860|     r0_32(PolymorphicDerived *)        = CheckedConvertOrNull                : r0_31
+#  860|     r0_33(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  860|     mu0_34(PolymorphicDerived *)       = Store                               : &:r0_33, r0_32
+#  860|     r0_35(glval<PolymorphicDerived *>) = CopyValue                           : r0_33
+#  861|     r0_36(glval<PolymorphicDerived &>) = VariableAddress[rd]                 : 
+#  861|     r0_37(glval<PolymorphicBase>)      = VariableAddress[b]                  : 
+#  861|     r0_38(glval<PolymorphicDerived>)   = CheckedConvertOrThrow               : r0_37
+#  861|     r0_39(PolymorphicDerived &)        = CopyValue                           : r0_38
+#  861|     mu0_40(PolymorphicDerived &)       = Store                               : &:r0_36, r0_39
+#  863|     r0_41(glval<void *>)               = VariableAddress[pv]                 : 
+#  863|     r0_42(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
+#  863|     r0_43(PolymorphicBase *)           = Load                                : &:r0_42, ~mu0_2
+#  863|     r0_44(void *)                      = DynamicCastToVoid                   : r0_43
+#  863|     mu0_45(void *)                     = Store                               : &:r0_41, r0_44
+#  864|     r0_46(glval<void *>)               = VariableAddress[pcv]                : 
+#  864|     r0_47(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  864|     r0_48(PolymorphicDerived *)        = Load                                : &:r0_47, ~mu0_2
+#  864|     r0_49(void *)                      = DynamicCastToVoid                   : r0_48
+#  864|     mu0_50(void *)                     = Store                               : &:r0_46, r0_49
+#  865|     v0_51(void)                        = NoOp                                : 
+#  849|     v0_52(void)                        = ReturnVoid                          : 
+#  849|     v0_53(void)                        = UnmodeledUse                        : mu*
+#  849|     v0_54(void)                        = ExitFunction                        : 
 
 #  867| void String::String()
 #  867|   Block 0
@@ -3895,36 +4145,46 @@ ir.cpp:
 #  874|     r0_11(char *)            = Convert                : r0_10
 #  874|     r0_12(glval<char *>)     = VariableAddress[p]     : 
 #  874|     mu0_13(char *)           = Store                  : &:r0_12, r0_11
-#  875|     r0_14(glval<char[5]>)    = VariableAddress[a]     : 
-#  875|     r0_15(char *)            = Convert                : r0_14
-#  875|     r0_16(int)               = Constant[0]            : 
-#  875|     r0_17(glval<char>)       = PointerAdd[1]          : r0_15, r0_16
-#  875|     r0_18(char *)            = Convert                : r0_17
-#  875|     r0_19(glval<char *>)     = VariableAddress[p]     : 
-#  875|     mu0_20(char *)           = Store                  : &:r0_19, r0_18
-#  876|     r0_21(glval<char[5]>)    = StringConstant["test"] : 
-#  876|     r0_22(char *)            = Convert                : r0_21
-#  876|     r0_23(int)               = Constant[0]            : 
-#  876|     r0_24(glval<char>)       = PointerAdd[1]          : r0_22, r0_23
-#  876|     r0_25(glval<char *>)     = VariableAddress[p]     : 
-#  876|     mu0_26(char *)           = Store                  : &:r0_25, r0_24
-#  877|     r0_27(glval<char(&)[5]>) = VariableAddress[ra]    : 
-#  877|     r0_28(glval<char[5]>)    = VariableAddress[a]     : 
-#  877|     mu0_29(char(&)[5])       = Store                  : &:r0_27, r0_28
-#  878|     r0_30(glval<char(&)[5]>) = VariableAddress[rs]    : 
-#  878|     r0_31(glval<char[5]>)    = StringConstant["test"] : 
-#  878|     mu0_32(char(&)[5])       = Store                  : &:r0_30, r0_31
-#  879|     r0_33(glval<char(*)[5]>) = VariableAddress[pa]    : 
-#  879|     r0_34(glval<char[5]>)    = VariableAddress[a]     : 
-#  879|     r0_35(char(*)[5])        = Convert                : r0_34
-#  879|     mu0_36(char(*)[5])       = Store                  : &:r0_33, r0_35
-#  880|     r0_37(glval<char[5]>)    = StringConstant["test"] : 
-#  880|     r0_38(glval<char(*)[5]>) = VariableAddress[pa]    : 
-#  880|     mu0_39(char(*)[5])       = Store                  : &:r0_38, r0_37
-#  881|     v0_40(void)              = NoOp                   : 
-#  871|     v0_41(void)              = ReturnVoid             : 
-#  871|     v0_42(void)              = UnmodeledUse           : mu*
-#  871|     v0_43(void)              = ExitFunction           : 
+#  874|     r0_14(glval<char *>)     = CopyValue              : r0_12
+#  875|     r0_15(glval<char[5]>)    = VariableAddress[a]     : 
+#  875|     r0_16(char *)            = Convert                : r0_15
+#  875|     r0_17(int)               = Constant[0]            : 
+#  875|     r0_18(glval<char>)       = PointerAdd[1]          : r0_16, r0_17
+#  875|     r0_19(char *)            = CopyValue              : r0_18
+#  875|     r0_20(char *)            = Convert                : r0_19
+#  875|     r0_21(glval<char *>)     = VariableAddress[p]     : 
+#  875|     mu0_22(char *)           = Store                  : &:r0_21, r0_20
+#  875|     r0_23(glval<char *>)     = CopyValue              : r0_21
+#  876|     r0_24(glval<char[5]>)    = StringConstant["test"] : 
+#  876|     r0_25(char *)            = Convert                : r0_24
+#  876|     r0_26(int)               = Constant[0]            : 
+#  876|     r0_27(glval<char>)       = PointerAdd[1]          : r0_25, r0_26
+#  876|     r0_28(char *)            = CopyValue              : r0_27
+#  876|     r0_29(glval<char *>)     = VariableAddress[p]     : 
+#  876|     mu0_30(char *)           = Store                  : &:r0_29, r0_28
+#  876|     r0_31(glval<char *>)     = CopyValue              : r0_29
+#  877|     r0_32(glval<char(&)[5]>) = VariableAddress[ra]    : 
+#  877|     r0_33(glval<char[5]>)    = VariableAddress[a]     : 
+#  877|     r0_34(char(&)[5])        = CopyValue              : r0_33
+#  877|     mu0_35(char(&)[5])       = Store                  : &:r0_32, r0_34
+#  878|     r0_36(glval<char(&)[5]>) = VariableAddress[rs]    : 
+#  878|     r0_37(glval<char[5]>)    = StringConstant["test"] : 
+#  878|     r0_38(char(&)[5])        = CopyValue              : r0_37
+#  878|     mu0_39(char(&)[5])       = Store                  : &:r0_36, r0_38
+#  879|     r0_40(glval<char(*)[5]>) = VariableAddress[pa]    : 
+#  879|     r0_41(glval<char[5]>)    = VariableAddress[a]     : 
+#  879|     r0_42(char(*)[5])        = CopyValue              : r0_41
+#  879|     r0_43(char(*)[5])        = Convert                : r0_42
+#  879|     mu0_44(char(*)[5])       = Store                  : &:r0_40, r0_43
+#  880|     r0_45(glval<char[5]>)    = StringConstant["test"] : 
+#  880|     r0_46(char(*)[5])        = CopyValue              : r0_45
+#  880|     r0_47(glval<char(*)[5]>) = VariableAddress[pa]    : 
+#  880|     mu0_48(char(*)[5])       = Store                  : &:r0_47, r0_46
+#  880|     r0_49(glval<char(*)[5]>) = CopyValue              : r0_47
+#  881|     v0_50(void)              = NoOp                   : 
+#  871|     v0_51(void)              = ReturnVoid             : 
+#  871|     v0_52(void)              = UnmodeledUse           : mu*
+#  871|     v0_53(void)              = ExitFunction           : 
 
 #  883| void FuncPtrConversions(int(*)(int), void*)
 #  883|   Block 0
@@ -3940,15 +4200,17 @@ ir.cpp:
 #  884|     r0_9(void *)            = Convert                  : r0_8
 #  884|     r0_10(glval<void *>)    = VariableAddress[p]       : 
 #  884|     mu0_11(void *)          = Store                    : &:r0_10, r0_9
-#  885|     r0_12(glval<void *>)    = VariableAddress[p]       : 
-#  885|     r0_13(void *)           = Load                     : &:r0_12, ~mu0_2
-#  885|     r0_14(..(*)(..))        = Convert                  : r0_13
-#  885|     r0_15(glval<..(*)(..)>) = VariableAddress[pfn]     : 
-#  885|     mu0_16(..(*)(..))       = Store                    : &:r0_15, r0_14
-#  886|     v0_17(void)             = NoOp                     : 
-#  883|     v0_18(void)             = ReturnVoid               : 
-#  883|     v0_19(void)             = UnmodeledUse             : mu*
-#  883|     v0_20(void)             = ExitFunction             : 
+#  884|     r0_12(glval<void *>)    = CopyValue                : r0_10
+#  885|     r0_13(glval<void *>)    = VariableAddress[p]       : 
+#  885|     r0_14(void *)           = Load                     : &:r0_13, ~mu0_2
+#  885|     r0_15(..(*)(..))        = Convert                  : r0_14
+#  885|     r0_16(glval<..(*)(..)>) = VariableAddress[pfn]     : 
+#  885|     mu0_17(..(*)(..))       = Store                    : &:r0_16, r0_15
+#  885|     r0_18(glval<..(*)(..)>) = CopyValue                : r0_16
+#  886|     v0_19(void)             = NoOp                     : 
+#  883|     v0_20(void)             = ReturnVoid               : 
+#  883|     v0_21(void)             = UnmodeledUse             : mu*
+#  883|     v0_22(void)             = ExitFunction             : 
 
 #  888| void VarArgUsage(int)
 #  888|   Block 0
@@ -4246,7 +4508,8 @@ ir.cpp:
 #  967|     mu0_13(bool)       = Store                  : &:r0_7, r0_12
 #  967|     r0_14(glval<bool>) = VariableAddress[b]     : 
 #  967|     r0_15(bool)        = Load                   : &:r0_14, ~mu0_2
-#  967|     v0_16(void)        = ConditionalBranch      : r0_15
+#  967|     r0_16(bool)        = CopyValue              : r0_15
+#  967|     v0_17(void)        = ConditionalBranch      : r0_16
 #-----|   False -> Block 2
 #-----|   True -> Block 1
 
@@ -4254,6 +4517,7 @@ ir.cpp:
 #  968|     r1_0(int)        = Constant[5]        : 
 #  968|     r1_1(glval<int>) = VariableAddress[x] : 
 #  968|     mu1_2(int)       = Store              : &:r1_1, r1_0
+#  968|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 6
 
 #  970|   Block 2
@@ -4268,7 +4532,8 @@ ir.cpp:
 #  970|     r2_8(int)        = Load               : &:r2_7, ~mu0_2
 #  970|     r2_9(int)        = Constant[0]        : 
 #  970|     r2_10(bool)      = CompareNE          : r2_8, r2_9
-#  970|     v2_11(void)      = ConditionalBranch  : r2_10
+#  970|     r2_11(bool)      = CopyValue          : r2_10
+#  970|     v2_12(void)      = ConditionalBranch  : r2_11
 #-----|   False -> Block 4
 #-----|   True -> Block 3
 
@@ -4276,17 +4541,20 @@ ir.cpp:
 #  971|     r3_0(int)        = Constant[7]        : 
 #  971|     r3_1(glval<int>) = VariableAddress[y] : 
 #  971|     mu3_2(int)       = Store              : &:r3_1, r3_0
+#  971|     r3_3(glval<int>) = CopyValue          : r3_1
 #-----|   Goto -> Block 6
 
 #  973|   Block 4
 #  973|     r4_0(glval<int *>) = VariableAddress[p] : 
 #  973|     r4_1(glval<int>)   = VariableAddress[x] : 
-#  973|     mu4_2(int *)       = Store              : &:r4_0, r4_1
-#  973|     r4_3(glval<int *>) = VariableAddress[p] : 
-#  973|     r4_4(int *)        = Load               : &:r4_3, ~mu0_2
-#  973|     r4_5(int *)        = Constant[0]        : 
-#  973|     r4_6(bool)         = CompareNE          : r4_4, r4_5
-#  973|     v4_7(void)         = ConditionalBranch  : r4_6
+#  973|     r4_2(int *)        = CopyValue          : r4_1
+#  973|     mu4_3(int *)       = Store              : &:r4_0, r4_2
+#  973|     r4_4(glval<int *>) = VariableAddress[p] : 
+#  973|     r4_5(int *)        = Load               : &:r4_4, ~mu0_2
+#  973|     r4_6(int *)        = Constant[0]        : 
+#  973|     r4_7(bool)         = CompareNE          : r4_5, r4_6
+#  973|     r4_8(bool)         = CopyValue          : r4_7
+#  973|     v4_9(void)         = ConditionalBranch  : r4_8
 #-----|   False -> Block 6
 #-----|   True -> Block 5
 
@@ -4294,7 +4562,9 @@ ir.cpp:
 #  974|     r5_0(int)          = Constant[2]        : 
 #  974|     r5_1(glval<int *>) = VariableAddress[p] : 
 #  974|     r5_2(int *)        = Load               : &:r5_1, ~mu0_2
-#  974|     mu5_3(int)         = Store              : &:r5_2, r5_0
+#  974|     r5_3(glval<int>)   = CopyValue          : r5_2
+#  974|     mu5_4(int)         = Store              : &:r5_3, r5_0
+#  974|     r5_5(glval<int>)   = CopyValue          : r5_3
 #-----|   Goto -> Block 6
 
 #  976|   Block 6
@@ -4330,7 +4600,8 @@ ir.cpp:
 #  981|     r2_8(int)        = Load               : &:r2_7, ~mu0_2
 #  981|     r2_9(int)        = Constant[0]        : 
 #  981|     r2_10(bool)      = CompareNE          : r2_8, r2_9
-#  981|     v2_11(void)      = ConditionalBranch  : r2_10
+#  981|     r2_11(bool)      = CopyValue          : r2_10
+#  981|     v2_12(void)      = ConditionalBranch  : r2_11
 #-----|   False -> Block 4
 #-----|   True -> Block 3
 
@@ -4341,12 +4612,14 @@ ir.cpp:
 #  983|   Block 4
 #  983|     r4_0(glval<int *>) = VariableAddress[p] : 
 #  983|     r4_1(glval<int>)   = VariableAddress[x] : 
-#  983|     mu4_2(int *)       = Store              : &:r4_0, r4_1
-#  983|     r4_3(glval<int *>) = VariableAddress[p] : 
-#  983|     r4_4(int *)        = Load               : &:r4_3, ~mu0_2
-#  983|     r4_5(int *)        = Constant[0]        : 
-#  983|     r4_6(bool)         = CompareNE          : r4_4, r4_5
-#  983|     v4_7(void)         = ConditionalBranch  : r4_6
+#  983|     r4_2(int *)        = CopyValue          : r4_1
+#  983|     mu4_3(int *)       = Store              : &:r4_0, r4_2
+#  983|     r4_4(glval<int *>) = VariableAddress[p] : 
+#  983|     r4_5(int *)        = Load               : &:r4_4, ~mu0_2
+#  983|     r4_6(int *)        = Constant[0]        : 
+#  983|     r4_7(bool)         = CompareNE          : r4_5, r4_6
+#  983|     r4_8(bool)         = CopyValue          : r4_7
+#  983|     v4_9(void)         = ConditionalBranch  : r4_8
 #-----|   False -> Block 6
 #-----|   True -> Block 5
 
@@ -4370,7 +4643,8 @@ ir.cpp:
 #  979|     mu7_6(bool)       = Store              : &:r7_0, r7_5
 #  979|     r7_7(glval<bool>) = VariableAddress[b] : 
 #  979|     r7_8(bool)        = Load               : &:r7_7, ~mu0_2
-#  979|     v7_9(void)        = ConditionalBranch  : r7_8
+#  979|     r7_9(bool)        = CopyValue          : r7_8
+#  979|     v7_10(void)       = ConditionalBranch  : r7_9
 #-----|   False -> Block 2
 #-----|   True -> Block 1
 
@@ -4428,6 +4702,7 @@ ir.cpp:
 #  995|     r1_1(int)        = Load               : &:r1_0, ~mu0_2
 #  995|     r1_2(glval<int>) = VariableAddress[w] : 
 #  995|     mu1_3(int)       = Store              : &:r1_2, r1_1
+#  995|     r1_4(glval<int>) = CopyValue          : r1_2
 #-----|   Goto -> Block 3
 
 #  997|   Block 2
@@ -4435,6 +4710,7 @@ ir.cpp:
 #  997|     r2_1(int)        = Load               : &:r2_0, ~mu0_2
 #  997|     r2_2(glval<int>) = VariableAddress[w] : 
 #  997|     mu2_3(int)       = Store              : &:r2_2, r2_1
+#  997|     r2_4(glval<int>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  999|   Block 3
@@ -4544,147 +4820,159 @@ ir.cpp:
 
 # 1031| void Lambda(int, String const&)
 # 1031|   Block 0
-# 1031|     v0_0(void)                               = EnterFunction                          : 
-# 1031|     mu0_1(unknown)                           = AliasedDefinition                      : 
-# 1031|     mu0_2(unknown)                           = UnmodeledDefinition                    : 
-# 1031|     r0_3(glval<int>)                         = VariableAddress[x]                     : 
-# 1031|     mu0_4(int)                               = InitializeParameter[x]                 : &:r0_3
-# 1031|     r0_5(glval<String &>)                    = VariableAddress[s]                     : 
-# 1031|     mu0_6(String &)                          = InitializeParameter[s]                 : &:r0_5
-# 1032|     r0_7(glval<decltype([...](...){...})>)   = VariableAddress[lambda_empty]          : 
-# 1032|     r0_8(glval<decltype([...](...){...})>)   = VariableAddress[#temp1032:23]          : 
-# 1032|     mu0_9(decltype([...](...){...}))         = Uninitialized[#temp1032:23]            : &:r0_8
-# 1032|     r0_10(decltype([...](...){...}))         = Load                                   : &:r0_8, ~mu0_2
-# 1032|     mu0_11(decltype([...](...){...}))        = Store                                  : &:r0_7, r0_10
-# 1033|     r0_12(char)                              = Constant[65]                           : 
-# 1034|     r0_13(glval<decltype([...](...){...})>)  = VariableAddress[lambda_ref]            : 
-# 1034|     r0_14(glval<decltype([...](...){...})>)  = VariableAddress[#temp1034:21]          : 
-# 1034|     mu0_15(decltype([...](...){...}))        = Uninitialized[#temp1034:21]            : &:r0_14
-# 1034|     r0_16(glval<String &>)                   = FieldAddress[s]                        : r0_14
-#-----|     r0_17(glval<String &>)                   = VariableAddress[s]                     : 
-#-----|     r0_18(String &)                          = Load                                   : &:r0_17, ~mu0_2
-# 1034|     mu0_19(String &)                         = Store                                  : &:r0_16, r0_18
-# 1034|     r0_20(glval<int &>)                      = FieldAddress[x]                        : r0_14
-#-----|     r0_21(glval<int>)                        = VariableAddress[x]                     : 
-#-----|     mu0_22(int &)                            = Store                                  : &:r0_20, r0_21
-# 1034|     r0_23(decltype([...](...){...}))         = Load                                   : &:r0_14, ~mu0_2
-# 1034|     mu0_24(decltype([...](...){...}))        = Store                                  : &:r0_13, r0_23
-# 1035|     r0_25(glval<decltype([...](...){...})>)  = VariableAddress[lambda_ref]            : 
-# 1035|     r0_26(glval<decltype([...](...){...})>)  = Convert                                : r0_25
-# 1035|     r0_27(glval<unknown>)                    = FunctionAddress[operator()]            : 
-# 1035|     r0_28(float)                             = Constant[1.0]                          : 
-# 1035|     r0_29(char)                              = Call                                   : func:r0_27, this:r0_26, 0:r0_28
-# 1035|     mu0_30(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1036|     r0_31(glval<decltype([...](...){...})>)  = VariableAddress[lambda_val]            : 
-# 1036|     r0_32(glval<unknown>)                    = FunctionAddress[(constructor)]         : 
-# 1036|     r0_33(glval<decltype([...](...){...})>)  = VariableAddress[#temp1036:21]          : 
-# 1036|     mu0_34(decltype([...](...){...}))        = Uninitialized[#temp1036:21]            : &:r0_33
-# 1036|     r0_35(glval<String>)                     = FieldAddress[s]                        : r0_33
-#-----|     r0_36(glval<unknown>)                    = FunctionAddress[String]                : 
-#-----|     v0_37(void)                              = Call                                   : func:r0_36, this:r0_35
-#-----|     mu0_38(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1036|     r0_39(glval<int>)                        = FieldAddress[x]                        : r0_33
-#-----|     r0_40(glval<int>)                        = VariableAddress[x]                     : 
-#-----|     r0_41(int)                               = Load                                   : &:r0_40, ~mu0_2
-#-----|     mu0_42(int)                              = Store                                  : &:r0_39, r0_41
-# 1036|     r0_43(decltype([...](...){...}))         = Load                                   : &:r0_33, ~mu0_2
-# 1036|     v0_44(void)                              = Call                                   : func:r0_32, this:r0_31, 0:r0_43
-# 1036|     mu0_45(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1037|     r0_46(glval<decltype([...](...){...})>)  = VariableAddress[lambda_val]            : 
-# 1037|     r0_47(glval<decltype([...](...){...})>)  = Convert                                : r0_46
-# 1037|     r0_48(glval<unknown>)                    = FunctionAddress[operator()]            : 
-# 1037|     r0_49(float)                             = Constant[2.0]                          : 
-# 1037|     r0_50(char)                              = Call                                   : func:r0_48, this:r0_47, 0:r0_49
-# 1037|     mu0_51(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1038|     r0_52(glval<decltype([...](...){...})>)  = VariableAddress[lambda_ref_explicit]   : 
-# 1038|     r0_53(glval<decltype([...](...){...})>)  = VariableAddress[#temp1038:30]          : 
-# 1038|     mu0_54(decltype([...](...){...}))        = Uninitialized[#temp1038:30]            : &:r0_53
-# 1038|     r0_55(glval<String &>)                   = FieldAddress[s]                        : r0_53
-# 1038|     r0_56(glval<String &>)                   = VariableAddress[s]                     : 
-# 1038|     r0_57(String &)                          = Load                                   : &:r0_56, ~mu0_2
-# 1038|     mu0_58(String &)                         = Store                                  : &:r0_55, r0_57
-# 1038|     r0_59(decltype([...](...){...}))         = Load                                   : &:r0_53, ~mu0_2
-# 1038|     mu0_60(decltype([...](...){...}))        = Store                                  : &:r0_52, r0_59
-# 1039|     r0_61(glval<decltype([...](...){...})>)  = VariableAddress[lambda_ref_explicit]   : 
-# 1039|     r0_62(glval<decltype([...](...){...})>)  = Convert                                : r0_61
-# 1039|     r0_63(glval<unknown>)                    = FunctionAddress[operator()]            : 
-# 1039|     r0_64(float)                             = Constant[3.0]                          : 
-# 1039|     r0_65(char)                              = Call                                   : func:r0_63, this:r0_62, 0:r0_64
-# 1039|     mu0_66(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1040|     r0_67(glval<decltype([...](...){...})>)  = VariableAddress[lambda_val_explicit]   : 
-# 1040|     r0_68(glval<unknown>)                    = FunctionAddress[(constructor)]         : 
-# 1040|     r0_69(glval<decltype([...](...){...})>)  = VariableAddress[#temp1040:30]          : 
-# 1040|     mu0_70(decltype([...](...){...}))        = Uninitialized[#temp1040:30]            : &:r0_69
-# 1040|     r0_71(glval<String>)                     = FieldAddress[s]                        : r0_69
-#-----|     r0_72(glval<unknown>)                    = FunctionAddress[String]                : 
-#-----|     v0_73(void)                              = Call                                   : func:r0_72, this:r0_71
-#-----|     mu0_74(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1040|     r0_75(decltype([...](...){...}))         = Load                                   : &:r0_69, ~mu0_2
-# 1040|     v0_76(void)                              = Call                                   : func:r0_68, this:r0_67, 0:r0_75
-# 1040|     mu0_77(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1041|     r0_78(glval<decltype([...](...){...})>)  = VariableAddress[lambda_val_explicit]   : 
-# 1041|     r0_79(glval<decltype([...](...){...})>)  = Convert                                : r0_78
-# 1041|     r0_80(glval<unknown>)                    = FunctionAddress[operator()]            : 
-# 1041|     r0_81(float)                             = Constant[4.0]                          : 
-# 1041|     r0_82(char)                              = Call                                   : func:r0_80, this:r0_79, 0:r0_81
-# 1041|     mu0_83(unknown)                          = ^CallSideEffect                        : ~mu0_2
-# 1042|     r0_84(glval<decltype([...](...){...})>)  = VariableAddress[lambda_mixed_explicit] : 
-# 1042|     r0_85(glval<decltype([...](...){...})>)  = VariableAddress[#temp1042:32]          : 
-# 1042|     mu0_86(decltype([...](...){...}))        = Uninitialized[#temp1042:32]            : &:r0_85
-# 1042|     r0_87(glval<String &>)                   = FieldAddress[s]                        : r0_85
-# 1042|     r0_88(glval<String &>)                   = VariableAddress[s]                     : 
-# 1042|     r0_89(String &)                          = Load                                   : &:r0_88, ~mu0_2
-# 1042|     mu0_90(String &)                         = Store                                  : &:r0_87, r0_89
-# 1042|     r0_91(glval<int>)                        = FieldAddress[x]                        : r0_85
-# 1042|     r0_92(glval<int>)                        = VariableAddress[x]                     : 
-# 1042|     r0_93(int)                               = Load                                   : &:r0_92, ~mu0_2
-# 1042|     mu0_94(int)                              = Store                                  : &:r0_91, r0_93
-# 1042|     r0_95(decltype([...](...){...}))         = Load                                   : &:r0_85, ~mu0_2
-# 1042|     mu0_96(decltype([...](...){...}))        = Store                                  : &:r0_84, r0_95
-# 1043|     r0_97(glval<decltype([...](...){...})>)  = VariableAddress[lambda_mixed_explicit] : 
-# 1043|     r0_98(glval<decltype([...](...){...})>)  = Convert                                : r0_97
-# 1043|     r0_99(glval<unknown>)                    = FunctionAddress[operator()]            : 
-# 1043|     r0_100(float)                            = Constant[5.0]                          : 
-# 1043|     r0_101(char)                             = Call                                   : func:r0_99, this:r0_98, 0:r0_100
-# 1043|     mu0_102(unknown)                         = ^CallSideEffect                        : ~mu0_2
-# 1044|     r0_103(glval<int>)                       = VariableAddress[r]                     : 
-# 1044|     r0_104(glval<int>)                       = VariableAddress[x]                     : 
-# 1044|     r0_105(int)                              = Load                                   : &:r0_104, ~mu0_2
-# 1044|     r0_106(int)                              = Constant[1]                            : 
-# 1044|     r0_107(int)                              = Sub                                    : r0_105, r0_106
-# 1044|     mu0_108(int)                             = Store                                  : &:r0_103, r0_107
-# 1045|     r0_109(glval<decltype([...](...){...})>) = VariableAddress[lambda_inits]          : 
-# 1045|     r0_110(glval<decltype([...](...){...})>) = VariableAddress[#temp1045:23]          : 
-# 1045|     mu0_111(decltype([...](...){...}))       = Uninitialized[#temp1045:23]            : &:r0_110
-# 1045|     r0_112(glval<String &>)                  = FieldAddress[s]                        : r0_110
-# 1045|     r0_113(glval<String &>)                  = VariableAddress[s]                     : 
-# 1045|     r0_114(String &)                         = Load                                   : &:r0_113, ~mu0_2
-# 1045|     mu0_115(String &)                        = Store                                  : &:r0_112, r0_114
-# 1045|     r0_116(glval<int>)                       = FieldAddress[x]                        : r0_110
-# 1045|     r0_117(glval<int>)                       = VariableAddress[x]                     : 
-# 1045|     r0_118(int)                              = Load                                   : &:r0_117, ~mu0_2
-# 1045|     mu0_119(int)                             = Store                                  : &:r0_116, r0_118
-# 1045|     r0_120(glval<int>)                       = FieldAddress[i]                        : r0_110
-# 1045|     r0_121(glval<int>)                       = VariableAddress[x]                     : 
-# 1045|     r0_122(int)                              = Load                                   : &:r0_121, ~mu0_2
-# 1045|     r0_123(int)                              = Constant[1]                            : 
-# 1045|     r0_124(int)                              = Add                                    : r0_122, r0_123
-# 1045|     mu0_125(int)                             = Store                                  : &:r0_120, r0_124
-# 1045|     r0_126(glval<int &>)                     = FieldAddress[j]                        : r0_110
-# 1045|     r0_127(glval<int>)                       = VariableAddress[r]                     : 
-# 1045|     mu0_128(int &)                           = Store                                  : &:r0_126, r0_127
-# 1045|     r0_129(decltype([...](...){...}))        = Load                                   : &:r0_110, ~mu0_2
-# 1045|     mu0_130(decltype([...](...){...}))       = Store                                  : &:r0_109, r0_129
-# 1046|     r0_131(glval<decltype([...](...){...})>) = VariableAddress[lambda_inits]          : 
-# 1046|     r0_132(glval<decltype([...](...){...})>) = Convert                                : r0_131
-# 1046|     r0_133(glval<unknown>)                   = FunctionAddress[operator()]            : 
-# 1046|     r0_134(float)                            = Constant[6.0]                          : 
-# 1046|     r0_135(char)                             = Call                                   : func:r0_133, this:r0_132, 0:r0_134
-# 1046|     mu0_136(unknown)                         = ^CallSideEffect                        : ~mu0_2
-# 1047|     v0_137(void)                             = NoOp                                   : 
-# 1031|     v0_138(void)                             = ReturnVoid                             : 
-# 1031|     v0_139(void)                             = UnmodeledUse                           : mu*
-# 1031|     v0_140(void)                             = ExitFunction                           : 
+# 1031|     v0_0(void)                                    = EnterFunction                          : 
+# 1031|     mu0_1(unknown)                                = AliasedDefinition                      : 
+# 1031|     mu0_2(unknown)                                = UnmodeledDefinition                    : 
+# 1031|     r0_3(glval<int>)                              = VariableAddress[x]                     : 
+# 1031|     mu0_4(int)                                    = InitializeParameter[x]                 : &:r0_3
+# 1031|     r0_5(glval<String &>)                         = VariableAddress[s]                     : 
+# 1031|     mu0_6(String &)                               = InitializeParameter[s]                 : &:r0_5
+# 1032|     r0_7(glval<decltype([...](...){...})>)        = VariableAddress[lambda_empty]          : 
+# 1032|     r0_8(glval<decltype([...](...){...})>)        = VariableAddress[#temp1032:23]          : 
+# 1032|     mu0_9(decltype([...](...){...}))              = Uninitialized[#temp1032:23]            : &:r0_8
+# 1032|     r0_10(decltype([...](...){...}))              = Load                                   : &:r0_8, ~mu0_2
+# 1032|     mu0_11(decltype([...](...){...}))             = Store                                  : &:r0_7, r0_10
+# 1033|     r0_12(char)                                   = Constant[65]                           : 
+# 1034|     r0_13(glval<decltype([...](...){...})>)       = VariableAddress[lambda_ref]            : 
+# 1034|     r0_14(glval<decltype([...](...){...})>)       = VariableAddress[#temp1034:21]          : 
+# 1034|     mu0_15(decltype([...](...){...}))             = Uninitialized[#temp1034:21]            : &:r0_14
+# 1034|     r0_16(glval<String &>)                        = FieldAddress[s]                        : r0_14
+#-----|     r0_17(glval<String &>)                        = VariableAddress[s]                     : 
+#-----|     r0_18(String &)                               = Load                                   : &:r0_17, ~mu0_2
+# 1034|     r0_19(glval<String>)                          = CopyValue                              : r0_18
+# 1034|     r0_20(String &)                               = CopyValue                              : r0_19
+# 1034|     mu0_21(String &)                              = Store                                  : &:r0_16, r0_20
+# 1034|     r0_22(glval<int &>)                           = FieldAddress[x]                        : r0_14
+#-----|     r0_23(glval<int>)                             = VariableAddress[x]                     : 
+#-----|     r0_24(int &)                                  = CopyValue                              : r0_23
+#-----|     mu0_25(int &)                                 = Store                                  : &:r0_22, r0_24
+# 1034|     r0_26(decltype([...](...){...}))              = Load                                   : &:r0_14, ~mu0_2
+# 1034|     mu0_27(decltype([...](...){...}))             = Store                                  : &:r0_13, r0_26
+# 1035|     r0_28(glval<decltype([...](...){...})>)       = VariableAddress[lambda_ref]            : 
+# 1035|     r0_29(glval<decltype([...](...){...})>)       = Convert                                : r0_28
+# 1035|     r0_30(glval<unknown>)                         = FunctionAddress[operator()]            : 
+# 1035|     r0_31(float)                                  = Constant[1.0]                          : 
+# 1035|     r0_32(char)                                   = Call                                   : func:r0_30, this:r0_29, 0:r0_31
+# 1035|     mu0_33(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1036|     r0_34(glval<decltype([...](...){...})>)       = VariableAddress[lambda_val]            : 
+# 1036|     r0_35(glval<unknown>)                         = FunctionAddress[(constructor)]         : 
+# 1036|     r0_36(glval<decltype([...](...){...})>)       = VariableAddress[#temp1036:21]          : 
+# 1036|     mu0_37(decltype([...](...){...}))             = Uninitialized[#temp1036:21]            : &:r0_36
+# 1036|     r0_38(glval<String>)                          = FieldAddress[s]                        : r0_36
+#-----|     r0_39(glval<unknown>)                         = FunctionAddress[String]                : 
+#-----|     v0_40(void)                                   = Call                                   : func:r0_39, this:r0_38
+#-----|     mu0_41(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1036|     r0_42(glval<int>)                             = FieldAddress[x]                        : r0_36
+#-----|     r0_43(glval<int>)                             = VariableAddress[x]                     : 
+#-----|     r0_44(int)                                    = Load                                   : &:r0_43, ~mu0_2
+#-----|     mu0_45(int)                                   = Store                                  : &:r0_42, r0_44
+# 1036|     r0_46(decltype([...](...){...}))              = Load                                   : &:r0_36, ~mu0_2
+# 1036|     r0_47(lambda [] type at line 1036, col. 21 &) = CopyValue                              : r0_46
+# 1036|     v0_48(void)                                   = Call                                   : func:r0_35, this:r0_34, 0:r0_47
+# 1036|     mu0_49(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1037|     r0_50(glval<decltype([...](...){...})>)       = VariableAddress[lambda_val]            : 
+# 1037|     r0_51(glval<decltype([...](...){...})>)       = Convert                                : r0_50
+# 1037|     r0_52(glval<unknown>)                         = FunctionAddress[operator()]            : 
+# 1037|     r0_53(float)                                  = Constant[2.0]                          : 
+# 1037|     r0_54(char)                                   = Call                                   : func:r0_52, this:r0_51, 0:r0_53
+# 1037|     mu0_55(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1038|     r0_56(glval<decltype([...](...){...})>)       = VariableAddress[lambda_ref_explicit]   : 
+# 1038|     r0_57(glval<decltype([...](...){...})>)       = VariableAddress[#temp1038:30]          : 
+# 1038|     mu0_58(decltype([...](...){...}))             = Uninitialized[#temp1038:30]            : &:r0_57
+# 1038|     r0_59(glval<String &>)                        = FieldAddress[s]                        : r0_57
+# 1038|     r0_60(glval<String &>)                        = VariableAddress[s]                     : 
+# 1038|     r0_61(String &)                               = Load                                   : &:r0_60, ~mu0_2
+# 1038|     r0_62(glval<String>)                          = CopyValue                              : r0_61
+# 1038|     r0_63(String &)                               = CopyValue                              : r0_62
+# 1038|     mu0_64(String &)                              = Store                                  : &:r0_59, r0_63
+# 1038|     r0_65(decltype([...](...){...}))              = Load                                   : &:r0_57, ~mu0_2
+# 1038|     mu0_66(decltype([...](...){...}))             = Store                                  : &:r0_56, r0_65
+# 1039|     r0_67(glval<decltype([...](...){...})>)       = VariableAddress[lambda_ref_explicit]   : 
+# 1039|     r0_68(glval<decltype([...](...){...})>)       = Convert                                : r0_67
+# 1039|     r0_69(glval<unknown>)                         = FunctionAddress[operator()]            : 
+# 1039|     r0_70(float)                                  = Constant[3.0]                          : 
+# 1039|     r0_71(char)                                   = Call                                   : func:r0_69, this:r0_68, 0:r0_70
+# 1039|     mu0_72(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1040|     r0_73(glval<decltype([...](...){...})>)       = VariableAddress[lambda_val_explicit]   : 
+# 1040|     r0_74(glval<unknown>)                         = FunctionAddress[(constructor)]         : 
+# 1040|     r0_75(glval<decltype([...](...){...})>)       = VariableAddress[#temp1040:30]          : 
+# 1040|     mu0_76(decltype([...](...){...}))             = Uninitialized[#temp1040:30]            : &:r0_75
+# 1040|     r0_77(glval<String>)                          = FieldAddress[s]                        : r0_75
+#-----|     r0_78(glval<unknown>)                         = FunctionAddress[String]                : 
+#-----|     v0_79(void)                                   = Call                                   : func:r0_78, this:r0_77
+#-----|     mu0_80(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1040|     r0_81(decltype([...](...){...}))              = Load                                   : &:r0_75, ~mu0_2
+# 1040|     r0_82(lambda [] type at line 1040, col. 30 &) = CopyValue                              : r0_81
+# 1040|     v0_83(void)                                   = Call                                   : func:r0_74, this:r0_73, 0:r0_82
+# 1040|     mu0_84(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1041|     r0_85(glval<decltype([...](...){...})>)       = VariableAddress[lambda_val_explicit]   : 
+# 1041|     r0_86(glval<decltype([...](...){...})>)       = Convert                                : r0_85
+# 1041|     r0_87(glval<unknown>)                         = FunctionAddress[operator()]            : 
+# 1041|     r0_88(float)                                  = Constant[4.0]                          : 
+# 1041|     r0_89(char)                                   = Call                                   : func:r0_87, this:r0_86, 0:r0_88
+# 1041|     mu0_90(unknown)                               = ^CallSideEffect                        : ~mu0_2
+# 1042|     r0_91(glval<decltype([...](...){...})>)       = VariableAddress[lambda_mixed_explicit] : 
+# 1042|     r0_92(glval<decltype([...](...){...})>)       = VariableAddress[#temp1042:32]          : 
+# 1042|     mu0_93(decltype([...](...){...}))             = Uninitialized[#temp1042:32]            : &:r0_92
+# 1042|     r0_94(glval<String &>)                        = FieldAddress[s]                        : r0_92
+# 1042|     r0_95(glval<String &>)                        = VariableAddress[s]                     : 
+# 1042|     r0_96(String &)                               = Load                                   : &:r0_95, ~mu0_2
+# 1042|     r0_97(glval<String>)                          = CopyValue                              : r0_96
+# 1042|     r0_98(String &)                               = CopyValue                              : r0_97
+# 1042|     mu0_99(String &)                              = Store                                  : &:r0_94, r0_98
+# 1042|     r0_100(glval<int>)                            = FieldAddress[x]                        : r0_92
+# 1042|     r0_101(glval<int>)                            = VariableAddress[x]                     : 
+# 1042|     r0_102(int)                                   = Load                                   : &:r0_101, ~mu0_2
+# 1042|     mu0_103(int)                                  = Store                                  : &:r0_100, r0_102
+# 1042|     r0_104(decltype([...](...){...}))             = Load                                   : &:r0_92, ~mu0_2
+# 1042|     mu0_105(decltype([...](...){...}))            = Store                                  : &:r0_91, r0_104
+# 1043|     r0_106(glval<decltype([...](...){...})>)      = VariableAddress[lambda_mixed_explicit] : 
+# 1043|     r0_107(glval<decltype([...](...){...})>)      = Convert                                : r0_106
+# 1043|     r0_108(glval<unknown>)                        = FunctionAddress[operator()]            : 
+# 1043|     r0_109(float)                                 = Constant[5.0]                          : 
+# 1043|     r0_110(char)                                  = Call                                   : func:r0_108, this:r0_107, 0:r0_109
+# 1043|     mu0_111(unknown)                              = ^CallSideEffect                        : ~mu0_2
+# 1044|     r0_112(glval<int>)                            = VariableAddress[r]                     : 
+# 1044|     r0_113(glval<int>)                            = VariableAddress[x]                     : 
+# 1044|     r0_114(int)                                   = Load                                   : &:r0_113, ~mu0_2
+# 1044|     r0_115(int)                                   = Constant[1]                            : 
+# 1044|     r0_116(int)                                   = Sub                                    : r0_114, r0_115
+# 1044|     mu0_117(int)                                  = Store                                  : &:r0_112, r0_116
+# 1045|     r0_118(glval<decltype([...](...){...})>)      = VariableAddress[lambda_inits]          : 
+# 1045|     r0_119(glval<decltype([...](...){...})>)      = VariableAddress[#temp1045:23]          : 
+# 1045|     mu0_120(decltype([...](...){...}))            = Uninitialized[#temp1045:23]            : &:r0_119
+# 1045|     r0_121(glval<String &>)                       = FieldAddress[s]                        : r0_119
+# 1045|     r0_122(glval<String &>)                       = VariableAddress[s]                     : 
+# 1045|     r0_123(String &)                              = Load                                   : &:r0_122, ~mu0_2
+# 1045|     r0_124(glval<String>)                         = CopyValue                              : r0_123
+# 1045|     r0_125(String &)                              = CopyValue                              : r0_124
+# 1045|     mu0_126(String &)                             = Store                                  : &:r0_121, r0_125
+# 1045|     r0_127(glval<int>)                            = FieldAddress[x]                        : r0_119
+# 1045|     r0_128(glval<int>)                            = VariableAddress[x]                     : 
+# 1045|     r0_129(int)                                   = Load                                   : &:r0_128, ~mu0_2
+# 1045|     mu0_130(int)                                  = Store                                  : &:r0_127, r0_129
+# 1045|     r0_131(glval<int>)                            = FieldAddress[i]                        : r0_119
+# 1045|     r0_132(glval<int>)                            = VariableAddress[x]                     : 
+# 1045|     r0_133(int)                                   = Load                                   : &:r0_132, ~mu0_2
+# 1045|     r0_134(int)                                   = Constant[1]                            : 
+# 1045|     r0_135(int)                                   = Add                                    : r0_133, r0_134
+# 1045|     mu0_136(int)                                  = Store                                  : &:r0_131, r0_135
+# 1045|     r0_137(glval<int &>)                          = FieldAddress[j]                        : r0_119
+# 1045|     r0_138(glval<int>)                            = VariableAddress[r]                     : 
+# 1045|     r0_139(int &)                                 = CopyValue                              : r0_138
+# 1045|     mu0_140(int &)                                = Store                                  : &:r0_137, r0_139
+# 1045|     r0_141(decltype([...](...){...}))             = Load                                   : &:r0_119, ~mu0_2
+# 1045|     mu0_142(decltype([...](...){...}))            = Store                                  : &:r0_118, r0_141
+# 1046|     r0_143(glval<decltype([...](...){...})>)      = VariableAddress[lambda_inits]          : 
+# 1046|     r0_144(glval<decltype([...](...){...})>)      = Convert                                : r0_143
+# 1046|     r0_145(glval<unknown>)                        = FunctionAddress[operator()]            : 
+# 1046|     r0_146(float)                                 = Constant[6.0]                          : 
+# 1046|     r0_147(char)                                  = Call                                   : func:r0_145, this:r0_144, 0:r0_146
+# 1046|     mu0_148(unknown)                              = ^CallSideEffect                        : ~mu0_2
+# 1047|     v0_149(void)                                  = NoOp                                   : 
+# 1031|     v0_150(void)                                  = ReturnVoid                             : 
+# 1031|     v0_151(void)                                  = UnmodeledUse                           : mu*
+# 1031|     v0_152(void)                                  = ExitFunction                           : 
 
 # 1032| void (void Lambda(int, String const&))::(lambda [] type at line 1032, col. 23)::(constructor)((void Lambda(int, String const&))::(lambda [] type at line 1032, col. 23)&&)
 # 1032|   Block 0
@@ -4741,20 +5029,21 @@ ir.cpp:
 #-----|     r0_7(lambda [] type at line 1034, col. 21 *)  = CopyValue                : r0_3
 #-----|     r0_8(glval<String &>)                         = FieldAddress[s]          : r0_7
 #-----|     r0_9(String &)                                = Load                     : &:r0_8, ~mu0_2
-# 1034|     r0_10(glval<unknown>)                         = FunctionAddress[c_str]   : 
-# 1034|     r0_11(char *)                                 = Call                     : func:r0_10, this:r0_9
-# 1034|     mu0_12(unknown)                               = ^CallSideEffect          : ~mu0_2
-#-----|     r0_13(lambda [] type at line 1034, col. 21 *) = CopyValue                : r0_3
-#-----|     r0_14(glval<int &>)                           = FieldAddress[x]          : r0_13
-#-----|     r0_15(int &)                                  = Load                     : &:r0_14, ~mu0_2
-# 1034|     r0_16(int)                                    = Load                     : &:r0_15, ~mu0_2
-# 1034|     r0_17(glval<char>)                            = PointerAdd[1]            : r0_11, r0_16
-# 1034|     r0_18(char)                                   = Load                     : &:r0_17, ~mu0_2
-# 1034|     mu0_19(char)                                  = Store                    : &:r0_6, r0_18
-# 1034|     r0_20(glval<char>)                            = VariableAddress[#return] : 
-# 1034|     v0_21(void)                                   = ReturnValue              : &:r0_20, ~mu0_2
-# 1034|     v0_22(void)                                   = UnmodeledUse             : mu*
-# 1034|     v0_23(void)                                   = ExitFunction             : 
+# 1034|     r0_10(glval<String>)                          = CopyValue                : r0_9
+# 1034|     r0_11(glval<unknown>)                         = FunctionAddress[c_str]   : 
+# 1034|     r0_12(char *)                                 = Call                     : func:r0_11, this:r0_10
+# 1034|     mu0_13(unknown)                               = ^CallSideEffect          : ~mu0_2
+#-----|     r0_14(lambda [] type at line 1034, col. 21 *) = CopyValue                : r0_3
+#-----|     r0_15(glval<int &>)                           = FieldAddress[x]          : r0_14
+#-----|     r0_16(int &)                                  = Load                     : &:r0_15, ~mu0_2
+# 1034|     r0_17(int)                                    = Load                     : &:r0_16, ~mu0_2
+# 1034|     r0_18(glval<char>)                            = PointerAdd[1]            : r0_12, r0_17
+# 1034|     r0_19(char)                                   = Load                     : &:r0_18, ~mu0_2
+# 1034|     mu0_20(char)                                  = Store                    : &:r0_6, r0_19
+# 1034|     r0_21(glval<char>)                            = VariableAddress[#return] : 
+# 1034|     v0_22(void)                                   = ReturnValue              : &:r0_21, ~mu0_2
+# 1034|     v0_23(void)                                   = UnmodeledUse             : mu*
+# 1034|     v0_24(void)                                   = ExitFunction             : 
 
 # 1036| void (void Lambda(int, String const&))::(lambda [] type at line 1036, col. 21)::~<unnamed>()
 # 1036|   Block 0
@@ -4808,17 +5097,18 @@ ir.cpp:
 #-----|     r0_7(lambda [] type at line 1038, col. 30 *) = CopyValue                : r0_3
 #-----|     r0_8(glval<String &>)                        = FieldAddress[s]          : r0_7
 #-----|     r0_9(String &)                               = Load                     : &:r0_8, ~mu0_2
-# 1038|     r0_10(glval<unknown>)                        = FunctionAddress[c_str]   : 
-# 1038|     r0_11(char *)                                = Call                     : func:r0_10, this:r0_9
-# 1038|     mu0_12(unknown)                              = ^CallSideEffect          : ~mu0_2
-# 1038|     r0_13(int)                                   = Constant[0]              : 
-# 1038|     r0_14(glval<char>)                           = PointerAdd[1]            : r0_11, r0_13
-# 1038|     r0_15(char)                                  = Load                     : &:r0_14, ~mu0_2
-# 1038|     mu0_16(char)                                 = Store                    : &:r0_6, r0_15
-# 1038|     r0_17(glval<char>)                           = VariableAddress[#return] : 
-# 1038|     v0_18(void)                                  = ReturnValue              : &:r0_17, ~mu0_2
-# 1038|     v0_19(void)                                  = UnmodeledUse             : mu*
-# 1038|     v0_20(void)                                  = ExitFunction             : 
+# 1038|     r0_10(glval<String>)                         = CopyValue                : r0_9
+# 1038|     r0_11(glval<unknown>)                        = FunctionAddress[c_str]   : 
+# 1038|     r0_12(char *)                                = Call                     : func:r0_11, this:r0_10
+# 1038|     mu0_13(unknown)                              = ^CallSideEffect          : ~mu0_2
+# 1038|     r0_14(int)                                   = Constant[0]              : 
+# 1038|     r0_15(glval<char>)                           = PointerAdd[1]            : r0_12, r0_14
+# 1038|     r0_16(char)                                  = Load                     : &:r0_15, ~mu0_2
+# 1038|     mu0_17(char)                                 = Store                    : &:r0_6, r0_16
+# 1038|     r0_18(glval<char>)                           = VariableAddress[#return] : 
+# 1038|     v0_19(void)                                  = ReturnValue              : &:r0_18, ~mu0_2
+# 1038|     v0_20(void)                                  = UnmodeledUse             : mu*
+# 1038|     v0_21(void)                                  = ExitFunction             : 
 
 # 1040| void (void Lambda(int, String const&))::(lambda [] type at line 1040, col. 30)::(constructor)((void Lambda(int, String const&))::(lambda [] type at line 1040, col. 30)&&)
 # 1040|   Block 0
@@ -4887,19 +5177,20 @@ ir.cpp:
 #-----|     r0_7(lambda [] type at line 1042, col. 32 *)  = CopyValue                : r0_3
 #-----|     r0_8(glval<String &>)                         = FieldAddress[s]          : r0_7
 #-----|     r0_9(String &)                                = Load                     : &:r0_8, ~mu0_2
-# 1042|     r0_10(glval<unknown>)                         = FunctionAddress[c_str]   : 
-# 1042|     r0_11(char *)                                 = Call                     : func:r0_10, this:r0_9
-# 1042|     mu0_12(unknown)                               = ^CallSideEffect          : ~mu0_2
-#-----|     r0_13(lambda [] type at line 1042, col. 32 *) = CopyValue                : r0_3
-#-----|     r0_14(glval<int>)                             = FieldAddress[x]          : r0_13
-#-----|     r0_15(int)                                    = Load                     : &:r0_14, ~mu0_2
-# 1042|     r0_16(glval<char>)                            = PointerAdd[1]            : r0_11, r0_15
-# 1042|     r0_17(char)                                   = Load                     : &:r0_16, ~mu0_2
-# 1042|     mu0_18(char)                                  = Store                    : &:r0_6, r0_17
-# 1042|     r0_19(glval<char>)                            = VariableAddress[#return] : 
-# 1042|     v0_20(void)                                   = ReturnValue              : &:r0_19, ~mu0_2
-# 1042|     v0_21(void)                                   = UnmodeledUse             : mu*
-# 1042|     v0_22(void)                                   = ExitFunction             : 
+# 1042|     r0_10(glval<String>)                          = CopyValue                : r0_9
+# 1042|     r0_11(glval<unknown>)                         = FunctionAddress[c_str]   : 
+# 1042|     r0_12(char *)                                 = Call                     : func:r0_11, this:r0_10
+# 1042|     mu0_13(unknown)                               = ^CallSideEffect          : ~mu0_2
+#-----|     r0_14(lambda [] type at line 1042, col. 32 *) = CopyValue                : r0_3
+#-----|     r0_15(glval<int>)                             = FieldAddress[x]          : r0_14
+#-----|     r0_16(int)                                    = Load                     : &:r0_15, ~mu0_2
+# 1042|     r0_17(glval<char>)                            = PointerAdd[1]            : r0_12, r0_16
+# 1042|     r0_18(char)                                   = Load                     : &:r0_17, ~mu0_2
+# 1042|     mu0_19(char)                                  = Store                    : &:r0_6, r0_18
+# 1042|     r0_20(glval<char>)                            = VariableAddress[#return] : 
+# 1042|     v0_21(void)                                   = ReturnValue              : &:r0_20, ~mu0_2
+# 1042|     v0_22(void)                                   = UnmodeledUse             : mu*
+# 1042|     v0_23(void)                                   = ExitFunction             : 
 
 # 1045| char (void Lambda(int, String const&))::(lambda [] type at line 1045, col. 23)::operator()(float) const
 # 1045|   Block 0
@@ -4913,28 +5204,29 @@ ir.cpp:
 #-----|     r0_7(lambda [] type at line 1045, col. 23 *)  = CopyValue                : r0_3
 #-----|     r0_8(glval<String &>)                         = FieldAddress[s]          : r0_7
 #-----|     r0_9(String &)                                = Load                     : &:r0_8, ~mu0_2
-# 1045|     r0_10(glval<unknown>)                         = FunctionAddress[c_str]   : 
-# 1045|     r0_11(char *)                                 = Call                     : func:r0_10, this:r0_9
-# 1045|     mu0_12(unknown)                               = ^CallSideEffect          : ~mu0_2
-#-----|     r0_13(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
-#-----|     r0_14(glval<int>)                             = FieldAddress[x]          : r0_13
-#-----|     r0_15(int)                                    = Load                     : &:r0_14, ~mu0_2
-#-----|     r0_16(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
-# 1045|     r0_17(glval<int>)                             = FieldAddress[i]          : r0_16
-# 1045|     r0_18(int)                                    = Load                     : &:r0_17, ~mu0_2
-# 1045|     r0_19(int)                                    = Add                      : r0_15, r0_18
-#-----|     r0_20(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
-# 1045|     r0_21(glval<int &>)                           = FieldAddress[j]          : r0_20
-# 1045|     r0_22(int &)                                  = Load                     : &:r0_21, ~mu0_2
-# 1045|     r0_23(int)                                    = Load                     : &:r0_22, ~mu0_2
-# 1045|     r0_24(int)                                    = Sub                      : r0_19, r0_23
-# 1045|     r0_25(glval<char>)                            = PointerAdd[1]            : r0_11, r0_24
-# 1045|     r0_26(char)                                   = Load                     : &:r0_25, ~mu0_2
-# 1045|     mu0_27(char)                                  = Store                    : &:r0_6, r0_26
-# 1045|     r0_28(glval<char>)                            = VariableAddress[#return] : 
-# 1045|     v0_29(void)                                   = ReturnValue              : &:r0_28, ~mu0_2
-# 1045|     v0_30(void)                                   = UnmodeledUse             : mu*
-# 1045|     v0_31(void)                                   = ExitFunction             : 
+# 1045|     r0_10(glval<String>)                          = CopyValue                : r0_9
+# 1045|     r0_11(glval<unknown>)                         = FunctionAddress[c_str]   : 
+# 1045|     r0_12(char *)                                 = Call                     : func:r0_11, this:r0_10
+# 1045|     mu0_13(unknown)                               = ^CallSideEffect          : ~mu0_2
+#-----|     r0_14(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
+#-----|     r0_15(glval<int>)                             = FieldAddress[x]          : r0_14
+#-----|     r0_16(int)                                    = Load                     : &:r0_15, ~mu0_2
+#-----|     r0_17(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
+# 1045|     r0_18(glval<int>)                             = FieldAddress[i]          : r0_17
+# 1045|     r0_19(int)                                    = Load                     : &:r0_18, ~mu0_2
+# 1045|     r0_20(int)                                    = Add                      : r0_16, r0_19
+#-----|     r0_21(lambda [] type at line 1045, col. 23 *) = CopyValue                : r0_3
+# 1045|     r0_22(glval<int &>)                           = FieldAddress[j]          : r0_21
+# 1045|     r0_23(int &)                                  = Load                     : &:r0_22, ~mu0_2
+# 1045|     r0_24(int)                                    = Load                     : &:r0_23, ~mu0_2
+# 1045|     r0_25(int)                                    = Sub                      : r0_20, r0_24
+# 1045|     r0_26(glval<char>)                            = PointerAdd[1]            : r0_12, r0_25
+# 1045|     r0_27(char)                                   = Load                     : &:r0_26, ~mu0_2
+# 1045|     mu0_28(char)                                  = Store                    : &:r0_6, r0_27
+# 1045|     r0_29(glval<char>)                            = VariableAddress[#return] : 
+# 1045|     v0_30(void)                                   = ReturnValue              : &:r0_29, ~mu0_2
+# 1045|     v0_31(void)                                   = UnmodeledUse             : mu*
+# 1045|     v0_32(void)                                   = ExitFunction             : 
 
 # 1068| void RangeBasedFor(vector<int> const&)
 # 1068|   Block 0
@@ -4946,132 +5238,144 @@ ir.cpp:
 # 1069|     r0_5(glval<vector<int> &>)  = VariableAddress[(__range)] : 
 # 1069|     r0_6(glval<vector<int> &>)  = VariableAddress[v]         : 
 # 1069|     r0_7(vector<int> &)         = Load                       : &:r0_6, ~mu0_2
-# 1069|     mu0_8(vector<int> &)        = Store                      : &:r0_5, r0_7
-# 1069|     r0_9(glval<iterator>)       = VariableAddress[(__begin)] : 
-#-----|     r0_10(glval<vector<int> &>) = VariableAddress[(__range)] : 
-#-----|     r0_11(vector<int> &)        = Load                       : &:r0_10, ~mu0_2
-# 1069|     r0_12(glval<unknown>)       = FunctionAddress[begin]     : 
-# 1069|     r0_13(iterator)             = Call                       : func:r0_12, this:r0_11
-# 1069|     mu0_14(unknown)             = ^CallSideEffect            : ~mu0_2
-# 1069|     mu0_15(iterator)            = Store                      : &:r0_9, r0_13
-# 1069|     r0_16(glval<iterator>)      = VariableAddress[(__end)]   : 
-#-----|     r0_17(glval<vector<int> &>) = VariableAddress[(__range)] : 
-#-----|     r0_18(vector<int> &)        = Load                       : &:r0_17, ~mu0_2
-# 1069|     r0_19(glval<unknown>)       = FunctionAddress[end]       : 
-# 1069|     r0_20(iterator)             = Call                       : func:r0_19, this:r0_18
-# 1069|     mu0_21(unknown)             = ^CallSideEffect            : ~mu0_2
-# 1069|     mu0_22(iterator)            = Store                      : &:r0_16, r0_20
-#-----|   Goto -> Block 1
+# 1069|     r0_8(glval<vector<int>>)    = CopyValue                  : r0_7
+# 1069|     r0_9(vector<int> &)         = CopyValue                  : r0_8
+# 1069|     mu0_10(vector<int> &)       = Store                      : &:r0_5, r0_9
+# 1069|     r0_11(glval<iterator>)      = VariableAddress[(__begin)] : 
+#-----|     r0_12(glval<vector<int> &>) = VariableAddress[(__range)] : 
+#-----|     r0_13(vector<int> &)        = Load                       : &:r0_12, ~mu0_2
+#-----|     r0_14(glval<vector<int>>)   = CopyValue                  : r0_13
+# 1069|     r0_15(glval<unknown>)       = FunctionAddress[begin]     : 
+# 1069|     r0_16(iterator)             = Call                       : func:r0_15, this:r0_14
+# 1069|     mu0_17(unknown)             = ^CallSideEffect            : ~mu0_2
+# 1069|     mu0_18(iterator)            = Store                      : &:r0_11, r0_16
+# 1069|     r0_19(glval<iterator>)      = VariableAddress[(__end)]   : 
+#-----|     r0_20(glval<vector<int> &>) = VariableAddress[(__range)] : 
+#-----|     r0_21(vector<int> &)        = Load                       : &:r0_20, ~mu0_2
+#-----|     r0_22(glval<vector<int>>)   = CopyValue                  : r0_21
+# 1069|     r0_23(glval<unknown>)       = FunctionAddress[end]       : 
+# 1069|     r0_24(iterator)             = Call                       : func:r0_23, this:r0_22
+# 1069|     mu0_25(unknown)             = ^CallSideEffect            : ~mu0_2
+# 1069|     mu0_26(iterator)            = Store                      : &:r0_19, r0_24
+#-----|   Goto -> Block 3
 
-#-----|   Block 1
-#-----|     r1_0(glval<iterator>) = VariableAddress[(__begin)]  : 
-#-----|     r1_1(glval<iterator>) = Convert                     : r1_0
-# 1069|     r1_2(glval<unknown>)  = FunctionAddress[operator!=] : 
-#-----|     r1_3(glval<iterator>) = VariableAddress[(__end)]    : 
-#-----|     r1_4(iterator)        = Load                        : &:r1_3, ~mu0_2
-# 1069|     r1_5(bool)            = Call                        : func:r1_2, this:r1_1, 0:r1_4
-# 1069|     mu1_6(unknown)        = ^CallSideEffect             : ~mu0_2
-# 1069|     v1_7(void)            = ConditionalBranch           : r1_5
-#-----|   False -> Block 5
-#-----|   True -> Block 2
+# 1077|   Block 1
+# 1077|     v1_0(void) = NoOp : 
+#-----|   Goto -> Block 2
 
-# 1069|   Block 2
-# 1069|     r2_0(glval<int>)      = VariableAddress[e]         : 
-#-----|     r2_1(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r2_2(glval<iterator>) = Convert                    : r2_1
-# 1069|     r2_3(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1069|     r2_4(int &)           = Call                       : func:r2_3, this:r2_2
-# 1069|     mu2_5(unknown)        = ^CallSideEffect            : ~mu0_2
-# 1069|     r2_6(int)             = Load                       : &:r2_4, ~mu0_2
-# 1069|     mu2_7(int)            = Store                      : &:r2_0, r2_6
-# 1070|     r2_8(glval<int>)      = VariableAddress[e]         : 
-# 1070|     r2_9(int)             = Load                       : &:r2_8, ~mu0_2
-# 1070|     r2_10(int)            = Constant[0]                : 
-# 1070|     r2_11(bool)           = CompareGT                  : r2_9, r2_10
-# 1070|     v2_12(void)           = ConditionalBranch          : r2_11
-#-----|   False -> Block 4
-#-----|   True -> Block 3
+# 1079|   Block 2
+# 1079|     v2_0(void) = NoOp         : 
+# 1080|     v2_1(void) = NoOp         : 
+# 1068|     v2_2(void) = ReturnVoid   : 
+# 1068|     v2_3(void) = UnmodeledUse : mu*
+# 1068|     v2_4(void) = ExitFunction : 
 
-# 1071|   Block 3
-# 1071|     v3_0(void) = NoOp : 
-#-----|   Goto -> Block 4
+#-----|   Block 3
+#-----|     r3_0(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r3_1(glval<iterator>) = Convert                     : r3_0
+# 1069|     r3_2(glval<unknown>)  = FunctionAddress[operator!=] : 
+#-----|     r3_3(glval<iterator>) = VariableAddress[(__end)]    : 
+#-----|     r3_4(iterator)        = Load                        : &:r3_3, ~mu0_2
+# 1069|     r3_5(bool)            = Call                        : func:r3_2, this:r3_1, 0:r3_4
+# 1069|     mu3_6(unknown)        = ^CallSideEffect             : ~mu0_2
+# 1069|     v3_7(void)            = ConditionalBranch           : r3_5
+#-----|   False -> Block 7
+#-----|   True -> Block 4
 
 # 1069|   Block 4
-# 1069|     v4_0(void)            = NoOp                        : 
-#-----|     r4_1(glval<iterator>) = VariableAddress[(__begin)]  : 
-# 1069|     r4_2(glval<unknown>)  = FunctionAddress[operator++] : 
-# 1069|     r4_3(iterator &)      = Call                        : func:r4_2, this:r4_1
-# 1069|     mu4_4(unknown)        = ^CallSideEffect             : ~mu0_2
-#-----|   Goto (back edge) -> Block 1
+# 1069|     r4_0(glval<int>)      = VariableAddress[e]         : 
+#-----|     r4_1(glval<iterator>) = VariableAddress[(__begin)] : 
+#-----|     r4_2(glval<iterator>) = Convert                    : r4_1
+# 1069|     r4_3(glval<unknown>)  = FunctionAddress[operator*] : 
+# 1069|     r4_4(int &)           = Call                       : func:r4_3, this:r4_2
+# 1069|     mu4_5(unknown)        = ^CallSideEffect            : ~mu0_2
+# 1069|     r4_6(int)             = Load                       : &:r4_4, ~mu0_2
+# 1069|     mu4_7(int)            = Store                      : &:r4_0, r4_6
+# 1070|     r4_8(glval<int>)      = VariableAddress[e]         : 
+# 1070|     r4_9(int)             = Load                       : &:r4_8, ~mu0_2
+# 1070|     r4_10(int)            = Constant[0]                : 
+# 1070|     r4_11(bool)           = CompareGT                  : r4_9, r4_10
+# 1070|     v4_12(void)           = ConditionalBranch          : r4_11
+#-----|   False -> Block 6
+#-----|   True -> Block 5
 
-# 1075|   Block 5
-# 1075|     r5_0(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1075|     r5_1(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1075|     r5_2(vector<int> &)         = Load                       : &:r5_1, ~mu0_2
-# 1075|     mu5_3(vector<int> &)        = Store                      : &:r5_0, r5_2
-# 1075|     r5_4(glval<iterator>)       = VariableAddress[(__begin)] : 
-#-----|     r5_5(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-#-----|     r5_6(vector<int> &)         = Load                       : &:r5_5, ~mu0_2
-# 1075|     r5_7(glval<unknown>)        = FunctionAddress[begin]     : 
-# 1075|     r5_8(iterator)              = Call                       : func:r5_7, this:r5_6
-# 1075|     mu5_9(unknown)              = ^CallSideEffect            : ~mu0_2
-# 1075|     mu5_10(iterator)            = Store                      : &:r5_4, r5_8
-# 1075|     r5_11(glval<iterator>)      = VariableAddress[(__end)]   : 
-#-----|     r5_12(glval<vector<int> &>) = VariableAddress[(__range)] : 
-#-----|     r5_13(vector<int> &)        = Load                       : &:r5_12, ~mu0_2
-# 1075|     r5_14(glval<unknown>)       = FunctionAddress[end]       : 
-# 1075|     r5_15(iterator)             = Call                       : func:r5_14, this:r5_13
-# 1075|     mu5_16(unknown)             = ^CallSideEffect            : ~mu0_2
-# 1075|     mu5_17(iterator)            = Store                      : &:r5_11, r5_15
+# 1071|   Block 5
+# 1071|     v5_0(void) = NoOp : 
 #-----|   Goto -> Block 6
 
-#-----|   Block 6
-#-----|     r6_0(glval<iterator>) = VariableAddress[(__begin)]  : 
-#-----|     r6_1(glval<iterator>) = Convert                     : r6_0
-# 1075|     r6_2(glval<unknown>)  = FunctionAddress[operator!=] : 
-#-----|     r6_3(glval<iterator>) = VariableAddress[(__end)]    : 
-#-----|     r6_4(iterator)        = Load                        : &:r6_3, ~mu0_2
-# 1075|     r6_5(bool)            = Call                        : func:r6_2, this:r6_1, 0:r6_4
-# 1075|     mu6_6(unknown)        = ^CallSideEffect             : ~mu0_2
-# 1075|     v6_7(void)            = ConditionalBranch           : r6_5
-#-----|   False -> Block 10
-#-----|   True -> Block 8
+# 1069|   Block 6
+# 1069|     v6_0(void)            = NoOp                        : 
+#-----|     r6_1(glval<iterator>) = VariableAddress[(__begin)]  : 
+# 1069|     r6_2(glval<unknown>)  = FunctionAddress[operator++] : 
+# 1069|     r6_3(iterator &)      = Call                        : func:r6_2, this:r6_1
+# 1069|     mu6_4(unknown)        = ^CallSideEffect             : ~mu0_2
+# 1069|     r6_5(glval<iterator>) = CopyValue                   : r6_3
+#-----|   Goto (back edge) -> Block 3
 
-#-----|   Block 7
-#-----|     r7_0(glval<iterator>) = VariableAddress[(__begin)]  : 
-# 1075|     r7_1(glval<unknown>)  = FunctionAddress[operator++] : 
-# 1075|     r7_2(iterator &)      = Call                        : func:r7_1, this:r7_0
-# 1075|     mu7_3(unknown)        = ^CallSideEffect             : ~mu0_2
-#-----|   Goto (back edge) -> Block 6
+# 1075|   Block 7
+# 1075|     r7_0(glval<vector<int> &>)  = VariableAddress[(__range)] : 
+# 1075|     r7_1(glval<vector<int> &>)  = VariableAddress[v]         : 
+# 1075|     r7_2(vector<int> &)         = Load                       : &:r7_1, ~mu0_2
+# 1075|     r7_3(glval<vector<int>>)    = CopyValue                  : r7_2
+# 1075|     r7_4(vector<int> &)         = CopyValue                  : r7_3
+# 1075|     mu7_5(vector<int> &)        = Store                      : &:r7_0, r7_4
+# 1075|     r7_6(glval<iterator>)       = VariableAddress[(__begin)] : 
+#-----|     r7_7(glval<vector<int> &>)  = VariableAddress[(__range)] : 
+#-----|     r7_8(vector<int> &)         = Load                       : &:r7_7, ~mu0_2
+#-----|     r7_9(glval<vector<int>>)    = CopyValue                  : r7_8
+# 1075|     r7_10(glval<unknown>)       = FunctionAddress[begin]     : 
+# 1075|     r7_11(iterator)             = Call                       : func:r7_10, this:r7_9
+# 1075|     mu7_12(unknown)             = ^CallSideEffect            : ~mu0_2
+# 1075|     mu7_13(iterator)            = Store                      : &:r7_6, r7_11
+# 1075|     r7_14(glval<iterator>)      = VariableAddress[(__end)]   : 
+#-----|     r7_15(glval<vector<int> &>) = VariableAddress[(__range)] : 
+#-----|     r7_16(vector<int> &)        = Load                       : &:r7_15, ~mu0_2
+#-----|     r7_17(glval<vector<int>>)   = CopyValue                  : r7_16
+# 1075|     r7_18(glval<unknown>)       = FunctionAddress[end]       : 
+# 1075|     r7_19(iterator)             = Call                       : func:r7_18, this:r7_17
+# 1075|     mu7_20(unknown)             = ^CallSideEffect            : ~mu0_2
+# 1075|     mu7_21(iterator)            = Store                      : &:r7_14, r7_19
+#-----|   Goto -> Block 8
 
-# 1075|   Block 8
-# 1075|     r8_0(glval<int &>)    = VariableAddress[e]         : 
-#-----|     r8_1(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r8_2(glval<iterator>) = Convert                    : r8_1
-# 1075|     r8_3(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1075|     r8_4(int &)           = Call                       : func:r8_3, this:r8_2
-# 1075|     mu8_5(unknown)        = ^CallSideEffect            : ~mu0_2
-# 1075|     r8_6(glval<int>)      = Convert                    : r8_4
-# 1075|     mu8_7(int &)          = Store                      : &:r8_0, r8_6
-# 1076|     r8_8(glval<int &>)    = VariableAddress[e]         : 
-# 1076|     r8_9(int &)           = Load                       : &:r8_8, ~mu0_2
-# 1076|     r8_10(int)            = Load                       : &:r8_9, ~mu0_2
-# 1076|     r8_11(int)            = Constant[5]                : 
-# 1076|     r8_12(bool)           = CompareLT                  : r8_10, r8_11
-# 1076|     v8_13(void)           = ConditionalBranch          : r8_12
-#-----|   False -> Block 7
-#-----|   True -> Block 9
+#-----|   Block 8
+#-----|     r8_0(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r8_1(glval<iterator>) = Convert                     : r8_0
+# 1075|     r8_2(glval<unknown>)  = FunctionAddress[operator!=] : 
+#-----|     r8_3(glval<iterator>) = VariableAddress[(__end)]    : 
+#-----|     r8_4(iterator)        = Load                        : &:r8_3, ~mu0_2
+# 1075|     r8_5(bool)            = Call                        : func:r8_2, this:r8_1, 0:r8_4
+# 1075|     mu8_6(unknown)        = ^CallSideEffect             : ~mu0_2
+# 1075|     v8_7(void)            = ConditionalBranch           : r8_5
+#-----|   False -> Block 2
+#-----|   True -> Block 10
 
-# 1077|   Block 9
-# 1077|     v9_0(void) = NoOp : 
-#-----|   Goto -> Block 10
+#-----|   Block 9
+#-----|     r9_0(glval<iterator>) = VariableAddress[(__begin)]  : 
+# 1075|     r9_1(glval<unknown>)  = FunctionAddress[operator++] : 
+# 1075|     r9_2(iterator &)      = Call                        : func:r9_1, this:r9_0
+# 1075|     mu9_3(unknown)        = ^CallSideEffect             : ~mu0_2
+# 1075|     r9_4(glval<iterator>) = CopyValue                   : r9_2
+#-----|   Goto (back edge) -> Block 8
 
-# 1079|   Block 10
-# 1079|     v10_0(void) = NoOp         : 
-# 1080|     v10_1(void) = NoOp         : 
-# 1068|     v10_2(void) = ReturnVoid   : 
-# 1068|     v10_3(void) = UnmodeledUse : mu*
-# 1068|     v10_4(void) = ExitFunction : 
+# 1075|   Block 10
+# 1075|     r10_0(glval<int &>)    = VariableAddress[e]         : 
+#-----|     r10_1(glval<iterator>) = VariableAddress[(__begin)] : 
+#-----|     r10_2(glval<iterator>) = Convert                    : r10_1
+# 1075|     r10_3(glval<unknown>)  = FunctionAddress[operator*] : 
+# 1075|     r10_4(int &)           = Call                       : func:r10_3, this:r10_2
+# 1075|     mu10_5(unknown)        = ^CallSideEffect            : ~mu0_2
+# 1075|     r10_6(glval<int>)      = CopyValue                  : r10_4
+# 1075|     r10_7(glval<int>)      = Convert                    : r10_6
+# 1075|     r10_8(int &)           = CopyValue                  : r10_7
+# 1075|     mu10_9(int &)          = Store                      : &:r10_0, r10_8
+# 1076|     r10_10(glval<int &>)   = VariableAddress[e]         : 
+# 1076|     r10_11(int &)          = Load                       : &:r10_10, ~mu0_2
+# 1076|     r10_12(int)            = Load                       : &:r10_11, ~mu0_2
+# 1076|     r10_13(int)            = Constant[5]                : 
+# 1076|     r10_14(bool)           = CompareLT                  : r10_12, r10_13
+# 1076|     v10_15(void)           = ConditionalBranch          : r10_14
+#-----|   False -> Block 9
+#-----|   True -> Block 1
 
 # 1099| int AsmStmt(int)
 # 1099|   Block 0
@@ -5154,6 +5458,7 @@ ir.cpp:
 # 1130|     r2_2(int)        = Constant[1]        : 
 # 1130|     r2_3(int)        = Add                : r2_1, r2_2
 # 1130|     mu2_4(int)       = Store              : &:r2_0, r2_3
+# 1130|     r2_5(glval<int>) = CopyValue          : r2_0
 #-----|   Goto (back edge) -> Block 1
 
 # 1130|   Block 3
@@ -5219,6 +5524,7 @@ ir.cpp:
 # 1140|     r6_4(int)        = Load                          : &:r6_3, ~mu0_2
 # 1140|     r6_5(glval<int>) = VariableAddress[x]            : 
 # 1140|     mu6_6(int)       = Store                         : &:r6_5, r6_4
+# 1140|     r6_7(glval<int>) = CopyValue                     : r6_5
 #-----|   Goto -> Block 8
 
 # 1140|   Block 7
@@ -5235,6 +5541,7 @@ ir.cpp:
 # 1142|     r8_0(int)        = Constant[7]        : 
 # 1142|     r8_1(glval<int>) = VariableAddress[x] : 
 # 1142|     mu8_2(int)       = Store              : &:r8_1, r8_0
+# 1142|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 13
 
 # 1144|   Block 9
@@ -5309,28 +5616,30 @@ ir.cpp:
 # 1156|     r0_34(int)                                         = Load                             : &:r0_33, ~mu0_2
 # 1156|     r0_35(glval<int>)                                  = PointerAdd[4]                    : r0_32, r0_34
 # 1156|     mu0_36(int)                                        = Store                            : &:r0_35, r0_31
-# 1157|     r0_37(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4_shuffle]     : 
-# 1157|     r0_38(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
-# 1157|     r0_39(__attribute((vector_size(16))) int)          = Load                             : &:r0_38, ~mu0_2
-# 1157|     r0_40(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
-# 1157|     r0_41(__attribute((vector_size(16))) int)          = Load                             : &:r0_40, ~mu0_2
-#-----|     r0_42(int)                                         = Constant[3]                      : 
-# 1157|     r0_43(int)                                         = Constant[2]                      : 
-# 1157|     r0_44(int)                                         = Constant[1]                      : 
-# 1157|     r0_45(int)                                         = Constant[0]                      : 
-# 1157|     r0_46(__attribute((vector_size(16))) int)          = BuiltIn[__builtin_shufflevector] : 0:r0_39, 1:r0_41, 2:r0_42, 3:r0_43, 4:r0_44, 5:r0_45
-# 1157|     mu0_47(__attribute((vector_size(16))) int)         = Store                            : &:r0_37, r0_46
-# 1158|     r0_48(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
-# 1158|     r0_49(__attribute((vector_size(16))) int)          = Load                             : &:r0_48, ~mu0_2
-# 1158|     r0_50(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4_shuffle]     : 
-# 1158|     r0_51(__attribute((vector_size(16))) int)          = Load                             : &:r0_50, ~mu0_2
-# 1158|     r0_52(__attribute((vector_size(16))) int)          = Add                              : r0_49, r0_51
-# 1158|     r0_53(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
-# 1158|     mu0_54(__attribute((vector_size(16))) int)         = Store                            : &:r0_53, r0_52
-# 1159|     v0_55(void)                                        = NoOp                             : 
-# 1153|     v0_56(void)                                        = ReturnVoid                       : 
-# 1153|     v0_57(void)                                        = UnmodeledUse                     : mu*
-# 1153|     v0_58(void)                                        = ExitFunction                     : 
+# 1156|     r0_37(glval<int>)                                  = CopyValue                        : r0_35
+# 1157|     r0_38(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4_shuffle]     : 
+# 1157|     r0_39(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
+# 1157|     r0_40(__attribute((vector_size(16))) int)          = Load                             : &:r0_39, ~mu0_2
+# 1157|     r0_41(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
+# 1157|     r0_42(__attribute((vector_size(16))) int)          = Load                             : &:r0_41, ~mu0_2
+#-----|     r0_43(int)                                         = Constant[3]                      : 
+# 1157|     r0_44(int)                                         = Constant[2]                      : 
+# 1157|     r0_45(int)                                         = Constant[1]                      : 
+# 1157|     r0_46(int)                                         = Constant[0]                      : 
+# 1157|     r0_47(__attribute((vector_size(16))) int)          = BuiltIn[__builtin_shufflevector] : 0:r0_40, 1:r0_42, 2:r0_43, 3:r0_44, 4:r0_45, 5:r0_46
+# 1157|     mu0_48(__attribute((vector_size(16))) int)         = Store                            : &:r0_38, r0_47
+# 1158|     r0_49(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
+# 1158|     r0_50(__attribute((vector_size(16))) int)          = Load                             : &:r0_49, ~mu0_2
+# 1158|     r0_51(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4_shuffle]     : 
+# 1158|     r0_52(__attribute((vector_size(16))) int)          = Load                             : &:r0_51, ~mu0_2
+# 1158|     r0_53(__attribute((vector_size(16))) int)          = Add                              : r0_50, r0_52
+# 1158|     r0_54(glval<__attribute((vector_size(16))) int>)   = VariableAddress[vi4]             : 
+# 1158|     mu0_55(__attribute((vector_size(16))) int)         = Store                            : &:r0_54, r0_53
+# 1158|     r0_56(glval<__attribute((vector_size(16))) int>)   = CopyValue                        : r0_54
+# 1159|     v0_57(void)                                        = NoOp                             : 
+# 1153|     v0_58(void)                                        = ReturnVoid                       : 
+# 1153|     v0_59(void)                                        = UnmodeledUse                     : mu*
+# 1153|     v0_60(void)                                        = ExitFunction                     : 
 
 perf-regression.cpp:
 #    6| void Big::Big()
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index fe11d99f31f..f3f5101dcb4 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -211,8 +211,10 @@ ssa.cpp:
 #   70|     r1_3(int)           = Constant[1]        : 
 #   70|     r1_4(char *)        = PointerAdd[1]      : r1_2, r1_3
 #   70|     m1_5(char *)        = Store              : &:r1_1, r1_4
-#   70|     m1_6(char)          = Store              : &:r1_2, r1_0
-#   70|     m1_7(unknown)       = Chi                : total:m3_0, partial:m1_6
+#   70|     r1_6(glval<char>)   = CopyValue          : r1_2
+#   70|     m1_7(char)          = Store              : &:r1_6, r1_0
+#   70|     m1_8(unknown)       = Chi                : total:m3_0, partial:m1_7
+#   70|     r1_9(glval<char>)   = CopyValue          : r1_6
 #-----|   Goto (back edge) -> Block 3
 
 #   71|   Block 2
@@ -222,7 +224,7 @@ ssa.cpp:
 #   68|     v2_3(void) = ExitFunction : 
 
 #   69|   Block 3
-#   69|     m3_0(unknown)    = Phi                : from 0:~m0_1, from 1:~m1_7
+#   69|     m3_0(unknown)    = Phi                : from 0:~m0_1, from 1:~m1_8
 #   69|     m3_1(int)        = Phi                : from 0:m0_4, from 1:m3_7
 #   69|     m3_2(char *)     = Phi                : from 0:m0_6, from 1:m1_5
 #   69|     r3_3(glval<int>) = VariableAddress[n] : 
@@ -262,20 +264,23 @@ ssa.cpp:
 #   80|     r1_0(int)        = Constant[3]        : 
 #   80|     r1_1(glval<int>) = VariableAddress[x] : 
 #   80|     m1_2(int)        = Store              : &:r1_1, r1_0
-#   81|     r1_3(int)        = Constant[4]        : 
-#   81|     r1_4(glval<int>) = VariableAddress[y] : 
-#   81|     m1_5(int)        = Store              : &:r1_4, r1_3
+#   80|     r1_3(glval<int>) = CopyValue          : r1_1
+#   81|     r1_4(int)        = Constant[4]        : 
+#   81|     r1_5(glval<int>) = VariableAddress[y] : 
+#   81|     m1_6(int)        = Store              : &:r1_5, r1_4
+#   81|     r1_7(glval<int>) = CopyValue          : r1_5
 #-----|   Goto -> Block 3
 
 #   84|   Block 2
 #   84|     r2_0(int)        = Constant[5]        : 
 #   84|     r2_1(glval<int>) = VariableAddress[x] : 
 #   84|     m2_2(int)        = Store              : &:r2_1, r2_0
+#   84|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #   86|   Block 3
 #   86|     m3_0(int)         = Phi                      : from 1:m1_2, from 2:m2_2
-#   86|     m3_1(int)         = Phi                      : from 1:m1_5, from 2:m0_10
+#   86|     m3_1(int)         = Phi                      : from 1:m1_6, from 2:m0_10
 #   86|     r3_2(glval<int>)  = VariableAddress[x_merge] : 
 #   86|     r3_3(glval<int>)  = VariableAddress[x]       : 
 #   86|     r3_4(int)         = Load                     : &:r3_3, m3_0
@@ -323,14 +328,15 @@ ssa.cpp:
 #   96|     m0_9(Point)           = Store                   : &:r0_6, r0_8
 #   97|     r0_10(glval<unknown>) = FunctionAddress[Escape] : 
 #   97|     r0_11(glval<Point>)   = VariableAddress[a]      : 
-#   97|     r0_12(void *)         = Convert                 : r0_11
-#   97|     v0_13(void)           = Call                    : func:r0_10, 0:r0_12
-#   97|     m0_14(unknown)        = ^CallSideEffect         : ~m0_5
-#   97|     m0_15(unknown)        = Chi                     : total:m0_5, partial:m0_14
-#   98|     v0_16(void)           = NoOp                    : 
-#   95|     v0_17(void)           = ReturnVoid              : 
-#   95|     v0_18(void)           = UnmodeledUse            : mu*
-#   95|     v0_19(void)           = ExitFunction            : 
+#   97|     r0_12(Point *)        = CopyValue               : r0_11
+#   97|     r0_13(void *)         = Convert                 : r0_12
+#   97|     v0_14(void)           = Call                    : func:r0_10, 0:r0_13
+#   97|     m0_15(unknown)        = ^CallSideEffect         : ~m0_5
+#   97|     m0_16(unknown)        = Chi                     : total:m0_5, partial:m0_15
+#   98|     v0_17(void)           = NoOp                    : 
+#   95|     v0_18(void)           = ReturnVoid              : 
+#   95|     v0_19(void)           = UnmodeledUse            : mu*
+#   95|     v0_20(void)           = ExitFunction            : 
 
 #  100| void MustTotallyOverlap(Point)
 #  100|   Block 0
@@ -374,14 +380,15 @@ ssa.cpp:
 #  107|     m0_15(int)            = Store                   : &:r0_11, r0_14
 #  108|     r0_16(glval<unknown>) = FunctionAddress[Escape] : 
 #  108|     r0_17(glval<Point>)   = VariableAddress[a]      : 
-#  108|     r0_18(void *)         = Convert                 : r0_17
-#  108|     v0_19(void)           = Call                    : func:r0_16, 0:r0_18
-#  108|     m0_20(unknown)        = ^CallSideEffect         : ~m0_5
-#  108|     m0_21(unknown)        = Chi                     : total:m0_5, partial:m0_20
-#  109|     v0_22(void)           = NoOp                    : 
-#  105|     v0_23(void)           = ReturnVoid              : 
-#  105|     v0_24(void)           = UnmodeledUse            : mu*
-#  105|     v0_25(void)           = ExitFunction            : 
+#  108|     r0_18(Point *)        = CopyValue               : r0_17
+#  108|     r0_19(void *)         = Convert                 : r0_18
+#  108|     v0_20(void)           = Call                    : func:r0_16, 0:r0_19
+#  108|     m0_21(unknown)        = ^CallSideEffect         : ~m0_5
+#  108|     m0_22(unknown)        = Chi                     : total:m0_5, partial:m0_21
+#  109|     v0_23(void)           = NoOp                    : 
+#  105|     v0_24(void)           = ReturnVoid              : 
+#  105|     v0_25(void)           = UnmodeledUse            : mu*
+#  105|     v0_26(void)           = ExitFunction            : 
 
 #  111| void MayPartiallyOverlap(int, int)
 #  111|   Block 0
@@ -441,14 +448,15 @@ ssa.cpp:
 #  118|     m0_23(Point)          = Store                   : &:r0_20, r0_22
 #  119|     r0_24(glval<unknown>) = FunctionAddress[Escape] : 
 #  119|     r0_25(glval<Point>)   = VariableAddress[a]      : 
-#  119|     r0_26(void *)         = Convert                 : r0_25
-#  119|     v0_27(void)           = Call                    : func:r0_24, 0:r0_26
-#  119|     m0_28(unknown)        = ^CallSideEffect         : ~m0_19
-#  119|     m0_29(unknown)        = Chi                     : total:m0_19, partial:m0_28
-#  120|     v0_30(void)           = NoOp                    : 
-#  116|     v0_31(void)           = ReturnVoid              : 
-#  116|     v0_32(void)           = UnmodeledUse            : mu*
-#  116|     v0_33(void)           = ExitFunction            : 
+#  119|     r0_26(Point *)        = CopyValue               : r0_25
+#  119|     r0_27(void *)         = Convert                 : r0_26
+#  119|     v0_28(void)           = Call                    : func:r0_24, 0:r0_27
+#  119|     m0_29(unknown)        = ^CallSideEffect         : ~m0_19
+#  119|     m0_30(unknown)        = Chi                     : total:m0_19, partial:m0_29
+#  120|     v0_31(void)           = NoOp                    : 
+#  116|     v0_32(void)           = ReturnVoid              : 
+#  116|     v0_33(void)           = UnmodeledUse            : mu*
+#  116|     v0_34(void)           = ExitFunction            : 
 
 #  122| void MergeMustExactlyOverlap(bool, int, int)
 #  122|   Block 0
@@ -484,6 +492,7 @@ ssa.cpp:
 #  125|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  125|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  125|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
+#  125|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  128|   Block 2
@@ -493,6 +502,7 @@ ssa.cpp:
 #  128|     r2_3(glval<int>)   = FieldAddress[x]     : r2_2
 #  128|     m2_4(int)          = Store               : &:r2_3, r2_1
 #  128|     m2_5(Point)        = Chi                 : total:m0_18, partial:m2_4
+#  128|     r2_6(glval<int>)   = CopyValue           : r2_3
 #-----|   Goto -> Block 3
 
 #  130|   Block 3
@@ -546,6 +556,7 @@ ssa.cpp:
 #  137|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  137|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  137|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
+#  137|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  140|   Block 2
@@ -553,6 +564,7 @@ ssa.cpp:
 #  140|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  140|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  140|     m2_3(Point)        = Store              : &:r2_2, r2_1
+#  140|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  142|   Block 3
@@ -602,6 +614,7 @@ ssa.cpp:
 #  148|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  148|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  148|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
+#  148|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  151|   Block 2
@@ -609,6 +622,7 @@ ssa.cpp:
 #  151|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  151|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  151|     m2_3(Point)        = Store              : &:r2_2, r2_1
+#  151|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  153|   Block 3
@@ -657,6 +671,7 @@ ssa.cpp:
 #  159|     r1_4(glval<int>)   = FieldAddress[x]       : r1_3
 #  159|     m1_5(int)          = Store                 : &:r1_4, r1_1
 #  159|     m1_6(Rect)         = Chi                   : total:m0_18, partial:m1_5
+#  159|     r1_7(glval<int>)   = CopyValue             : r1_4
 #-----|   Goto -> Block 3
 
 #  162|   Block 2
@@ -664,6 +679,7 @@ ssa.cpp:
 #  162|     r2_1(Rect)        = Load               : &:r2_0, m0_6
 #  162|     r2_2(glval<Rect>) = VariableAddress[a] : 
 #  162|     m2_3(Rect)        = Store              : &:r2_2, r2_1
+#  162|     r2_4(glval<Rect>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  164|   Block 3
@@ -698,19 +714,22 @@ ssa.cpp:
 #  174|     r0_15(glval<Wrapper>) = VariableAddress[w]     : 
 #  174|     r0_16(glval<int>)     = FieldAddress[f]        : r0_15
 #  174|     m0_17(int)            = Store                  : &:r0_16, r0_14
-#  175|     r0_18(glval<Wrapper>) = VariableAddress[w]     : 
-#  175|     r0_19(glval<int>)     = FieldAddress[f]        : r0_18
-#  175|     r0_20(int)            = Load                   : &:r0_19, m0_17
-#  175|     r0_21(glval<int>)     = VariableAddress[a]     : 
-#  175|     m0_22(int)            = Store                  : &:r0_21, r0_20
-#  176|     r0_23(glval<Wrapper>) = VariableAddress[w]     : 
-#  176|     r0_24(Wrapper)        = Load                   : &:r0_23, ~m0_17
-#  176|     r0_25(glval<Wrapper>) = VariableAddress[x]     : 
-#  176|     m0_26(Wrapper)        = Store                  : &:r0_25, r0_24
-#  177|     v0_27(void)           = NoOp                   : 
-#  171|     v0_28(void)           = ReturnVoid             : 
-#  171|     v0_29(void)           = UnmodeledUse           : mu*
-#  171|     v0_30(void)           = ExitFunction           : 
+#  174|     r0_18(glval<int>)     = CopyValue              : r0_16
+#  175|     r0_19(glval<Wrapper>) = VariableAddress[w]     : 
+#  175|     r0_20(glval<int>)     = FieldAddress[f]        : r0_19
+#  175|     r0_21(int)            = Load                   : &:r0_20, m0_17
+#  175|     r0_22(glval<int>)     = VariableAddress[a]     : 
+#  175|     m0_23(int)            = Store                  : &:r0_22, r0_21
+#  175|     r0_24(glval<int>)     = CopyValue              : r0_22
+#  176|     r0_25(glval<Wrapper>) = VariableAddress[w]     : 
+#  176|     r0_26(Wrapper)        = Load                   : &:r0_25, ~m0_17
+#  176|     r0_27(glval<Wrapper>) = VariableAddress[x]     : 
+#  176|     m0_28(Wrapper)        = Store                  : &:r0_27, r0_26
+#  176|     r0_29(glval<Wrapper>) = CopyValue              : r0_27
+#  177|     v0_30(void)           = NoOp                   : 
+#  171|     v0_31(void)           = ReturnVoid             : 
+#  171|     v0_32(void)           = UnmodeledUse           : mu*
+#  171|     v0_33(void)           = ExitFunction           : 
 
 #  179| int AsmStmt(int*)
 #  179|   Block 0
@@ -791,19 +810,21 @@ ssa.cpp:
 #  200|     r0_27(int)            = Load                      : &:r0_26, m0_19
 #  200|     r0_28(int)            = Add                       : r0_27, r0_24
 #  200|     m0_29(int)            = Store                     : &:r0_26, r0_28
-#  201|     r0_30(glval<unknown>) = FunctionAddress[abs]      : 
-#  201|     r0_31(glval<int>)     = VariableAddress[x]        : 
-#  201|     r0_32(int)            = Load                      : &:r0_31, m0_8
-#  201|     r0_33(int)            = Call                      : func:r0_30, 0:r0_32
-#  201|     r0_34(glval<int>)     = VariableAddress[ret]      : 
-#  201|     r0_35(int)            = Load                      : &:r0_34, m0_29
-#  201|     r0_36(int)            = Add                       : r0_35, r0_33
-#  201|     m0_37(int)            = Store                     : &:r0_34, r0_36
-#  202|     r0_38(glval<int>)     = VariableAddress[#return]  : 
-#  202|     r0_39(glval<int>)     = VariableAddress[ret]      : 
-#  202|     r0_40(int)            = Load                      : &:r0_39, m0_37
-#  202|     m0_41(int)            = Store                     : &:r0_38, r0_40
-#  198|     r0_42(glval<int>)     = VariableAddress[#return]  : 
-#  198|     v0_43(void)           = ReturnValue               : &:r0_42, m0_41
-#  198|     v0_44(void)           = UnmodeledUse              : mu*
-#  198|     v0_45(void)           = ExitFunction              : 
+#  200|     r0_30(glval<int>)     = CopyValue                 : r0_26
+#  201|     r0_31(glval<unknown>) = FunctionAddress[abs]      : 
+#  201|     r0_32(glval<int>)     = VariableAddress[x]        : 
+#  201|     r0_33(int)            = Load                      : &:r0_32, m0_8
+#  201|     r0_34(int)            = Call                      : func:r0_31, 0:r0_33
+#  201|     r0_35(glval<int>)     = VariableAddress[ret]      : 
+#  201|     r0_36(int)            = Load                      : &:r0_35, m0_29
+#  201|     r0_37(int)            = Add                       : r0_36, r0_34
+#  201|     m0_38(int)            = Store                     : &:r0_35, r0_37
+#  201|     r0_39(glval<int>)     = CopyValue                 : r0_35
+#  202|     r0_40(glval<int>)     = VariableAddress[#return]  : 
+#  202|     r0_41(glval<int>)     = VariableAddress[ret]      : 
+#  202|     r0_42(int)            = Load                      : &:r0_41, m0_38
+#  202|     m0_43(int)            = Store                     : &:r0_40, r0_42
+#  198|     r0_44(glval<int>)     = VariableAddress[#return]  : 
+#  198|     v0_45(void)           = ReturnValue               : &:r0_44, m0_43
+#  198|     v0_46(void)           = UnmodeledUse              : mu*
+#  198|     v0_47(void)           = ExitFunction              : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index ce0d9323340..57330c88ce9 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -214,7 +214,9 @@ ssa.cpp:
 #   70|     r1_3(int)           = Constant[1]        : 
 #   70|     r1_4(char *)        = PointerAdd[1]      : r1_2, r1_3
 #   70|     m1_5(char *)        = Store              : &:r1_1, r1_4
-#   70|     mu1_6(char)         = Store              : &:r1_2, r1_0
+#   70|     r1_6(glval<char>)   = CopyValue          : r1_2
+#   70|     mu1_7(char)         = Store              : &:r1_6, r1_0
+#   70|     r1_8(glval<char>)   = CopyValue          : r1_6
 #-----|   Goto (back edge) -> Block 3
 
 #   71|   Block 2
@@ -263,20 +265,23 @@ ssa.cpp:
 #   80|     r1_0(int)        = Constant[3]        : 
 #   80|     r1_1(glval<int>) = VariableAddress[x] : 
 #   80|     m1_2(int)        = Store              : &:r1_1, r1_0
-#   81|     r1_3(int)        = Constant[4]        : 
-#   81|     r1_4(glval<int>) = VariableAddress[y] : 
-#   81|     m1_5(int)        = Store              : &:r1_4, r1_3
+#   80|     r1_3(glval<int>) = CopyValue          : r1_1
+#   81|     r1_4(int)        = Constant[4]        : 
+#   81|     r1_5(glval<int>) = VariableAddress[y] : 
+#   81|     m1_6(int)        = Store              : &:r1_5, r1_4
+#   81|     r1_7(glval<int>) = CopyValue          : r1_5
 #-----|   Goto -> Block 3
 
 #   84|   Block 2
 #   84|     r2_0(int)        = Constant[5]        : 
 #   84|     r2_1(glval<int>) = VariableAddress[x] : 
 #   84|     m2_2(int)        = Store              : &:r2_1, r2_0
+#   84|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #   86|   Block 3
 #   86|     m3_0(int)         = Phi                      : from 1:m1_2, from 2:m2_2
-#   86|     m3_1(int)         = Phi                      : from 1:m1_5, from 2:m0_10
+#   86|     m3_1(int)         = Phi                      : from 1:m1_6, from 2:m0_10
 #   86|     r3_2(glval<int>)  = VariableAddress[x_merge] : 
 #   86|     r3_3(glval<int>)  = VariableAddress[x]       : 
 #   86|     r3_4(int)         = Load                     : &:r3_3, m3_0
@@ -323,13 +328,14 @@ ssa.cpp:
 #   96|     m0_8(Point)          = Store                   : &:r0_5, r0_7
 #   97|     r0_9(glval<unknown>) = FunctionAddress[Escape] : 
 #   97|     r0_10(glval<Point>)  = VariableAddress[a]      : 
-#   97|     r0_11(void *)        = Convert                 : r0_10
-#   97|     v0_12(void)          = Call                    : func:r0_9, 0:r0_11
-#   97|     mu0_13(unknown)      = ^CallSideEffect         : ~mu0_2
-#   98|     v0_14(void)          = NoOp                    : 
-#   95|     v0_15(void)          = ReturnVoid              : 
-#   95|     v0_16(void)          = UnmodeledUse            : mu*
-#   95|     v0_17(void)          = ExitFunction            : 
+#   97|     r0_11(Point *)       = CopyValue               : r0_10
+#   97|     r0_12(void *)        = Convert                 : r0_11
+#   97|     v0_13(void)          = Call                    : func:r0_9, 0:r0_12
+#   97|     mu0_14(unknown)      = ^CallSideEffect         : ~mu0_2
+#   98|     v0_15(void)          = NoOp                    : 
+#   95|     v0_16(void)          = ReturnVoid              : 
+#   95|     v0_17(void)          = UnmodeledUse            : mu*
+#   95|     v0_18(void)          = ExitFunction            : 
 
 #  100| void MustTotallyOverlap(Point)
 #  100|   Block 0
@@ -372,13 +378,14 @@ ssa.cpp:
 #  107|     m0_14(int)            = Store                   : &:r0_10, r0_13
 #  108|     r0_15(glval<unknown>) = FunctionAddress[Escape] : 
 #  108|     r0_16(glval<Point>)   = VariableAddress[a]      : 
-#  108|     r0_17(void *)         = Convert                 : r0_16
-#  108|     v0_18(void)           = Call                    : func:r0_15, 0:r0_17
-#  108|     mu0_19(unknown)       = ^CallSideEffect         : ~mu0_2
-#  109|     v0_20(void)           = NoOp                    : 
-#  105|     v0_21(void)           = ReturnVoid              : 
-#  105|     v0_22(void)           = UnmodeledUse            : mu*
-#  105|     v0_23(void)           = ExitFunction            : 
+#  108|     r0_17(Point *)        = CopyValue               : r0_16
+#  108|     r0_18(void *)         = Convert                 : r0_17
+#  108|     v0_19(void)           = Call                    : func:r0_15, 0:r0_18
+#  108|     mu0_20(unknown)       = ^CallSideEffect         : ~mu0_2
+#  109|     v0_21(void)           = NoOp                    : 
+#  105|     v0_22(void)           = ReturnVoid              : 
+#  105|     v0_23(void)           = UnmodeledUse            : mu*
+#  105|     v0_24(void)           = ExitFunction            : 
 
 #  111| void MayPartiallyOverlap(int, int)
 #  111|   Block 0
@@ -433,13 +440,14 @@ ssa.cpp:
 #  118|     m0_20(Point)          = Store                   : &:r0_17, r0_19
 #  119|     r0_21(glval<unknown>) = FunctionAddress[Escape] : 
 #  119|     r0_22(glval<Point>)   = VariableAddress[a]      : 
-#  119|     r0_23(void *)         = Convert                 : r0_22
-#  119|     v0_24(void)           = Call                    : func:r0_21, 0:r0_23
-#  119|     mu0_25(unknown)       = ^CallSideEffect         : ~mu0_2
-#  120|     v0_26(void)           = NoOp                    : 
-#  116|     v0_27(void)           = ReturnVoid              : 
-#  116|     v0_28(void)           = UnmodeledUse            : mu*
-#  116|     v0_29(void)           = ExitFunction            : 
+#  119|     r0_23(Point *)        = CopyValue               : r0_22
+#  119|     r0_24(void *)         = Convert                 : r0_23
+#  119|     v0_25(void)           = Call                    : func:r0_21, 0:r0_24
+#  119|     mu0_26(unknown)       = ^CallSideEffect         : ~mu0_2
+#  120|     v0_27(void)           = NoOp                    : 
+#  116|     v0_28(void)           = ReturnVoid              : 
+#  116|     v0_29(void)           = UnmodeledUse            : mu*
+#  116|     v0_30(void)           = ExitFunction            : 
 
 #  122| void MergeMustExactlyOverlap(bool, int, int)
 #  122|   Block 0
@@ -472,6 +480,7 @@ ssa.cpp:
 #  125|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  125|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  125|     mu1_4(int)         = Store               : &:r1_3, r1_1
+#  125|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  128|   Block 2
@@ -480,6 +489,7 @@ ssa.cpp:
 #  128|     r2_2(glval<Point>) = VariableAddress[a]  : 
 #  128|     r2_3(glval<int>)   = FieldAddress[x]     : r2_2
 #  128|     mu2_4(int)         = Store               : &:r2_3, r2_1
+#  128|     r2_5(glval<int>)   = CopyValue           : r2_3
 #-----|   Goto -> Block 3
 
 #  130|   Block 3
@@ -528,6 +538,7 @@ ssa.cpp:
 #  137|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  137|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  137|     mu1_4(int)         = Store               : &:r1_3, r1_1
+#  137|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  140|   Block 2
@@ -535,6 +546,7 @@ ssa.cpp:
 #  140|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  140|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  140|     mu2_3(Point)       = Store              : &:r2_2, r2_1
+#  140|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  142|   Block 3
@@ -579,6 +591,7 @@ ssa.cpp:
 #  148|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  148|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  148|     mu1_4(int)         = Store               : &:r1_3, r1_1
+#  148|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  151|   Block 2
@@ -586,6 +599,7 @@ ssa.cpp:
 #  151|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  151|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  151|     mu2_3(Point)       = Store              : &:r2_2, r2_1
+#  151|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  153|   Block 3
@@ -630,6 +644,7 @@ ssa.cpp:
 #  159|     r1_3(glval<Point>) = FieldAddress[topLeft] : r1_2
 #  159|     r1_4(glval<int>)   = FieldAddress[x]       : r1_3
 #  159|     mu1_5(int)         = Store                 : &:r1_4, r1_1
+#  159|     r1_6(glval<int>)   = CopyValue             : r1_4
 #-----|   Goto -> Block 3
 
 #  162|   Block 2
@@ -637,6 +652,7 @@ ssa.cpp:
 #  162|     r2_1(Rect)        = Load               : &:r2_0, m0_6
 #  162|     r2_2(glval<Rect>) = VariableAddress[a] : 
 #  162|     mu2_3(Rect)       = Store              : &:r2_2, r2_1
+#  162|     r2_4(glval<Rect>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  164|   Block 3
@@ -670,19 +686,22 @@ ssa.cpp:
 #  174|     r0_15(glval<Wrapper>) = VariableAddress[w]     : 
 #  174|     r0_16(glval<int>)     = FieldAddress[f]        : r0_15
 #  174|     mu0_17(int)           = Store                  : &:r0_16, r0_14
-#  175|     r0_18(glval<Wrapper>) = VariableAddress[w]     : 
-#  175|     r0_19(glval<int>)     = FieldAddress[f]        : r0_18
-#  175|     r0_20(int)            = Load                   : &:r0_19, ~mu0_2
-#  175|     r0_21(glval<int>)     = VariableAddress[a]     : 
-#  175|     m0_22(int)            = Store                  : &:r0_21, r0_20
-#  176|     r0_23(glval<Wrapper>) = VariableAddress[w]     : 
-#  176|     r0_24(Wrapper)        = Load                   : &:r0_23, ~mu0_2
-#  176|     r0_25(glval<Wrapper>) = VariableAddress[x]     : 
-#  176|     m0_26(Wrapper)        = Store                  : &:r0_25, r0_24
-#  177|     v0_27(void)           = NoOp                   : 
-#  171|     v0_28(void)           = ReturnVoid             : 
-#  171|     v0_29(void)           = UnmodeledUse           : mu*
-#  171|     v0_30(void)           = ExitFunction           : 
+#  174|     r0_18(glval<int>)     = CopyValue              : r0_16
+#  175|     r0_19(glval<Wrapper>) = VariableAddress[w]     : 
+#  175|     r0_20(glval<int>)     = FieldAddress[f]        : r0_19
+#  175|     r0_21(int)            = Load                   : &:r0_20, ~mu0_2
+#  175|     r0_22(glval<int>)     = VariableAddress[a]     : 
+#  175|     m0_23(int)            = Store                  : &:r0_22, r0_21
+#  175|     r0_24(glval<int>)     = CopyValue              : r0_22
+#  176|     r0_25(glval<Wrapper>) = VariableAddress[w]     : 
+#  176|     r0_26(Wrapper)        = Load                   : &:r0_25, ~mu0_2
+#  176|     r0_27(glval<Wrapper>) = VariableAddress[x]     : 
+#  176|     m0_28(Wrapper)        = Store                  : &:r0_27, r0_26
+#  176|     r0_29(glval<Wrapper>) = CopyValue              : r0_27
+#  177|     v0_30(void)           = NoOp                   : 
+#  171|     v0_31(void)           = ReturnVoid             : 
+#  171|     v0_32(void)           = UnmodeledUse           : mu*
+#  171|     v0_33(void)           = ExitFunction           : 
 
 #  179| int AsmStmt(int*)
 #  179|   Block 0
@@ -757,19 +776,21 @@ ssa.cpp:
 #  200|     r0_27(int)            = Load                      : &:r0_26, m0_19
 #  200|     r0_28(int)            = Add                       : r0_27, r0_24
 #  200|     m0_29(int)            = Store                     : &:r0_26, r0_28
-#  201|     r0_30(glval<unknown>) = FunctionAddress[abs]      : 
-#  201|     r0_31(glval<int>)     = VariableAddress[x]        : 
-#  201|     r0_32(int)            = Load                      : &:r0_31, m0_8
-#  201|     r0_33(int)            = Call                      : func:r0_30, 0:r0_32
-#  201|     r0_34(glval<int>)     = VariableAddress[ret]      : 
-#  201|     r0_35(int)            = Load                      : &:r0_34, m0_29
-#  201|     r0_36(int)            = Add                       : r0_35, r0_33
-#  201|     m0_37(int)            = Store                     : &:r0_34, r0_36
-#  202|     r0_38(glval<int>)     = VariableAddress[#return]  : 
-#  202|     r0_39(glval<int>)     = VariableAddress[ret]      : 
-#  202|     r0_40(int)            = Load                      : &:r0_39, m0_37
-#  202|     m0_41(int)            = Store                     : &:r0_38, r0_40
-#  198|     r0_42(glval<int>)     = VariableAddress[#return]  : 
-#  198|     v0_43(void)           = ReturnValue               : &:r0_42, m0_41
-#  198|     v0_44(void)           = UnmodeledUse              : mu*
-#  198|     v0_45(void)           = ExitFunction              : 
+#  200|     r0_30(glval<int>)     = CopyValue                 : r0_26
+#  201|     r0_31(glval<unknown>) = FunctionAddress[abs]      : 
+#  201|     r0_32(glval<int>)     = VariableAddress[x]        : 
+#  201|     r0_33(int)            = Load                      : &:r0_32, m0_8
+#  201|     r0_34(int)            = Call                      : func:r0_31, 0:r0_33
+#  201|     r0_35(glval<int>)     = VariableAddress[ret]      : 
+#  201|     r0_36(int)            = Load                      : &:r0_35, m0_29
+#  201|     r0_37(int)            = Add                       : r0_36, r0_34
+#  201|     m0_38(int)            = Store                     : &:r0_35, r0_37
+#  201|     r0_39(glval<int>)     = CopyValue                 : r0_35
+#  202|     r0_40(glval<int>)     = VariableAddress[#return]  : 
+#  202|     r0_41(glval<int>)     = VariableAddress[ret]      : 
+#  202|     r0_42(int)            = Load                      : &:r0_41, m0_38
+#  202|     m0_43(int)            = Store                     : &:r0_40, r0_42
+#  198|     r0_44(glval<int>)     = VariableAddress[#return]  : 
+#  198|     v0_45(void)           = ReturnValue               : &:r0_44, m0_43
+#  198|     v0_46(void)           = UnmodeledUse              : mu*
+#  198|     v0_47(void)           = ExitFunction              : 

From a34c0d4200667c9a9c5ee6bd769ca4e8cff7311e Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jonas@semmle.com>
Date: Mon, 23 Sep 2019 15:39:32 +0200
Subject: [PATCH 003/232] C++: Autoformat TranslatedExpr.qll

---
 .../code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index e9e7cf59cb0..fb6cc3f8570 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -2556,8 +2556,8 @@ predicate exprNeedsCopyIfNotLoaded(Expr expr) {
   expr instanceof AddressOfExpr
   or
   expr instanceof BuiltInOperationBuiltInAddressOf
-  // No case for ParenthesisExpr to avoid getting too many instructions
   or
+  // No case for ParenthesisExpr to avoid getting too many instructions
   expr instanceof ReferenceDereferenceExpr
   or
   expr instanceof ReferenceToExpr

From 61b372b062d3f0262cbe90c3cb96de21e9276f28 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Mon, 23 Sep 2019 17:30:05 +0100
Subject: [PATCH 004/232] Add Go to supported languages topic and update
 release number

---
 docs/language/global-sphinx-files/global-conf.py | 4 ++--
 docs/language/support/versions-compilers.csv     | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/language/global-sphinx-files/global-conf.py b/docs/language/global-sphinx-files/global-conf.py
index 260783d9117..84912a8c538 100644
--- a/docs/language/global-sphinx-files/global-conf.py
+++ b/docs/language/global-sphinx-files/global-conf.py
@@ -56,9 +56,9 @@ def setup(sphinx):
 # built documents.
 #
 # The short X.Y version.
-version = u'1.22'
+version = u'1.22.1'
 # The full version, including alpha/beta/rc tags.
-release = u'1.22'
+release = u'1.22.1'
 copyright = u'2019 Semmle Ltd'
 author = u'Semmle Ltd'
 
diff --git a/docs/language/support/versions-compilers.csv b/docs/language/support/versions-compilers.csv
index 4a59214c47f..b70ac87335f 100644
--- a/docs/language/support/versions-compilers.csv
+++ b/docs/language/support/versions-compilers.csv
@@ -10,6 +10,7 @@ C#,C# up to 7.3. with .NET up to 4.8 [3]_.,"Microsoft Visual Studio up to 2019,
 
 .NET Core up to 2.2","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
 COBOL,ANSI 85 or newer [4]_.,Not applicable,"``.cbl``, ``.CBL``, ``.cpy``, ``.CPY``, ``.copy``, ``.COPY``"
+Go, "Go up to 1.13", "Go 1.11 or more recent", ``.go``
 Java,"Java 6 to 12 [5]_.","javac (OpenJDK and Oracle JDK),
 
 Eclipse compiler for Java (ECJ) [6]_.",``.java``

From b75bf06649df642ed47b5686ed874c82834ea632 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jonas@semmle.com>
Date: Tue, 24 Sep 2019 13:00:21 +0200
Subject: [PATCH 005/232] C++: Accept test changes in other IR tests

---
 .../signanalysis/SignAnalysis.expected        |  30 ++
 .../syntax-zoo/aliased_ssa_sanity.expected    |   2 +-
 .../syntax-zoo/raw_sanity.expected            |  21 +-
 .../syntax-zoo/unaliased_ssa_sanity.expected  |   2 +-
 .../GlobalValueNumbering/ir_gvn.expected      | 262 ++++++++++--------
 5 files changed, 192 insertions(+), 125 deletions(-)

diff --git a/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected b/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
index cdc15c4b45a..4dc280b6ca9 100644
--- a/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
@@ -13,6 +13,7 @@
 | bounded_bounds.c:16:12:16:12 | Load: x | negative strictlyNegative |
 | bounded_bounds.c:16:12:16:12 | Store: x | negative strictlyNegative |
 | inline_assembly.c:9:23:9:23 | Uninitialized: definition of y | positive |
+| inline_assembly.c:10:3:10:7 | CopyValue: ... = ... | positive strictlyPositive |
 | inline_assembly.c:10:3:10:7 | Store: ... = ... | positive strictlyPositive |
 | inline_assembly.c:10:7:10:7 | Constant: (unsigned int)... | positive strictlyPositive |
 | inline_assembly.c:12:32:12:32 | Load: y | positive strictlyPositive |
@@ -27,8 +28,10 @@
 | minmax.c:18:37:18:37 | Load: x | positive strictlyPositive |
 | minmax.c:18:40:18:40 | Load: y | positive strictlyPositive |
 | minmax.c:18:43:18:43 | Load: z | positive strictlyPositive |
+| minmax.c:20:2:24:3 | CopyValue: ... = ... | positive |
 | minmax.c:20:2:24:3 | Store: ... = ... | positive |
 | minmax.c:20:6:24:3 | CopyValue: (statement expression) | positive |
+| minmax.c:22:18:22:22 | CopyValue: ... = ... | positive strictlyPositive |
 | minmax.c:22:18:22:22 | Store: ... = ... | positive strictlyPositive |
 | minmax.c:22:22:22:22 | Load: x | positive strictlyPositive |
 | minmax.c:23:3:23:3 | Load: t | positive |
@@ -37,6 +40,7 @@
 | minmax.c:26:40:26:40 | Load: y | positive strictlyPositive |
 | minmax.c:26:43:26:43 | Load: z | positive |
 | test.c:7:10:7:10 | Phi: p | positive |
+| test.c:8:5:8:19 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:8:5:8:19 | Store: ... = ... | positive strictlyPositive |
 | test.c:8:13:8:17 | Load: count | positive |
 | test.c:8:13:8:19 | Add: ... + ... | positive strictlyPositive |
@@ -44,6 +48,7 @@
 | test.c:10:10:10:14 | Load: count | positive |
 | test.c:10:10:10:14 | Store: count | positive |
 | test.c:15:10:15:10 | Phi: p | positive |
+| test.c:16:5:16:26 | CopyValue: ... = ... | positive |
 | test.c:16:5:16:26 | Store: ... = ... | positive |
 | test.c:16:13:16:26 | Rem: ... % ... | positive |
 | test.c:16:14:16:18 | Load: count | positive |
@@ -57,6 +62,7 @@
 | test.c:24:5:24:11 | Constant: ... ++ | positive strictlyPositive |
 | test.c:24:5:24:11 | Load: ... ++ | positive |
 | test.c:24:5:24:11 | Store: ... ++ | positive strictlyPositive |
+| test.c:25:5:25:22 | CopyValue: ... = ... | positive |
 | test.c:25:5:25:22 | Store: ... = ... | positive |
 | test.c:25:13:25:17 | Load: count | positive strictlyPositive |
 | test.c:25:13:25:22 | Rem: ... % ... | positive |
@@ -67,6 +73,7 @@
 | test.c:33:15:33:15 | Phi: i | positive |
 | test.c:33:15:33:15 | Phi: i | positive |
 | test.c:33:19:33:19 | Constant: 2 | positive strictlyPositive |
+| test.c:33:22:33:28 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:33:22:33:28 | Store: ... = ... | positive strictlyPositive |
 | test.c:33:26:33:26 | Load: i | positive |
 | test.c:33:26:33:28 | Add: ... + ... | positive strictlyPositive |
@@ -101,6 +108,7 @@
 | test.c:51:15:51:17 | Add: ... + ... | positive strictlyPositive |
 | test.c:51:17:51:17 | Constant: 2 | positive strictlyPositive |
 | test.c:51:21:51:21 | Constant: 4 | positive strictlyPositive |
+| test.c:51:24:51:30 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:51:24:51:30 | Store: ... = ... | positive strictlyPositive |
 | test.c:51:28:51:28 | Load: i | positive |
 | test.c:51:28:51:30 | Add: ... + ... | positive strictlyPositive |
@@ -459,6 +467,7 @@
 | test.c:343:5:343:7 | Constant: ... ++ | positive strictlyPositive |
 | test.c:343:5:343:7 | Load: ... ++ | positive |
 | test.c:343:5:343:7 | Store: ... ++ | positive strictlyPositive |
+| test.c:345:3:345:7 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:345:3:345:7 | Store: ... = ... | positive strictlyPositive |
 | test.c:345:7:345:7 | Load: i | positive strictlyPositive |
 | test.c:346:7:346:7 | Load: x | positive |
@@ -474,6 +483,7 @@
 | test.c:356:36:356:37 | Uninitialized: definition of y6 | positive |
 | test.c:356:40:356:41 | Uninitialized: definition of y7 | positive |
 | test.c:356:44:356:45 | Uninitialized: definition of y8 | positive |
+| test.c:357:3:357:23 | CopyValue: ... = ... | positive |
 | test.c:357:3:357:23 | Store: ... = ... | positive |
 | test.c:357:8:357:8 | Load: x | positive |
 | test.c:357:8:357:23 | Load: ... ? ... : ... | positive |
@@ -483,6 +493,7 @@
 | test.c:357:12:357:14 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:357:18:357:18 | Load: x | positive |
 | test.c:357:22:357:23 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:358:3:358:24 | CopyValue: ... = ... | positive |
 | test.c:358:3:358:24 | Store: ... = ... | positive |
 | test.c:358:8:358:8 | Load: x | positive |
 | test.c:358:8:358:24 | Load: ... ? ... : ... | positive |
@@ -494,6 +505,7 @@
 | test.c:358:24:358:24 | Load: x | positive |
 | test.c:365:7:365:7 | Load: x | positive |
 | test.c:365:11:365:13 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:366:5:366:15 | CopyValue: ... = ... | positive |
 | test.c:366:5:366:15 | Store: ... = ... | positive |
 | test.c:366:10:366:10 | Load: x | positive |
 | test.c:366:10:366:15 | Load: ... ? ... : ... | positive |
@@ -501,6 +513,7 @@
 | test.c:366:10:366:15 | Store: ... ? ... : ... | positive |
 | test.c:366:10:366:15 | Store: ... ? ... : ... | positive strictlyPositive |
 | test.c:366:15:366:15 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:367:5:367:17 | CopyValue: ... = ... | positive |
 | test.c:367:5:367:17 | Store: ... = ... | positive |
 | test.c:367:10:367:10 | Load: x | positive |
 | test.c:367:10:367:17 | Load: ... ? ... : ... | positive |
@@ -508,6 +521,7 @@
 | test.c:367:10:367:17 | Store: ... ? ... : ... | positive |
 | test.c:367:10:367:17 | Store: ... ? ... : ... | positive strictlyPositive |
 | test.c:367:15:367:17 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:368:5:368:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:368:5:368:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:368:10:368:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:368:10:368:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -515,6 +529,7 @@
 | test.c:368:11:368:13 | Add: ... + ... | positive strictlyPositive |
 | test.c:368:13:368:13 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:368:19:368:21 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:369:5:369:36 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:369:5:369:36 | Store: ... = ... | positive strictlyPositive |
 | test.c:369:10:369:36 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:369:10:369:36 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -524,6 +539,7 @@
 | test.c:369:27:369:29 | Add: ... + ... | positive strictlyPositive |
 | test.c:369:29:369:29 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:369:36:369:36 | Constant: 5 | positive strictlyPositive |
+| test.c:370:5:370:38 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:370:5:370:38 | Store: ... = ... | positive strictlyPositive |
 | test.c:370:10:370:38 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:370:10:370:38 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -533,6 +549,7 @@
 | test.c:370:27:370:29 | Add: ... + ... | positive strictlyPositive |
 | test.c:370:29:370:29 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:370:36:370:38 | Constant: 500 | positive strictlyPositive |
+| test.c:371:5:371:39 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:371:5:371:39 | Store: ... = ... | positive strictlyPositive |
 | test.c:371:10:371:39 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:371:10:371:39 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -570,6 +587,7 @@
 | test.c:378:24:378:25 | Uninitialized: definition of y3 | positive |
 | test.c:378:28:378:29 | Uninitialized: definition of y4 | positive |
 | test.c:378:32:378:33 | Uninitialized: definition of y5 | positive |
+| test.c:379:3:379:24 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:379:3:379:24 | Store: ... = ... | positive strictlyPositive |
 | test.c:379:8:379:8 | Load: x | positive |
 | test.c:379:8:379:24 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -579,6 +597,7 @@
 | test.c:379:12:379:14 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:379:18:379:18 | Load: x | positive strictlyPositive |
 | test.c:379:22:379:24 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:380:3:380:25 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:380:3:380:25 | Store: ... = ... | positive strictlyPositive |
 | test.c:380:8:380:8 | Load: x | positive |
 | test.c:380:8:380:25 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -588,14 +607,18 @@
 | test.c:380:13:380:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:380:19:380:21 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:380:25:380:25 | Load: x | positive strictlyPositive |
+| test.c:381:3:381:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:381:3:381:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:381:8:381:11 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:382:3:382:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:382:3:382:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:382:8:382:11 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:383:3:383:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:383:3:383:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:383:8:383:11 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:384:7:384:7 | Load: x | positive |
 | test.c:384:12:384:14 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:385:5:385:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:385:5:385:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:385:10:385:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:385:10:385:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -603,6 +626,7 @@
 | test.c:385:11:385:15 | Sub: ... - ... | positive |
 | test.c:385:13:385:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:385:21:385:21 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:386:5:386:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:386:5:386:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:386:10:386:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:386:10:386:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -610,6 +634,7 @@
 | test.c:386:11:386:15 | Sub: ... - ... | positive |
 | test.c:386:13:386:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:386:21:386:21 | Constant: (unsigned int)... | positive strictlyPositive |
+| test.c:387:5:387:38 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:387:5:387:38 | Store: ... = ... | positive strictlyPositive |
 | test.c:387:10:387:38 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:387:10:387:38 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -644,17 +669,22 @@
 | test.c:394:34:394:36 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:395:16:395:17 | Uninitialized: definition of y1 | positive |
 | test.c:396:16:396:17 | Uninitialized: definition of y2 | positive |
+| test.c:397:3:397:15 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:397:3:397:15 | Store: ... = ... | positive strictlyPositive |
 | test.c:397:9:397:11 | Add: ++ ... | positive strictlyPositive |
 | test.c:397:9:397:11 | Constant: ++ ... | positive strictlyPositive |
 | test.c:397:9:397:11 | Load: ++ ... | positive |
 | test.c:397:9:397:11 | Store: ++ ... | positive strictlyPositive |
+| test.c:397:9:397:14 | CopyValue: ... , ... | positive strictlyPositive |
 | test.c:397:14:397:14 | Load: y | positive strictlyPositive |
+| test.c:398:3:398:23 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:398:3:398:23 | Store: ... = ... | positive strictlyPositive |
 | test.c:398:9:398:11 | Add: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Constant: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Load: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Store: ... ++ | positive strictlyPositive |
+| test.c:398:9:398:19 | CopyValue: ... , ... | positive strictlyPositive |
+| test.c:398:9:398:22 | CopyValue: ... , ... | positive strictlyPositive |
 | test.c:398:14:398:19 | Add: ... += ... | positive strictlyPositive |
 | test.c:398:14:398:19 | Load: ... += ... | positive strictlyPositive |
 | test.c:398:14:398:19 | Store: ... += ... | positive strictlyPositive |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
index 5e76fb042be..a8f98105b08 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
@@ -21,7 +21,7 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:28:12:28:15 | Chi: call to C |
 | ms_try_mix.cpp:48:10:48:13 | Chi: call to C |
 | pointer_to_member.cpp:35:11:35:21 | FieldAddress: {...} |
-| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
 | vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
 ambiguousSuccessors
diff --git a/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
index b9c4bd7eba5..e8b34aff726 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
@@ -1,9 +1,10 @@
 missingOperand
-| condition_decls.cpp:16:6:16:20 | ConditionalBranch: (condition decl) | Instruction 'ConditionalBranch' is missing an expected operand with tag 'Condition' in function '$@'. | condition_decls.cpp:15:6:15:17 | IR: if_decl_bind | void if_decl_bind(int) |
-| condition_decls.cpp:26:3:36:3 | Switch: switch (...) ...  | Instruction 'Switch' is missing an expected operand with tag 'Condition' in function '$@'. | condition_decls.cpp:25:6:25:21 | IR: switch_decl_bind | void switch_decl_bind(int) |
-| condition_decls.cpp:41:9:41:23 | ConditionalBranch: (condition decl) | Instruction 'ConditionalBranch' is missing an expected operand with tag 'Condition' in function '$@'. | condition_decls.cpp:40:6:40:20 | IR: while_decl_bind | void while_decl_bind(int) |
-| condition_decls.cpp:48:39:48:53 | ConditionalBranch: (condition decl) | Instruction 'ConditionalBranch' is missing an expected operand with tag 'Condition' in function '$@'. | condition_decls.cpp:47:6:47:18 | IR: for_decl_bind | void for_decl_bind(int) |
+| condition_decls.cpp:16:6:16:20 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:15:6:15:17 | IR: if_decl_bind | void if_decl_bind(int) |
+| condition_decls.cpp:26:10:26:24 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:25:6:25:21 | IR: switch_decl_bind | void switch_decl_bind(int) |
+| condition_decls.cpp:41:9:41:23 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:40:6:40:20 | IR: while_decl_bind | void while_decl_bind(int) |
+| condition_decls.cpp:48:39:48:53 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:47:6:47:18 | IR: for_decl_bind | void for_decl_bind(int) |
 | misc.c:125:5:125:11 | CopyValue: (statement expression) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:97:6:97:10 | IR: misc3 | void misc3() |
+| misc.c:220:3:223:3 | CopyValue: ... = ... | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:3:223:3 | Store: ... = ... | Instruction 'Store' is missing an expected operand with tag 'StoreValue' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:9:223:3 | FieldAddress: {...} | Instruction 'FieldAddress' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:9:223:3 | FieldAddress: {...} | Instruction 'FieldAddress' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
@@ -47,13 +48,13 @@ instructionWithoutSuccessor
 | misc.c:222:10:222:10 | Store: 2 |
 | ms_assume.cpp:20:12:20:12 | Constant: (bool)... |
 | ms_try_except.cpp:3:9:3:9 | Uninitialized: definition of x |
-| ms_try_except.cpp:7:13:7:17 | Store: ... = ... |
+| ms_try_except.cpp:7:13:7:17 | CopyValue: ... = ... |
 | ms_try_except.cpp:9:19:9:19 | Load: j |
-| ms_try_except.cpp:10:13:10:17 | Store: ... = ... |
-| ms_try_except.cpp:14:13:14:17 | Store: ... = ... |
-| ms_try_except.cpp:17:13:17:17 | Store: ... = ... |
+| ms_try_except.cpp:10:13:10:17 | CopyValue: ... = ... |
+| ms_try_except.cpp:14:13:14:17 | CopyValue: ... = ... |
+| ms_try_except.cpp:17:13:17:17 | CopyValue: ... = ... |
 | ms_try_except.cpp:19:17:19:21 | Sub: ... - ... |
-| ms_try_except.cpp:20:9:20:13 | Store: ... = ... |
+| ms_try_except.cpp:20:9:20:13 | CopyValue: ... = ... |
 | ms_try_mix.cpp:11:12:11:15 | CallSideEffect: call to C |
 | ms_try_mix.cpp:16:13:16:19 | ThrowValue: throw ... |
 | ms_try_mix.cpp:18:16:18:19 | CallSideEffect: call to C |
@@ -75,7 +76,7 @@ instructionWithoutSuccessor
 | static_init_templates.cpp:97:27:97:36 | Convert: (void *)... |
 | static_init_templates.cpp:105:27:105:27 | Constant: (void *)... |
 | static_init_templates.cpp:105:27:105:27 | Constant: (void *)... |
-| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
 | stmt_expr.cpp:29:11:32:11 | CopyValue: (statement expression) |
 | stmt_in_type.cpp:5:53:5:53 | Constant: 1 |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
index ab5362cb06c..c8cee7b2a7c 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
@@ -30,7 +30,7 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:28:12:28:15 | CallSideEffect: call to C |
 | ms_try_mix.cpp:48:10:48:13 | CallSideEffect: call to C |
 | pointer_to_member.cpp:35:11:35:21 | FieldAddress: {...} |
-| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
 | vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
 ambiguousSuccessors
diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
index 8be4cf4e2c1..4bc9f90cc60 100644
--- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
+++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
@@ -40,34 +40,40 @@ test.cpp:
 #    5|         valnum = r0_7
 #    5|     m0_19(int)                  = Store                    : &:r0_18, r0_17
 #    5|         valnum = r0_17
-#    6|     r0_20(glval<int>)           = VariableAddress[p0]      : 
+#    5|     r0_20(glval<int>)           = CopyValue                : r0_18
+#    5|         valnum = r0_7
+#    6|     r0_21(glval<int>)           = VariableAddress[p0]      : 
 #    6|         valnum = r0_3
-#    6|     r0_21(int)                  = Load                     : &:r0_20, m0_4
+#    6|     r0_22(int)                  = Load                     : &:r0_21, m0_4
 #    6|         valnum = m0_4
-#    6|     r0_22(glval<int>)           = VariableAddress[p1]      : 
+#    6|     r0_23(glval<int>)           = VariableAddress[p1]      : 
 #    6|         valnum = r0_5
-#    6|     r0_23(int)                  = Load                     : &:r0_22, m0_6
+#    6|     r0_24(int)                  = Load                     : &:r0_23, m0_6
 #    6|         valnum = m0_6
-#    6|     r0_24(int)                  = Add                      : r0_21, r0_23
+#    6|     r0_25(int)                  = Add                      : r0_22, r0_24
 #    6|         valnum = r0_17
-#    6|     r0_25(glval<int>)           = VariableAddress[x]       : 
+#    6|     r0_26(glval<int>)           = VariableAddress[x]       : 
 #    6|         valnum = r0_7
-#    6|     m0_26(int)                  = Store                    : &:r0_25, r0_24
+#    6|     m0_27(int)                  = Store                    : &:r0_26, r0_25
 #    6|         valnum = r0_17
-#    7|     r0_27(glval<int>)           = VariableAddress[x]       : 
+#    6|     r0_28(glval<int>)           = CopyValue                : r0_26
+#    6|         valnum = r0_7
+#    7|     r0_29(glval<int>)           = VariableAddress[x]       : 
 #    7|         valnum = r0_7
-#    7|     r0_28(int)                  = Load                     : &:r0_27, m0_26
+#    7|     r0_30(int)                  = Load                     : &:r0_29, m0_27
 #    7|         valnum = r0_17
-#    7|     r0_29(glval<int>)           = VariableAddress[y]       : 
+#    7|     r0_31(glval<int>)           = VariableAddress[y]       : 
 #    7|         valnum = r0_9
-#    7|     m0_30(int)                  = Store                    : &:r0_29, r0_28
+#    7|     m0_32(int)                  = Store                    : &:r0_31, r0_30
 #    7|         valnum = r0_17
-#    8|     v0_31(void)                 = NoOp                     : 
-#    1|     r0_32(glval<int>)           = VariableAddress[#return] : 
+#    7|     r0_33(glval<int>)           = CopyValue                : r0_31
+#    7|         valnum = r0_9
+#    8|     v0_34(void)                 = NoOp                     : 
+#    1|     r0_35(glval<int>)           = VariableAddress[#return] : 
 #    1|         valnum = unique
-#    1|     v0_33(void)                 = ReturnValue              : &:r0_32
-#    1|     v0_34(void)                 = UnmodeledUse             : mu*
-#    1|     v0_35(void)                 = ExitFunction             : 
+#    1|     v0_36(void)                 = ReturnValue              : &:r0_35
+#    1|     v0_37(void)                 = UnmodeledUse             : mu*
+#    1|     v0_38(void)                 = ExitFunction             : 
 
 #   12| int test01(int, int)
 #   12|   Block 0
@@ -116,40 +122,46 @@ test.cpp:
 #   16|         valnum = r0_7
 #   16|     m0_22(int)                  = Store                     : &:r0_21, r0_20
 #   16|         valnum = r0_20
-#   17|     r0_23(glval<int>)           = VariableAddress[p0]       : 
+#   16|     r0_23(glval<int>)           = CopyValue                 : r0_21
+#   16|         valnum = r0_7
+#   17|     r0_24(glval<int>)           = VariableAddress[p0]       : 
 #   17|         valnum = r0_3
-#   17|     r0_24(int)                  = Load                      : &:r0_23, m0_4
+#   17|     r0_25(int)                  = Load                      : &:r0_24, m0_4
 #   17|         valnum = m0_4
-#   17|     r0_25(glval<int>)           = VariableAddress[p1]       : 
+#   17|     r0_26(glval<int>)           = VariableAddress[p1]       : 
 #   17|         valnum = r0_5
-#   17|     r0_26(int)                  = Load                      : &:r0_25, m0_6
+#   17|     r0_27(int)                  = Load                      : &:r0_26, m0_6
 #   17|         valnum = m0_6
-#   17|     r0_27(int)                  = Add                       : r0_24, r0_26
+#   17|     r0_28(int)                  = Add                       : r0_25, r0_27
 #   17|         valnum = r0_17
-#   17|     r0_28(glval<int>)           = VariableAddress[global01] : 
+#   17|     r0_29(glval<int>)           = VariableAddress[global01] : 
 #   17|         valnum = r0_18
-#   17|     r0_29(int)                  = Load                      : &:r0_28, ~m0_1
+#   17|     r0_30(int)                  = Load                      : &:r0_29, ~m0_1
 #   17|         valnum = unique
-#   17|     r0_30(int)                  = Add                       : r0_27, r0_29
-#   17|         valnum = r0_30
-#   17|     r0_31(glval<int>)           = VariableAddress[x]        : 
+#   17|     r0_31(int)                  = Add                       : r0_28, r0_30
+#   17|         valnum = r0_31
+#   17|     r0_32(glval<int>)           = VariableAddress[x]        : 
 #   17|         valnum = r0_7
-#   17|     m0_32(int)                  = Store                     : &:r0_31, r0_30
-#   17|         valnum = r0_30
-#   18|     r0_33(glval<int>)           = VariableAddress[x]        : 
+#   17|     m0_33(int)                  = Store                     : &:r0_32, r0_31
+#   17|         valnum = r0_31
+#   17|     r0_34(glval<int>)           = CopyValue                 : r0_32
+#   17|         valnum = r0_7
+#   18|     r0_35(glval<int>)           = VariableAddress[x]        : 
 #   18|         valnum = r0_7
-#   18|     r0_34(int)                  = Load                      : &:r0_33, m0_32
-#   18|         valnum = r0_30
-#   18|     r0_35(glval<int>)           = VariableAddress[y]        : 
+#   18|     r0_36(int)                  = Load                      : &:r0_35, m0_33
+#   18|         valnum = r0_31
+#   18|     r0_37(glval<int>)           = VariableAddress[y]        : 
 #   18|         valnum = r0_9
-#   18|     m0_36(int)                  = Store                     : &:r0_35, r0_34
-#   18|         valnum = r0_30
-#   19|     v0_37(void)                 = NoOp                      : 
-#   12|     r0_38(glval<int>)           = VariableAddress[#return]  : 
+#   18|     m0_38(int)                  = Store                     : &:r0_37, r0_36
+#   18|         valnum = r0_31
+#   18|     r0_39(glval<int>)           = CopyValue                 : r0_37
+#   18|         valnum = r0_9
+#   19|     v0_40(void)                 = NoOp                      : 
+#   12|     r0_41(glval<int>)           = VariableAddress[#return]  : 
 #   12|         valnum = unique
-#   12|     v0_39(void)                 = ReturnValue               : &:r0_38
-#   12|     v0_40(void)                 = UnmodeledUse              : mu*
-#   12|     v0_41(void)                 = ExitFunction              : 
+#   12|     v0_42(void)                 = ReturnValue               : &:r0_41
+#   12|     v0_43(void)                 = UnmodeledUse              : mu*
+#   12|     v0_44(void)                 = ExitFunction              : 
 
 #   25| int test02(int, int)
 #   25|   Block 0
@@ -198,47 +210,53 @@ test.cpp:
 #   29|         valnum = r0_7
 #   29|     m0_22(int)                  = Store                            : &:r0_21, r0_20
 #   29|         valnum = r0_20
-#   30|     r0_23(glval<unknown>)       = FunctionAddress[change_global02] : 
+#   29|     r0_23(glval<int>)           = CopyValue                        : r0_21
+#   29|         valnum = r0_7
+#   30|     r0_24(glval<unknown>)       = FunctionAddress[change_global02] : 
 #   30|         valnum = unique
-#   30|     v0_24(void)                 = Call                             : func:r0_23
-#   30|     m0_25(unknown)              = ^CallSideEffect                  : ~m0_1
+#   30|     v0_25(void)                 = Call                             : func:r0_24
+#   30|     m0_26(unknown)              = ^CallSideEffect                  : ~m0_1
 #   30|         valnum = unique
-#   30|     m0_26(unknown)              = Chi                              : total:m0_1, partial:m0_25
+#   30|     m0_27(unknown)              = Chi                              : total:m0_1, partial:m0_26
 #   30|         valnum = unique
-#   31|     r0_27(glval<int>)           = VariableAddress[p0]              : 
+#   31|     r0_28(glval<int>)           = VariableAddress[p0]              : 
 #   31|         valnum = r0_3
-#   31|     r0_28(int)                  = Load                             : &:r0_27, m0_4
+#   31|     r0_29(int)                  = Load                             : &:r0_28, m0_4
 #   31|         valnum = m0_4
-#   31|     r0_29(glval<int>)           = VariableAddress[p1]              : 
+#   31|     r0_30(glval<int>)           = VariableAddress[p1]              : 
 #   31|         valnum = r0_5
-#   31|     r0_30(int)                  = Load                             : &:r0_29, m0_6
+#   31|     r0_31(int)                  = Load                             : &:r0_30, m0_6
 #   31|         valnum = m0_6
-#   31|     r0_31(int)                  = Add                              : r0_28, r0_30
+#   31|     r0_32(int)                  = Add                              : r0_29, r0_31
 #   31|         valnum = r0_17
-#   31|     r0_32(glval<int>)           = VariableAddress[global02]        : 
+#   31|     r0_33(glval<int>)           = VariableAddress[global02]        : 
 #   31|         valnum = r0_18
-#   31|     r0_33(int)                  = Load                             : &:r0_32, ~m0_26
+#   31|     r0_34(int)                  = Load                             : &:r0_33, ~m0_27
 #   31|         valnum = unique
-#   31|     r0_34(int)                  = Add                              : r0_31, r0_33
-#   31|         valnum = r0_34
-#   31|     r0_35(glval<int>)           = VariableAddress[x]               : 
+#   31|     r0_35(int)                  = Add                              : r0_32, r0_34
+#   31|         valnum = r0_35
+#   31|     r0_36(glval<int>)           = VariableAddress[x]               : 
 #   31|         valnum = r0_7
-#   31|     m0_36(int)                  = Store                            : &:r0_35, r0_34
-#   31|         valnum = r0_34
-#   32|     r0_37(glval<int>)           = VariableAddress[x]               : 
+#   31|     m0_37(int)                  = Store                            : &:r0_36, r0_35
+#   31|         valnum = r0_35
+#   31|     r0_38(glval<int>)           = CopyValue                        : r0_36
+#   31|         valnum = r0_7
+#   32|     r0_39(glval<int>)           = VariableAddress[x]               : 
 #   32|         valnum = r0_7
-#   32|     r0_38(int)                  = Load                             : &:r0_37, m0_36
-#   32|         valnum = r0_34
-#   32|     r0_39(glval<int>)           = VariableAddress[y]               : 
+#   32|     r0_40(int)                  = Load                             : &:r0_39, m0_37
+#   32|         valnum = r0_35
+#   32|     r0_41(glval<int>)           = VariableAddress[y]               : 
 #   32|         valnum = r0_9
-#   32|     m0_40(int)                  = Store                            : &:r0_39, r0_38
-#   32|         valnum = r0_34
-#   33|     v0_41(void)                 = NoOp                             : 
-#   25|     r0_42(glval<int>)           = VariableAddress[#return]         : 
+#   32|     m0_42(int)                  = Store                            : &:r0_41, r0_40
+#   32|         valnum = r0_35
+#   32|     r0_43(glval<int>)           = CopyValue                        : r0_41
+#   32|         valnum = r0_9
+#   33|     v0_44(void)                 = NoOp                             : 
+#   25|     r0_45(glval<int>)           = VariableAddress[#return]         : 
 #   25|         valnum = unique
-#   25|     v0_43(void)                 = ReturnValue                      : &:r0_42
-#   25|     v0_44(void)                 = UnmodeledUse                     : mu*
-#   25|     v0_45(void)                 = ExitFunction                     : 
+#   25|     v0_46(void)                 = ReturnValue                      : &:r0_45
+#   25|     v0_47(void)                 = UnmodeledUse                     : mu*
+#   25|     v0_48(void)                 = ExitFunction                     : 
 
 #   39| int test03(int, int, int*)
 #   39|   Block 0
@@ -291,50 +309,60 @@ test.cpp:
 #   43|         valnum = r0_9
 #   43|     m0_24(int)                  = Store                     : &:r0_23, r0_22
 #   43|         valnum = r0_22
-#   44|     r0_25(int)                  = Constant[0]               : 
-#   44|         valnum = r0_25
-#   44|     r0_26(glval<int *>)         = VariableAddress[p2]       : 
+#   43|     r0_25(glval<int>)           = CopyValue                 : r0_23
+#   43|         valnum = r0_9
+#   44|     r0_26(int)                  = Constant[0]               : 
+#   44|         valnum = r0_26
+#   44|     r0_27(glval<int *>)         = VariableAddress[p2]       : 
 #   44|         valnum = r0_7
-#   44|     r0_27(int *)                = Load                      : &:r0_26, m0_8
+#   44|     r0_28(int *)                = Load                      : &:r0_27, m0_8
 #   44|         valnum = m0_8
-#   44|     m0_28(int)                  = Store                     : &:r0_27, r0_25
-#   44|         valnum = r0_25
-#   44|     m0_29(unknown)              = Chi                       : total:m0_1, partial:m0_28
+#   44|     r0_29(glval<int>)           = CopyValue                 : r0_28
+#   44|         valnum = m0_8
+#   44|     m0_30(int)                  = Store                     : &:r0_29, r0_26
+#   44|         valnum = r0_26
+#   44|     m0_31(unknown)              = Chi                       : total:m0_1, partial:m0_30
 #   44|         valnum = unique
-#   45|     r0_30(glval<int>)           = VariableAddress[p0]       : 
+#   44|     r0_32(glval<int>)           = CopyValue                 : r0_29
+#   44|         valnum = m0_8
+#   45|     r0_33(glval<int>)           = VariableAddress[p0]       : 
 #   45|         valnum = r0_3
-#   45|     r0_31(int)                  = Load                      : &:r0_30, m0_4
+#   45|     r0_34(int)                  = Load                      : &:r0_33, m0_4
 #   45|         valnum = m0_4
-#   45|     r0_32(glval<int>)           = VariableAddress[p1]       : 
+#   45|     r0_35(glval<int>)           = VariableAddress[p1]       : 
 #   45|         valnum = r0_5
-#   45|     r0_33(int)                  = Load                      : &:r0_32, m0_6
+#   45|     r0_36(int)                  = Load                      : &:r0_35, m0_6
 #   45|         valnum = m0_6
-#   45|     r0_34(int)                  = Add                       : r0_31, r0_33
-#   45|         valnum = r0_19
-#   45|     r0_35(glval<int>)           = VariableAddress[global03] : 
-#   45|         valnum = r0_20
-#   45|     r0_36(int)                  = Load                      : &:r0_35, ~m0_29
-#   45|         valnum = unique
 #   45|     r0_37(int)                  = Add                       : r0_34, r0_36
-#   45|         valnum = r0_37
-#   45|     r0_38(glval<int>)           = VariableAddress[x]        : 
+#   45|         valnum = r0_19
+#   45|     r0_38(glval<int>)           = VariableAddress[global03] : 
+#   45|         valnum = r0_20
+#   45|     r0_39(int)                  = Load                      : &:r0_38, ~m0_31
+#   45|         valnum = unique
+#   45|     r0_40(int)                  = Add                       : r0_37, r0_39
+#   45|         valnum = r0_40
+#   45|     r0_41(glval<int>)           = VariableAddress[x]        : 
 #   45|         valnum = r0_9
-#   45|     m0_39(int)                  = Store                     : &:r0_38, r0_37
-#   45|         valnum = r0_37
-#   46|     r0_40(glval<int>)           = VariableAddress[x]        : 
+#   45|     m0_42(int)                  = Store                     : &:r0_41, r0_40
+#   45|         valnum = r0_40
+#   45|     r0_43(glval<int>)           = CopyValue                 : r0_41
+#   45|         valnum = r0_9
+#   46|     r0_44(glval<int>)           = VariableAddress[x]        : 
 #   46|         valnum = r0_9
-#   46|     r0_41(int)                  = Load                      : &:r0_40, m0_39
-#   46|         valnum = r0_37
-#   46|     r0_42(glval<int>)           = VariableAddress[y]        : 
+#   46|     r0_45(int)                  = Load                      : &:r0_44, m0_42
+#   46|         valnum = r0_40
+#   46|     r0_46(glval<int>)           = VariableAddress[y]        : 
 #   46|         valnum = r0_11
-#   46|     m0_43(int)                  = Store                     : &:r0_42, r0_41
-#   46|         valnum = r0_37
-#   47|     v0_44(void)                 = NoOp                      : 
-#   39|     r0_45(glval<int>)           = VariableAddress[#return]  : 
+#   46|     m0_47(int)                  = Store                     : &:r0_46, r0_45
+#   46|         valnum = r0_40
+#   46|     r0_48(glval<int>)           = CopyValue                 : r0_46
+#   46|         valnum = r0_11
+#   47|     v0_49(void)                 = NoOp                      : 
+#   39|     r0_50(glval<int>)           = VariableAddress[#return]  : 
 #   39|         valnum = unique
-#   39|     v0_46(void)                 = ReturnValue               : &:r0_45
-#   39|     v0_47(void)                 = UnmodeledUse              : mu*
-#   39|     v0_48(void)                 = ExitFunction              : 
+#   39|     v0_51(void)                 = ReturnValue               : &:r0_50
+#   39|     v0_52(void)                 = UnmodeledUse              : mu*
+#   39|     v0_53(void)                 = ExitFunction              : 
 
 #   49| unsigned int my_strspn(char const*, char const*)
 #   49|   Block 0
@@ -391,6 +419,8 @@ test.cpp:
 #   55|         valnum = r0_7
 #   55|     m2_3(char *)        = Store                  : &:r2_2, r2_1
 #   55|         valnum = m0_6
+#   55|     r2_4(glval<char *>) = CopyValue              : r2_2
+#   55|         valnum = r0_7
 #-----|   Goto -> Block 3
 
 #   56|   Block 3
@@ -572,6 +602,8 @@ test.cpp:
 #   80|         valnum = r0_5
 #   80|     m1_6(signed short)        = Store                      : &:r1_5, r1_4
 #   80|         valnum = r1_4
+#   80|     r1_7(glval<signed short>) = CopyValue                  : r1_5
+#   80|         valnum = r0_5
 #-----|   Goto -> Block 2
 
 #   82|   Block 2
@@ -648,10 +680,12 @@ test.cpp:
 #   88|         valnum = r0_9
 #   88|     m3_4(int)        = Store                      : &:r3_3, r3_2
 #   88|         valnum = m3_0
-#   89|     v3_5(void)       = NoOp                       : 
-#   84|     v3_6(void)       = ReturnVoid                 : 
-#   84|     v3_7(void)       = UnmodeledUse               : mu*
-#   84|     v3_8(void)       = ExitFunction               : 
+#   88|     r3_5(glval<int>) = CopyValue                  : r3_3
+#   88|         valnum = r0_9
+#   89|     v3_6(void)       = NoOp                       : 
+#   84|     v3_7(void)       = ReturnVoid                 : 
+#   84|     v3_8(void)       = UnmodeledUse               : mu*
+#   84|     v3_9(void)       = ExitFunction               : 
 
 #   91| int regression_test00()
 #   91|   Block 0
@@ -668,21 +702,23 @@ test.cpp:
 #   92|         valnum = r0_3
 #   92|     m0_6(int)         = Store                    : &:r0_5, r0_4
 #   92|         valnum = r0_4
-#   92|     m0_7(int)         = Store                    : &:r0_3, r0_4
+#   92|     r0_7(int)         = CopyValue                : r0_4
 #   92|         valnum = r0_4
-#   93|     r0_8(glval<int>)  = VariableAddress[#return] : 
-#   93|         valnum = r0_8
-#   93|     r0_9(glval<int>)  = VariableAddress[x]       : 
+#   92|     m0_8(int)         = Store                    : &:r0_3, r0_7
+#   92|         valnum = r0_4
+#   93|     r0_9(glval<int>)  = VariableAddress[#return] : 
+#   93|         valnum = r0_9
+#   93|     r0_10(glval<int>) = VariableAddress[x]       : 
 #   93|         valnum = r0_3
-#   93|     r0_10(int)        = Load                     : &:r0_9, m0_7
+#   93|     r0_11(int)        = Load                     : &:r0_10, m0_8
 #   93|         valnum = r0_4
-#   93|     m0_11(int)        = Store                    : &:r0_8, r0_10
+#   93|     m0_12(int)        = Store                    : &:r0_9, r0_11
 #   93|         valnum = r0_4
-#   91|     r0_12(glval<int>) = VariableAddress[#return] : 
-#   91|         valnum = r0_8
-#   91|     v0_13(void)       = ReturnValue              : &:r0_12, m0_11
-#   91|     v0_14(void)       = UnmodeledUse             : mu*
-#   91|     v0_15(void)       = ExitFunction             : 
+#   91|     r0_13(glval<int>) = VariableAddress[#return] : 
+#   91|         valnum = r0_9
+#   91|     v0_14(void)       = ReturnValue              : &:r0_13, m0_12
+#   91|     v0_15(void)       = UnmodeledUse             : mu*
+#   91|     v0_16(void)       = ExitFunction             : 
 
 #  104| int inheritanceConversions(Derived*)
 #  104|   Block 0

From 9511465f04ef80c6f1b0afe914e54d6b625bdc97 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Thu, 26 Sep 2019 11:16:24 +0200
Subject: [PATCH 006/232] Learn QL: Minor formatting fix in
 python/statements-expressions

(cherry picked from commit c47a4e0c44eba9f24ffb5490986188347e1372f5)
---
 docs/language/learn-ql/python/statements-expressions.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/learn-ql/python/statements-expressions.rst b/docs/language/learn-ql/python/statements-expressions.rst
index 2d45abde73a..9f1a15a6d1a 100644
--- a/docs/language/learn-ql/python/statements-expressions.rst
+++ b/docs/language/learn-ql/python/statements-expressions.rst
@@ -72,7 +72,7 @@ An ``if`` statement where one branch is composed of just ``pass`` statements cou
 
 To find statements like this we can run the following query:
 
-**Find ``if`` statements with empty branches**
+**Find 'if' statements with empty branches**
 
 .. code-block:: ql
 

From 94d876e8a3664c4fba6f48f7f10f937885900759 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Wed, 25 Sep 2019 18:20:48 +0200
Subject: [PATCH 007/232] Learn QL: Fix query link in Python Points-to tutorial

(cherry picked from commit c6c565bc373e1353830ea731823feea024b4c4c8)
---
 docs/language/learn-ql/python/pointsto-type-infer.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/learn-ql/python/pointsto-type-infer.rst b/docs/language/learn-ql/python/pointsto-type-infer.rst
index 6ca1bde67c8..bcbab520477 100644
--- a/docs/language/learn-ql/python/pointsto-type-infer.rst
+++ b/docs/language/learn-ql/python/pointsto-type-infer.rst
@@ -173,7 +173,7 @@ Many of the results shown will have ``cls`` as ``NoneType``. It is more informat
      not cls.hasAttribute("__iter__")
    select loop, cls, origin
 
-➤ `See this in the query console <https://lgtm.com/query/6718356557331218618/>`__. This reports the same results, but with a third column showing the source of the ``None`` values.
+➤ `See this in the query console <https://lgtm.com/query/3795352249440053606/>`__. This reports the same results, but with a third column showing the source of the ``None`` values.
 
 Finding calls using call-graph analysis
 ----------------------------------------------------

From 3a4cef646de30c263d4fdc86c34b377cbe8129db Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Thu, 26 Sep 2019 16:04:01 +0100
Subject: [PATCH 008/232] docs: fix some formatting issues

---
 .../learn-ql/cpp/conversions-classes.rst         |  2 +-
 docs/language/learn-ql/cpp/function-classes.rst  |  4 ++++
 .../learn-ql/cpp/introduce-libraries-cpp.rst     |  4 ++++
 .../learn-ql/cpp/zero-space-terminator.rst       |  4 ++++
 docs/language/learn-ql/csharp/ql-for-csharp.rst  | 15 ---------------
 docs/language/learn-ql/java/call-graph.rst       |  2 ++
 .../learn-ql/java/expressions-statements.rst     |  2 ++
 .../learn-ql/java/introduce-libraries-java.rst   | 10 +++++++++-
 .../learn-ql/java/types-class-hierarchy.rst      |  2 ++
 .../javascript/introduce-libraries-js.rst        |  2 +-
 docs/language/learn-ql/python/functions.rst      |  2 ++
 .../python/introduce-libraries-python.rst        | 16 ++++++++--------
 .../learn-ql/python/pointsto-type-infer.rst      |  9 +++++----
 .../learn-ql/python/statements-expressions.rst   |  8 ++++----
 14 files changed, 48 insertions(+), 34 deletions(-)

diff --git a/docs/language/learn-ql/cpp/conversions-classes.rst b/docs/language/learn-ql/cpp/conversions-classes.rst
index 512d967a53f..28032a932d2 100644
--- a/docs/language/learn-ql/cpp/conversions-classes.rst
+++ b/docs/language/learn-ql/cpp/conversions-classes.rst
@@ -128,7 +128,7 @@ Unlike the earlier versions of the query, this query would return each side of t
 
    Note
    
-    In general, QL predicates named ``getAXxx`` exploit the ability to return multiple results (multiple instances of ``Xxx``) whereas plain ``getXxx`` predicates usually return at most one specific instance of ``Xxx``.
+   In general, QL predicates named ``getAXxx`` exploit the ability to return multiple results (multiple instances of ``Xxx``) whereas plain ``getXxx`` predicates usually return at most one specific instance of ``Xxx``.
 
 Classes
 -------
diff --git a/docs/language/learn-ql/cpp/function-classes.rst b/docs/language/learn-ql/cpp/function-classes.rst
index 5dde2546995..4b9db11351b 100644
--- a/docs/language/learn-ql/cpp/function-classes.rst
+++ b/docs/language/learn-ql/cpp/function-classes.rst
@@ -60,6 +60,10 @@ This query returns fewer results. However, if you examine the results then you c
 
 For example, there is a more complicated LGTM `query <https://lgtm.com/rules/2152580467/>`__ that finds unused static functions. To see the QL code for this query, click **Open in query console** at the top of the page.
 
+.. pull-quote::
+
+   Tip
+
    You can explore the definition of an element in the standard QL libraries and see what predicates are available. Use the keyboard **F3** button to open the definition of any element. Alternatively, hover over the element and click **Jump to definition** in the tooltip displayed. The library file is opened in a new tab with the definition highlighted.
 
 Finding a specific function
diff --git a/docs/language/learn-ql/cpp/introduce-libraries-cpp.rst b/docs/language/learn-ql/cpp/introduce-libraries-cpp.rst
index 01f8b244684..5c287bd7115 100644
--- a/docs/language/learn-ql/cpp/introduce-libraries-cpp.rst
+++ b/docs/language/learn-ql/cpp/introduce-libraries-cpp.rst
@@ -12,6 +12,10 @@ There is an extensive QL library for analyzing C/C++ code. The QL classes in thi
 
 The rest of this topic briefly summarizes the most important QL classes and predicates provided by this library.
 
+.. pull-quote::
+
+   Tip
+
    You can find related classes and features using the query console's auto-complete feature. You can also press **F3** to jump to the definition of any element (QL library files are opened in new tabs in the console).
 
 Summary of the library classes
diff --git a/docs/language/learn-ql/cpp/zero-space-terminator.rst b/docs/language/learn-ql/cpp/zero-space-terminator.rst
index f2d0ae36dbd..c5c578633e1 100644
--- a/docs/language/learn-ql/cpp/zero-space-terminator.rst
+++ b/docs/language/learn-ql/cpp/zero-space-terminator.rst
@@ -87,6 +87,10 @@ Now we can write a query using these classes:
 
 Note that there is no need to check whether anything is added to the ``strlen`` expression, as it would be in the corrected C code ``malloc(strlen(string) + 1)``. This is because the corrected code would in fact be an ``AddExpr`` containing a ``StrlenCall``, not an instance of ``StrlenCall`` itself. A side-effect of this approach is that we omit certain unlikely patterns such as ``malloc(strlen(string) + 0``). In practice we can always come back and extend our query to cover this pattern if it is a concern.
 
+.. pull-quote::
+
+   Tip
+
    For some projects, this query may not return any results. Possibly the project you are querying does not have any problems of this kind, but it is also important to make sure the query itself is working properly. One solution is to set up a test project with examples of correct and incorrect code to run the query against (the C code at the very top of this page makes a good starting point). Another approach is to test each part of the query individually to make sure everything is working.
 
 When you have defined the basic query then you can refine the query to include further coding patterns or to exclude false positives:
diff --git a/docs/language/learn-ql/csharp/ql-for-csharp.rst b/docs/language/learn-ql/csharp/ql-for-csharp.rst
index 56d8f7ef017..879d8c15107 100644
--- a/docs/language/learn-ql/csharp/ql-for-csharp.rst
+++ b/docs/language/learn-ql/csharp/ql-for-csharp.rst
@@ -14,23 +14,8 @@ These topics provide an overview of the QL C# libraries and show examples of how
 
 -  :doc:`Introducing the C# libraries <introduce-libraries-csharp>` introduces the standard libraries used to write queries for C# code.
 
-.. raw:: html
-
-   <!-- Working with generic types and methods(generics) - how to query generic types and methods. -->
-
 -  :doc:`Tutorial: Analyzing data flow in C# <dataflow>` demonstrates how to write queries using the standard QL for C# data flow and taint tracking libraries.
 
-.. raw:: html
-
-   <!-- Working with call graphs(call-graph) - how to construct and query call graphs, and work with dynamic and virtual dispatch. -->
-
-.. raw:: html
-
-   <!-- Working with control flow(control-flow) - how to query intra-procedural control flow. -->
-
-.. raw:: html
-
-   <!-- Working with comments(comments) - how to query comments and XML documentation. -->
 
 Other resources
 ---------------
diff --git a/docs/language/learn-ql/java/call-graph.rst b/docs/language/learn-ql/java/call-graph.rst
index b0c721b1fd7..3cea5294c0e 100644
--- a/docs/language/learn-ql/java/call-graph.rst
+++ b/docs/language/learn-ql/java/call-graph.rst
@@ -78,6 +78,8 @@ Given this API, we can easily write a query that finds methods that are not call
 
 ➤ `See this in the query console <https://lgtm.com/query/665280012/>`__. This simple query typically returns a large number of results.
 
+.. pull-quote::
+
    Note
 
    We have to use ``polyCalls`` instead of ``calls`` here: we want to be reasonably sure that ``callee`` is not called, either directly or via overriding.
diff --git a/docs/language/learn-ql/java/expressions-statements.rst b/docs/language/learn-ql/java/expressions-statements.rst
index c8882c41792..0034868f01a 100644
--- a/docs/language/learn-ql/java/expressions-statements.rst
+++ b/docs/language/learn-ql/java/expressions-statements.rst
@@ -18,6 +18,8 @@ Specifically, consider the following code snippet:
 
 If ``l`` is bigger than 2\ :sup:`31`\ - 1 (the largest positive value of type ``int``), then this loop will never terminate: ``i`` will start at zero, being incremented all the way up to 2\ :sup:`31`\ - 1, which is still smaller than ``l``. When it is incremented once more, an arithmetic overflow occurs, and ``i`` becomes -2\ :sup:`31`\, which also is smaller than ``l``! Eventually, ``i`` will reach zero again, and the cycle repeats.
 
+.. pull-quote::   
+
    More about overflow
 
    All primitive numeric types have a maximum value, beyond which they will wrap around to their lowest possible value (called an "overflow"). For ``int``, this maximum value is 2\ :sup:`31`\ - 1. Type ``long`` can accommodate larger values up to a maximum of 2\ :sup:`63`\ - 1. In this example, this means that ``l`` can take on a value that is higher than the maximum for type ``int``; ``i`` will never be able to reach this value, instead overflowing and returning to a low value.
diff --git a/docs/language/learn-ql/java/introduce-libraries-java.rst b/docs/language/learn-ql/java/introduce-libraries-java.rst
index 32863b099e0..ef20dd47ccf 100644
--- a/docs/language/learn-ql/java/introduce-libraries-java.rst
+++ b/docs/language/learn-ql/java/introduce-libraries-java.rst
@@ -14,6 +14,10 @@ The library is implemented as a set of QL modules, that is, files with the exten
 
 The rest of this topic briefly summarizes the most important QL classes and predicates provided by this library.
 
+.. pull-quote::
+
+   Note
+
    The example queries in this topic illustrate the types of results returned by different library classes. The results themselves are not interesting but can be used as the basis for developing a more complex query. The tutorial topics show how you can take a simple query and fine-tune it to find precisely the results you're interested in.
 
 Summary of the library classes
@@ -315,7 +319,11 @@ Class ``Javadoc`` represents an entire Javadoc comment as a tree of ``JavadocEle
 
 ➤ `See this in the query console <https://lgtm.com/query/670490015/>`__. None of the LGTM.com demo projects uses the ``@author`` tag on private fields.
 
-   Note that on line 5 we used ``getParent+`` to capture tags that are nested at any depth within the Javadoc comment.
+.. pull-quote::
+
+   Note
+
+   On line 5 we used ``getParent+`` to capture tags that are nested at any depth within the Javadoc comment.
 
 For more information on working with Javadoc, see the :doc:`tutorial on Javadoc <javadoc>`.
 
diff --git a/docs/language/learn-ql/java/types-class-hierarchy.rst b/docs/language/learn-ql/java/types-class-hierarchy.rst
index df50e600cf9..9855a0391b2 100644
--- a/docs/language/learn-ql/java/types-class-hierarchy.rst
+++ b/docs/language/learn-ql/java/types-class-hierarchy.rst
@@ -32,6 +32,8 @@ To determine ancestor types (including immediate super types, and also *their* s
 
 ➤ `See this in the query console <https://lgtm.com/query/674620010/>`__. If this query were run on the example snippet above, the query would return ``A``, ``I``, and ``java.lang.Object``.
 
+.. pull-quote::
+
    Tip
 
    If you want to see the location of ``B`` as well as ``A``, you can replace ``B.getASupertype+()`` with ``B.getASupertype*()`` and re-run the query.
diff --git a/docs/language/learn-ql/javascript/introduce-libraries-js.rst b/docs/language/learn-ql/javascript/introduce-libraries-js.rst
index 0e3a7e5acdd..0858cbb5f8d 100644
--- a/docs/language/learn-ql/javascript/introduce-libraries-js.rst
+++ b/docs/language/learn-ql/javascript/introduce-libraries-js.rst
@@ -224,7 +224,7 @@ The `TopLevel <https://help.semmle.com/qldoc/javascript/semmle/javascript/AST.ql
 
 .. pull-quote::
 
-    Note
+   Note
 
    By default, LGTM filters out alerts in minified top-levels, since they are often hard to interpret. When writing your own queries in the LGTM query console, this filtering is *not* done automatically, so you may want to explicitly add a condition of the form ``and not e.getTopLevel().isMinified()`` or similar to your query to exclude results in minified code.
 
diff --git a/docs/language/learn-ql/python/functions.rst b/docs/language/learn-ql/python/functions.rst
index 2e06468480b..a7246ad109e 100644
--- a/docs/language/learn-ql/python/functions.rst
+++ b/docs/language/learn-ql/python/functions.rst
@@ -10,6 +10,8 @@ In this example we look for all the "getters" in a program. Programmers moving t
 
 Using the member predicate ``Function.getName()``, we can list all of the getter functions in a snapshot:
 
+.. pull-quote::
+
    Tip
 
    Instead of copying this query, try typing the code. As you start to write a name that matches a library class, a pop-up is displayed making it easy for you to select the class that you want.
diff --git a/docs/language/learn-ql/python/introduce-libraries-python.rst b/docs/language/learn-ql/python/introduce-libraries-python.rst
index 3e437554e48..86ba7edee7b 100644
--- a/docs/language/learn-ql/python/introduce-libraries-python.rst
+++ b/docs/language/learn-ql/python/introduce-libraries-python.rst
@@ -33,7 +33,7 @@ This part of the library represents the Python source code. The ``Module``, ``Cl
 Scope
 ^^^^^
 
-A Python program is a group of modules. Technically a module is just a list of statements, but we often think of it as composed of classes and functions. These top-level entities, the module, class and function are represented by the three classes (`Module <https://help.semmle.com/qldoc/python/semmle/python/Module.qll/type.Module$Module.html>`__, `Class <https://help.semmle.com/qldoc/python/semmle/python/Class.qll/type.Class$Class.html>`__ and `Function <https://help.semmle.com/qldoc/python/semmle/python/Function.qll/type.Function$Function.html>`__ which are all subclasses of ``Scope``.
+A Python program is a group of modules. Technically a module is just a list of statements, but we often think of it as composed of classes and functions. These top-level entities, the module, class and function are represented by the three classes `Module <https://help.semmle.com/qldoc/python/semmle/python/Module.qll/type.Module$Module.html>`__, `Class <https://help.semmle.com/qldoc/python/semmle/python/Class.qll/type.Class$Class.html>`__ and `Function <https://help.semmle.com/qldoc/python/semmle/python/Function.qll/type.Function$Function.html>`__, which are all subclasses of ``Scope``.
 
 -  ``Scope``
 
@@ -110,12 +110,12 @@ Examples
 
 Each syntactic element in Python source is recorded in the snapshot. These can be queried via the corresponding class. Let us start with a couple of simple examples.
 
-1. Finding all finally blocks
-'''''''''''''''''''''''''''''
+1. Finding all ``finally`` blocks
+'''''''''''''''''''''''''''''''''
 
 For our first example, we can find all ``finally`` blocks by using the ``Try`` class:
 
-**Find all ``finally`` blocks**
+**Find all** ``finally`` **blocks**
 
 .. code-block:: ql
 
@@ -126,8 +126,8 @@ For our first example, we can find all ``finally`` blocks by using the ``Try`` c
 
 ➤ `See this in the query console <https://lgtm.com/query/659662193/>`__. Many projects include examples of this pattern.
 
-2. Finding 'except' blocks that do nothing
-''''''''''''''''''''''''''''''''''''''''''
+2. Finding ``except`` blocks that do nothing
+''''''''''''''''''''''''''''''''''''''''''''
 
 For our second example, we can use a simplified version of a query from the standard query set. We look for all ``except`` blocks that do nothing.
 
@@ -137,7 +137,7 @@ A block that does nothing is one that contains no statements except ``pass`` sta
 
    not exists(Stmt s | s = ex.getAStmt() | not s instanceof Pass)
 
-where ``ex`` is an ``ExceptStmt`` and ``Pass`` is the class representing ``pass`` statements. Instead of using the double negative, **"no**\ *statements that are*\ **not**\ *pass statements"*, this can also be expressed positively, "all statements must be pass statements." The positive form is expressed in QL using the ``forall`` quantifier:
+where ``ex`` is an ``ExceptStmt`` and ``Pass`` is the class representing ``pass`` statements. Instead of using the double negative, *no statements that are not pass statements*, this can also be expressed positively, *all statements must be pass statements*. The positive form is expressed in QL using the ``forall`` quantifier:
 
 .. code-block:: ql
 
@@ -145,7 +145,7 @@ where ``ex`` is an ``ExceptStmt`` and ``Pass`` is the class representing ``pass`
 
 Both forms are equivalent. Using the positive QL expression, the whole query looks like this:
 
-**Find pass-only ``except`` blocks**
+**Find pass-only** ``except`` **blocks**
 
 .. code-block:: ql
 
diff --git a/docs/language/learn-ql/python/pointsto-type-infer.rst b/docs/language/learn-ql/python/pointsto-type-infer.rst
index bcbab520477..1b5817f8534 100644
--- a/docs/language/learn-ql/python/pointsto-type-infer.rst
+++ b/docs/language/learn-ql/python/pointsto-type-infer.rst
@@ -37,7 +37,8 @@ The predicate ``ControlFlowNode.pointsTo(...)`` shows which object a control flo
    predicate pointsTo(Context context, Value object, ControlFlowNode origin)
 
 ``object`` is an object that the control flow node refers to, and ``origin`` is where the object comes from, which is useful for displaying meaningful results.
- The third form includes the ``context`` in which the control flow node refers to the ``object``. This form can usually be ignored.
+
+The third form includes the ``context`` in which the control flow node refers to the ``object``. This form can usually be ignored.
 
 .. pull-quote::
 
@@ -62,7 +63,7 @@ We want to find ``except`` blocks in a ``try`` statement that are in the wrong o
 
 First we can write a query to find ordered pairs of ``except`` blocks for a ``try`` statement.
 
-**Ordered except blocks in same ``try`` statement**
+**Ordered except blocks in same** ``try`` **statement**
 
 .. code-block:: ql
 
@@ -81,7 +82,7 @@ Here ``ex1`` and ``ex2`` are both ``except`` handlers in the ``try`` statement `
 
 The results of this query need to be filtered to return only results where ``ex1`` is more general than ``ex2``. We can use the fact that an ``except`` block is more general than another block if the class it handles is a superclass of the other.
 
-**More general ``except`` block**
+**More general** ``except`` **block**
 
 .. code-block:: ql
 
@@ -102,7 +103,7 @@ ensures that ``cls1`` is a ``ClassValue`` that the ``except`` block would handle
 
 Combining the parts of the query we get this:
 
-**More general ``except`` block precedes more specific**
+**More general** ``except`` **block precedes more specific**
 
 .. code-block:: ql
 
diff --git a/docs/language/learn-ql/python/statements-expressions.rst b/docs/language/learn-ql/python/statements-expressions.rst
index 9f1a15a6d1a..622733ceb1b 100644
--- a/docs/language/learn-ql/python/statements-expressions.rst
+++ b/docs/language/learn-ql/python/statements-expressions.rst
@@ -143,7 +143,7 @@ Python implementations commonly cache small integers and single character string
 
 We can check for these as follows:
 
-**Find comparisons to integer or string literals using ``is``**
+**Find comparisons to integer or string literals using** ``is``
 
 .. code-block:: ql
 
@@ -158,6 +158,8 @@ We can check for these as follows:
 
 The clause ``cmp.getOp(0) instanceof Is and cmp.getComparator(0) = literal`` checks that the first comparison operator is "is" and that the first comparator is a literal.
 
+.. pull-quote::
+
    Tip
 
    We have to use ``cmp.getOp(0)`` and ``cmp.getComparator(0)``\ as there is no ``cmp.getOp()`` or ``cmp.getComparator()``. The reason for this is that a ``Compare`` expression can have multiple operators. For example, the expression ``3 < x < 7`` has two operators and two comparators. You use ``cmp.getComparator(0)`` to get the first comparator (in this example the ``3``) and ``cmp.getComparator(1)`` to get the second comparator (in this example the ``7``).
@@ -253,9 +255,7 @@ checks that the value of the attribute (the expression to the left of the dot in
 Class and function definitions
 ------------------------------
 
-As Python is a dynamically typed language, class, and function definitions are executable statements. This means that a class statement is both a statement and a scope containing statements. To represent this cleanly the class definition is broken into a number of parts. At runtime, when a class definition is executed a class object is created and then assigned to a variable of the same name in the scope enclosing the class. This class is created from a code-object representing the source code for the body of the class. To represent this the ``ClassDef`` class (which represents a ``class`` statement) subclasses ``Assign``. The ``Class`` class, which represents the body of the class, can be accessed via the ``ClassDef.getDefinedClass()``
-
-``FunctionDef``, ``Function`` are handled similarly.
+As Python is a dynamically typed language, class, and function definitions are executable statements. This means that a class statement is both a statement and a scope containing statements. To represent this cleanly the class definition is broken into a number of parts. At runtime, when a class definition is executed a class object is created and then assigned to a variable of the same name in the scope enclosing the class. This class is created from a code-object representing the source code for the body of the class. To represent this the ``ClassDef`` class (which represents a ``class`` statement) subclasses ``Assign``. The ``Class`` class, which represents the body of the class, can be accessed via the ``ClassDef.getDefinedClass()``. ``FunctionDef`` and ``Function`` are handled similarly.
 
 Here is the relevant part of the class hierarchy:
 

From ff78feeeeaec99bdf779242c33e25f57c7bcab29 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Mon, 30 Sep 2019 11:51:17 +0100
Subject: [PATCH 009/232] docs: version number and small css tweaks

---
 .../slides-semmle-2/static/theme/css/default.css             | 5 +++--
 docs/language/ql-training/conf.py                            | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
index 2c05ea5e93b..e3664d42e06 100644
--- a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
+++ b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
@@ -485,6 +485,7 @@ ul {
   margin-left: 2.2em;
   margin-bottom: 1em;
   position: relative;
+  width: 90%;
 }
 /* line 300, ../scss/default.scss */
 ul li {
@@ -1569,7 +1570,7 @@ p.first.admonition-title {
   text-align: left;
   font-size: 0.8em;
   width: 100%;
-  overflow: scroll;
+  overflow: auto;
   border: 1px solid black;
 }
 
@@ -1608,7 +1609,7 @@ p.first.admonition-title {
   display: block;
   position: fixed;
   top: 0;
-  right: -1%;
+  right: 0;
   font-size: 1.2em;
 }
 
diff --git a/docs/language/ql-training/conf.py b/docs/language/ql-training/conf.py
index de712cd06a4..8f8a13569b5 100644
--- a/docs/language/ql-training/conf.py
+++ b/docs/language/ql-training/conf.py
@@ -86,9 +86,9 @@ htmlhelp_basename = 'QL training'
 # built documents.
 #
 # The short X.Y version.
-version = u'1.21'
+version = u'1.22'
 # The full version, including alpha/beta/rc tags.
-release = u'1.21'
+release = u'1.22'
 copyright = u'2019 Semmle Ltd'
 author = u'Semmle Ltd'
 

From 56ed2f618d932f221976391dd46f754ca208fbe0 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Wed, 2 Oct 2019 09:05:31 +0100
Subject: [PATCH 010/232] Add alias for easier user-searching

---
 docs/language/support/versions-compilers.csv | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/support/versions-compilers.csv b/docs/language/support/versions-compilers.csv
index b70ac87335f..74f69d662b6 100644
--- a/docs/language/support/versions-compilers.csv
+++ b/docs/language/support/versions-compilers.csv
@@ -10,7 +10,7 @@ C#,C# up to 7.3. with .NET up to 4.8 [3]_.,"Microsoft Visual Studio up to 2019,
 
 .NET Core up to 2.2","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
 COBOL,ANSI 85 or newer [4]_.,Not applicable,"``.cbl``, ``.CBL``, ``.cpy``, ``.CPY``, ``.copy``, ``.COPY``"
-Go, "Go up to 1.13", "Go 1.11 or more recent", ``.go``
+Go (aka Golang), "Go up to 1.13", "Go 1.11 or more recent", ``.go``
 Java,"Java 6 to 12 [5]_.","javac (OpenJDK and Oracle JDK),
 
 Eclipse compiler for Java (ECJ) [6]_.",``.java``

From 4a8e8fa0de4470aaeed94357f70b54b68c0b84a7 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Fri, 4 Oct 2019 09:18:19 +0100
Subject: [PATCH 011/232] docs: semmle logo

---
 .../static/theme/css/default.css              |  18 +--
 .../_static-training/title-slide.svg          | 149 +-----------------
 .../ql-training/cpp/bad-overflow-guard.rst    |   4 -
 .../ql-training/cpp/control-flow-cpp.rst      |   4 -
 .../ql-training/cpp/data-flow-cpp.rst         |   4 -
 .../ql-training/cpp/global-data-flow-cpp.rst  |   4 -
 .../language/ql-training/cpp/intro-ql-cpp.rst |   4 -
 .../cpp/program-representation-cpp.rst        |   4 -
 docs/language/ql-training/cpp/snprintf.rst    |   4 -
 docs/language/ql-training/index.rst           |   4 -
 .../ql-training/java/apache-struts-java.rst   |   4 -
 .../ql-training/java/data-flow-java.rst       |   4 -
 .../java/global-data-flow-java.rst            |   4 -
 .../ql-training/java/intro-ql-java.rst        |   4 -
 .../java/program-representation-java.rst      |   4 -
 .../ql-training/java/query-injection-java.rst |   4 -
 docs/language/ql-training/template.rst        |   4 -
 17 files changed, 4 insertions(+), 223 deletions(-)

diff --git a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
index e3664d42e06..83d3d94e3aa 100644
--- a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
+++ b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
@@ -1301,13 +1301,13 @@ aside.gdbar img {
 .title-slide hgroup h1 {
   font-size: 2em;
   line-height: 1.4;
-  /*letter-spacing: -3px;*/
   color: white;
   margin: auto;
   display: block;
   position: absolute;
   top: 0;
   bottom: 10%;
+  left: 1.25em;
   height: 0;
 }
 /* line 898, ../scss/default.scss */
@@ -1431,31 +1431,19 @@ hgroup .pre {
   color: #5c31ff;
 }
 
-/* title slide (deck title, subtitle, semmle logo)*/
+/* title slide (deck title, subtitle)*/
 
 .title-slide {
   background-image: url("../../title-slide.svg");
   background-size: cover;
 }
 
-.semmle-logo sup {
-  vertical-align: super;
-  font-size: 0.3em;
-  font-weight: 100;
-}
-
-.title-slide .semmle-logo {
-  color: white;
-  font-size: 1.2em;
-  position: absolute;
-  top: 10%;
-}
-
 .title-slide p {
   color: white;
   font-size: 1em;
   position: absolute;
   bottom: 30%;
+  left: 2.6em;
 }
 
 .title-slide hgroup .pre {
diff --git a/docs/language/ql-training/_static-training/title-slide.svg b/docs/language/ql-training/_static-training/title-slide.svg
index 6f9a19f4a1b..13eb2d34fef 100644
--- a/docs/language/ql-training/_static-training/title-slide.svg
+++ b/docs/language/ql-training/_static-training/title-slide.svg
@@ -1,148 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:xlink="http://www.w3.org/1999/xlink"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   version="1.1"
-   viewBox="0.0 0.0 960.0 540.0"
-   fill="none"
-   stroke="none"
-   stroke-linecap="square"
-   stroke-miterlimit="10"
-   id="svg3783"
-   sodipodi:docname="semmle-template.svg"
-   inkscape:version="0.92.4 (5da689c313, 2019-01-14)">
-  <metadata
-     id="metadata3789">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <defs
-     id="defs3787" />
-  <sodipodi:namedview
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1"
-     objecttolerance="10"
-     gridtolerance="10"
-     guidetolerance="10"
-     inkscape:pageopacity="0"
-     inkscape:pageshadow="2"
-     inkscape:window-width="1366"
-     inkscape:window-height="705"
-     id="namedview3785"
-     showgrid="false"
-     inkscape:zoom="0.94074074"
-     inkscape:cx="480"
-     inkscape:cy="270"
-     inkscape:window-x="-8"
-     inkscape:window-y="-8"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="svg3783" />
-  <clipPath
-     id="g3a04b465b0_0_0.0">
-    <path
-       d="m0 0l960.0 0l0 540.0l-960.0 0l0 -540.0z"
-       clip-rule="nonzero"
-       id="path3752" />
-  </clipPath>
-  <g
-     clip-path="url(#g3a04b465b0_0_0.0)"
-     id="g3781">
-    <path
-       fill="#ffffff"
-       d="m0 0l960.0 0l0 540.0l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3755" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m-2.6246718E-7 0l960.0 0l0 539.99945l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3757" />
-    <g
-       transform="matrix(0.5 0.0 0.0 0.49999947506561676 -2.624671916010499E-7 0.0)"
-       id="g3764">
-      <clipPath
-         id="g3a04b465b0_0_0.1">
-        <path
-           d="m0 0l1920.0 0l0 1080.0l-1920.0 0z"
-           clip-rule="evenodd"
-           id="path3759" />
-      </clipPath>
-      <image
-         clip-path="url(#g3a04b465b0_0_0.1)"
-         fill="#000"
-         width="1920.0"
-         height="1080.0"
-         x="0.0"
-         y="0.0"
-         preserveAspectRatio="none"
-         xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAQ4B4ADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDxaiiivYJCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiirC2crqGG3BGetNRctgK9FWfsM3+z+dH2Gb/Z/Oq9nPsFytRT5Ymhba2M4zxTKlpp2YBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArYg/wCPeP8A3RWPWxB/x7x/7orpw27EySiiiuwRm3/+vH+7/U1Vq1f/AOvH+7/U1VrzqvxspBRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa0MiCCMF1ztHesmitKdTkdwaNnzY/76/nR5sf99fzrGorb6y+wrFm+YNOCpBG3t+NVqKK55S5ncYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFWrXTby9jMlvAZFB2kgjrU/9g6p/z6N/30P8a0VKpJXUX9wGdRWj/YOqf8+jf99D/GobrTLyyjElxAY0J2gkjrQ6NRK7i/uAqUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABWvB4X1i5gSeK0Zo3GVORyKyK9V0XXtKg0W0ilvokkWIBlJ6Gt6FOE21J2A8wurWayuXt502SocMvpUNaviS4iutfu5oHDxs+Qw6GsqspJKTSAKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA7Hwj/yDZv+ux/kK6Cuf8I/8g2b/rsf5Cugr6XB/wACJD3CsHxb/wAgqP8A67D+RrerB8W/8gqP/rsP5Gni/wCBL0BbnGUUUV8yWFFa2haQNSnZpCRDH97Hc+ldcuk2Cx7Bax7fcV20MDUrR5r2Qmzzuiug8QaIlkoubYERE4ZfSufrnrUpUpckhhRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHY+ET/wAS2b/rsf5Ct/I9RXmAZl6MR9DS+Y/99vzr06OY+zpqHLt5isenZHqKwfFh/wCJVH/12H8jXH+Y/wDfb86QszDBYn6mitmPtKbhy7+YWEooorzBnXeEpUNrNFn5w2ce1dHXmtpeTWU4mgbaw/I1vr4vcR/NaqX9jxXs4THU401CeliWjU8SSpHo8iseXICj3rhauahqdxqUu+Y8D7qjoKp1wYuuq1TmjsNKwUUUVyjCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAqVLaWRQyrkH3qKtW0/49k/GtaUFOVmDKP2Of+5+tI9rMilmXAHXmtaobr/j2f6VvLDxSbFcyaKKK4xhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFSpazP0Qgep4ppN7ARUVcXT2P3nA+gqQafH3djWioTfQV0Z9FaX2GH1b86Q2EXqw/Gq+rzC5nUVfbTx/DIfxFQvYyr0w30NQ6M10HcrUU5o3Q4dSPqKbWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAqKZHVFGWY4Art9N8PWttCrTxiWYjkt0FcfYSLFfwO/3Q4zXpAIYAg5B6V6uW0oSvKSu0JmZe6DZXURCRLFJ2Za4a4ge2uHhkGGQ4Nem159rcqTavcMhyu7GR3qsyowjFTSsxIz6KKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtW0/49k/GsqpkupY0CqwwPataU1CV2DNaobr/AI9n+lUfts/94fkKa91LIhVmGD14reWIi00KxDRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKlgt3nPHC9yaaTbsgIgCxwBknsKuRWLNzIdo9B1q3FAkI+Uc9yetS1108OlrIVyOOCOL7qgH171JRRXQklsIKKKKYBRRRQAUUUUAIQCMEZHvVaWyjflfkPt0q1RUyhGW4GRLbyQn5hx6jpUVbZAIwRkVSuLIHLRdf7tctTDtaxGmUaKCCDgjBormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVtaf4kuLKIRSKJYx0yeRWLRWlOrOm+aDsBv3vii4uIjHBGIgRgtnJrAJycmiiirWnVd5u4BRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU6ON5XCRoWY9ABk1v2XhWeUB7qQRKf4Rya1pUalV2grhc56iu7g8OadCOYTIfVzmrQ0qwAwLOH/AL4FdscsqPdoXMedUV6DJomnSjm0jH+6MfyrMuvCcDgm2laM+jcipnltaOqswucjRVy+0u709v30fy9nXkGqdcMoyi7SVmMKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAorqND8F3WpxrcXLm3t25Xj5mH9K6dfAOkKmCZ2P94vXRDDVJq9gPOLa2Mx3Nwg/WtJVCKFUYArqtQ8GtBEXsJDIFH+rbr+BrmGVkYqwIYHBB7V1Qo+zViWJRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAV7m2WYZHDjv61mMpVirDBHatuq11biVdyj5x+tc9ajze8twTMyijp1oriKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1YWE2oXAhhH1Y9AKgiieeVYoxlmOAK9A0vTo9NtFjUAueXb1NdeDwrry12Qm7CadpVvpsQEa7pCPmc9TV+iivoYQjBcsVZEhRRRVAFFFFADZI0lQpIoZSOQa5HW/D5tQ1zaAmLqyd1+ntXYUhAIIIyDWFfDwrRtLcE7Hl9FbPiDSvsFz5sQ/cSHj/ZPpWNXzlWnKnNwl0LCiiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACGkpqutKJVzDCPMcevoPzrArt/hyy/ab1f49gI+ma2oRUqiTA9AAAGAAAKWiivaAK4zxhpyxSx3sa4Eh2vj17Guzrn/GDKNGAPUyDFTNXiJnB0UUVzCCiiigAooooAKKKKACiiigAooooAKKKKACit/TfCl3exrLOwt4zyMjLH8K1j4KtduBdS7vXAxVqEmFjzq+g2nzVHB61TrtdX8L3VjEzjE8HdlHI+orjJEMchQ9Qa8/EU+SV+40NooornGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFXtN0e+1aXZZ27OB1c8KPqaaTbsgKNFehab8PYEAfUbhpG7xxcL+fU/pXTWeh6ZYgfZ7KFCP4iuW/M811Qwc5b6AePRWN3OMw2s0n+5GT/KrH9iaqRn+zLz/vy3+Fe04A6CitlgV1YHiEmnX0IzLZXEY/24mH9KrV7xgVUutLsL4EXNpDL7sgz+dKWB7SA8Sor0nUfAFhOC1lK9s/ZT8y/rz+tcZq3hzUtHJNxDui7Sx8r/APW/GuWph6lPVrQDJooorEArW0nQptR/eOfLgz97HJ+lQaPp51HUEiP+rHzOfavQI0WNFRFCqowAO1ejgsIqvvz2E2UbbRLC1UbYFZv7z8mrRtbcrgwR4/3RU1Fe1GnCKskSZF54dsbpSUTyX7Mn+FcjqOmz6bNslGVP3XHQ16LVW/so7+0eCQdfun0PrXJicDCpG8FZjTPOKKfPC9vO8Mgw6MVNMr59qzsygooooAKKKKAOk8KWIkmku3HCfKn1rrazdBgEGjwDHLDcfxrSr6XCU1ToxXzIYUUUV0gFFFFABRRRQAUUUUAVNSs1vrCWBupGVPoe1edMpRirDBBwRXqFef67ALfWJ1AwGO4fjXk5pT0VReg4mdRRRXjlBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUVdtNIvb3Bigbb/ebgVsweEXIBuLgL7IK3p4WrU1jELnM0V2ieFbBR87SP/wACxUv/AAjOmf8APN/++zXSstrPsK6OGortJPCtgw+RpE/4FmqM/hFwCYLgH2cVEsvrx6XC6OZoq7d6Re2eTLA23+8vIqlXJKEou0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVreHNUbSNZinwTGx2SAdwayas2Sbp89lGaunfnVgPbIZo54llicMjDII70+vM9O1m90w4gkyh6o3INbS+NptvzWiFvZjivZVRdRXOyJAGScAVwPijVlv7tYIWzDDnnszVBqPiS+1BDGWEUR6rHxn6msionO+iE2FFFFZgFFFFABRRRQAUUUUAFFFFABRRRQAV0PhTTEvLxriVd0cPQHoWrnq7jwZt/syXH3vM5q4K8gR0lFFFdBQEBgQRkHqDXlnjPSV07UxJEuIpRkD0r1OuN8fIr21uv8AHyRWGJhzU2B5zRRRXjAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRS7W2btp25xntmkoAKKKKACiiigAooooAKKKKACiiigAooooAKACTgDJNA5OBXofhHwosCJqN/GDKeYo2H3fc+9aUqUqkrICh4d8ENchLvVAyRHlYehb6+legQW8NrCsMEaxxrwFUYAqSivXpUY01aIBRRRWoBRRRQAUUUUAFIyq6lWUMpGCD0NLRQBxXiHwPFOr3OlARy9TB/C309K8+likhlaKVGR1OGVhgg17tXN+J/DEWsQGeBQl6g4P98ehrhxGFT96G4HL+EIQLa4mxyzhPyGf610tc94V3RQXVrIpWWOXLKeo4x/Suhr0sFb2EbEPcKKKK6gCiiigDiPFEIi1gsB/rEDf0/pWLW34qlD6uFB/wBXGFP6n+tYlfM4q3tpW7lrYKKKK5wCjvRRQB6VZALYW4HaJf5VPVXTZBLpls4/55gfkMVar6yDvFNEBRRRVAFFFFABRRRQAUUUUAFcV4rUDVlPrEP5mu1rh/E8gfWCB/AgWuDMn+5+Y1uY1FFFeAUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVq6NosmpSb3ylup5b19hV06cqkuWK1Aq2Gm3Ooy7IE4H3nPQV12neHrSyAeQedL/AHmHA+grTt7eK1hWKFAiL0AqWvdw+BhS1lqyWxAABgDA9qWiiu4QUUUUAFFFFACEAjBGR71kah4etL0F4x5Mv95RwfqK2KKipThUVpq4HnN/ptzp0uydOD0cdDVSvTLi3iuoWimQOjdQa4jWdFk02TemXt2PDensa8TF4F0vehqvyKTMqiiivPGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFX9PX5Hb1OKoVp2QxbD3JrbDq8xMs0UUV3iCiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACuqLZXrQSttimwMnoG7VgUU07O4HrnUZorz/AE3xTeWKCKQCeIdAxwR+Nax8bQ7eLOTd6Fhit1Uix3OpZgqlmIAHJJrzrxFqS6lqRMZzDGNqH19TS6n4jvNSUx8QwnqiHr9TWRWc530QmzFddsjL6HFNqW5GLl/rUVePJWbRQUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdFG80qxoMsxwB702um8LabuZr6ReB8sefXua2oUXWqKCBmm2hxHQ/sQA8wDcG/264h42jkMbAhlOCD616fXJ+JtO8u4S+jX5XIEmOx9a9PH4VcinBbfkSmUV8L6y6BlsJCGGQcVlSRvDI0cg2upwQexr2C213SltIVN/ACEUEb/avJ9SdZNTuXRgytIxBHfmvPr0oQScXcoq0UUVzAFFFFABRRRQAUUUUAFFFT2VpJfXsNtEMvIwUUJXdkB0/grw+L+5/tC5TNvCfkU9Hb/wCtXpVVrCyi0+xhtYRhI1A+p7mrNe1QpKnCwBRRRWwBRRRQAUUUUAFFFFABRRRQAUUUUAc5renra3Y1aFcAjZcgd17N+H8qiBDAEHIPQiumdFkjZHGVYYIPcV53c3snhzVpNPuQz2md0Ld1U0QrRou0tn+DE0b9FVre/tbpA0M6NntnmrBIAyTgV2qSaumSLUN1cx2ds88pwqDP19qrXmsWVkpMkys3ZV5Jrj9W1ibU5OfkhX7qD+tcmJxkKMbJ3Y0rlO6uHu7qSd/vOxNQ0UV88227soKKKKQBRRRQB2vhe6E2mGEn5omx+B/ya3K4DQ9Q/s/UFZj+6f5X/wAa74EMAQcg9DX0OArKpSS6rQli0UUV2iCiiigAooooAKKKKAEZgqlj0Aya83v7j7VfzT9nc4+naut8S6iLWyNujfvZhj6L3riq8XM6yclTXQqIUUUV5YwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAp0cTzSBI0Z2PQAZqS1tpLy5SCIZdzj6V3um6XBpsIWNQZD95yOSa68LhJV3fZCbscrB4Y1CVQzhIx6Meakk8KXyLlHjf2ziu0or1FltG1tRXZ5rc2dxZvsuImQ9s9DUFel3FtDdQmKZA6Hsa4XWNLfTLrby0L8o39K87FYJ0VzR1Q07mdRRRXCMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVVLsFUZZjgAd6AL2kaY+p3Yj5ES8yN6Cu+hhjt4ViiUKijAAqrpOnrp1ikWB5h+aQ+pq9X0WDwyowu93uQ3cKKKK7ACiiigAooooAKKKKACiiigAqOaGO4haKVQyMMEGpKKGr6MDz3V9MfTLwx8mJuY29RVCvQ9W09dRsXiwPMHzIfQ156ysjlWGGU4IPY187jcP7GemzKTEooorjGFFFFABRRRQAUUUUAFFFFABRRRQAVqWf8Ax7J+P86y607I5th7E1vh/jEyzRRRXcIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAMq7/AOPp6gqW5Obl/rUVeZP4mUFFFFSAUUUUAFFFFAGvaeHLy8tUuI5IQjjIDMc/yqf/AIRK/wD+etv/AN9H/Cui0H/kCWv+6f5mtGvcpYCjKCk+qJucZ/wiV/8A89bf/vo/4Vnalpc+lvGk7RsXBI2En+leiVyXi/8A4+bX/cb+YrLF4KlSpOcdwTOboooryCgooooAKKKKACigDJwKCCpwQQR1BoAsWNo99eR26dWPJ9B616JBCltAkMYwiDAFY3hnTfs1qbqRf3so4z2Wt6vfy/D+zp873ZLYVFc26XVtJBIMq4walorvaTVmI81vLV7O7kgkHzIcfX3qCuw8T6b59uLyNf3kXD47rXH18ziaDo1HHp0LTuFFFFc4BRRRQAUUUUAFFFFABXZ/D7TxLfTXzjIhXav1P/1q4yvVvBNqLbw5E+PmmYuf5f0rpwkOap6AdFRRVuCxeX5n+Vf1r1pSUdWBUAJOBU8dnNJ0TA9TWpHbxQj5VGfWpa55V+xVjOXTW/ikA+lPGmJ3kb8qvUVHtZ9wsUTpq9pD+VRtprj7rg1pUUKrPuFjFktpo/vIceoqGugqCW0il6rg+orSNfuKxjUVYntJIefvL6iq9bppq6EFFFFMArjviBp4m06K+UfPC21j/sn/AOvXY1R1m1F5o13ARndGcfWs60OeDQHiysynKkg+xp5nmIwZZMf7xqOivETaADyeaKKKQBRRRQAUUUUAFFFFABXU+HdbG1bK5bBHEbn+RrlqM4PFbUK8qM+aINHqNFcfpXiV7cLDeZkjHAcdR/jXVW93Bdx74JVdfY9K+goYmnWXuvXsQ1YmoooroAKKKQkAZJwPU0ALVTUNQh062Msp5/hXuxqhqPiK1tAUhImm9AeB9TXIXl7PfTmWdyzHoOw+lcGKx0aa5YasaQl5dy3ty88pyzHp6D0qCiivBbcndlBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6rwjaDy57thyT5a+3c/0rp6xPCxB0YY7SNn9K26+lwcVGhGxD3CiiiukArM160F1pE3HzxjzFP06/pmtOoLwgWU5boI2z+VRVipQcX2A81ooor5QsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK2/DFkLjUTOwykAz/wI9P61iV3Hhi28nSFkI+aZix+nQfyrswNL2lZX6aiZs0UUV9ESFFFFABRRRQAUUUUAFFFFABRRRQAUUVZ0+IS3iKeg5pN2VwL9lpi7BJOMk9F9KpapYxQXG9IkCyc8L3710NUtVi8yyLd0INcsajc7sprQ46+0SyvUOYljk7Ogwf8A69cTf2Mun3TQSjkdD2Ir0iuf8V26vYJPj5o2xn2NY47CwlTdSKs0JM46iiivCKCiiigAooooAKKKKACiiigAq/p7fI6+hzVCrNk+2fHZhitKLtNAzTooor0SQooooAKKt2WmXN9kxJ8o/ibgVZuNAvIIy4CyAdQvWrUJNXSEZdFBGDg9aKgYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUlLUVy+yBz7YFKTsrgZTtukZvU5ptFFeWUFFFFABRRRQAUUUUAegaD/yBLX/AHT/ADNaNYui6hZw6RbxyXUKOFOVaQAjk1f/ALU0/wD5/bf/AL+ivpqNSCpx1WyIZbrkvF//AB82v+438xXRf2pp/wDz+2//AH9Fcx4puYLme3ME0coCnJRgcflWGPnF0Gk+w1uYFFFFeAUFFFFABRRRQBZ0+7+w30Vz5YfYc7T34xWrEP8AhItdEvk+XCoG8ZzkD1+tYIBJAAyT2rvtE04afYKrD96/zOff0rvwUJVXyP4VqxM0gAoAAwB0paKK98kKKKKAEZQ6lWGQRgg9xXn2saedOv3jA/dt8yH2r0KsvXtO/tCwbaP30fzJ7+orjxuH9rTut0NM4KigjBxRXzpQUUUUAFFFFABRR16VZg069uf9VbSsPXbx+dOMXJ2SArV7VokPl6NZRqP+WS4H1Ga8ui8MalIRlET/AHm/wr3bRNFe3062MrLvESjjtwK7aClQvKorXBajLWyWMB5BlvT0q5Vv7Cf+en6UfYT/AHx+VOVVSd2y7FSirJsn7MppjWso/hz9DS549wIaKcyMvVSPwptUAUUUUAFFFFAAQCMGs67ssZkiHHda0aKqMnF3QHP0VfvrXbmVBx3FUK7IyUldEBSOu5GX1BFLRVAeHXqeXf3Cf3ZWH61BVvVDnVrzH/PZ/wCZqpXgPdgFFFFIAooooAKKKKACiiigAooooAKfFNJC4eKRkYd1OKZRQnbVAa8HiXUYRgyLIP8AbH9atDxddY5t4T+f+Nc9RXRHF1o6KTCxuyeK75xhEiT3Az/Os251O8u/9dcOw/u5wPyqpRUzxFWekpMLBRRRWIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAdL4TvVSWWzc43/On17/AOfausrzCOR4pFkjYq6nII7Gu10nxBBeosc7COcDnPAb6V7OX4qPL7Kb16EtG1RRRXqiCsfxJei10t4gf3k3yAe3erWoara6fGWlcF+yDqf8K4bUL+XUbpp5T7Ko6KPSuDHYqNODhF6saRVooorwCgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr0mxi8mwt4v7saj9K82AyQK9QAwMV62VLWT9CZC0UUV7AgooooAKKKKACiiigAooooAKKKKACrWnyCK9QnoeKq0Dg5pNXVgOsqO4TfbyL6qRVGy1NHQRznaw43djWiGVlyCCPauFxcXqXucpWB4ruFTT0gz80j5x7CtG+1ezsUYySqzjoinJNcPqN/LqN0ZpOB0VfQUsdiYxpuCerJSKlFFFeCUFFFFABRT/Jl/wCeb/8AfJo8mX/nm/8A3yafK+wDKKf5Mv8Azzf/AL5NNKlThgQfQihpoBKKKKQBSqxVgw6g5pKKANpGDorDoRmnVRsJsgxE+4q9XpU5c0bkhSqNzAepxSUVYHfWsKQW0caDChRUtZWl6tDc26JI4SVRgg8Zq7Pe29vGXklUAdgck16UZRcboRy+vQJBqTbBgOA2PesyrOoXZvbx5iMA8AegqtXnzacm0AUUUVIwooooAKKKKACiiigAooooAKKKKACqGoScrGPqauuwRCx6CseRzJIXPUmufETtHl7ghtFFFcRQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFPghe4nSGMZdzgChK7sgNrw1pv2q7+0yL+6hPGe7V2lVrCzSxs47dP4RyfU9zVmvpsLQ9jTUevUhsKKKK6ACiiigAooooA4nxJpv2S98+NcRTc8dj3FYlejajZJf2UkDdSMqfQ9q88lieGV4pBhkOCDXz+Pw/sqnMtmUmMoqzZWFzfy7LeMt6t2H1NdXp/hm2tsPc4nl9CPlH4d6yoYWpW+FadxtnL2el3l8f3ELFf75GF/Ot+08JRrhruYsf7qcD866VVCqFUAAdABQzBVJYgAdya9all1KGstWTcq22l2VoB5Nsin1IyfzNW6yrrxDp9tkeb5rDtHz+vSsmXxZNI4S1tVBJwC7ZJ/CtZYnD0vdTXyFZndaXa+dN5jD5E/U16RZNvsom/wBmvK7S8u4rONGlw2MttGOa6/w7eyT6eUeRi0bY5PaufG0pTipFwfQ6yisne394/nRvYfxH86832XmaXNaissTSDpIfzqRbuUdSD9RS9kwuaFRPbxP1XB9RxUK3o/iT8qnSeN+jDPoanllECs9kRyjZ9jVdkZDhlINatIyqwwwBHvVKo1uFjJoq5LZ94z+BqoylThhg1rGSewhKKKKoBCAwIPINY1zD5ExX+E8itqqt9F5kG4feXmtKUuWQmZNMlbZC7eik0+srxJeCy0C7lzhthVfqeBXVJ8qbJPIbmTzbqaT++7N+ZqKiivBAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo6UUUAXINVvrddsVzIF9M8U+TWtRlXa11Jj2OKoUVoqtRK3MwFZmdtzEknuaSiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr09GDxq46MAa8wr0TSJvtGkWr5yfLCn6jg/wAq9XK5e9KIpF2iiivZJCiiigAooooAKKKKACiiigAooooAKKKKACkeQxxs2ThQTS1S1eb7PpN1JnB8sqPqeB/OpnLli5dgPOySTknJooor5MsKKKKACiiigDaX7o+lOpq/dH0p1eqtiArKvf8Aj6b6CtWsq9/4+m+grnxPwFIgop8MMlxMsUSlnY4AFdXY+FYEQNeOzueqqcAVjRw1Ss/cQ2zkaK7t/DmmMuBAUPqrnP61z+reHpLBDPAxlhHXPVa1q4GtTjzbryFcxUco4ZeoNa8UgljDj8R6Vj1NbTmB+funqKxo1OR2ewNGtRSKwZQQcg0td4goJJ6kmiigAooooAKKKKACiiigAooooAKKKKACiiigAooqtdXHlLtXlyPypSkoq7Agvp9x8pTwOtU6OvWivNnNyd2UFFFFSAVv6Foi39rPPOCFYFIj7/3vw/xrIsbR768jt4+rnk+g7mvRYIUtoEhiGEQbQK9DAYZVZOclohNnm08D207wyjDoxUio66rxVpu5Vv415XCy49Ox/p+VcrXNiKLo1HBjTCiiisACiiigAooooAKKKKACiiigArqfC2m4BvpF5Pyx5/U1gadZPf3scC5wTlj6DvXpNlZMyLBbp8qKB6ACvSy+hzS9rLZfmJjaKlntpbZgsq4z0PY1FXuJp6okKKKVVZ2CqCSewoASitO30S4lAMhEY9+tXo9Ct1Hzs7H64rKVaC6jsznqK6b+xbP+63/fVQyaDC3+rkZT781KxEA5Wc/WbqPhQXlwl/JlIjw6jq3oa7WDw5LbfvZgJMdAO31qeSNZEaNxwRgisqtSnVXLuhpM5CC3itohFDGEQdgKe8iRoXkYKo5JJwBVXW9Rg0V2jlO+b+FB1Pv7Vw+oardajJmZyE7RqeBSr42nRXLHV9hJHRah4qhizHZp5rf324Uf41zV3qV3fMTPMzD+6OAPwqrRXjVsVVq/E9OxVgrU8P232nV4gRlU+c/hWfBF50uzOOK63wppwSS4l3Z4CiqwlJzqRb2E2dBWx4du/Iv/ACmOFlGPx7VnfZ/9qnJCUcMr4IORX0FRKcXFkp2O+oqtYXQu7VJM/N0b61ZrxmmnZmwUUUUgCiiigCWO4kj6HI9DVuK6STg/K3oaz6KiUEwNemSRJKMMOfWqUNy0fDfMv8qvI6yLuU5FYuLiMz5oGhPPK+tRVrEBgQRkGqNxbmP5l5X+VaQqX0YWK9BAIIPQ0UVqIwpU2Ssvoa4D4hakMQacjc/6yT+ld9rdzFp6zXUzbY0XcTXh+pX0mpajNdy/ekbIHoOwqsVVtTUerIKtFFFeaAUUUUAFFFFABRRUkVtPcNthhkkPoik0AR0Ve/sTVcZ/s28x6+S3+FVprae3OJoZIz6OpFNxa3QEVFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK67wldb7Wa1J+aNty/Q//AF/51yNXtIvvsGoxTE/Jna/0NdGEq+yqqT2BnodFICGAIOQRkEUtfTEBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeLbrZaw2oPzSNub6D/AOv/ACruLfQLq4tknV4wrDIya8x8ULMmv3EUxBMeFXb0x2rz8diIqk4xer0GkY9FFFeCUFFFFABRRRQBtL90fSnVjedL/wA9H/76NHnS/wDPR/8Avo11/WV2FY2ayr3/AI+m+gqPzpf+ej/99GmlixyxJPqTWdWspxtYEjqvCdmoiku2GWJ2r7DvXTVh+FpFbSdg6o5z+Nble9g4pUI2Je4UjKHUqwyCMEHvS0V0gedaraiy1KaEfdByv0qnWr4jkWTWpdp+6Ap+orKr5aslGpJLa5aLFtcmE7W5Q/pWkrB1DKcg1i1LBcPAeOV7g1VKty6PYTRr0VFFOkw+U89wetS12ppq6EFFFFMAooooAKKKKACiiigAooooAKKKTrQBBc3KwjA5c9vStjw9pSyWktzdLuNwCqg/3fWqum6THf3qxlMr9529q7lbeJECKgVQMADsK1w1Fynzz2WwHlt/ZvYXslu/8J+U+o7Gn2CK3mblB6dRXZeJNEW9tPtEXEsI/Ne9cpawNAXDYIOMEVyTwzpVtNh30JvKj/uL+VHlR/3F/Kn1e0mxN9eqjD90vzP9PT8a2ULuyRJraJpqW1i100aiSUDHHRf/AK9aNWpgBCQBgCqterSioRsgGSRpNE0ci7kcFSD3FeealYvp99JbtkgHKn1Xsa9GrF8R6b9ssfOjXM0IyMd17j+tcuPw/tafMt0NM4iiiivnygooooAKKKKACiiigAooooAtWWoXOnszWzhS3BJUH+ddR4e8XTRmWG8uVQsQVcoAPoeK42it6WInTas9O3QLHaeIfF0sixw2dyrsG3M4QEfTpWD/AMJLqn/Pcf8Aftf8KyamtLWS8uo7eIZdzgVUsVWnL3Xa/RBY3dM1DXNUuRFDMAo+85jXCj8q7yxaWyiAEgeTHLlBk/pVPTNOh0yzSCIc/wATd2NXK9mhSlGP7xtsi5b/ALSuv+eg/wC+RR/aV1/z0H/fIqpRWvJHsF2W/wC0rr/noP8AvkVq2D3IUSzP8x+6u0cVn6daea3nSD5B0Hqa2K56rj8KRSLH2yf+/wDoKwtdvJ2hdLOVUu8cMVBA+tT3975IMUZ/eHqfSsYkk5PWlSordg2eYazcahPeldROZ04yVAJ/LrWdXo3iHRl1OzLxqBcxjKn19q86ZSrFSMEHBFeXi6Mqc9Xe4ISiiiuUZZsf+PkfQ13Xhgf6HMf9v+lcLY/8fI+hruvDDf6JMvo+f0r1MASzcooor1RF7TL42VxzzE3DD+tdUrK6hlOVPIIrh61NL1Q2pEMxJhPQ/wB2uXEUeb3o7lRlbQ6WikVldQykFT0Ipa4DQKKKKACiiigAp8cjRtlTTKKLXA04pllXI4I6ipCMjB6VlI5jYMpwRWjDKJUyOvcVzzhbVDKlxB5Z3L90/pVetZgGUhuneuL8Ram0DG0tidrDmQenoK3w8ZVXyoT0OF+JmstcXcNjA37hV3OR/E2a8/roPFrZ1CEekf8AU1z9YYpctVx7EXuFFFFc4BRRRQAVpaPoV7rU+y2jwgPzytwq1P4c0CXXb7ZylvHzK47D0HvXrFpaQWNslvbRiOJBgAV1YfDOp70tgMHS/BOl2Cq06fa5h1aQfL+C/wCOa6OOKOFAkSKijoqjAFOor04U4wVooAprxpKhSRFdT1DDINOoqwOd1TwXpWoKzRR/ZZj0aIcfivT8sV59rPh++0SXFwm6Jj8sqfdP+Br2Oorm2hvLd4LiNZInGGVq5quFhNXWjA8Morc8TeHpNDvPky9rIcxue3sfesOvKlFxfKwCiiipAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAfDBLcOUiQuwUsQPQDJpldp4Z037LZ/aZF/ezDjPZe359fyrA1/Tf7PvyUXEEuWT29RXXUwkoUVVfX+kK+plUUUVyDCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDsPDOqieAWUrfvIx8hPdfT8K6GvMYpXglWWNirqcgiu70jVo9Tt+SFnUfOn9RXuYDFKcfZy3RLRp0UUV6QgooooAKKKKACiiigAorTtNBvLpQ5AiQ9C/U/hVxvC0wXK3KE+hXFZOvTTs2OzMCirN5p9zYtiePAPRhyDWJq+rR6ZbnkNOw+RP6mqlVhGHO3oI6SfxnpWl2MNjLJJ5wX5wq5wK8w8RX0Opa3PdW5YxPjGRg9KzppXnlaWRizsckmmV83Wr+0uktL3LCiiisACilVSzBVBJPQDvVkaZfEAiznx/1zNNJvYCrRVv+y7//AJ8rj/v2aa+n3salntZlUdyhFHK+wFaiiikAUUUUAamiar/Zt18+TC/Dgdveu5hmjnjEkTh0PIINeZVPb3lzaHMEzx+wPB/Cu/C450VyyV0Jq56VWbq2rw6bAfmDTkfKgP6muQfXdTkXa12+PYAfyFUfnmk5JZ2PUnJNdFXM01amtRWJ44nvHllY/Mec+pqsQQSD1FbMUYijCDt39ao30O1xIBw3X61wVKNoc3XqNMqUUUVzjAEqcg4I7irkV8y8SDcPUdap0VUZyjsBtg5AI6Glpsf+rX6U6vTRAUUUUDCiiigAopD0qGB5ZcswCrngDvScrOwE9FFFMAoorV0Kw+13nmOMxRcn3PYVUYuTshG5oth9isgzjEsnzN7DsK0qKK9GMVFWQARkYNcXq9j9hvWCj90/zJ/hXaVS1WxF9ZMgH7xfmQ+/pWdWHPEDiepwK7TSLH7DZKrD96/zP9fT8Kw9A08z3ZnkX5IT0I6t/wDWrq9pY4XqelZ4eFveYEc3+qNQxQyTNiNCx9q1oNNdhm6x/uitBI0jXaihR6AVs6yjohpGRFo8jcyuF9hyatJpFsv3tzfU1forJ1ZvqOyON1DwvpltckraLsf5h8x49R1qk3h/S2H/AB6gfRj/AI1295bC6t2T+IcqfeubIIJBGCOoq6VOlKOsV9wmYM3hSycfupJYz9cism68K3kILQMsy+g4NdpRSqYGhPpb0C7PMZYZYHKSxsjDswxTK9KurO3vI9lxErj36j6GuT1Xw3LaBprXMsI5I/iX/GvLxGAnT96OqGmYNFFFcAwooooAKKKKACux8GaeAkt+45J2J9O5rjq9R0a3FrpFrFjBCAn6nrXdl9Pmqcz6CZeooor2yQqa2gNxOqDp3PoKhrc0638m33EfO/P4VnUnyxGlctIiogVRgDgCoLy6FtFkffPCirDMEUsxwBya566nNzOXPToB6CuenDmepTdiJmLsWY5J6mkoorsICvP/ABZp4tNT85BiOcbvoe9egVz/AIwtxLo4lx80Tg59j1/pXLjKfPSflqNHC2tu93dw20eN8rhFz6k4r0mLwDpC2gjkMzzY5lD4OfYdK81t53tbmK4iIEkTh1J9Qc16NF8QdMNoHlhuFnA5jVQRn2OeleXhvZa+0KOLudOfSddnsnbcYujeoIyD+RFdJ4YlxNPEe4BFczPqEmq63NeyqFaXnaOwAwB+QFa2kXH2fUomJwrHafxrowrSd1tclna0UUV6wgooooAu2OpTWTYHzxnqh/pXR2t/BeL+7f5u6nrXH0oJU5UkEdxWFWhGeuzGpWO4orlY9eurUKHxKvo3X860IPE1nJxKkkR+mRXJLDVFsrlqSNqiqSatYSD5bqP/AIEdv86l+3Wf/P3B/wB/B/jWThJbod0WKKqPqljH967i/Bs/yqnN4jsYx8heU/7K4H61SpTeyC6Neo5dQh04ebNIFHp3P4Vy914lupQVgRYV9eprHklkmcvI7Ox6ljmuiGClL4yXPsdvcayb+IeQSsLfmfrWVeWwuoCn8XVT71laXdeVL5Ln5HPHsa23YIjOegGav2XsXaIXueNeJZC2tzIf+WeEI9x1rIrpvF9kTdf2gg4lOJPr2NczXkYqMo1pcwIKKKK5wCnRxtLIkaLud2CqB3JptdD4KsheeI4mYZWBTIfr0H86qEeaSiB6LoWlR6PpUVqgG/G6Rv7zHrWlRRXuxioqyAKKKKYBRRRQAUUUUAUdY0yLVtMltJAMsMox/hbsa8Ynhe3nkhkXa8bFWB7EV7rXlvjqyFr4gMqjC3CCT8eh/lmuHG0/dUwOZooorzQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKnsvs/2uM3RIhBywAyT7VBRTTs7gdsPFGmgYBlA/3KpatrOl6lYPDmQSD5oyU6NXLUV2zzCrOLjJKzFYKKKK4RhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVJBPLbTLLC5R1PBFR0U02ndAdvpPiCG+URTkRT+/RvpW1Xl2SDkVs6f4jurMBJf30Q7N1H0Neth8x+zV+8lo7iisyz16wuwAJfLc/wvxWkrKwypBHqDXqQqRmrxdxC0UUVYBW94e01Z3N1KuUQ4UHuawa7bRAqaRARgZBJ+tc2Km409Oo4q7NGioJLyGP+LcfQVQmvpJchflX9a86NOUjS5Y1CWF4HgZQ5YY+leE+IbS4stauIbh2ds5Vj3XtXslec/ERFXU7Vx95ojn8DU4qnal6CONooorzRBRRRQBp+Hv8AkYtP/wCu6/zr2WvGvD3/ACMWn/8AXdf517LXpYH4GAVXv/8AkHXP/XJ/5GrFV7//AJB1z/1yf+RrtlsB4g33j9aSlb7x+tJXgAFFFFABRRRQAVesYesrD2WqkMRmlCDv1PoK2FUKoUDAA4row8LvmYmxaZIgkQo3Q0+iu1q4jFdDG5RuoptaF9DuQSqOR1+lZ9ebUhySsUgoooqANqP/AFa/SnU2P/Vr9KdXqLYgKKKKYwooooASjoMClooAKKKKAFRGkkVEGWY4AHeu5sLNbGzSEdRyx9T3rh45HikDxsVYdCO1WP7Tvf8An5k/OtaVSMNWI7miuG/tO9/5+ZPzo/tO9/5+ZPzrf6zHsB3NFcN/ad7/AM/Mn50f2ne/8/Mn50fWY9gOi1Oa9spY/sccZjlPTbzv/wDr1rafNdW8QeYxtMRzheB9KztIhuBbCW6lZ3fkK38IrSrSMb6vr0Asy6lclcjZkf7NV/7Xuv8AY/75pKqSrskI7dq0jCPYLsuf2vdf7H/fNH9r3X+x/wB81Qoq/Zx7Bdl/+17r/Y/75qnLK00rSMAGbk4plFNRS2QBRRRTAKKKKAOb13QFlVrq0XEg5eMd/cVyRGDg16jXJeJdIETG9gXCMf3ijsfWvIx+DVvaw+Y0zm6KKK8goKKKKAAdRXrkQxCgHTaK8jr1exlE9hBKDkPGD+leplr1kvQUixRRRXqklizh8+5VT90cn6V0FZ2kxbYWlPVjgfStAkAEnoK5KsrysWtjO1W42oIVPLct9KyaluJTPO8h7nj6VFXRCPLGxDdwoooqwCsrxIAfD93n+6P5itWsXxVMItBmBP8ArCFH55/pWVZ2py9GCPOqKKK+bLLNj/x8j6GtMcHIrMsf+PkfQ1p13Yb4CWdtpd2LyxjfPzAbW+tXa47Rb/7Fd7XP7qThvY+tdiCCMjkV61KfNEQUUUVqAUUUUAQ3H3R9ar1YuPuj61XrSOwBRRRTAKswafd3IzFA7D1xxWroOkLcD7XcLmMH5FPf3rqAAoAAAA7CuOtilB8sdSlG5w0ukX0K7mt3wOpHNUiCDgjBr0esjWNHju4WmhULOozx/F7VNPGXdpobj2OPHByK07jUBLpyoD+8bhqyJ5kt4XllO1UGSTXM6TrT3GvSCQ4jnG1R6Y6VtWqwjOMZbtkI6K9tVvbOW3fo64z6HtXnEkbRStG4wynBFen1xPii0+z6n5qjCTLu/HvXHmdK8VUXQcTEooorxSgrtvhygN3fv3VEA/En/CuJrs/h1MF1G8hPV4ww/A//AF63w38VAei0UUV7IBRRRQAUUUUAFFFFABXBfEdADp8nc71/LH+Nd7Xn/wARpgZ7GHuqs/5nH9K58X/CYHD0UUV44BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBseGdJh1nVfss7sqbC2V68V2P/AAr3Tv8An4n/AErnvAX/ACMf/bFq9Qr0cLRhOneSA5A/D3TgP+Pif9K86uYxDdSxKchHZRn2Ne6HofpXh19/yELn/rq38zWeMpwglyoCCiiiuIAooooAKKKKACiiigAooooAKnhvLmA5inkT6GoKKabWqA1I/EOpRj/X7v8AeGal/wCEo1LH34/++BWNRWqxNZfaf3hY1JPEOpSD/X7f90Yrt/A+uve2UljcTM08Z3LuPJU15pU1pdzWVylxbyFJUOQRVQxM1NSk2wPcqK4zS/H9rLGqajG0Ug6ugyp/DtWpJ4z0NE3C7Ln+6qHP616Ua9Nq9wN4kAEkgAc15L4t1RdT1yRojmKIeWp9cdTWhr/jabUImtrFGggbhnJ+Zh/SuSrixWIU/djsAUUUVxAFFFFAF7RZ47bWrOeZtsccqszegr1MeKdEIz/aMP45rx6it6OIlSVkgPYf+Eo0T/oIw/mar33ifRWsZ0XUImZo2UAZOSRXk1FavGzfRAKeWP1pKKK4wCiiigAooqe1h86bn7q8mnGLk7IC3ZQ+XFvI+Zv0FWqKK9OMVFWRIUUUUwEIBBB6GsieIwyle3UfStiq93D5sWQPmXkVjWp80dN0CMuiiiuAo2o/9Wv0p1V0uoQgBfnHpS/a4f7/AOlekpxtuST0VB9rh/v/AKUfa4f7/wClP2ke4E9FQfa4f7/6U5LiJ2Cq2SaOePcCWiiiqAKKKKACiiigAooooAK0dFsvtl6CwzHH8zf0FZ1dhoVr9n05WI+aT5j/AErWjDmkI0+lFFFd4BUFwOFP4VPUc4/dGmtwKtFFFaAFFFFABRRRQAUUUUAFMliSeJ4pBlHGCKfRQ1fQDzjULNrG9kgb+E8H1HaqtdX4stN0UV2o5U7G/pXKV8ziqXsqrj0LQUUUVzgFd/4RvRcaT5BPzwHb+HauArT0LUzpeorIT+6f5ZB7etdOEq+yqpvZiZ6ZRTUdZEV0IKsMgirFqnmXUa+rV77dlck3oI/KgRPQCodQl8q0bHVvlFWqytXf5o4/bca44LmmW9jMooortICiiigArjfGt6Gkgs1P3fnf69q6q9vIrC0kuJThUH5n0ry+9upL28luJD8ztn6VwY+sow5FuxogoopUUu4VepNeKUWLH/j5H0NadV2i8mFTGMsg/P1qr9vk/urXbGSorlkTuaVdHoerAhbS4bkfcY9/auK+3yf3VoGoSg5AGa0hi4wd0Fj1WiuP0fxYTtt73A7LJ/jXTLcllDLtIPQivUo1Y1o3gxWLVFVvtDego+0N6CtuVgPuPuj61Xp7yFwAaZVJWQBRRRTA9As4hDZQxr0VAP0qeqWlXK3WmwuDyFCt9RV2vDmmpNM1WwUEgDJ6UjMqLuY4ArJvtQXy3O7ZCgJZj6CiMHIGzyjxvqJfW7qxh+WCOQk47k8/1rmIZWhmSVDhkIYVY1W8/tDVbq7HSWQsvsM8fpVSuKrUlOfM2SemwSrPBHKv3XUMPxrH8U2/m6WJQPmicH8Dwf6VL4bn8/RowTzGxQ/z/rV7UIftGn3EWMlkOPrX0Ev3+H9URszzeiiivmiwrX8MX407xBbSscRsfLf6H/6+KyKKqMnFpoD3jqKK53whri6tpiwyv/pUACuD1Ydmroq9yE1OKkgCiiiqAKKKKACiiigAryPxdqA1DxDOyHMcX7pfw6/rmu+8Va4uj6WwRv8ASpgVjA6j1b8K8lJJJJ6mvPxtTaCAKKKK88AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooqSCCW5lEcMbO57Cmk27ICOiuht/CdzIoM8yR/7IGTU7+EPl+S6591rpWCrtX5RXRy9FaV9od7YAu6b4x/GnOPrWbXPOEoO0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG/4Pv7bTtb8+6lEcflsNx9a7/wD4SzRP+f5K8horopYmVOPKkB66fFmiYP8ApyV5Rdusl7O6nKtIxB9RmoaKVavKra4BRRRWABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW34Xt4LjUX85VYom5FbpnPWsSnRSyQyCSJ2R16MpwRWlGahUUmr2A7HxPa250wzFFWVWARgME+35ZNcZU9ze3N4VNxO8m3puPAqCtMVWjWqc0VYEFFFFc4AATnA6daK7HQ9GjXSZPtKfPdLyO6r2/x/KuVvLWSyu5LeT7yHGfUdjXRVw06UIzfULkFFFFc4BRRRQAVagu1gj2iPJ7nPWqtFVGTi7oC9/aA/wCeZ/76o/tAf88z/wB9VRoq/b1O4rIvf2gP+eZ/76o/tAf88z/31VGij29TuFkXv7QH/PM/99Uf2gP+eZ/76qjRR7ep3CyHSMryFlXaD2ptFFZPXUYUUUUAFFFFABU1pxdJ9T/KoafE2yZG9CKqLtJMDZpwikYZEbEHuBTa9J8PEf2Daf7p/ma9WMeZknmxUqcMCD6EUVseKf8AkPz/AEX+QrHpNWdgCiiikAUUUUAPhj82eOP+8wFd8ihI1UcADFcVpKb9Ut1/2s/pXb114ZaNiCiiiukAqOb/AFRqSorg/IB6mmtwK1FFFaAFFFFABRRRQAUUUUAFFFFAFLVoBcaVcR452Fh+HNed16e670ZT0IxXmUg2yuPRjXjZpH3oyHEbRRRXlFBRRRQB03hzxF9j22d237gn5HP8H/1q9E0krLdK6kMu0kEV4rXcfDi7vJNWa0Vy0OzJVv4RntXo4bFSt7KQrHqkNtLcHEa5Hr2qpfaHLLcljMowAMYzXSwTQLGEX5AO1VJnVp3wQeacK81LTQuyOTudHurdS2BIo7rWfXc1zXiCG3sh9rLpHGTh8nABrso4jmdpEOPYy6iubmG0gaadwiL1JrCv/F1lbArbAzydiOF/OuP1HVbvU5d9xIdo+6g6Cpr42nTVo6sSRa13XJNWuNq5W3Q/Ivr7msiiivGnOU5c0tygq/Yw4BlYdeFqpBEZpQg6dz6CtcAKAAMAdK2w8LvmYmLWVdw+VLkD5W5FatRTxCaIr36j61vVhzxEmZFFBBBIPBFFeeUFaWna3daeQqtvi7o39KzaKuE5QfNF2YHd2XiCyvAAz+VIf4X/AMa1QwYZUgj1Bry+rNvqF3an9zcOvtnivSpZm1pUVxcp6RRXEReKNQj4fy3HuKsr4vuB1toz+JrrWY0Hu7CszrqK5BvF1yR8ttGPxNVZvEuoyjCusY/2RzSlmNBbXYWZ6Lp+rnSZC7MPJb76scfiK2ovGmi3IxBeRmT+6xxivDZrq4uDmaZ3Puairz62MjUldRKV0e233iTT41L3F/CAOihv5CvP/E/jBtUjazsQyWp++54L+3sK5KisamKlKPKtEAUUUVzAdX4QkzDcxejBh/n8K6auQ8Iti8uF9UB/Wuvr6LAO+HiS9zzO5j8q6lj/ALrkfrUVXNWXbq10P+mhqnXz81aTRQUUUVIFrT9QuNMvUurZ9sifkR6H2r1fQvENprluDGwS4UfPCTyPp6ivHqfDNLbyrLDI0cinKspwRW9CvKk/ID3WivOtL+IFzAqx6jB56j/lpHw34jof0rp7XxjolyB/pflN/dlUrj8elelDEU59QN6is7+39Hxn+07T/v8AL/jVO58YaJbKf9MErf3YlLZ/HpWjqQW7A3aytb1600S2LzMGlI+SIHlv8B71yWqfEGaVWj0238kH/lrLy34DoP1rjbi4mupmmnlaSRjksxyTXJVxkUrQ1YFjU9TuNWvnurlsu3QDoo9BVOiivObbd2AUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorT0/w9qmpx+ba2jNH/fYhQfpnrTUXJ2SAzKKuahpN9pbhLy2eLPQnkH6EcVToaadmAUUUUgCiiigAooooAKKKKACiiigAooooAkt4JLm4SCIZdzgV3+m6ZDptuEjALn77nqTXP8AhG2D3M9yw/1ahV+p/wD1V11e3l1BKHtXuyWwooor0xCEAjBGQexrj/EWjLaN9rt1xCxw6j+E/wCFdjUN3brdWksD9HUj6Vz4mgq0Gnv0BM80ooIKsQeoOKK+ZLCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKtXunz2HleeuPNQMPb2+tX/AA5pv22+86Rcwwncc927Cuo1nThqOnvGB+9X5oz7+n413UME6lFz69BN6nn1FKQVJBGCDgg9qSuEYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFamg6d/aF+N4zDF8z+/oPxrMVSzBVBJJwAO9eg6Pp406wSIgeY3zSH3/8ArdK7MDh/bVLvZCbL9c/4o03z7YXka/vIR8+O6/8A1q6CkZQylWAIPBB7171akqsHBknl9FX9Y086dqDxAfum+aM+3/1qoV8vODhJxluiwoooqQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA17eTzIFbvjB+tTiRwMB2A9AazLGba5jJ4bp9a0a9GlPmjclgSWOSST6miiitACiiigAooooAv6Jxq0H1P8AKu0rhtNk8rUrdv8AbA/Piu5rsw3wsQUUUV0AFVp2y+PSp3YIpNUycnJqorqAUUUVYBRRRQAUUUUAFFFFABRRRQAV5lcHNxJ/vGvSZ38uCRz/AAqT+leZudzsfUk15Gav4V6jiJTkjeVwkalmPQAZJptdF4SERu5i2PMC/Ln0715tCl7WooXtcpmLcWN1aqGngdFPcjioUjeQ4VSa9IvYIpdPn88Dy9p61x6qqLhRgV11sCqcrJ6CuZwsZT1wK774XWpi1W+d8ZEK4/OuUrqPAl4LXW2DHCyR7T+dEaEU7rcE9T1SsW4Yi5kwSPmNbQOeRWLdjF1J9a2obstkfmP/AH2/OsLxeok8M3m/naoYZ9c1t1x3j3VEh09dPRsyzEFgOyitKzUabbJPOKKKK8UAooqe0h82XJHyryacYuTsgLlnD5cW4j5m5qzRRXpxioqyJCiiimBn30O1hKo4PX61TradBIhRuhFY8iGOQo3UVw14cr5l1GhtFFW7O3EgZ3GV6CsoRcnZDKlFPljMUhQ9uh9aZSas7MAp8cTythBn3pYIjNIFHTua1URY1CqMCtaVLn1ewmyomnjHzufwp5sIv7zfnVuiutUYLoK5nSWDqMo27271UIIJBGDW5Ve5txMuQMOOnvWNTDq14jTMuigjBwetFcgwooooA6Dwl/yEJv8Arn/WuxrkvCCf6Tcv6IB+tdbX0OXr9wvmS9zzzWf+Qzd/9dDVGreqNv1S6b1kb+dVK8Gq71JerKCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALWm263ep2tu5+SSVVb6E817XFEkMSxRqFRRhQBwBXhkUjwzJLGcOjBlPoRXp2leNtMurZftkv2acD5gwJBPqCK7sHUhG6luBra9ZRX2iXcUqggRs6k9iBkGvGehrv8AxN4ytZbGSy01zI0o2vLggBe4GetcBUYucZSXKAUUUVyAFFFFABRRRQAUUUUAFFFFABRRRQB1nhBgYLpO4ZT+h/wrpa4Tw9fiy1ICQ4jlGxj6Hsa7uvoMvqKVFLsS9woooruEFB6UVma7frY6bIQf3sg2IPr3qak1CLk+gHCTMHnkYdCxI/OmUUV8m9SwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdHG8sixxqWdjgAdzTa6bwrpu52v5F4X5Ys+vc/0rahRdaooIGdBptimn2MduuCQMufVu5q3RRX08YqKUVsiDjfE+m/Z7oXka/u5j82Ozf/AF/8awK9JvbWO9tJLeT7rjGfQ9jXnVxBJa3EkEow6HBrwsww/s5862f5lJkdFFFeeMKKKKACiiigAooooAKKKKACiiigAooooAns7prO6S4WNHZOQHyRn1rY/wCEtvv+eNv/AN8t/jWBRWtOvUpq0HYLG/8A8Jbff88bf/vlv8aP+Etvv+eNv/3y3+NYFFafXK/8zCyNLUdan1SJEnhhBQ5VkByP1rNopQpY4UEn2rGc5VJc0ndgJRTzDIoyUYD6Uypaa3AKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAA4Oa1LW4EyYP3x196y6VHZGDKcEVpTqODBo26Kr290swAbh/T1qxXoRkpK6JCiiimAU6OKSZtsaMx9AKnsbN766WFeB1J9BXZ2tnDZxBIkAx1Pc1rTpOevQRyC6ZfxkSC2fg5FdnCxeCNyCCVBwRT60rNI7u2aFx86/dPeumMVSVw3M2inyxtDKyN1FMrYBkkfmY5ximC3UdSTU1FO7Aj8lPSl8pP7tPoouwI/JT0pDbqehIqWii7Arm3bsc1GyMvUGrlFNSYFGirTQq3sfaoHiZPcetUmmAyiiimBma/cfZ9ImOcM42D8a4Gui8V3okuY7VTxGMt9TXO18/mFXnrWXTQpBUlu8kc6NE7I+eGBwRUdT2Yzcr7VxwV5IZuS3tzPEsc0zOo7E1BRRXqNt7khWloMmzVoh/eBX9P/AK1ZtTWcvkXkMv8AdcGnF2kmI9TsNae3URzgug6EdRUGqa/pkFzmS42FkDYKn/PaqA5Ga5/xPBmOCcDoSprqqU1G847j5mT6p4/tIo2TT42ll7O4wo/xrz+7u5765e4uJC8jnJJqOQYkYe9Nrw6tadR+8UFFFFZAABJwOprXgiEMQXv1P1rIBIOQcEdxT/Ol/wCej/8AfRrWlUUHdoTNmisbzpf+ej/99Gjzpf8Ano//AH0a3+srsFjZorG86X/no/8A30aPOl/56P8A99Gj6yuwWNmqd9DuTzAOV6/SqXnS/wDPR/8Avo0GWQjBkfH+8aideMo2aCwkcZlkVB1NbCIEQKvQVWsYdieYR8zdPpVutaFPljd9RMq3sPmR7wPmX+VZtblZN1D5Mpx908is8RD7SGi5Ypth3d2NWqhtv+PZMelTV0U1aKQgoooqwCiiigDLvE2Tkjo3NV6u6h95PoapV51VWmykFFFFZgdd4Ri22dxL/ek2j8B/9euiYhVJPQDNZ2g2/wBn0eBSMFhvP41Lq8/2fSrmTODsIH1PFfS0F7LDq/RX/Uh7nnsrmSZ5D/Exb86bRRXzW5YUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFdNo3iQRItvek7RwsnoPeuZorWjWnRlzQBo9NininQNFIrg91OakrzFJZIzlHZT7HFPa8uXGGnkI92r01mqtrHX1J5Tur/WrOxQ7pBJJ2RDk/wD1q4rUNQm1G5M0p9lUdFFVM5OT1orixGMnX0eiGlYKKKK5BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUoYgcE/nSUUALub+8fzo3N/eP50lFFwF3N/eP50mc9aKKACiiigAoord0XSFlQXVyuVP3EPf3NaUqUqkuWIGPFa3E4zFDI49QvFLLaXEIzLBIo9SvFdyAFGAAAOwpSARgjI967vqEbbk8x5/RXQazpCLG11bLtxy6Dpj1Fc/XDVpSpy5ZFJhRRRWYBRRRQAUUUUAFFFFACqrOwVVLMegAq5/ZGobN/wBklx/u11uhaTHY2iSugNxINzE/w+wrXr1qOWc0bzdmK55rFbO8xRlK4+9kdK0kjSNcIMCuu1DTI7uzeVUAnUEhgOuO1cpU/VlQdtxXuFVri1WVSyjD+3erNFEoqSswMMjBwetFT3ahblgO/NQV5klZtFBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKADvVqG9dOH+YfrVWiqjJxd0BrJcxSdGwfQ1LkHpWJTg7L0YiuiOJfVCsd54YjG2eT+LIWuhrhfCd+63j2zOf3gyufUV3CqVHJya9fCzU6SaJY6praY286uOnf6VDRW7V1YC/qe1pY5F5DrmqFZX9up/ahtXb9yPlVvQ1rAEjIGRU02rWXQGJRRjHWirAKKKKACiiigAooooAKKKKAIpIQeV4NZuo3iafaSTSdRwo9T2rVd1jQu7BVUZJNcTrt3/a0u0ZEafc/wAazrVnCDtv0A5uaV55nlkOWckk0ynSRtE5Vhg02vm3e+pYVLbNsuEJ6ZxUVFCdncDcoqG3kMsIY9elTV6ad1dEhRRRTA7jTLj7Tp0Mmcnbtb6jim6tb/adMmQDLBdw+o5rK8M3X+ttWPX51/r/AErcnkwNo6nrXoU/3kBHk7HLE+9JWhrdl9h1ORAMRv8AOn0NZ9fOTg4ScXuiwoooqQCiiigAooooAKKKKACpbeHzpQP4RyairVtYfJi5+8eTWtGHPLyBk2MDFLRRXoEhUNzD50RH8Q5FTUUmk1ZgV7QOsO11IIPerFFFEVyqwBRRRTAKKKr3NwIUwD856D0pSkoq7Ap3r758DovFV6CcnJ60V5spczbKCp7K3N3eQwL1dgPw71BXS+E7LdNJeMOE+RPr3rTD0va1VAGdWqhECqMADAFc94tudlnFbA8yNuP0FdFXA6/efbNVkKnKR/Iv4df1r2sfU5KLXfQlblD7PPjPkyY/3TUdevDUtL/svb9pt93k4xkZztryGvFrUlTtZ3uUFFFFYgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAORd8ir/eIFd5GixxqijCqAAK4JWKsGHUHIru4JlngSVDlXUGvRwFveJZJRTlRnJCqTgE8elNr0RCMAylSMgjBFcJPH5VxJH/dYj9a7qSRYomkc4VRkmuDlcyzPIerMTXn4+1ojiNooorzSgooooAKKKKACgHBBoooA9OjdZIkdDlWAIPtT65DRPEK2kQtbvJjH3HHOPY10H9s6ds3fa4sfXmvpaOKp1IJ3syLGrFIqRMWOAoyfpXCE5Yn3qxrHiQTIYLLIQ/ec9x6VmxXsbj5ztb36Vx4jE05z5YvYdi1SVGbiEDPmL+BqpcXm8FI+AeprnnVjFXuFiC4fzJ2YdKioorz27u5QUUUUgCiiigAooooAKKKKACiiigAooooA6/wPpVjqTXf2y3WbYF27ieK7H/hFdD/6B0X5n/Gua+HP3776LXe16uGhF0k2gMf/AIRXQ/8AoHRfmf8AGvP/ABjY22n615NpCsUflg7R616xXmHj3/kYf+2S1OLhFU7pActRRRXmAFKqlmCgZJpK0bODYvmMPmPT2q6cHOVgZNaxfZQGU4k67hXU2PiJNgS7BDD+Md65uivUpydPSJJ2h1nTwuftC/TBzWVqPiHzEaK0BAPBc9fwrAorSVeTVhATk5PWvV/DF0v9iWizqrfJwxHPXvXlFTJe3UaBEnkVR0AY8VkrdRp2PStW2/2jJtxjjp9KpVxlprN3ayZLmVT1Vzmuis9atLsAb/Lk/uvxXZSqRaSEzRooByOKK3AKKKKACiikZlUEsQAO5NAC0yaaO3jMkrhVHUmsy91+2twVh/fSe3QfjXN3l/cX0m6Z8jso6CsZ1ox23At6rq73zeXHlYAendvrWXRRXHKTk7sCGeATJj+IdDWU6lGKsMEVt1UvIPMTeo+YdfeuWvS5lzLcaZnUUUVxFGraY+zLip6pWMw2mMnnqKu16NJpwViWFFFISFBJOAK0ENTUm068ikQZZTk/TvXbRyrNGsqHcrjcD615pPJ5szN27V1PhbUfMhaxkb5k+aPPcdxTwWJ/euD2ew2tC14j077ZYebGuZYfmHuO4riK9Rrhdf0s6feGSNf3Epyvse4p5lh/+XsfmCZkUUUV5BQUUUUAFFFFABRRSohdwqjJNAFiyh8yTeR8q/qa06jijEUYQduvvUlejShyRsSwooorQAooooAKKKKACiiigArPubRgTIhLDuD1rQoqJ01NWYGHRV67tesiD6iqNcE4ODsyh8ML3EyRRjLucAV6LY2iWNlHbp/COT6nuawvC+l7F+3zL8zDEQPp6101e1l2H5Ie0lu/yJbKGsXwsNOklBw5+VPqa89znk9a2fEWo/bb7yo2zDD8ox3Pc1jV5+Or+1q2WyGkFFFFcQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiit7R/Dy6hZ/aZpmRWJCBB6dzWlKlOrLlgtQMGirOoWbWF9LbMwbYRhh3BGRVaolFxbi90AUVp2Wg316Awj8uM/wAT8VtQeEYVAM1wzH0UYFdFPB1qiukK5yVFdsPC2nYwRL/33UUvhO0Yfu5ZEPvzWzy6uuwXRx1Fbd54YvLcFoSsy/7PX8qxXRo2KupVh1BrkqUp03aasMSiiiswCiiigAooooAK1dJ1c2X7mUFoSeMdVrKrR0XTjqOoLGw/dJ80h9vT8a1oOftFybgz0vQoomtftIZWMo49l/8Ar1lausOm3DeZIqRt8yEnt6VZACgADAHYVna3p39o6eyqMzR/NGff0/GvoKlOUYNx1ZBy+rax9rHkQZEPcnq3/wBasiggg4PBor52pUlUlzSLCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorV0HRH128kt0mWIom/LDPfFOMXJ2QGVRXSa54Qm0XT/tb3SSDeE2gHv8A/qrm6c4Sg7SAKKKKkAooooAKKKKAO6+HJAa+yey13u4eorwpJHj+47Ln0OKd9om/57Sf99Guyli/ZwUbAe57h6ivMPHvPiH/ALZLXN/aJv8AntJ/30aYzs5yzFj6k5pVsV7WPLYBKKKK5AJrWHzZRn7o5NatQWkXlwjPVuTVivQow5YksKKKK1AKKKKACiiigAooooAs2+o3dtjyp3A9CcitCPxLdrxJHG/6VjUVanJbMR0A8UHvaj8H/wDrUN4ob+G1H4v/APWrn6Kr20+4GvL4jvX4QRxj2GTWdPd3FyczTO/sTx+VQ0VDnKW7AKKKKkYUUUUAFFFFAGVdw+VLkfdbkVBWrdRebCR3HIrKrz60OWQ0AJU5BwRVyO/IGJFz7iqdFRGcobDNE38YHCsTVWe6ebjovoKgoqpVZyVmFgqS3nktbhJojh0ORUdFQm07oD0fT72PULRJ4+/DL6HuKde2cV9avBKPlYcHuD61xGjaq2mXWWyYH4df6iu9jkSWNZI2DIwyCO4r6LC144inaW/Uhqx5xe2UthdPBMMEdD2I9ar16FqulxanbbG+WVeUf0P+FcHdWstncNDMm11/WvHxeFdCV18LKTuQ0UUVyDCiiigArSs4PLTew+Zv0FU7WLzZgD0HJrVrqw8L+8xMWitvwvZW9/qMkVzEJEERYAnvkV1v/COaT/z5p/30f8a7owbVxWPN6K9I/wCEc0n/AJ80/wC+j/jVTU9B0yDS7qWO1VXSJmU5PBxT9mwscFRRRWYBRRRQAUUUUAFFFFACU/TtCN7e+YwxaqcsfU+lW9N02TUJsD5Yl++/pXYR20cNsIIlwqjitaeHVRpzWiFcrKoRQqgBQMADsKxvEOqixtDDG37+UYGP4R3NaGoX0WnWrTSnkcKvdj6V59d3Ut5cvPKcsx/L2rTHYpUo8kd3+A0iGiiivBKCiiigAooooAKKKKACiiigAooooAKKKKAADPSitXSLXObhxx0UH9TVO/tvs1yQB8jcrWroyUFMCtRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVp6drt3psLQxiN4ycgODwfbmsyirhUlTfNB2YFh2uNSvSxBknlPYV12k+HobJVluAJZ/fotLoGkCxthNKv+kSDJz/CPStqvZwmDUf3lXWTJbCiiivSEFFFFABVDUdJttRjIkXbJ2kA5FX6KmcIzXLJXQHnOo6dPptx5co4P3WHRhVSvR9QsYtQtWglH+63dT6157dW0lpcyQSjDocGvAxmF9hK6+FlJ3IqKKK4hhRRRQAVoWGsXOmxMlusXzHLFlyTWfRVQnKDvF2YG3/wlWo/9Mf8Avj/69H/CVaj/ANMf++P/AK9YlFbfWq/8zCyJLidrm4eZlVWc5IUYGajoorBu7uwCiiikAUUUUASQW81y+yGJpG64UZNWP7J1D/nyn/74Nb/gD/kPP/1yNem12UMKqkOZsDxaHRNRmmSMWcwLHGSh4rqT4QtYIAk6TCQj75OOfYV6CjFHDDqDWH4z1+2tPsxkVy5U4UDrXXSoUqT/AHmq7voDPKr+0axvJLdjnYeD6iq9WL27a9vJLhxguenoKr15U+XmfLsAUUUVIBRRRQAUUUUAFFFFABW54W1qDQ9QluJ0d1ePYAnXqKw+hoqoycZcyA7HxL4ts9Z0n7LBDKr+YGy2MYGf8a46iinUqSqO8gCiiioAKKKKACiiigAooooAKKKKACpIE8yZV7Z5qOrmnpl2f0GKunHmkkDL9LRRXpEhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVkXEflzsvbqK16oagnKP+FYYiN4X7AilRRRXCUFFFT2dq95dxwJ1c4z6U0m3ZAFrZXF7JsgiZz3I6CtdPCl6Vy0kan0611dnZw2NusMKgADk9zVivapZbTUf3mrJucBe6FfWSl3j3oP4k5xVnQtbNg4t5yTbMeD/cP+FdqQCCCMiuN8SaUtpKLmFcRSHkDsayrYWWG/fUXsF7nZKyugZSCpGQR3qlqWlwanBskGHH3HHUVyuja7Jp7CGbL2x7d1+ldpDPHcRLLC4dG6EGu6jXp4qFn80LY89v8ATrjTpvLmXg/dcdGqpXplxbw3ULRTIHQ9Qa5PU/DM1uTLZ5li/ufxD/GvMxOXyp+9T1X4lJnP0UEFSQQQR1Bo6mvOGaVjHth3d2NWqZEu2JV9BT69OEeWKRJ0fgz/AJC03/XE/wAxXc1w3gz/AJC03/XE/wAxXc100/hGgqjrP/IFvf8Ari/8jV6qOs/8gW9/64v/ACNW9hnmNFFFcpIUUUUAFFFPihknkCRIzsewFADK0tM0eW+YO+UgB5bufpWnp3h5Y8S3mGbqIweB9fWt0AKAAMAdAK6adC+shDIII7aFYolCovQCm3V1FaQNLK2FH5n6Uy9vobCHfK3J+6o6muPv7+a/m3yHCj7qjoK1qVVBWW4Gbrt7LfX3mPwn8C9gKy60NQXMat6Gs+vCr39o2y0FFFFYgFFFFACorO4VQSxOAB3rUfw5qSQeaYgcDJUMM/lUGjTRQarBJNgIG6ntXoDSIkZkZ1CAZ3Z4xXoYPCU60XKTE3Y8xIIOD1oqe+kSW+nkj+4zkioK4GrNoYUUUUgCiip7K1a8vIrdOrnGfQd6aTbsgJ9O0q41KTEQwg+856CuosvCVnuVZS8rHqc4ArVtbaK0t0hiXCKPzrVtItke8/eb+Ve7SwNOlG81dk3uU/7AsRGEjRkAGBg1g674clFqzRfvAvzKcciuyoIyMHpWk6UZR5WB4uRg4NFdH4u0gWF+LmFcQT5OP7rd65yvAqU3Tk4soKKKKgAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiipEgmk+5E7D1C00m9gI6KsjT7o/8ALFqa1lcr1gf8Bmq9nPsBBRSsrKcMCD6EUlQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU5YpG+6jH6ChK+wDaKl+yzH/lmaQ28w6xt+VVyS7AR0UEEHBBB96KkAooooAKKKKACiiigAooooAK1vDtiLzU1ZxmOEb29z2FZNdj4TgCadJNj5pJP0H+TXVgqaqVkntuJnQUUUV9ISFFFFABRRRQAUUUUAFcz4ssQ0Ud6g5U7H+nY101VNSgFzptxERndGcfUcisMTTVSk4gjzmiiivmCwors9C0myOlxTSQRzSSjJZ13Y56D0rn9fsobHVGjg4RlDbf7ue1dVTCTp0lUb3FczKKKK5RhRRRQAUUUUAFFFFABRRRQB1fgD/kPP/1yNem15N4R1O10rVmnu3KxmMrkDPNdx/wmuif8/D/98V6eEqQjTs2B0NcB8Rv9fZf7p/nW9/wmuif8/D/98VyPjPWbLV5bZrOQuIwQ2RiniakJU2kwOWooorywCiiigAoopQpY4AJPoKAEoqwtjdsMrazke0Z/wqOS3niGZIZEH+0pFOzAjqzYXK2d9DcNH5io2SvrVaiiLcWmugF7Vr9NRv2uEi8tSoGD1OO5qjRQBk4HWnOTnJye7AKKnWzmYZ2gfU1E8bxth1waHGSV2gG0UUVIBRRRQAUUUUAFFFFABRRRQAVpWK4gz6ms2tW0GLZK3w698TJ6KKK7hBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVWvlzbk+hBqzUNyM27j2qKivFgZNFFFeaUFbvhRFbU2Y9VQ4rCrQ0S8FlqccjHCN8rfQ1vhpKNaLfcGeg0UgIYAg5B6UtfTkBWV4iVW0abPbBH1rVrnPFV8qWy2in53O5h6CufFSUaMm+wLc5Grunapc6bLuibKE/Mh6GqVFfNxnKD5ouzLPQNO1m11JAEbZL3jY8/h61o15erMjBlJDA8EHpW/p/iieDEd2pmT+8PvD/ABr18PmSfu1dPMlo6K+0ez1AEyx4k7OvBrnLrwtdwSBrdlmTPTo35V09nqVpfLmCZWPdScMPwq4v3h9a6qmGo11zfihXaOLkikhbbIjIw7MMU2vQJIY5l2yxq49GGaz5tAsZclUaM/7Df0rKWHfRgc/o+qtpF086RCQsmzBOO4P9K2v+E2m/58k/7+H/AAqtJ4X/AOeVz+DLVZvDd4PuvE30JqOSpHoO5pf8JtN/z5J/38P+FQXfi6W7s5rc2iKJUKEh+mR9KoHw/fj+BD/wIUo8PX56rGP+BUrVOwXMqitpPDN0335YlH4mrUXhiMf624ZvZVxQqM30Ec3U0FpcXLYhhd/cDj8666DRbCDBEAZvVzmryqFGFAAHYCtI4Z9WBztp4aY4a7kwP7idfzrdt7SC0TZBGqD26n8amrPvNYtLPIL+Y/8AcTn/APVW6jCmrgaHSsfUdehtsx2+JZfUfdWsW+1q5vcoD5cR/hXv9TWdWM8R0iBJPcS3Mplmcux7mo6KK5hle8GbZvqKy61bv/j2asquHEfENBRRRXOMKKKKACnmWQpsMjFP7ueKZRQAUUUUAFFFFABW94UjDao7nqsZx+YrBrX8NXIg1dFY8SqU/Ht/KujCtKtFvuDO/t4vNlGfujk1pVFBF5UQH8R5NS19BJ3ZIUUUVAGN4ntkudIKN/eGD6V5lIjRSMjDDKcGvTPEU4W3jgB+Zm3H6CuI1e1yBcKORw39DXnY6lze8ug0ZFFFFeWMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVEaRwiAlj0AoAQDJwK0bbSZJQGmPlr6dzV6y09LYB3w0vr6fSrtd9HCLeYmyvDZW8H3Ixn1PJqxRRXYoqKskIKKKKYDXjSRcOqsPQjNUZ9JhkyYiY29OorQoqZ04z+JAcxPbS2zbZFx6EdDUVdVJGkqFHUMp6g1hX1g1qd6ZaI9/T6159bDOGsdhplKiiiuUYUUUUAFFFFABRRSqpdgqjJPagBKtQ2LvzIdo9O9Wbe1WEbm5f19Ks1108P1kK5FHbxR/dQZ9TzUtFFdKSWwgooopgNZVcYZQR7iq0tjG3KHaf0q3RUyhGW6AxpYXhbDj6HsaZW0yK6lWGQazbm2MJ3Lyh/SuOrRcdVsNMr0UUVgMKKKKACiiigArvPDgA0K3x33f+hGuDruPDEgfRkX/nm7Kfzz/WvRyx/vn6f5CZs0UUV7pIUUUUAFFFFABRRRQAUhGQQelLUdxIIbaWU9EQt+QobsrsDzM8MaSg9aK+RLL1lrF7YRGOCbCE52kA4PtVSaaW4maWZy8jHJY96ZRVOcmlFvRAFFFFSAUUUUAFFFFABRRRQAUUUUAFFKi7nVfUgV6Cvw7tWRW+3y8jP3B/jWlOlOp8IHntFSTxiG4kjByEYjNR1mAUUUUAFS29tNdzrDBG0kjdFUUtpaTX11HbQIWkkOAK9Z8P+HrfRLUAAPcsP3kpHP0HtW9Cg6r8gOe0jwAoVZdTkJPXykPT6muttNI0+yQLb2kSD12jNXaK9SFGEFogECgDAAH0FNeGKQYeNGHuAafRWoGFqPhHSdQUnyBDIf44uK4PXPCd7o+ZVHn23/PRRyPqK9ZpGVXUqwDKRgg9656uGhPyYHhFW7CMM7Oe3Sul8XeFhYFr+xT/AEcn94g/gPqPauXtJhDId33T+lecoOnUSmDNSoLqMPA2eo5FTBgRkHIqreTqsZjU5Y9cdq66jXK7kmdRRRXmlBRRRQAUUUUAFFFFABRRRQAVr23/AB7p9KyK1rU5tk+ldGG+JiZNRRRXaIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1Z6fc3zYhj+Xu54Aq9pGjG7xPcAiHsO7f/AFq6mONIkCIoVRwAO1dFOi5avYRi23hqBADcSNI3ovA/xrQj0qwjGBaxn/eGf51corpVOK2QFY6dZEYNpD/3wKpXegWE8LgRmMkdUb/IrWpknEbfSm4RejQHA33he5twXtmE6D+HGGH+NYTKysVYEMOCD1FeoVl6tokGpRlgBHcAfK4HX2PrXDiMtVual9w0zgqKluLeW1naGZSrqeRUVeO007Mo3NK8Ry2SCGdTLEOhzyK308Saa65MrL7Fa4Siuulj61Ncu68xWOuvfFcKoVtELuf4mGAK5WeeS4maWVizsckmo6KyrYmpWfvsaVgooorAAooooAVWZGDKxUjoQa17PxJf2pUO4mQdn6/nWPRV06s6bvB2A9EtvEtrKo86N4if+BCtKHULSf8A1dxGfbOD+Vef2r77dT3HBqavYhiZNJsg9DBBGQciiuASeaP7krr9GIqddVv06XUv4tmtViV1QHcUVxY1rUR/y8n/AL5H+FIdZ1A/8vLfgB/hT+sR7AdrSM6oMswA9zXDPqV6/wB66l/BiKgeR3PzuzfU5pPErogO0m1axg+9cIT6Kcn9KzbjxNGMi3gLH+85wPyrm6KzlXk9gLt1q15dZDylV/upwKpUUVi23uAUUUUhhRRRQBVvmxBj1NZtXL98uqenNU64K7vMaCiiisRhRRRQAUUUUAFFFFABRRRQAVo6Rbl5/tB4EZ+X/eqhHG0sixoMsxwK6aCFYIVjXoo6+tdWFpc8uZ7ITOu0zVI7uMRyMFmHUH+L6VpVwYJBBBwfar8OsXkK7RJuH+0M166n3EdbUF1dw2cReVvovc1zj65euMBlX6LVCSWSZ90jlmPc03U7ASXd095cNK/foPQVXZQ6FWGVIwRS0Vk9QOZuoDbXDRnoOh9RUNb2p2vn2+9R88fP1HesGvIr0vZzt0KQUUUViAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW7ptn5EQlcfvGH5Cs7Tbfz7oFhlE+Y/0roK7sJSv77E2FFFFdwgooooAKKKKACiiigApGVXUqwyp4INLRQBzd7am1nK9UPKn2qvXRahb/aLVgB86/Mtc7XlYil7OemzKQUUUVgAUUUUAFaVpb+Wm9h87fpVS0i82YZ+6vJrVrqw9O/vMTCiiiusQUUUUAFFFFABRRRQAUjAMpUjIPWlooAyLiEwyY/hPQ1FWrdRebCcfeHIrKrz6sOSWmw0FFFFZDCiiigAro/CV2EuJrVj/rBuX6jr/n2rnKltp3tbmOeM4dGyK2oVfZVFMGemVftNMknAeQ7EP5moPD/lapAl4OYvT/a9K6SvoJ1tPcJSKkem2qD/AFe7605tPtWGPKA+lWaKw55dyrGPc6QVBaA5/wBk1lkFSQRgjsa6yszVbMNGZ0HzL97HcVvTqu9pCaMaiiiugkKxvEt2LfSmjB+eY7B9O/8An3rYJCqSTgDkk1wWuaj/AGjflkP7mP5U9/euPHVlTpNdXoNIzKKKK+dKCiiigAooooAKKKKACiiigAooooAKKKKAFRtrq3oc13S/EUKgX+zugx/rP/rVwlFaU6s6fwsB88nnTySYxuYtj0plFFZgFFFS2sBuruG3XrI4QficUAeg+BNGFvZnUpV/ezcR57L/APXrsqitoUtraKFAAsahQPpUte5SgoQUUAUUUVoAUUUUAFFFSLBK/wB2Nj+FJuwEEsSTwvFIoZHBVge4rx3X9LbSNXmtudmd0Z9VPSvbRZXB/gx9TXHePfDt1dW1tdwxBpI2KNgjkHkf1rlxUFUj7u4HmAYjoTRV2XSNQh+/aSfgM/yqmysjbWUqR2IxXmShKPxKwCUUVIlvK4yqHHrSSb2AjoqVraVBkoce1RUNNbgFFFFIAooooAKKKKACtKxbNvj0JrNq7p78un41tQdpiZfooorvEFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABV/SLA392Aw/dJy5/pVCuy0W1Frp0ZI+eT52/Hp+la0oc0tRGgqhFCqAAOAB2paKK7wCiiigAqOc4iPvUlQXB6LTW4EFFFFaAY3iDShfWhmjX/AEiIZGP4h6Vw9eo1wOvWYstVkVRhJPnX8ev65rx8yoJWqr5jTMyiiivJKCiiigAooooAKKKKACiiigC5YSYYxnvyK0KxFYowYdQa14pBLGGHeuzDzuuUTJKKKK6RBRRRQAUUUUAFFFFABRRRQAUUUUAFISACT2pap3s21PLHU9fpUzkoxuwKUsnmSs3r0plFFea3d3KCgAk4AyT0Aore8M6b9puzdSL+6hPy57t/9b/CrpUnVmoLqBgkEHBord8Tab9lvPtMa/upjzjs3f8APr+dYVFWk6U3B9ACiiiswCiiigAooooAfFM8D7422t64zU/9pXf/AD2P/fI/wqrRVKco6JgWv7Su/wDnsf8Avkf4Uf2ld/8APY/98j/CqtFP2s/5mFi1/aV3/wA9j/3yP8KP7Su/+ex/75H+FVaKPaz/AJmFi1/aV3/z2P8A3yP8KP7Su/8Ansf++R/hVWij2s/5mFi1/aV3/wA9v/HRVUnJJPeiik5Slu7gFFFFSAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG7pEWy0393bP4Dj/ABq/UNouyzhH+wKmr2aUeWCRIUUUVYBRRRQAUUUUAFFFFABRRRQAVzV5F5N3Ig6A5H0PNdLWHrC4vAf7yCuXGRvC40Z9FFFeaMKKKKANKxTbBu7satVHAMQRj/ZFSV6VNWikSFFFFWAUUUUAFFFFABRRRQAUUUUAFY86eXO69s8VsVm34xcA+q1z4lXjcaKtFFFcQwooooAKKKKAPS/C0p03S7dcZSRd7j3POa7COVJow6MCp9K4rS3EmlWrDp5Sj8hitG3upbZ8xtx3B6GvpVRTpx5eyJTOmorPg1aGQASfu2/SryyI4yrqR7GsXFx3RQ6kZQylT0IwaWkZlUZLAfWpA5aRdkjJ/dJFMJCgknAHUms/U/ENhbTykS+axY4VOe9cpqWvXWoZQHyof7inr9TWtbG0qS3uybF7X9eE4a0tG/d9Hcfxew9q5yiivCrVpVpc0ikrBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa/haMS+JrFT/fJ/IE1kVq+GZRD4ksXPTzMfmCP61dP416gex0UUV7oBRRU1vbvcNgcKOppNpK7AiVWdgFBJPYVeh04nmU49hVyG3SBcKOe57mpa5p1m/hKsRR28UX3UH1qWiism29xhWbryhtImP8Adwf1rSrM199mkSg/xED9f/rVdL+JH1E9ji6gns7e5XbNCjj3FT0Dk4r2Wk1ZmRjSeEbdsy27FG7I3IrKurOezfZNGV9D2Nd2BgAUyaGO4jMcqB1PY1xyw0PsKwXOAqpdWwZS6DDDr710WqaI9pmaDLw9SO61j1x1aX2ZDMSinSDbKw9DTa8p6FBRRRQAUUUUAFS20nlzqe3Q1FRTTs7gblFQ20vmwqe44NTV6cXdXRIUUUUwCiiigAooooAKKKKACiiigAooooAKKKKAHwR+bPHH/eYCu/ACgADAHArhtOx/aVtn/nqv867quvDbNiCiiiukAooooAKqStukNWZG2IT+VU6uKAKKKKoArmPF8IMdtNjkEof5/wBK6esDxbj+y4v+uw/ka5car0JAtzjaKKK+bLCiiigAooooAKKKKACijqcCus0bw4iItxfJuc8rEeg+tbUKE60uWIN2OcttOvLzmC3kcf3scfn0rTttD1WFubcbT1HmL/jXaABVAAAA4AFLXr08thHVydybnIT2dzbDM0LoPUjj86hruUkAGxxlDwQRWRquhoUa4s1wRy0Y6H6U6mHcdUI52iiiuYYUUUUAFFFFABRRRQAUUVFNOkK5Y89hSbSV2ATTLChY9ewrJdy7lmPJqZHNxdx+ZyC4GPbNd0NE03/nzjrKFGeKvyuyQ9jz6ivQf7E03/nzj/Kj+xNN/wCfOP8AKtP7Lqd0HMcFBC9zOkMQy7kKBXotjaJY2cdvH0Qcn1Pc1paL4e0+Im6+yRhuQhx27mo7tFS7lVRhQ3ArrwWHVGTvqxMoX9ml/ZSW7/xDg+h7GvOpoXt5nhkGHQ7SPevTq5fxVpuQt/GvTCy4/Q/0/KpzHD88PaLdfkCZy1FFFeGUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHT25zaxH/YH8qlqrpz+ZYxH0G38qtV7UHeKZIUUUVQBRRRQAUUUUAFFFFABRRRQAViayf8ASkH+x/U1t1z+qPvvnH90Ba5sW7UwRTooorzCgooooA2YuYU/3RT6gtG3WyewxU9enB3imSFFFFUAUUUUAFFFFABRRRQAUUUUAFZ2of65f92tGsq8bdct7ACsMQ/cBEFFFFcJQUUUUAFFFFAHXeFb8PbtZOfnQlk9x3ro68ygnktplliYq6nIIrtNL8QW96ipMwin7gng/SvbwOLi4qnN6olo2aUMV6Ej6GmggjIORS16Yh/ny/8APV/++jWZrmpGy052MhMjjagJ70t/q9pp6EySBn7IpyTXEajqE2o3JllOB0VR0UVwYzFRpRcY/F+Q0ipRRRXgFBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVoWWi31/F5sMYEfZmOM/SqhCU3aKuBn0VNdWs9nOYZ4yjjse9Q0mmnZgFFFFIAp8MrQTxzJ95GDD6g5plFAHuFhdJe2MFzGcrIgYVYrgvAeuKA2lTvjktCT+o/rXfKpdgqjJJwK9ujUU4KQEtvA08m0cKOprYjjWJAqjAFNghEEQQde59TUlYVJ8z8ikgooorMYUUUUAFc54ouRiG2B5++39P61vzzpbwPLIcKoya4O9umvLuSd+rHgegrrwlPmnzdETJ6EFFFFemZlxG3KCKdVSOQofUVYWRG71m0A8gEEEZBrlNd0sWYa6hH7k/eX+6f8K6kyIBywqB0+3H7Nt3LJ8pB7is6lPniBxfhvTRdXEl7OgMakqoI4LHr+VZmr6edOv3iwfLb5oz6r/nivRH01NKVbWIYiUfIfUVka9pv9oWB2DM0XzJ7+o/GuOpgk8OlH4lr/AJjvqcHRRRXilBRRRQAUUUUAWLOby5dp+61alYdadpP5se0n5l/WurD1PssTLNFFOh2edH5n3Nw3fTvXWIPKk8vzPLbZ/e28fnTa78+T9n52eTt/4Dt/wrgpNvmvs+5k7fp2rWpT5LaiG0UUVkMKKKKACiiigAooooAKKKKAHwSeVcRyf3WB/Ku/BDAEcg157XZ6LdC602PJ+eP5G/Dp+ldOGlq0I0KKKK6wCiio5X2LgdTQtQIpn3NgdBUVFXtKiSS6+cA7RkA1bfKrgUirDqCPrSV088UckDq6jGPyrmDwSKmnU5wasFcx4vmAitoc8lix/Dj+tdPXA6/eC81WQqcpH8i/h1/XNcuYVFGi13GtzMooq3pmny6pqMNnD96RsE/3R3P4CvASbdkUKdLuhpI1Py/9GMnl7vf1+nb61Tr2o6TaHR/7L2f6N5fl47/X655+teP6lYS6ZqE1nMPnibGfUdiPqOa3r0HSSYFWiiiucAooooA2/DNgLq+M0gzHDzz3btXbVg+FIwulu/dpDn8AK3q+iwNNQop99SXuFFFFdggpySMnTp6U2igDmdbijtr8MvyrMNwHv3qhWp4tjBsIX7rJj8CDXKR3Esf3WOPQ14mJqKlVcWtBpGvRWeuoN/EgP0NSi/jPVWFQq0H1Cxboqr9ui/2vypragn8KMfrT9tDuFi5SMwUZYgD3rOe/kb7oC/rVd5Hc5ZifrWcsTFbBYuzXwHEXJ9TVFmZ2LMcmkorlnUlPcqxLbf8AH1D/AL6/zr0sdBXmlt/x9Q/76/zr0sdBXq5VtL5EyFooor1hF5dWnRAqpEABgDB/xridV8UX8WqXKKkGFcjlT/jXUV55rP8AyGLr/roa87HydKCdPR3GtS//AMJZqH9y3/75P+NMl8T3s0TxSRW7I42kFDyPzrForyniqz+0yrIKKKK5wCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDV0abBeAnr8w/r/SteuWhlaGVZF6qc10sMqzxLIh4YV6WEqc0eV9BMkooorqEFFFFABRRRQAUUUUAFFFFADZJFiiaRuijJrl3cySM7dWJJrU1a66W6H3f+grJrzcXU5pcq6DQUUUVyjCiiigC7p8nLRn6ir9YqOY3DDqDWvG4kQOp4NduHnePL2JY+iiiugAooooAKKKKACiiigAooooAa7BELHoBmsZmLMWPUnNXb6b/lkp92qjXFiJ3lZdBoKKKK5xhRRRQAUUUUAFFFFAFmLULyAYiuZFHsadJqt/KuHupSP96qlFX7SdrXYASWOWJJ9TRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAV6Fo88M+lwGEjCqFIHY157Tklkiz5bsmeu04rqwuJ9hJu17iaudB4snhe5hjQgyIPmx29q52gkk5PJorKtV9rUc+40FFFFZAFFFFADo5HhlWSNirqcqwPINexeBtdGr2m66AS4Q7AT0c+orxuvRtLtvsOnwQjhlXJI/vdTXfgKUqkpK9lYG7HqVFclY+Ip7cBJx5qDv3FbcGu2E4H73YfRxiuieHqQ6DUkzSoqFby2YZFxF/30Kjk1GziGXuY/zzWXLLsUWqZLLHBGZJHCoOpNY114lt4wRbo0jep4Fc9eajcXz5mfjso6CuinhZy+LREuSRa1fV2v5PLjysCngevuay6KK9KEFBcqM73CiiiqAKKKKACrVjdR2js7Rl2PAOegqrR1pNJqzAs6vqqvYvItszPENwAbqO9ch/wmEX/Pm/8A32P8K7OHSL24TK27bT3bjNef6z4V1TTbqfNm5hViQy8gDtXnYurOkl7F+vUaV9zJvp4rm8kmhiMSOd2wnOD3qvQRg4PWivEk3J3ZQUUUUgCiiigAp0btG4ZTyKbRRsBsQzLMgYfiPSpKxopWhfcv4j1rVimWZMqfqPSu+lVU1Z7ktE3mSeX5e9tn93PH5U2iitgCiiigAooooAKKKKACiiigAooooAK0NH1D7Bd5Y/un4f296z6KcW4u6EehKQyhlIIPII70tcro+tG1xb3BJh/hbuv/ANaun85DGJFYMpHBB616FOamtAFdwi5NVGYsxJpXcu2TTa3SsAU6OR4nDo2GHem05I3kOERmPoozTfmBZl1K4mjKEgA9cDrVSpfstx/zwl/74NZ+p3UunxHbazSzH7qLGT+fHFQ5QgrhqUtf1UWFoYo2/wBIlGFx/CPWuGqxfPdSXTSXiusrc4dSOPp6VXr53FYh1ql3sikrBXpXgXRfsdgdRmXE9yPkz/DH/wDX6/lXE+H9Oi1LVooriVI7dfnlZ2C5UdufWvWl1CwVQq3lsABgASLwK0wdNX52MtVx/jvRftdiNShXM1uMSY/iT1/D+Wa6f+0bH/n9t/8Av6v+NNa/090ZGu7ZlYYIMq4I/Ou6pGM4uLYHiVFaWvafHpurSwwSpJbsd8TIwb5T2+o6Vm14sk4uzAKKKKQHYeEpg1hNDnlJN34Ef/Wroa8/0TUf7Ov1dj+6f5X+nrXfqyuoZSCpGQR3r6DL6qnSUeqJYtFFFdwgooprusaM7sFVRkk9qAOd8XTAW0EGfmZ934Af/Xrkqv6vqB1G/eUf6sfKg9qoV81i6qq1nJbFLYKKKK5hhRRRQAUUUUAFFFFAEtt/x9Q/76/zr0sdBXmMbmOVHAyVIOK6uDxDdOAZLaNR6ZOa9PLq0KfMpdRM6UKWOAM1KtuT944rAHiWZRgW8Y/E0f8ACTz/APPvH+Zr0niYEnRiFB2z9a4jVYYv7VuTsXO89q1P+Enn/wCfeP8AM1kXM5ubmSZgAXOcCuevUjUSQFfyo/7i/lTGtoW6xj8Kmorm5U+gyo9hGfusV/WqslpLHzjcPUVq0VlKhB+QXMOitWa1jmGcYb1FZ0sDwthhx2NctSlKHoVcjooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACrlhem1k2tzE3X296p0VUJOD5kB1asHUMpBB6EUtc7aX8lqcfej7qf6VuQXUVyuY2ye6nqK9SlXjUXmS0TUUUVsAUUUUAFFFBIAyTgUAFU76+W1TauDKRwPT3NQXeqogKW/zN/e7CsdnZ2LMSWPUmuSviUlyw3GkDMWYsxyTySaSiivOGFFFFABRRRQAVPa3Hktg/cPX2qCinGTi7oDbBDAEEEHvS1kwXLwnHVfStKKZJhlD+Heu+nVU/UmxJRRRWoBRRRQAUUUhOBk9KAFqvc3IhXA5c9B6VHPequVi5Pr2FUGJYkk5J7muarXS0iNIQkkkk5JooorjGFFFFABRRRQAUUUUAFFFFABRRRQAUUVKltLJ0XA9TTSb2AiqeyUPfQKwBBkUEHvzUq6e38TgfSrdjYIt9Ad5OJB2961jQm3sFz1H+w9K/6B9t/37FH9h6V/0D7b/v2K0KK9jkj2A858e2NrZy2YtreOHcrbti4zXG13nxEjd5LIqpIAbOPwrg8Y615GJVqrAKKKKwAKKKKALNhaPfXkcCfxHk+g71p+IdIWxeOaBcQsNp9jWv4a037LafaZF/eyjjPZa1r21S9tJIJBww4Poa9ejgVLDu/xPUm+p5tRUtzA9rcPDIMMhwairyWmnZlBRRRSAKKKKACiiigAooooAKKKKALWmQ/aNTtoyMgyDP0HJr0euE8Nru1yE/3Qx/Q13de5lcbU2/MlhRRRXpCCiiigAooooAKKKKACiiigAooooAK6nQtISOFbqdQ0jcop/hFc1AgkuI0PRmA/WvQgAoAHAHQVx4yo4pRXUqCFrM1JMTK3ZlrTqhqY+WM+5rhpP3y2ec+MfDEUltJqVlGEljG6VFHDDufrXnle7SKrxsjDKsMEHuK8OuYxDdTRDojso/A1z4ymoyUl1JIqKKK4wCiiigAooooAKdHI0bblODTaKL22A04LtJeD8relWaw6sw3rx8P8y/rXXTxHSQrGnRUUdxHKPlbn0NS10pp6oQUUUUwCiiigAooooAKKKKACiopJ44h8zc+gqlNeu/CfKP1rOdWMdwsWp7pIRgct6VHaaze2cm6OXKnqjcqfwrPPNFcjrz5rp2HY7C18V2sgAuY2ib1HzD/GtSPV9PlGVvIv+BNt/nXndFdcMyqxVpWYcp6OdRsVGTeW/wD38FW9H1uwN5Ikc3mMI84Qe479K8trf8Jf8hKb/rkf5it6WPlWmqbWjFax6HcavLICsS+WPXqazySxJJyT3NJRXqRio7COK8V/8hdf+uS/zNYddHr9lPfa6sVuhZvJUn0AyazL7Rr3T4xJNGDH/eU5Ar57FUpurOSWlykZ9FFFcgwooooAKKKKACiiigArZ0jxBLp4EMwMtv2HdfpWNRWlOrKnLmg9QPRbXVLK8UGG4Qk/wk4b8jVyvLqXc2Mbjj0zXpRzRpe9H8Rcp6Hd6tZWaky3Cbh/Apy35CuS1fXpdS/dRgx2/wDd7t9f8KyKK5q+OqVVy7IEgoooriGFFFFABRRRQAUUUUAFHXpRV2yt8/vWH+6KuEHN2QElrahAHcfN2HpVuiivQhBRVkSFFFFUAUUUUAFFFFABRRRQAU10WRSrDIp1FDVwMm4tzC3qp6Goa2ZEWRCrDg1kyxGKQqa4K1Lkd1sNMZRRRWIwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAClVirAqSCO4NJRQBeh1W4jwHxIPfr+dXE1mE/fjdT7c1i0VvHEVI9Qsb41W1P8bD/gNNbV7YdN7fRawqKv63UFY1ZdZPSKLHux/pVCe7nuD+8kJHoOBUNFYzrTnux2CiiiswCiiigAooooAKKKKACiiigAoBIOQcH2oooAsx3sqcNhh71OuoRn7yMPpzWfRWsa011Cxp/bYfU/lSG+hHTcfwrNoqvrExWLr6gf4E/Emq0k8kv32JHp2qOis5VJS3Y7BRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAVPDaPLyflX1NT21p0eQfQVdrppUL6yE2RRW8cQ4XJ9TU1FFdaSWiEFSW7iO4jduisCajopiO+/4S7S/Wb/vj/69H/CXaX6zf98f/XrgaK09pIdze8S6tbao9ubbf8gOdwxXOSQRyj5l59RUtFZy97cDLns3j5X5lqvW5VO5tAwLxjDdx61yVKFtYjTM+p7MwLdRtc7vKBywAyTUB4ODRXMnZ3GdqPFOnKAAJQB0+Sj/AISrT/SX/vmuKoru/tKt5CsbGu31lqEiT2+8S4w25cZFY9FFcdSo6knJ7sYUVdsY0kV96g4PerX2eH/nmv5VpCg5K9xXMilVWdgqgljwAO9a32eH/nmv5V0PhvTICXu2iXKnanHT3rWng5TklcLmNaeFbqZA88iw5/h6mnXHhO4jQtBMshH8JGCa7zy0/uijy0/uivS+o0OW1hXZ5LLE8MjRyKVdeCDTK7/xHpkEluLoRLvQ4Y46iuX+zw/881/KvNqYNwlZMdzIorX+zw/881/KshvvH61hUpOG40zX8MkDW4h6q38q7qvPdEl8nWbVj3fb+fH9a9Cr2Msd6TXmSwooor0RBRRRQAUUUUAFFFFABRRRQAUUUUAKjFHVx1ByK9Btp0ureOZD8rjP0rz2tPStYk09tjAvCTkr6fSubE0XUjeO6Ki7HaVR1M/JGPc0sGrWU65WdQfRuDWN4h8SaXp5QTXSlgpYIvJP+cV50U4SvLQtvQj1K9j07Tp7qU4WNCcep7CvE5HMkjO3LMSTW74k8Tza5II0BitEOVTPLH1NYFcmKrKpKy2RIUUUVzAFFFFABRRRQAUUUUAFFFFAB0qaO7lT+LI9DUNFNScdgL6agP40I+lSreQt/Fj6isuitliJoVjYE8R6OtL5sf8AfX86xqKr6y+wWNgzRDq60xryFf4s/Ssqtvw/4buddmJB8q2Q/PKR+g9TTjXnN8sUFim+oKPuIT9aryXcsn8WB7V6pZ+ENGtIwv2QTN3eU5J/pS3fhHRbtCptFibs8R2kf0raWHrSWrHY8nihedvl/Emri2CAfMxJ9q39V8OyaJjafMt2OFkx39DWZUxw6j8W5LZSewGPkY59DVJ42jYqwwa627trCPS4ZYZ91w2Ny7s9ueO1Yl1CJIScfMvIorYdJe6NMy6KK6PQvB95rMIuXkFtbH7rsuS30HpXHCEpu0UM5ytPQ9Sh0y7eWZXZWTaAgGeo9TXSXvw6lSEvZ3olkA/1cibc/Q5ri5oZLeZ4ZUZJEJVlbqDWvLUoSUragdf/AMJbY/8APG4/75X/ABo/4S2x/wCeNx/3yv8AjXG0Vv8A2jX7r7hWR2+mavaX+ozGMMjMigB8AnGf8an124hh0mYSkZddqr6muBBIIIOCO4pzyPIcu7MfVjmrWYy9m4Nav9QsNooorzhhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBF5soXt3rXACgAdBVSwj2xlz1PFXK7qELRv3JYUUUVuAUUUUAFFFFABRRRQAUUUUAFFFFABVa8h8yLcB8y81qWGnT6hJtjGFH3nPQV0ltoNlAo8xPObuW6flVqg6qt0EeaUV6S+mWKsV+xwY/65iqF34csLlTsQwv2ZP8ACsZZZUSvFplcxwtFX9S0m40yTEg3Rn7rjoaoV584Sg+WSsxhRRRUgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRSqpdgoHJPFAFmyh3ybyPlX+dF7Dsk3gfK386vRRiKMIO360SxiWMoe/6V2+x/d8vUm+pj0UrKUYqRyDzSVxFBRRRQAUUUUAFFFFABRRRQAUUUUAFXbO2ziVx9BVe2h86UD+EcmtYAAYHSumhTv7zE2LRRRXYIKKKKACiiigAooooAKKKKACiiigCleW2QZEHI6iqFbdZd3D5UvH3W5Fcdenb3kNMgooormGFFFFAF/T/uP9RV2qWn/cf6irtehR+BEvcK6rw3IrWDRj7ysc1ytW9Ov30+4Ei8qeGX1FdNKfLK7EdxRVO21O0ukBSZQf7rHBFPn1G1t0LSTJ9Ack13cyte4FbXZFTS5AerkAVx1X9U1NtQmGAViX7q/1qhXFVmpS0AKxG+8frW3WI33j9a4MV0KQI5jkV1OGU5H1r0u3mW4topl+66hhXmddj4VvfOsmtWPzxHK/7p/+vW+WVeWo4PqEjoKKKK9wkKKKKACiiigAooooAKKKKACiiigAooooAK4DXrn7TrE7A5VDsH4f/XzXZ6neCx0+Wcn5gMJ7seledEliSTkk15OaVdFTXqOIUUAFjgAk+1SG3nAyYZMeu015CTZRHRRjFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAVFLuqKMljgD3r2vSrCPTNMgtIgMIoyfU9zXjFrIIbuGVuiOrH8DXuMbB41YEEEAgiu/Ape8wHUUUV6IFe9tUvbOW3kGVdcfQ9jXlsiGORkPVSQa9aJABJOAK8ou5BLeTSL0ZyR+dY1egmRU1vuHPpTqq3kwjjKA/M3FYTkoq7EZ6KHmVScBmAJ9K9ziiSCFIo1CoihVUdgOleFV6b4c8YWd3Zx29/OsF0gClpDhZPfPTNY4OcYtp9Sjq68y+IEEcWvRSIAGlgDPjuQSM/kB+VdzeeItJsYDJLfQtgZCRuHY/QCvLNb1aTWtUlvHXap+VEz91R0H9a1xlSPJy9QM6iirFnYXN9Jst4i57nsPqa86MXJ2SAr1JDBNcPshieRvRVzXV2HhWCIB7x/Nf+4pwo/qa3oYYoECQxpGo7KMCvRo5bOWs3YVzjbbwtfzYMpjgX/aOT+QrVg8JWqf66eWQ/7OFH9a6CqU+safbZEl3HkdlO4/pXcsHhqSvL8WK7Io/D+mRdLVWPqzE1ZXTbFPu2VuP+2Y/wAKy5fFlinEcc0nvgAfqaqt4wX+CyJ+smP6Ue3wkNrfcFmdD9itMf8AHrB/37FMbTbF/vWVuf8AtmP8K57/AITB/wDnyX/v5/8AWp6+MF/jsiPpJn+lH1zCvr+H/ACzNWTw/pkvW1VT6qxFUZ/CVq/+pnljP+1hh/SnxeLLF+JI5o/fAI/Q1oQaxp9zgR3ceT2Y7T+tPlwlXa35Bqcvc+Fr+HJiMc6/7JwfyNZE0E1u+yaJ429GXFemUyaGKdCk0aSKezDIrGplkH8DsFzzKiuvv/CsEoL2b+U/9xjlT/UVzF5YXNjJsuIih7Hsfoa8ythatH4lp3KTK9FFFc4BRRRQAUUUUAFFFFABRRTohulQepFC1YGvEuyJV9BT6Slr1UrKxIUUUUAFFFFABRRRQAVoadpE9/8AP/q4v7xHX6VFptn9tvUi/h6t9K7ZEWNFRAAqjAArejS59XsIzYfD9jGvzI0h9Wb/AApZdAsJFwIyh9VY1p0V1ezh2A5DUdEmsgZEPmReo6j61Qtbd7q5jhTq5x9K70gMCCMg9QayLHTFtNYmdR8mzKe2T/8AWrCdBcytsBpW1tHaQLDEuFUfmamoorqStoBXuByDUNWbgfux9arVpHYCG5toru3eCZQyMPy9688vrR7G8kt36oeD6jsa9JrkvF0IW5t5gOXUqfw//XXnZlRUqftOqGjm6KKK8MoKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACr1jD1lYey1UhjMsoQd+vsK2FAVQoGAOldGHhd8zE2LRRRXaIo30PSVR7NVGttlDKVIyD1rHmjMUpQ9unuK4sRCz5kNDKKKK5xhRRRQAUUUUAFFFFABRRTo13yKvqaANGzj8uEE9W5qzSAYAFLXpxjyqxIUUUVQBRRRQAUUUUAFFFFABRRRQAUUUUAFQXUfmQn1HIqekpSV1ZgYlFSTp5czL71HXmNWdigrUsNAvL9Q4AjjP8T96k8Paat9eF5RmKLkj1PYV3AAAAAwB0Ar0cHglVXPPYTZhWfhQpG3+kgsT/d4qte6Tc2I3Ou5P7y9K6+36NUrKrqVYAg8EGvQeGglaOhJ57RV/V7EWN6VX/Vv8y1QrjaadmAUUUUhhRRRQAViN94/WtusRvvH61y4roNCVa069fT76O4XkA4Yeo71VorljJxakt0M9OhlSeFJY23I4yCKfXG+HdZ+ySC0uG/cuflY/wn/CuxByMivpsNXjXhzLfqQ1YWiiitwCiiigAooooAKKKKACiiigAoorC8QayLOI2sDfv3HJH8A/xrOrVjSg5yAx/Eupi7uxbxNmKE8kfxN3qjpemS6ncbE+VB99/SqPWu+0K0W00uLj53G5jXiUIPF13Ke39aFPRE1npVpYxhYolLd2YZJq5tBGMDHpilor3YwjFWirEmbf6LaX6HMYSTs6jFcTfWUthctBKOR0PYivSKwvFFos2nicD54j19q4MdhYyg6kVZoaZxdFFFeEUFFFFABRRRQAUUUUAFFFdj4B8LRa9eyXV4pNnbkAr/fb0+lVGLk7IDlIrW4mGYoJHHqqk1EyMjbXUqfQjFfScFvDbRLFBEkUajAVFAArF8R+FrHxBZSK8SJdAHy51GCD7+orZ0NNGOx4LRUlxBJa3MtvKu2SNirD0IpgBYgAZJOAK5/IRYsbGfULgQwLk9Sx6KPU17J4UkgisYbG6k8yeJdqu/RhXKaRpyadYrGAPMYbpG9TV8cHI617uHwKhT95+8yebU9GCgDAAA9qa8Mcg+dFP4VxcGt38C7Vn3KOgcZon1y/nXaZtoP9wYpfU6l9yudB40upLHTJYtOPmTMMOByUXvXla6g2PmTJ9q9EJJOSck1xPiTTVsrwTRLiKbJwOgbv/jWeMozpxVSLvbcV7me9+5GEUD3qqzFjljkmkoryZTlLdjCiiipAKAMnAp0UbzSLHGpZ2OAoHJrtNG0COwCz3AElz+ifT3966MPhp15WW3cG7GZpXhl5gs19lE6iIcMfr6fzrqoYYreJY4UVEHRVGKkPAya53VfE8cBaGy2ySdDIfuj6ete1GNDCQu/+CyNWblzd29nF5lxKsa+56/Qd65y98W9Usof+2kn9BXOXFzNdSmWeRpHPdjUVedWzGpPSGi/EpItXWo3l4T59w7g/w5wPyHFVaKK8+UnJ3k7jCiiikAUUUUAFFFFAFq11G8syPIuHQD+HOR+R4resvFvRL2H/ALaR/wBRXL0VvSxNWl8LCx6XbXdveReZbyrIvsen1HanTQxXETRzIroeqsM15vb3M1rKJYJGjcd1NdVpXieOcrDe7Y5OgkH3T9fSvWoZhCr7tTR/gS0U9V8MvCGmscunUxHlh9PX+dc4Rg4NeojkZFYms6BHfhp7cCO5/R/r7+9ZYrL0/fpfd/kCZxNaP9iXZ0L+19v+j+ZsxjnH976Z4pNM0i41HWI9P2sjlv3mR9xR1Neviwthp32Dyh9m8vytn+zjFcNDDupdv+mUeIUVe1jTJNI1Sazkydhyjf3lPQ1RrmaadmAUUUUgCpIP9en1qOnxHEqH/aFOO6A2aKKK9QkKKKKACiiigAooooA3/DCAyTv3AArpK5Xw5cCK9eJjjzF4+orqq7qD9wQUUUVsAUmVDY/iP+f60tYuq6mLTUrYA5CcuB6H/OamclFXYG1RTUdZEV0IKsMginVQEc/+qP1qrVm4P7v8arVpHYArlfGEgL2sfcBm/PH+FdQzKiF2IVQMkntXn2r339oajJMPuD5U+grgzGoo0uTqxoo0UUV4JQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVPaw+bLyPlXk04pydkBbs4fLi3EfM38qtUUV6cYqKsiQooopgFVbyHzItwHzL/KrVFTKKkrMDDoqe6h8qXgfK3IqCvNknF2ZQUUUUgCiiigAooooAKsWa5uR7DNV6tWH+uJ9qukrzQM0qKKK9IkKKKKACiiigAooooAKKKKACiiigAooooAKKKKAM2/XE4PqKq1d1D7yfSqVedWVpspbHYeEgosJiOpfmuhrjPDGoLbXTW8hwkvQn1rs697AzUqCS6EvcsW/RqmqG36NU1dEtxHPeJwNsB75Nc7Wnrt6t3e7UOUjG0H1PesyvOqtObaAKKKKzGFFFFABWI33j9a26raXo8upzMc7IVPzP/hWFaEpuMYrUaMyiu8h8O6dEgUw7z6sc1VvvC9rNGWtcxSdh1BqpZbWUb6BzI42ui0TxCbcLbXhJi6K/dfr7VgzwSW0zRSrtdTgio65KVWdGd47j3PT0dZEDIwZTyCO9Orz/TdZutObCNvi7xt0/D0rrLDXrK+AG/ypP7j8fka92hjadXR6Mlo1KKKK7BBRRRQAUUUUAFFVLzUrSxUmeZQf7o5J/CuW1PxLPdBorYGGI9T/ABGuavi6dFavXsCRr6z4gjs1aC2IefoSOif/AF6415GkdndizMcknvTTycmivCxGJnXleW3YtKwV6TYur2MDL0KD+VebV1/hjUllt/scjYkT7me4rpy2oo1HF9RM6KiilX76/WvdJDa390/lWbrwK6LcZU8jA471v1zXiG/WRhaxnIU5cj19K568/wB20+oHD+VJ/cb8qPKk/uN+VbNFeJ9WXcq5jeVJ/cb8qPKk/uN+VbNFH1ZdwuYxjcDJRsfSm1sTf6l/901j1jVp8jsCdwooorIYV658K5o20C6hBAkS4JYexUYP6H8q8jrX8OeIbnw5qQuoBvRhtliJ4cf4+9aU5KMrsaPoGiuStPiN4euIA8txJbvjJR4ySPxHBrB8TfEqCS0ktNFDlpAVNww27R/sg85rqc4pXuO5xHieaO48T6lLDgxtcPgjvz1qDRIhNrVqjdN+78hn+lUCSTk9TV/RJRDrVq56b9v5jH9a5qTTqxb7r8yWehUUUV9SQFFFFABWN4niEmiux6xurD88f1rZrH8TyiPRZFPWRlUfnn+lYYm3sZX7MEcNRRRXzBYU5EaR1RFLMxwAOpNNrr/Dej+REL2df3rj92D/AAr6/U1vh6Eq0+VA3Yt6JoqabF5kgDXLj5j/AHfYVqSypDE0kjhUUZLHoKV3WNGd2CqoySegFcPresvqUxjjJW2Q/KP73ua9urVp4SmlFeiI3JNZ1+S+LQW5Mdt0PYv9fb2rEoorwatWVWXNNlhRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG3o2vyWJWC4Jktug7lPp7e1dnFKk0SyRuGRhkMOhrzGtfRNZfTZhHIS1s5+Yf3fcV6WDxrg1Cpt+Qmj1XStPsIoGvHmt0vZFxkuAQo6A/wA/ypH1fTI3KPqNorKcEGdQQfzrDR1kRXRgysMgjoRXP+JNH8+I3sC/vUH7wD+JfX6iu+vCcIucNQTNPxommappwure/s3urfoqzKS69x1/H8/WvPaKK8KrU9pLmtYYUUUVmAVpaRpMupznB2RJ99/6D3rNr0LRrVbTS4EA5Zdze5NdmCw6rVPe2QmzRtNNs7eJfLhUnH3mGTU0lpbzLtkgjYe6ii3bKlfSpq9zlS0sSczq2hi3Rri1yUH3kPOPpWFXoZAYEEZBGCK4S/gFtfTRDorHH0rkr01HVAV6KKK5xhRRRQA6N2ikV0OGU5BrsNM1WK+jCsQs4HKnv9K42gEqQQSCO9aU6jgxHodFcXDrV/CoUTlh/tDNOl1y/lXHnbR/sgCuj6xEDpdQ1OGwiJYhpSPlQHmuNnme4meWQ5Zjk0xnZ2LMxZj1JNJWFSo5sDV0rWXsf3UoLwfqtdPb3dvdJuhlVh7HkVwdAYocqSCO4pwrOOjA7u4PIFUri9t7RN88yIPc8muBn1K7eVsXU+3oB5hqozs7bmYsT3JzWcszSVoxHym3rOvtfgwW4KQdyer/AP1qw6KK8yrVnVlzTZQUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAAZOB1rWt4fJhC/xHk/WqljDufzCOF6fWtGuzD07LmYmFFFFdIgooooAKKKKAIbiHzoSv8Q5H1rJIwcHrW5WdfQ7X8wDhuv1rmxFO65kNFSiiiuMYUUUUAFFFFABVqwOJyPUVVqa1bbcL78VdN2mmDNaiiivSJCiiigAooooAKKKKACiiigAooooAKKKKACiiigDP1A/vEHtVOrF6264I9Biq9edVd5spACQcjg1v6f4omt0EdynmoOjDrWBRRSrTpO8HYDvbTxPZvGxCSZHbFVb/XprpTHEvlRnrzya5vT/ALj/AFFXa9OOIqVIXZLQUUUVIBRRRQAUUUUAFdRpNuttpsKKOo3H3Jrl66TRbtbvTYyD8yfKw9K6cK17TXewjRooor0AOT8W26rNDOBgsNp965quh8V3ay3Uduhz5Yy31rnq+bxrTry5SlsFFFFcoy7a6tfWeBFcMFH8J5H5Vqw+LrhQBNBG/uODXO0VvDE1aekZBY61fF8JHzWrj6Nn+lKfF1uBxbSH/gQrkaK2/tCv3/AVkdNL4vkI/dWqj/fbNZlz4g1G5BBm8tT2Tisyisp4utPeQ7IVmZySxJPqTSUUVzgFFFFABTo5HicOjFWByCKbRQB0tl4rdECXcW/H8a9a0V8U2G5cCUnI421xNOj/ANan+8K7YY+vFWvcVkdpe+IZZkKW6+Wp6sTzWKSSck5NJS11Sm5askKKKKkYUVPY2wvL6C2LbRI4XdjOM10lz4OS3tZZvtrHy0LY8vrgZ9apRb2A5Cb/AFL/AO6ax62Jv9S/+6ax64cTuhoKKKK5hhRRRQAUVpWWhX19B58SKEP3S7Y3fSqE0MlvM0MqFJEOCp7Vcqc4pSa0YDKASrAg4IOQaKKgD0LSdRTUbFJQR5ijbIvoav15vY38+n3AmgbB6FT0YehrsbHxFY3agSOIJO6uePwPSvfwuNhUiozdpfmS0a9FNV0ddyMrD1BzUFxf2lqpM9xGmOxbn8utdzkkrtiLNcT4k1Jby8EETZihyMjoW71Pq3iVrhGgsgyRnhpDwSPb0rna8bHYyM17Ont1KSCiilVS7BVBJJwAO9eWM1vD+mfb73fIuYIsFs/xHsK7qqWl2K6fp8cAxvxucjux6/4VDrmpf2dYEof30nyx+3qfwr6HD044WjzS33ZL1ZieJdXMshsYG/dof3pH8R9Pw/z0rnKCSTknJNFeHWrSrTc5FIKKKKyAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDo/DWrmKQWM7fu3P7on+E+n4/56111eXAkHIOCK77Q9S/tGwBc/vo/lk9/Q/jXs5dieZeyl02JaOY8QaZ9gvd8a4glyVx/Ce4rIr0TVLFdQ0+SA4343IT2YdP8K88ZSjFWBBBwQe1ceOoeyqXWzGmJRRRXEMK9G02ZZ9Nt5FPBQfnXnNb3h/Wlsj9muDiBjlW/un/Cu7AV40qlpbMTR2sbbHB7d6uCs9HWRA6MGUjIIOQaswSfwn8K96SvqiSeuH1SUTanO6nI3YBroNX1iO2iaGBg05GCR/D/APXrlCc1w4iafuoAooormGFFFFABRRRQAUUUUAFFFFABVa7m8uLA+83FTu4RCzHgVkzSmaQsfwFY16nLGy3BEdFFFcBQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFORC7hV6mm1fsYcKZWHJ4H0q6cOeVgZajQRxhB0FPoor0kraEBRRRQMKKKKACiiigApkiCSMoehp9FDV9AMV0KOVbqKbV++hyolUcjg/SqFebUhySsUgoooqACiiigApQSrAjsaSigDaRg6Kw7inVSsJcqYz1HIq7XpU5c0bkhRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUjEKpJ6AUtVL6XbHsHVqmcuWNwKDtvdmPc02iivMKCiiigBQxHQkfSje394/nSUUALvb+8fzo3t/eP50lFF2Au9v7x/Oje394/nSU5Udvuqx+gp6gJvb+8fzo3t/eP508wSj/AJZP/wB8mmEEHBBH1FGoBvb+8fzq1p+oz6dP5kLcH7ynoaqUU4ylF3T1A7CHxZasg82KRG9uRVW+8Vl4ylpEVJ/jbtXM0V1Sx9dxtcVkK7tI5dySx5JPekoorjGFFFFABRRRQAUUUUAFFFFABRRRQAVp6LpB1WdwzlIowNxHU56AfkazK0dH1Z9KndgnmRyABlzjp0I/WtaHs/aL2mwMta3oK6ZEk8MjPETtIbqDWJWzrOutqkawpF5cSnccnJJrGqsT7L2j9lsCCnR/61P94U2nR/61P94VitwNmlpKWvUJCiiigCxY3Is76C5K7hG4baDjOK6S58Yx3FrLCLNgZEK58zpkY9K5OiqUmtgI5v8AUv8A7prHrYm/1L/7prHrhxO6GgooormGFFFFAHaaRrdiNMhilmWKSJArK3fHcVzWs3kd/qck8Q/d8KpI6471Qorqq4udWmqctkKwUUUVyjCiiigAooooAKKKmtLV7u4WGMcnqfQU0m3ZAMihkncJEhZj2FdV4a8MTS363E5ULD82MZ57f4/hVqzsYbKIJGvPdu5Ndbo8PlWIcjmQ7vw7V6lHCRhaUtxXGnS+OJP0rgPEtrd3F+8ijzIYxtTb6dz+dekahP8AZ7KRwcMRtX6muUrqrRdaHJJi2PPyMHBorp9X0hZkaeBcSjkgfxVzFeLWoypSsykwooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtPQb77DqaFjiKT5H/HofzrMoq6c3CSkugHqNcR4msvs2p+cowk43f8AAu/+P411GjXf23SoZScuBtf6jj/69VfE1r5+ktIB80LBx9Oh/wAfwr3sXFVsPzL1JW5w9FFFfPFBRRRQBPb3t1a/6i4kjHorcflUsurX8y7Xu5SPQNj+VU6KtVJpWTdgNK2uhINrnD/zq1WHnBq7Be4wsvP+1XRSr9JCaL9FNVg4ypBHtTq6iQooooGFFFFABRRRQAU1mCKWY4AqOW4jhHJy3oKzprh5jycDsBWNSsoeoWHXNyZmwOEHQVBRRXDKTk7soKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBEZpQvbv9K1wAAABwKr2kPlRZI+ZuTVmu+hT5Y3e7JYUVcstLur7mNMJ/fbgVrJ4XGPnujn/ZT/AOvXVGnOWqQjnaK3LjwzMikwTLJ/ssNprGlhkgkMcqFHHUGlKEo7oBlFFFQMKKKKACiiigBCAQQRwayJ4jDKV7dvpWxVa7h82LIHzLyKxr0+aN1ugRmUUUVwFBRRRQAUUUUAOjcxuGHUVrxyCVAy9DWNU1tcGF+funqK2o1OR2ewmjWopqsHUMpyDTq7yQooooGFFFFABRRRQAUUUUAFFFISACScAUCEdxGhZjwKyJZDLIWP4VLdXBmbav3B+tV64a1TmdlsUkFFFFYDCiiigAooooAK09N0O61HDAeXF/fb+lX9B0H7QFurpf3X8CH+L/61dcqhVCqAAOgHavTwmA51z1NuwmzJtPDlhbAF085/V+n5VppDFEMRxov+6oFSUV68KUIK0VYkOtQTWVtOCJYI2+q1PRVtJ6MDnr3wrbygtasYn/unkVy95Y3FjL5c8ZU9j2Nek1BdWkN7AYp0DKfzH0rgxGX05q8NH+A0zzWitDVtKk0y42n5om+4/rWfXhzhKEnGW5QUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU6P/Wp/vCm06PAkUn1FNbgbNLUfnRf89F/Ojzov+ei/nXp8y7kklFR+dF/z0X86POi/wCei/nRzLuBJRUfnRf89F/Ojzov+ei/nRzLuATf6l/901j1qyzRmFwHUnae9ZVcmJabVhoKKKK5hhRRQAT0GaACiiigAooooAKKKKACiiigArpvDtqEtWuCPmkOB9BXM12mlADS7fH9yuzBRTqX7CZdUFmAHUnFdjEgiiSMdFAArlrBPMv4F/2wfy5rq69USMXXpf8AVQj3Y/yH9axav6xJv1Fx2UBf0z/WqFMTCuP1m2FtqLhRhXG8f1rsK53xMB5tue+DXJjIp0r9howaKKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6nwhccXNsT6SKP0P8ASukniE9vJC3R1Kn8RXE+GpfL1uJe0isp/LP9K7qvoMvlz0LPpoS9zy9lKOVYYKnBpKu6vF5Or3SdP3hP58/1qlXgzjyycexQUUUVIBRRRQAUUUUAPSV4zlGIq1HfnpIv4iqVFXGpKOzCxqrdwt/Hj61IJYz0dfzrGorZYmXVCsbW9P7y/nTTPEvWRfzrHoo+svsFjSe+iX7uWqrJeyPwPlHtVeis5Vpy6jsB560UUVkAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVi0h82XJHyryargEkAck1rwRCGIL37/WtqMOaV3shMlrR0fT/ALfdfP8A6pOW9/as6uu8PxCPTA3d2JNepSjzS1JNREVECIAqjgAdqWiiu8AqjqenR39uRgCVR8jf0q9RSaTVmB566FHKMMMDgikrS12IRapJjowDVm150lZtAFFFFSMKKKKACiiigDLu4fKlyB8rciq9a88QmiK9+31rIIIJB4IrgrQ5ZXWzGgooorEYUUUUAFFFFAE0Fw0J9V7itKOVJVyp/CselV2RsqSDW1Os4aPYTRt0VQiv+0g/EVbSaOT7rg12RqxlsxElFFFWAUUUUAFFRvLHGPmYCqst+OkY/E1EqkY7sC28ixruY4rNuLppjgcJ6etRPI0jZc5NNrjqVnPRbDSCiiisRhRRRQAUUUUAFaeiad/aN8FYfuk+Z/8ACsyu58N2gttKVyPnmO4/TtXXgqPtaqT2Woma6qFUKoAAGAB2paKK+jJCiiigAooooAKKKKAKuoWUeoWbwSDqPlPoa87mhe3neGQYZDg16dXH+K7QR3cdyo4lGG+orzMyopw9ot0NM56iiivEKCirem2DaleLbrIEyCSxGentTL+0awvZLZnDlCPmHfIz/Wr9nLk57abAV6KKKgAooooAKKKKACrdlpt1fti3iLAdWPAH41a0PSTqdwWfIt4/vkd/YV3MUUcESxxIERRgADpXoYTAusueeiE2ctF4QkK/vrtVPoq5/wAKJfCEoX9zdKx9GXb/AI11lFel/Z+Hta34sV2ecXum3Vg2LiIqD0Ycg/jVWvTpoY54mjlQOjDBBFcLreknTLgFMmCT7hPb2Nebi8C6K546oadzLooorzxhRRRQAUUUUAFFFFABRRRQAUUUUAFegeCPD8ZsJr+8iDfaVMcasP4OhP4/y+tcloGkvrOrRWoyI/vSsP4VHX/D8a9jjjSGJIo1CogCqo6ADoK7cHR5nzsDxnW9Lk0fVZrR8lQd0bH+JD0P+e9Z9epeNNF/tPSjcxLm5tgWGOrJ3H9f/wBdeW1hXpeznboAU+KJpm2qPxplatrGI4R6nk0qVPnlYGyJbBAPmYk+1JJYLj5GIPoau0V2exha1ibmK6NGxVhgim1o30YaLf3Ws6uKpDklYpBXW6DOJdNVM/NGSprkqv6Tfmxust/q34YVphaip1LvZiZ3+jjOpRn0BP6V01c1oTrJeo6EFShIIrpa9kSOTvm3X85/2yKr1Nd/8fk//XRv51DTEFcr4hnEt+IweI1wfrW/qF8ljblyRvI+VfU1xkjtLIzscsxyTXBjaqUeRDQ2iiivMKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALmkvs1e0P/AE1UfmcV6LXm+n/8hO0x/wA9k/mK9Ir2srfuS9SZHCeJV265Mf7yqf0A/pWTWz4o/wCQy3+4tY1eZif40vVlLYKKKKwAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopdrbQ2DtJwDjg/5yKAEooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiinRoZJAg6mhK+gFqxhy3msOBwPrWhTUQRoEXoBTq9KnDkjYkK67w/KJNMC90Yg1yNaOj6h9guvn/ANU/De3vXRSlyy1EdlRSI6yIHRgykZBHelrvAKKKo6nqMdhbk5BlYfIv9aTaSuwOc12US6pJjooC1m0ruXcuxyxOSaSvOk7tsAoooqRhRRRQAUUUUAFZ99DhvNUcHg/WtCmugkQo3QioqQ542AxaKdIhjkKHqKbXmvTQoKKKKACiiigAooooAKKKKAHrNIvR2qQXcw/j/SoKKpTktmBP9rmP8f6Uxp5W6u1R0UOcnuwDOeTRRRUgFFFFABRRRQAUUUUAFFFFACqMsB6mvTIIxFbxRj+FAv6V5pHxKn1FenZyM16+VL4n6EyFooor1xBRRRQAUUUUAFFFFABWJ4piD6Rv/wCebg/0/rW3WT4kIGhze5X+YrDEq9GV+wI4SiiivmCxUd43DozKw6FTgihmZ2LMSzE5JPJNJRR5AFFFFABRRRQAUUUDqKAPQ9HtBZ6XBGBhioZvqf8AOKvUi42jHTHFLX1kIqMVFdCAoooqgCqGs2gvNLnjxllXev1H+cVfpr42NnpjmpnFSi4vqB5hRRRXyZYUUUUAFFFFABRRRQAUUUUAFFFOikaGVJUxuRgwyMjI9j1oA9U8H6L/AGTpIllXFzc4d8jlR2X/AD3NdFXk/wDwmuv/APP6v/flP8KP+E11/wD5/V/78p/hXpQxdKEVFJgesV5N4u0X+yNXZolxa3GXjx0U91/D+RFL/wAJrr//AD+r/wB+U/wqnqPiHUtWtxBezrIituA8tQQfqBWVfEU6sbWdwMutiFg0KkelY9WrW58r5H+7/KsKE1GWomaVFNV1YZVgRSPIkYyzAV3XVriIrxgtu3vxWXU9zcGd+OFHSoK4K01KWg0FFFFZDOi8JanNbaxFDndG4YYP0J/pXo8eoQuPmypryPSJfJ1e1fp+8A/Pj+teiV7WXWnSafRksytS1Ozhv7hWmGRITisi68QxqCLdCzerVR8SxeXrUp7SKrD8sf0rIrlr4qpGbgtLDSJbi5luZTJKxYmoqKK4G23djCiiikAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBc0lN+r2g/6aqfyOa9FrhfDUXma3E3aNWY/lj+td1XuZZG1JvzJZwniVt2uTD+6qj9Af61k1d1eXztXun6/vCPy4/pVKvIry5qsn5spBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAPhhe4mSGMZdztA967W50ON9DWyjA8yMbkb1fv+f+elUPCum4DX8i9crFn9T/T866ivawOFXsnKa+L8iWzy8qVYqwIIOCD2pK6DxRpv2e5F5Gv7uY/Pjs3/ANeufryq1J0puDKCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtCxh2p5hHLdPpVS3i86UL/AAjk/StYDAwOldOHhd8zExaKKK7BBRRRQBcstUurHiJ8p/cbkVrJ4oG357Xn/Zf/AOtXO0VpGpOOiYjcn8TTOCIIVj/2mO41jSzSTyGSVy7nqSaZRSlOUt2AUUUVAwooooAKKKKACiiigAooooAp30O5PMA5Xr9Kz62yMjB6Vk3EXkylf4TyPpXHiIWfMhoiooormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAADgg16RYTC4sIJQc7kGfr3rzeuu8KXwktntHPzRncv0r0ctqKNVxfUTOjooor3SQooooAKKKKACiiigArn/Fk4SwjhzzI+fwH+RXQVwniK9F5qbKpzHENg+veuLH1FCi11eg1uZNFFFfPFBRRRQAUUUUAFFFFABRRRQB6Fo12LzS4ZAcsq7H+o/zmr9cFourNplyd+WgfhwO3uK7mGeO4iWWJw6N0INfR4PEKrTS6ohqxJRRWt4etUuNS3SDKxLvAPc9q6ZyUIuTBakcGhX9xGHEQRT03nBP4Vj+JorjRdMmeeMqXGyNgcgk+/wCtemM6opZjgD1rn9aii1m0ltJlzC6lRnsex+tef9Yq1E0i+VI8IopXQo7Ieqkg0leGAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACgkdCRSEk9TmiigAooooAKKKKAFVijhlOCpyK9MglE9vHMvR1DD8RXmVdx4ZuvP0lYyfmhYofp1H+H4V6eWVLTcO4pFDxfb8W1yB6xsf1H9a5avQtZtPtulTxAZcDcn1HP/1q89rPMafLW5u4IKKKK4BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB1PhC34ubkj0jU/qf6V0k8ogt5Jm6IpY/gKqaNafYtKhiIw5G5/qef8A61VfE115GktGD80zBB9Op/w/GvoqS+r4a76IndnEMxdyzHJY5NJRRXzpQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABUttGktzGkkgjjJ+Zz2FRUU1owO+i1fSYYkijuolRAFUDPAp/9uab/wA/kf6159RXorM6i05ULlO6vNR0m9tJLeS7j2uMZ54PY1wzrsdlDBsEjI6GkormxGJddpyVmhpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigByuyZ2sRn0NL50v/PR/wDvqmUU7sB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76pGdnxuYnHqabRRdgFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKns7uSyuknjPKnp6j0qCimm4u6A9JsryK+tlniOQRyPQ+lWK880zVJtMn3p80Z+8h6Gu3sdSttQiDwuN3dD1FfQ4XFxrKz0kQ1YuUUUV2AFFFFABRRWLq2vw2KtHCRJP6Dov1qKlWNOPNNgLr+rCxtjDG37+QYGP4R61w55OTUk88lxM0srFnY5JNR187icQ68+bp0LSsFFFFcwBRRRQAUUUUAFFFFABRRRQAVZs9QurF91vKy56r1B/Cq1FOMnF3i7AdHF4vnVcS20bn1Viv+NamiePDZ6ojS2yxwONkjbixUHv09cVxFFdLxldqzldBY95+1/bI1lWUSRsMqynII9qyde1u30XT3ld1M7KRDHnlj9PSvJLe/vLRSttdzwg9RHIVz+RqGWWSaQySyNI56s5yT+NaPG+7aKswGkkkknJPWiiiuEAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtrwze/ZtT8ljhJxt/4F2/w/GsWlVijBlJBByCO1aUqjpzU10A9QrgdesfsOpuFGIpPnT8eo/OvSPB0Uev2y3cv3IxtkUd39Pp3/EV2VzYxSWpjSJBt+6oUY+levjJ060VFetxRTPnKivQfGfhi2WyfUrKJYpIuZUQYDD1x2Irz6vIq0nTlysYUUUVmAUUUqqWOACT7UAJRVhLKVuuFHvUo0/1k/IVoqU30C5Soq8dP9JP0qJ7GVemG+lDozXQLlailZWQ4YEH3pKzAKKKKACiiigAooooAKKKKACtPQbH7dqaBhmKP53/DoPzrMAJOAMk132h6b/Z1gA4/fSfNJ7eg/CuvBUPa1ddkJs064jxNe/adT8lTlIBt/wCBd/8AD8K6rVL5dP0+Sc4342oD3Y9P8a88Zi7FmJJJySe9d2Z1rRVJddxISiiivGKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACit/SdFimgW4uQWDcqmccepq3d6DayxHyF8qQdCCcH611RwlSUeYVzlaKVlKOVYYYHBFJXKMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKfFLJDIHidkYdCpxTKKL22A37TxVdQgLcIsw9ehrVi8VWDj5xJGfdc/yri6K7KePrwVr39RWR3J8TaYB/rXP/AAA1Wn8W2yg+TDI57Z4FcfRVyzKu9rILI1b3xDe3gKhvKjP8Kf41lHk5NFFcc6k6jvN3GFFFFQAUUUUASW9vNdTLDAheRugFWL3SrzT1VriLajHAYEEZ9OKt+HL6Cy1FmnIVZEKBz2OQf6Vs+ItUs30x7eKaOWSQjGxt2MHOc/hXZToUpUHUlLVCvqcfRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA9J+FupRwx3lkzAMXEmD3BGM/hgfnXp9fNtpeXFhdJc20rRyochh/nmvS/D3xEuLyP7JdQQ/aVHyMCQHH09a7KElO0Oo07G7442Wnhy+nxxJGY8f7Tcf/XrxGvWdRvptUJFyVZCCPLA+UA9eK891vRn02YyRgtbOflP932NbYzDVIxU3rYV7syKKKs2lv5rbm+4P1rz4xcnZAJb2rS/MeE/nWhHEkQwq4p4AAwKWu+nSjD1JuFFFFaAFFFFADHjSQYZQRWfcWjRZZOV/lWnSdazqUozWoXMSirV3beWd6D5T1HpVWuCUXF2ZQUUUVIBRRRQAUUVr6Joz6lMJJAVtkPzH+97Crp05VJKMdwLnhrSDLIL6df3aH90D/EfX8P89K66moixoqIoVVGAB0Arn/EmsCCI2UDfvXH7wj+FfT6mvoIxhg6Ov/Dsjcx/EGp/b73ZG2YIshcfxHuayKKK+fqVJVJuct2WFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB2ek3CT6bDtPKKEYehFW3dY0LuwVVGST2rhYLia2ffDIyH2PWpLi/urpds0zMvp0H6V6MMclCzWorEdzKJrqWUDAdyw/E1HRRXnt3dxhRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKANHRdGm1u8a2gkjRgpbL5xitDV/CF5o9gbuaeB0DBcJnPP4VH4U1e20bVHuLrfsMZUbFyc1t+JvFem6tozWtsJvMLhvnQAYH410wjSdJtvUDh6KKK5gCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigApyO0bq6MVZTkEdQabRQB3Wia0mpReXIQtyg+Yf3vcVqSxJNE0ciBkYYKnoa8zikeGRZI2KupyGB5Fdpo2vx34WC4Ijuf0f6e/tXuYPGqovZ1N/wAyWjF1bw9LaSeZbAyW5P1KfX296ZGgjQKOgrvYFyxJ6CszUfD6TEy2mI37ofun6elE8HGEnKmK5zFFPmglt5DHNGyMOxFMrEYUUUUgCiiigAooooAayh1KnoayJUMchQ9jWzVDUE+ZX9eDXPiIXjfsCKVFFFcRQUVLb2011KIoI2kc9lFdVpXhiOAia9xJJ1EY+6Pr61vQw1Ss/dWncG7GXo2gSXxWe4Bjtuo7F/p7e9dnFEkMSxxoFRRgKOgp44GBWJrOvx2AaC3Ikuf0T6+/tXt06dLCU7v7yNyTW9aTTYvLjIa5cfKP7vua4d3aR2d2LMxySepNEsjzSNJIxZ2OSxPJpteNicTKvK726FpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopVVnYKoJZjgAd6AEorrLnw6q6CqIoN1FmQkfxHuP8+lcnW1ahOi0pdQTCiiisQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACgHByKKKAOv0DxC6Q+XekuucCTuPr611sUsc8YkidXQ9CDXmlgf3B+taVreXFnJvgkK+o7H6ivZw+IkoLm1JZ29xbQ3UeyeNXX3HT6VhXfhrq1pL/AMAk/wAams/EcMmFuk8tv7y8r/iK2Ypo5kDxSK6+qnNddqdURw9xYXVqT50DqP72Mj8+lV69DqpNpdlcEmS2TJ7qNp/SspYbswOHorqpPDdm3KPKn4gj+VV28Lj+G7I+sf8A9es3QmBztFdB/wAIu/8Az9j/AL4/+vTl8Lj+K7J+kf8A9el7GfYDnarXwzb59DXZx+G7NeXeV/xAH8qsnS7GCP5LaPPqw3H9abwspqz0C551a6deXhHkW7uD/FjA/M8VvWXhLo97N/2zj/qa6imTTRQRl5pFjQd2OBV08upU9Z6/kO422tLezi8u3iWNfYdfqe9Ommit4mkmdUQdWY4rBv8AxVBEClmnmv8A32GFH9TXMXl/c30m+4lLnsOw+gorY+lSXLT1/ILG3qvid5g0NjlE6GU8Mfp6fzrnCcnJoorxq1adaXNNlWCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArovC+m+dcG9kX5IjhM929fwrCtbaS7uY4Ihl3OB7e9ejWltHZ2sdvEPkQY+vvXoZfh/aT53svzE2TVw3iLTfsV95sa4hm+YY7HuK7mqep2K6jYyQNgN1Q+jdq9XF0PbU7LdbEp2POqKdIjRSNG6lXUkEHsabXzRYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAXdPfl0/Gr9Y8EnlTK3bvWuCCMiu7DyvG3Yli0+KaWB98UjI3qpxTKK3A14PEV5FgSBJR/tDB/MVoxeJrZv9bDIh9sMK5eitVWmuojtI9a0+TpcBfZgRU639m3S6hP/bQVwlFWsRLsB3v2u2/5+Iv++xTWv7Net1CP+2grhKKf1l9gO0k1rT4+twG9lBNZOo+K7aFQsUEkjH1wo/rWBWVcy+bMSOg4FYV8ZOEfd0Y0jVufFN/NkRCOBf8AZGT+ZrImnmuH3zSvI3qzZqOivMqVqlT43coKKKKzAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA0dI1OPS5XlNt50jDap37do79jWv/wAJj/04f+Rv/sa5eiuini61OPLB2XogsdR/wmP/AE4f+Rv/ALGj/hMf+nD/AMjf/Y1y9FafX8R/N+C/yFZFzVL2PULs3CW/kswG4bt2T69BVOiiuWUnOTk92MKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq/ZXGR5THkdKoUAkHI61cJuDugNyiqdveBgFkOG9fWrlehGakrokKKKKoAooooAKKKq3F2sYKoct/KplJRV2Al5cbF8tT8x6+wrOpWJYkk5JpK8+pNzdykFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVNFdSRcZyvoahopqTi7oDRS/jb7wKmpRcwn/AJaCsmitliJrcVjWNzCP+WgqN76NfugsazaKbxEugWJ5buSXjO1fQVBRRWEpOWrGFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD//2Q=="
-         id="image3762" />
-    </g>
-    <path
-       fill="#130f45"
-       fill-opacity="0.7308"
-       d="m0 0.503937l960.0 0l0 540.0l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3766" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 47.711285l157.23622 0l0 62.895016l-157.23622 0z"
-       fill-rule="evenodd"
-       id="path3768" />
-    <g
-       transform="matrix(0.31447244094488186 0.0 0.0 0.3144750656167979 50.824146981627294 47.71128608923885)"
-       id="g3775">
-      <clipPath
-         id="g3a04b465b0_0_0.2">
-        <path
-           d="m2.842171E-14 0l500.0 0l0 200.0l-500.0 0z"
-           clip-rule="evenodd"
-           id="path3770" />
-      </clipPath>
-      <image
-         clip-path="url(#g3a04b465b0_0_0.2)"
-         fill="#000"
-         width="500.0"
-         height="200.0"
-         x="0.0"
-         y="0.0"
-         preserveAspectRatio="none"
-         xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAYAAAAeGRPoAAAOPklEQVR42u3dbZHqwLqA0S0BCUhAQiQgAQlIQAISkIAEJCABCTjoc3ZVuGcuNWxC+u1OJ6xUrT/7Y4av9JN0QvInpfQHAJg3LwIACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgexEAQNABAEEHAAQdABB0ABB0AEDQAQBBBwAEHQAEHQAQdABA0AEAQQcAQQcABB0AEHQAQNABQNABAEEHgAG6/zqMtPvxc9Y//nyf+ZhWT79H0Bux7j8w2xcfiH3/950VCxjp71gydum8dqOXy9OGQdTr+vyYBH3irb3LyA/I9b9O/ZbfykAFCPosg37J2AlMgj6dTR/he4pfzv3evUELEPR6U+7PO2Xvpty7oNf2JOjTfRAuqc5ye/rwAAh6vdd0SA9S5l76+sV7JOiFj4vXCvlvU/JWQEDQ2w96+nCG9STode1TG8vBCgcIevNBv2XunQt6Aav+eHZLy8WJc4CgNx30NPBw6UnQ68X8mtpcrqIO4iPoTQf9lvF/Bf1LYi7qgKC3GfTug730y1P8O0Ev45zmsVysgCA+gt5M0H8L9ZD/txP0ZZ8A50Q5QNDnF/TnP9sP2Dv/I+hlvpp2T/NbNlZEEHRBbyLoz8G+Px0efTUtL+jBTmmei6l3EB9Bbyfo63/MpF5ejN2CHrx3PufFCgqCbrxoI+jPO4iPvfTdP94HQQ90DA7svd/6OvziXGBq3146CLqgtxP0553Ec3+8/NWYLeiBbkFhvaXh11/fBE/zr62QIOiC3kTQ3x3G7QS9jE1QUA8Zvz/ie+97KyQIuqA3E/T1BzOqgh5k30hMc/fWz1ZIEHRBbybor96nTtDbPX4eefw6Z0/9ZoUEQRf0poK+ejpn6pLxswR9gEtm0LeBjyX3bHsrJQi6oLcT9D99Ix4nRa8Fve2gRz+es6ADgr6YoP+p/LMEvYHp9p9v7GEkKyUIuqAj6I5bsyCrfuDuDODFrX+8zhtBR9DnO+W++vKB7HF86PLmpL5b/2+O/bcCNpUf5yczHd2HP3vfHyp59fyv/d/vU5nrBXQ/3oP7gI3QGo9lqE8ew+bH87z9Y9bs7zdGdgXWzVX/eT8OHDeuBR/LXIL++DycB7xml/7fHWx0CPpUQT98YcT3Kea787d+wOsqDCqfLKeBP3PsZ+cS8JzX/ePMvergNQ2/GFKJ0Az53bs0/uJPp4ANly7F3Fb5HPhZbzXoj0ucRt2G+lxog4iFBv2Q+YG7p++4SltOwIbGfddI0O9vQhr1OlxGzFQ8Ql7i9d9OsD6d3pwdfAt6fqcRUeiCNlwj3vfWgx61gfmvdfKYXBFT0N/YBnzYrgv+oJUOeY2wdyMex+bFnmKJAeuQ6mx8lgpfzmN8tfF0KhSFIRstq8A9zH8t+zT/oK9S/TtVHuyxC/q/PpA1B4s5nVR1TNMtl8CNpC5gsD1NGNJV5Y2qa8aAOSY0m6fnep0wpJvAWYGowzutBn1fcI+81owSCwt67ne/fzvmM/e99dqDWumNpDFBv1SM+b9CWiNwkVEfE5rDBM/19OJzP0WgTmleQa81gzFkOQqtoJeYdv9tJZ1j2HepvSX3WvndyN97mGCW4tRAzH9GvUZobul/Z0LXXHYNxHxsmKYK+mbiz+SrjW9T8IL+/9wKDtBzCXuLMc+dmswJ+pSDe9fIwFkzNFMsu36D/t7AY9mmtoO+aeR1ipxRYqFBLz3oR35l5dtinrunPregt7Z0ablBb2m5fxCl2kFvOeaiLujVzqz97UPX2vcqdzMa9MacAS/o+VOagl5nqfGNh0+Dvp5BzCNm8lhY0Gses2zle5WbGa2sj9ft09dM0OttSAl6nb30mkG/zuw1zD3nhoUEfaqt0Usqd1GVVjZgptpjFPS6r7mg19lLrxX04wxfv2+52JegN77X+jjbt9Z0/KHAivS4FvNfP+8DfE6xJx5+sgEk6DHLJgl6rXGghaCXWG8e93M49OvwLv3v2yTX4N8jwoLexNcz7hXCvg5eebYfDBKXoNdolaYN+uOwyfbHIPm4y9m+8ufncROQ7sfr0qXY62of03RBf2zs/ryj2eMuZ8dU77oJtd7zbZo+6NfA927oeUPr/vWN2KFygxdBb+oCCvdU7uYvp6AVdexKE/FVoaGvTYmgD/3d+8KfkaEXMuoCold6z/HVOjD0cq2lT2odupEd8Z6f0rRB3wW9d2OPZ68DNijspQt6c5c4zA1nqb3z3Gt+RxzauKX6Qb+nz2+sUepbBLtU//yQdaoX9DFfQyp1Dfja7/ktTRv0iI2/iFsk576f9tIF/eVgOPXlDo9B0/C5K0nkV0Nyoz5k7y0y6F2abkZkzAxBdGh2qU7Qbxmf9ejp96ne8/VEQc+9cmb098GvjYxVgr7AJ1X77mO/rSw5W76rzICWmMbKmaI8Vwx6zuGP6HMWproq4rvj6IeJIxo9IzLle76dKOg5Oy73FLNnHvU63oVY0IcOGlOeNLeZYLD75ES0mpGpEfRbwHO/NhC73K8ivduYiAj6OfP5Rd5Bccr3/DBB0HNfu1J3QDs0+JgE3R775FHPmQYsecGGXcHARQT9MPGgFDlD0mV+7ko/x4g9vOsC3vPzBEHfTvzZLLGXbtpd0Ed94E6p7slzY6I+9vHdCr9+q4IDb0TQIy5UEXFXv93Er3VKZYN+Dfo8HRfwnl8mCPqx0M+d8jbX1yTGgp4xWNacjv/kqkjrzIH2UNitwMAXEfSoASFiwyLqkEepKf/coEd9TfOwgPf8PkHQrxmPtfT4kDMTKsiCHnIGd9RFEiKmurZpmcs9lQ1pVGRWld7nIS6FgpAb0qi9vN1C3vPaQV/q4utrgh5+jLjksfYhx7eXfFnOkkGPHAxylmNaftBbuR3ytpH3vGbQNwseH6a4V4agf4HHsfYSe6nvpmOPC15hu4KD+7qRwT1yUGox6JHnaSzlPa8Z9CXf86DUFTcFnf+bijtW/tBeFrzClgz6n0YG98iZghaDHnlIYSnvec2g7xY8PhyT5gh6pT32qNDe0vcGfVtocL81NLhHXrCjxaBHfr2o5Ffzlhr0JR+Sc113Qa9+vfjSYVty0A+FBvfLDAb3pQQ9clp06e+5oAu6oDcuYsrrKOiCLuiCLuiCLujz31O/CrqgC7qgC7qgC3obroUGAUEXdEEX9C6VPewn6IJe3djlltqfen918tRpwSvsNgm6oAt6zvu35K+tCbqgv1xWjT++b5xS65KgC7qgC/rvixu0LDzoOdPa28YfX/T3TOe+dSvogi7ow96/lndyEPQiA9qp8cdX4tKOK0EXdEFffNDH3iDJPccFfVK5x5PXMwx6zuCyE3RBF/TFB33suHgWPEGf89fDSu+llzqefG5kkBN0QRf09oKec0LuWvQEfSoRdxbqCj22bcHHlbMhsxV0QRf0RQd9nfFz7aUL+qRy71N+L7RVeik48K8zn+9K0AVd0Bcb9DmcMIygF/te9i3F3jTjEPB43v2Oc8bPvxaK+qZ/7mMIuqALelzQc6bd78Hj4cMqY3xwKOBLgh71vct7ijlpLOJ2qkOmvXKn9C/BUd9kzJZcDe6CLuihQV9lzl5GR32VOWsg6F906ddbilsuI6ectoGPY1fpeV+DVtpt5uCxM7gLuqCHBj1ipvDvOr0PeO3WmTF3QZkvC/ouxS+3/oO0fRG9Tf93x+ANivTBnnPU8z6N3AJeZ079Dz28IOiCLuifBz13L/3naznm5OHHFHvuY9gkIf66m7NER3Wq5VxxUP/td+/exH3d/5tz0O/cGdwFXdCLBD36UtHXfo998ybi234nIWJjwt75lwZ9Kdcw/nRLeFPwsVyelPj5BndBF/Sy48S10PhwfRofoneqSn0DSdBn4pjmvYwdhOZ4w5ZPV1ZBF3RBHxf0zUzHw30S4K8Oeu6ZlHMKXMmp9xrLzuAu6IJebSZvN7PxYc5XtRT0QOugYzdz2xqd08bMyeAu6N7zqkGPumZHjeWW3PlN0FPMd6LnEri5bsxcDO6C7j2fJOhziHqpi9ow46DPKeqnAs+71T31nCvUCbqgC3p+0FuOupgL+mzjViLmLU+/nzKn0QRd0AU9JugtnkAcffltFhj0R9xa3CI9VHjuxwU9V0EXdEGPC/rjRLkWZjGjL0PNgoNe4tKsuVui3Zc878jnKuiCLuixQX+cdzPlN2QOSWQFPWNvPeJShGOPDx0m2hKt/bxLPFdBF3RBjw/6z731mhv+l+SiMYIeGLh9pQ/wbcKQ/7Y1XjLs936av8SKKuiCLujlgl4r7OfKM5R8QdCfB43oG6z8Ddvjxi6tbtBEXo/9cQ34VeH3SdAFXdDLBv3nax91PfbHTo09ckGvvge76wM/9NrEt/7fHtP7Gxe0Gvdtv8INec6P53vo/98q1Z1dGGMX/FgOGaL3psY+jvWbwXzsz+2854Pf867Q+1fi20L7fsP93Ubkvf83p/T+Rk8I+uTB/7avVnTJGajA6zFRtAUdABB0AEDQAUDQAQBBBwAEHQAQdAAQdABA0AEAQQcABB0ABB0AEHQAQNABAEEHALwIACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agu5FAABBBwAm9x+vDo6+g0o7jgAAAABJRU5ErkJggg=="
-         id="image3773" />
-    </g>
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 232.3622l751.43304 0l0 69.60631l-751.43304 0z"
-       fill-rule="evenodd"
-       id="path3777" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 305.27505l362.74014 0l0 52.125977l-362.74014 0z"
-       fill-rule="evenodd"
-       id="path3779" />
-  </g>
-  <rect
-     style="fill:#120f45;fill-opacity:1"
-     id="rect3791"
-     width="148.53281"
-     height="54.267715"
-     x="59.527557"
-     y="56.338581" />
-</svg>
+<svg version="1.1" viewBox="0.0 0.0 960.0 540.0" fill="none" stroke="none" stroke-linecap="square" stroke-miterlimit="10" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><clipPath id="g3a04b465b0_0_0.0"><path d="m0 0l960.0 0l0 540.0l-960.0 0l0 -540.0z" clip-rule="nonzero"/></clipPath><g clip-path="url(#g3a04b465b0_0_0.0)"><path fill="#ffffff" d="m0 0l960.0 0l0 540.0l-960.0 0z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m-2.6246718E-7 0l960.0 0l0 539.99945l-960.0 0z" fill-rule="evenodd"/><g transform="matrix(0.5 0.0 0.0 0.49999947506561676 -2.624671916010499E-7 0.0)"><clipPath id="g3a04b465b0_0_0.1"><path d="m0 0l1920.0 0l0 1080.0l-1920.0 0z" clip-rule="evenodd"/></clipPath><image clip-path="url(#g3a04b465b0_0_0.1)" fill="#000" width="1920.0" height="1080.0" x="0.0" y="0.0" preserveAspectRatio="none" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAQ4B4ADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDxaiiivYJCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiirC2crqGG3BGetNRctgK9FWfsM3+z+dH2Gb/Z/Oq9nPsFytRT5Ymhba2M4zxTKlpp2YBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArYg/wCPeP8A3RWPWxB/x7x/7orpw27EySiiiuwRm3/+vH+7/U1Vq1f/AOvH+7/U1VrzqvxspBRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa0MiCCMF1ztHesmitKdTkdwaNnzY/76/nR5sf99fzrGorb6y+wrFm+YNOCpBG3t+NVqKK55S5ncYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFWrXTby9jMlvAZFB2kgjrU/9g6p/z6N/30P8a0VKpJXUX9wGdRWj/YOqf8+jf99D/GobrTLyyjElxAY0J2gkjrQ6NRK7i/uAqUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABWvB4X1i5gSeK0Zo3GVORyKyK9V0XXtKg0W0ilvokkWIBlJ6Gt6FOE21J2A8wurWayuXt502SocMvpUNaviS4iutfu5oHDxs+Qw6GsqspJKTSAKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA7Hwj/yDZv+ux/kK6Cuf8I/8g2b/rsf5Cugr6XB/wACJD3CsHxb/wAgqP8A67D+RrerB8W/8gqP/rsP5Gni/wCBL0BbnGUUUV8yWFFa2haQNSnZpCRDH97Hc+ldcuk2Cx7Bax7fcV20MDUrR5r2Qmzzuiug8QaIlkoubYERE4ZfSufrnrUpUpckhhRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHY+ET/wAS2b/rsf5Ct/I9RXmAZl6MR9DS+Y/99vzr06OY+zpqHLt5isenZHqKwfFh/wCJVH/12H8jXH+Y/wDfb86QszDBYn6mitmPtKbhy7+YWEooorzBnXeEpUNrNFn5w2ce1dHXmtpeTWU4mgbaw/I1vr4vcR/NaqX9jxXs4THU401CeliWjU8SSpHo8iseXICj3rhauahqdxqUu+Y8D7qjoKp1wYuuq1TmjsNKwUUUVyjCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAqVLaWRQyrkH3qKtW0/49k/GtaUFOVmDKP2Of+5+tI9rMilmXAHXmtaobr/j2f6VvLDxSbFcyaKKK4xhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFSpazP0Qgep4ppN7ARUVcXT2P3nA+gqQafH3djWioTfQV0Z9FaX2GH1b86Q2EXqw/Gq+rzC5nUVfbTx/DIfxFQvYyr0w30NQ6M10HcrUU5o3Q4dSPqKbWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAqKZHVFGWY4Art9N8PWttCrTxiWYjkt0FcfYSLFfwO/3Q4zXpAIYAg5B6V6uW0oSvKSu0JmZe6DZXURCRLFJ2Za4a4ge2uHhkGGQ4Nem159rcqTavcMhyu7GR3qsyowjFTSsxIz6KKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtW0/49k/GsqpkupY0CqwwPataU1CV2DNaobr/AI9n+lUfts/94fkKa91LIhVmGD14reWIi00KxDRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKlgt3nPHC9yaaTbsgIgCxwBknsKuRWLNzIdo9B1q3FAkI+Uc9yetS1108OlrIVyOOCOL7qgH171JRRXQklsIKKKKYBRRRQAUUUUAIQCMEZHvVaWyjflfkPt0q1RUyhGW4GRLbyQn5hx6jpUVbZAIwRkVSuLIHLRdf7tctTDtaxGmUaKCCDgjBormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVtaf4kuLKIRSKJYx0yeRWLRWlOrOm+aDsBv3vii4uIjHBGIgRgtnJrAJycmiiirWnVd5u4BRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU6ON5XCRoWY9ABk1v2XhWeUB7qQRKf4Rya1pUalV2grhc56iu7g8OadCOYTIfVzmrQ0qwAwLOH/AL4FdscsqPdoXMedUV6DJomnSjm0jH+6MfyrMuvCcDgm2laM+jcipnltaOqswucjRVy+0u709v30fy9nXkGqdcMoyi7SVmMKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAorqND8F3WpxrcXLm3t25Xj5mH9K6dfAOkKmCZ2P94vXRDDVJq9gPOLa2Mx3Nwg/WtJVCKFUYArqtQ8GtBEXsJDIFH+rbr+BrmGVkYqwIYHBB7V1Qo+zViWJRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAV7m2WYZHDjv61mMpVirDBHatuq11biVdyj5x+tc9ajze8twTMyijp1oriKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1YWE2oXAhhH1Y9AKgiieeVYoxlmOAK9A0vTo9NtFjUAueXb1NdeDwrry12Qm7CadpVvpsQEa7pCPmc9TV+iivoYQjBcsVZEhRRRVAFFFFADZI0lQpIoZSOQa5HW/D5tQ1zaAmLqyd1+ntXYUhAIIIyDWFfDwrRtLcE7Hl9FbPiDSvsFz5sQ/cSHj/ZPpWNXzlWnKnNwl0LCiiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACGkpqutKJVzDCPMcevoPzrArt/hyy/ab1f49gI+ma2oRUqiTA9AAAGAAAKWiivaAK4zxhpyxSx3sa4Eh2vj17Guzrn/GDKNGAPUyDFTNXiJnB0UUVzCCiiigAooooAKKKKACiiigAooooAKKKKACit/TfCl3exrLOwt4zyMjLH8K1j4KtduBdS7vXAxVqEmFjzq+g2nzVHB61TrtdX8L3VjEzjE8HdlHI+orjJEMchQ9Qa8/EU+SV+40NooornGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFXtN0e+1aXZZ27OB1c8KPqaaTbsgKNFehab8PYEAfUbhpG7xxcL+fU/pXTWeh6ZYgfZ7KFCP4iuW/M811Qwc5b6AePRWN3OMw2s0n+5GT/KrH9iaqRn+zLz/vy3+Fe04A6CitlgV1YHiEmnX0IzLZXEY/24mH9KrV7xgVUutLsL4EXNpDL7sgz+dKWB7SA8Sor0nUfAFhOC1lK9s/ZT8y/rz+tcZq3hzUtHJNxDui7Sx8r/APW/GuWph6lPVrQDJooorEArW0nQptR/eOfLgz97HJ+lQaPp51HUEiP+rHzOfavQI0WNFRFCqowAO1ejgsIqvvz2E2UbbRLC1UbYFZv7z8mrRtbcrgwR4/3RU1Fe1GnCKskSZF54dsbpSUTyX7Mn+FcjqOmz6bNslGVP3XHQ16LVW/so7+0eCQdfun0PrXJicDCpG8FZjTPOKKfPC9vO8Mgw6MVNMr59qzsygooooAKKKKAOk8KWIkmku3HCfKn1rrazdBgEGjwDHLDcfxrSr6XCU1ToxXzIYUUUV0gFFFFABRRRQAUUUUAVNSs1vrCWBupGVPoe1edMpRirDBBwRXqFef67ALfWJ1AwGO4fjXk5pT0VReg4mdRRRXjlBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUVdtNIvb3Bigbb/ebgVsweEXIBuLgL7IK3p4WrU1jELnM0V2ieFbBR87SP/wACxUv/AAjOmf8APN/++zXSstrPsK6OGortJPCtgw+RpE/4FmqM/hFwCYLgH2cVEsvrx6XC6OZoq7d6Re2eTLA23+8vIqlXJKEou0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVreHNUbSNZinwTGx2SAdwayas2Sbp89lGaunfnVgPbIZo54llicMjDII70+vM9O1m90w4gkyh6o3INbS+NptvzWiFvZjivZVRdRXOyJAGScAVwPijVlv7tYIWzDDnnszVBqPiS+1BDGWEUR6rHxn6msionO+iE2FFFFZgFFFFABRRRQAUUUUAFFFFABRRRQAV0PhTTEvLxriVd0cPQHoWrnq7jwZt/syXH3vM5q4K8gR0lFFFdBQEBgQRkHqDXlnjPSV07UxJEuIpRkD0r1OuN8fIr21uv8AHyRWGJhzU2B5zRRRXjAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRS7W2btp25xntmkoAKKKKACiiigAooooAKKKKACiiigAooooAKACTgDJNA5OBXofhHwosCJqN/GDKeYo2H3fc+9aUqUqkrICh4d8ENchLvVAyRHlYehb6+legQW8NrCsMEaxxrwFUYAqSivXpUY01aIBRRRWoBRRRQAUUUUAFIyq6lWUMpGCD0NLRQBxXiHwPFOr3OlARy9TB/C309K8+likhlaKVGR1OGVhgg17tXN+J/DEWsQGeBQl6g4P98ehrhxGFT96G4HL+EIQLa4mxyzhPyGf610tc94V3RQXVrIpWWOXLKeo4x/Suhr0sFb2EbEPcKKKK6gCiiigDiPFEIi1gsB/rEDf0/pWLW34qlD6uFB/wBXGFP6n+tYlfM4q3tpW7lrYKKKK5wCjvRRQB6VZALYW4HaJf5VPVXTZBLpls4/55gfkMVar6yDvFNEBRRRVAFFFFABRRRQAUUUUAFcV4rUDVlPrEP5mu1rh/E8gfWCB/AgWuDMn+5+Y1uY1FFFeAUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVq6NosmpSb3ylup5b19hV06cqkuWK1Aq2Gm3Ooy7IE4H3nPQV12neHrSyAeQedL/AHmHA+grTt7eK1hWKFAiL0AqWvdw+BhS1lqyWxAABgDA9qWiiu4QUUUUAFFFFACEAjBGR71kah4etL0F4x5Mv95RwfqK2KKipThUVpq4HnN/ptzp0uydOD0cdDVSvTLi3iuoWimQOjdQa4jWdFk02TemXt2PDensa8TF4F0vehqvyKTMqiiivPGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFX9PX5Hb1OKoVp2QxbD3JrbDq8xMs0UUV3iCiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACuqLZXrQSttimwMnoG7VgUU07O4HrnUZorz/AE3xTeWKCKQCeIdAxwR+Nax8bQ7eLOTd6Fhit1Uix3OpZgqlmIAHJJrzrxFqS6lqRMZzDGNqH19TS6n4jvNSUx8QwnqiHr9TWRWc530QmzFddsjL6HFNqW5GLl/rUVePJWbRQUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdFG80qxoMsxwB702um8LabuZr6ReB8sefXua2oUXWqKCBmm2hxHQ/sQA8wDcG/264h42jkMbAhlOCD616fXJ+JtO8u4S+jX5XIEmOx9a9PH4VcinBbfkSmUV8L6y6BlsJCGGQcVlSRvDI0cg2upwQexr2C213SltIVN/ACEUEb/avJ9SdZNTuXRgytIxBHfmvPr0oQScXcoq0UUVzAFFFFABRRRQAUUUUAFFFT2VpJfXsNtEMvIwUUJXdkB0/grw+L+5/tC5TNvCfkU9Hb/wCtXpVVrCyi0+xhtYRhI1A+p7mrNe1QpKnCwBRRRWwBRRRQAUUUUAFFFFABRRRQAUUUUAc5renra3Y1aFcAjZcgd17N+H8qiBDAEHIPQiumdFkjZHGVYYIPcV53c3snhzVpNPuQz2md0Ld1U0QrRou0tn+DE0b9FVre/tbpA0M6NntnmrBIAyTgV2qSaumSLUN1cx2ds88pwqDP19qrXmsWVkpMkys3ZV5Jrj9W1ibU5OfkhX7qD+tcmJxkKMbJ3Y0rlO6uHu7qSd/vOxNQ0UV88227soKKKKQBRRRQB2vhe6E2mGEn5omx+B/ya3K4DQ9Q/s/UFZj+6f5X/wAa74EMAQcg9DX0OArKpSS6rQli0UUV2iCiiigAooooAKKKKAEZgqlj0Aya83v7j7VfzT9nc4+naut8S6iLWyNujfvZhj6L3riq8XM6yclTXQqIUUUV5YwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAp0cTzSBI0Z2PQAZqS1tpLy5SCIZdzj6V3um6XBpsIWNQZD95yOSa68LhJV3fZCbscrB4Y1CVQzhIx6Meakk8KXyLlHjf2ziu0or1FltG1tRXZ5rc2dxZvsuImQ9s9DUFel3FtDdQmKZA6Hsa4XWNLfTLrby0L8o39K87FYJ0VzR1Q07mdRRRXCMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVVLsFUZZjgAd6AL2kaY+p3Yj5ES8yN6Cu+hhjt4ViiUKijAAqrpOnrp1ikWB5h+aQ+pq9X0WDwyowu93uQ3cKKKK7ACiiigAooooAKKKKACiiigAqOaGO4haKVQyMMEGpKKGr6MDz3V9MfTLwx8mJuY29RVCvQ9W09dRsXiwPMHzIfQ156ysjlWGGU4IPY187jcP7GemzKTEooorjGFFFFABRRRQAUUUUAFFFFABRRRQAVqWf8Ax7J+P86y607I5th7E1vh/jEyzRRRXcIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAMq7/AOPp6gqW5Obl/rUVeZP4mUFFFFSAUUUUAFFFFAGvaeHLy8tUuI5IQjjIDMc/yqf/AIRK/wD+etv/AN9H/Cui0H/kCWv+6f5mtGvcpYCjKCk+qJucZ/wiV/8A89bf/vo/4Vnalpc+lvGk7RsXBI2En+leiVyXi/8A4+bX/cb+YrLF4KlSpOcdwTOboooryCgooooAKKKKACigDJwKCCpwQQR1BoAsWNo99eR26dWPJ9B616JBCltAkMYwiDAFY3hnTfs1qbqRf3so4z2Wt6vfy/D+zp873ZLYVFc26XVtJBIMq4walorvaTVmI81vLV7O7kgkHzIcfX3qCuw8T6b59uLyNf3kXD47rXH18ziaDo1HHp0LTuFFFFc4BRRRQAUUUUAFFFFABXZ/D7TxLfTXzjIhXav1P/1q4yvVvBNqLbw5E+PmmYuf5f0rpwkOap6AdFRRVuCxeX5n+Vf1r1pSUdWBUAJOBU8dnNJ0TA9TWpHbxQj5VGfWpa55V+xVjOXTW/ikA+lPGmJ3kb8qvUVHtZ9wsUTpq9pD+VRtprj7rg1pUUKrPuFjFktpo/vIceoqGugqCW0il6rg+orSNfuKxjUVYntJIefvL6iq9bppq6EFFFFMArjviBp4m06K+UfPC21j/sn/AOvXY1R1m1F5o13ARndGcfWs60OeDQHiysynKkg+xp5nmIwZZMf7xqOivETaADyeaKKKQBRRRQAUUUUAFFFFABXU+HdbG1bK5bBHEbn+RrlqM4PFbUK8qM+aINHqNFcfpXiV7cLDeZkjHAcdR/jXVW93Bdx74JVdfY9K+goYmnWXuvXsQ1YmoooroAKKKQkAZJwPU0ALVTUNQh062Msp5/hXuxqhqPiK1tAUhImm9AeB9TXIXl7PfTmWdyzHoOw+lcGKx0aa5YasaQl5dy3ty88pyzHp6D0qCiivBbcndlBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6rwjaDy57thyT5a+3c/0rp6xPCxB0YY7SNn9K26+lwcVGhGxD3CiiiukArM160F1pE3HzxjzFP06/pmtOoLwgWU5boI2z+VRVipQcX2A81ooor5QsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK2/DFkLjUTOwykAz/wI9P61iV3Hhi28nSFkI+aZix+nQfyrswNL2lZX6aiZs0UUV9ESFFFFABRRRQAUUUUAFFFFABRRRQAUUVZ0+IS3iKeg5pN2VwL9lpi7BJOMk9F9KpapYxQXG9IkCyc8L3710NUtVi8yyLd0INcsajc7sprQ46+0SyvUOYljk7Ogwf8A69cTf2Mun3TQSjkdD2Ir0iuf8V26vYJPj5o2xn2NY47CwlTdSKs0JM46iiivCKCiiigAooooAKKKKACiiigAq/p7fI6+hzVCrNk+2fHZhitKLtNAzTooor0SQooooAKKt2WmXN9kxJ8o/ibgVZuNAvIIy4CyAdQvWrUJNXSEZdFBGDg9aKgYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUlLUVy+yBz7YFKTsrgZTtukZvU5ptFFeWUFFFFABRRRQAUUUUAegaD/yBLX/AHT/ADNaNYui6hZw6RbxyXUKOFOVaQAjk1f/ALU0/wD5/bf/AL+ivpqNSCpx1WyIZbrkvF//AB82v+438xXRf2pp/wDz+2//AH9Fcx4puYLme3ME0coCnJRgcflWGPnF0Gk+w1uYFFFFeAUFFFFABRRRQBZ0+7+w30Vz5YfYc7T34xWrEP8AhItdEvk+XCoG8ZzkD1+tYIBJAAyT2rvtE04afYKrD96/zOff0rvwUJVXyP4VqxM0gAoAAwB0paKK98kKKKKAEZQ6lWGQRgg9xXn2saedOv3jA/dt8yH2r0KsvXtO/tCwbaP30fzJ7+orjxuH9rTut0NM4KigjBxRXzpQUUUUAFFFFABRR16VZg069uf9VbSsPXbx+dOMXJ2SArV7VokPl6NZRqP+WS4H1Ga8ui8MalIRlET/AHm/wr3bRNFe3062MrLvESjjtwK7aClQvKorXBajLWyWMB5BlvT0q5Vv7Cf+en6UfYT/AHx+VOVVSd2y7FSirJsn7MppjWso/hz9DS549wIaKcyMvVSPwptUAUUUUAFFFFAAQCMGs67ssZkiHHda0aKqMnF3QHP0VfvrXbmVBx3FUK7IyUldEBSOu5GX1BFLRVAeHXqeXf3Cf3ZWH61BVvVDnVrzH/PZ/wCZqpXgPdgFFFFIAooooAKKKKACiiigAooooAKfFNJC4eKRkYd1OKZRQnbVAa8HiXUYRgyLIP8AbH9atDxddY5t4T+f+Nc9RXRHF1o6KTCxuyeK75xhEiT3Az/Os251O8u/9dcOw/u5wPyqpRUzxFWekpMLBRRRWIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAdL4TvVSWWzc43/On17/AOfausrzCOR4pFkjYq6nII7Gu10nxBBeosc7COcDnPAb6V7OX4qPL7Kb16EtG1RRRXqiCsfxJei10t4gf3k3yAe3erWoara6fGWlcF+yDqf8K4bUL+XUbpp5T7Ko6KPSuDHYqNODhF6saRVooorwCgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr0mxi8mwt4v7saj9K82AyQK9QAwMV62VLWT9CZC0UUV7AgooooAKKKKACiiigAooooAKKKKACrWnyCK9QnoeKq0Dg5pNXVgOsqO4TfbyL6qRVGy1NHQRznaw43djWiGVlyCCPauFxcXqXucpWB4ruFTT0gz80j5x7CtG+1ezsUYySqzjoinJNcPqN/LqN0ZpOB0VfQUsdiYxpuCerJSKlFFFeCUFFFFABRT/Jl/wCeb/8AfJo8mX/nm/8A3yafK+wDKKf5Mv8Azzf/AL5NNKlThgQfQihpoBKKKKQBSqxVgw6g5pKKANpGDorDoRmnVRsJsgxE+4q9XpU5c0bkhSqNzAepxSUVYHfWsKQW0caDChRUtZWl6tDc26JI4SVRgg8Zq7Pe29vGXklUAdgck16UZRcboRy+vQJBqTbBgOA2PesyrOoXZvbx5iMA8AegqtXnzacm0AUUUVIwooooAKKKKACiiigAooooAKKKKACqGoScrGPqauuwRCx6CseRzJIXPUmufETtHl7ghtFFFcRQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFPghe4nSGMZdzgChK7sgNrw1pv2q7+0yL+6hPGe7V2lVrCzSxs47dP4RyfU9zVmvpsLQ9jTUevUhsKKKK6ACiiigAooooA4nxJpv2S98+NcRTc8dj3FYlejajZJf2UkDdSMqfQ9q88lieGV4pBhkOCDXz+Pw/sqnMtmUmMoqzZWFzfy7LeMt6t2H1NdXp/hm2tsPc4nl9CPlH4d6yoYWpW+FadxtnL2el3l8f3ELFf75GF/Ot+08JRrhruYsf7qcD866VVCqFUAAdABQzBVJYgAdya9all1KGstWTcq22l2VoB5Nsin1IyfzNW6yrrxDp9tkeb5rDtHz+vSsmXxZNI4S1tVBJwC7ZJ/CtZYnD0vdTXyFZndaXa+dN5jD5E/U16RZNvsom/wBmvK7S8u4rONGlw2MttGOa6/w7eyT6eUeRi0bY5PaufG0pTipFwfQ6yisne394/nRvYfxH86832XmaXNaissTSDpIfzqRbuUdSD9RS9kwuaFRPbxP1XB9RxUK3o/iT8qnSeN+jDPoanllECs9kRyjZ9jVdkZDhlINatIyqwwwBHvVKo1uFjJoq5LZ94z+BqoylThhg1rGSewhKKKKoBCAwIPINY1zD5ExX+E8itqqt9F5kG4feXmtKUuWQmZNMlbZC7eik0+srxJeCy0C7lzhthVfqeBXVJ8qbJPIbmTzbqaT++7N+ZqKiivBAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo6UUUAXINVvrddsVzIF9M8U+TWtRlXa11Jj2OKoUVoqtRK3MwFZmdtzEknuaSiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr09GDxq46MAa8wr0TSJvtGkWr5yfLCn6jg/wAq9XK5e9KIpF2iiivZJCiiigAooooAKKKKACiiigAooooAKKKKACkeQxxs2ThQTS1S1eb7PpN1JnB8sqPqeB/OpnLli5dgPOySTknJooor5MsKKKKACiiigDaX7o+lOpq/dH0p1eqtiArKvf8Aj6b6CtWsq9/4+m+grnxPwFIgop8MMlxMsUSlnY4AFdXY+FYEQNeOzueqqcAVjRw1Ss/cQ2zkaK7t/DmmMuBAUPqrnP61z+reHpLBDPAxlhHXPVa1q4GtTjzbryFcxUco4ZeoNa8UgljDj8R6Vj1NbTmB+funqKxo1OR2ewNGtRSKwZQQcg0td4goJJ6kmiigAooooAKKKKACiiigAooooAKKKKACiiigAooqtdXHlLtXlyPypSkoq7Agvp9x8pTwOtU6OvWivNnNyd2UFFFFSAVv6Foi39rPPOCFYFIj7/3vw/xrIsbR768jt4+rnk+g7mvRYIUtoEhiGEQbQK9DAYZVZOclohNnm08D207wyjDoxUio66rxVpu5Vv415XCy49Ox/p+VcrXNiKLo1HBjTCiiisACiiigAooooAKKKKACiiigArqfC2m4BvpF5Pyx5/U1gadZPf3scC5wTlj6DvXpNlZMyLBbp8qKB6ACvSy+hzS9rLZfmJjaKlntpbZgsq4z0PY1FXuJp6okKKKVVZ2CqCSewoASitO30S4lAMhEY9+tXo9Ct1Hzs7H64rKVaC6jsznqK6b+xbP+63/fVQyaDC3+rkZT781KxEA5Wc/WbqPhQXlwl/JlIjw6jq3oa7WDw5LbfvZgJMdAO31qeSNZEaNxwRgisqtSnVXLuhpM5CC3itohFDGEQdgKe8iRoXkYKo5JJwBVXW9Rg0V2jlO+b+FB1Pv7Vw+oardajJmZyE7RqeBSr42nRXLHV9hJHRah4qhizHZp5rf324Uf41zV3qV3fMTPMzD+6OAPwqrRXjVsVVq/E9OxVgrU8P232nV4gRlU+c/hWfBF50uzOOK63wppwSS4l3Z4CiqwlJzqRb2E2dBWx4du/Iv/ACmOFlGPx7VnfZ/9qnJCUcMr4IORX0FRKcXFkp2O+oqtYXQu7VJM/N0b61ZrxmmnZmwUUUUgCiiigCWO4kj6HI9DVuK6STg/K3oaz6KiUEwNemSRJKMMOfWqUNy0fDfMv8qvI6yLuU5FYuLiMz5oGhPPK+tRVrEBgQRkGqNxbmP5l5X+VaQqX0YWK9BAIIPQ0UVqIwpU2Ssvoa4D4hakMQacjc/6yT+ld9rdzFp6zXUzbY0XcTXh+pX0mpajNdy/ekbIHoOwqsVVtTUerIKtFFFeaAUUUUAFFFFABRRUkVtPcNthhkkPoik0AR0Ve/sTVcZ/s28x6+S3+FVprae3OJoZIz6OpFNxa3QEVFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK67wldb7Wa1J+aNty/Q//AF/51yNXtIvvsGoxTE/Jna/0NdGEq+yqqT2BnodFICGAIOQRkEUtfTEBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeLbrZaw2oPzSNub6D/AOv/ACruLfQLq4tknV4wrDIya8x8ULMmv3EUxBMeFXb0x2rz8diIqk4xer0GkY9FFFeCUFFFFABRRRQBtL90fSnVjedL/wA9H/76NHnS/wDPR/8Avo11/WV2FY2ayr3/AI+m+gqPzpf+ej/99GmlixyxJPqTWdWspxtYEjqvCdmoiku2GWJ2r7DvXTVh+FpFbSdg6o5z+Nble9g4pUI2Je4UjKHUqwyCMEHvS0V0gedaraiy1KaEfdByv0qnWr4jkWTWpdp+6Ap+orKr5aslGpJLa5aLFtcmE7W5Q/pWkrB1DKcg1i1LBcPAeOV7g1VKty6PYTRr0VFFOkw+U89wetS12ppq6EFFFFMAooooAKKKKACiiigAooooAKKKTrQBBc3KwjA5c9vStjw9pSyWktzdLuNwCqg/3fWqum6THf3qxlMr9529q7lbeJECKgVQMADsK1w1Fynzz2WwHlt/ZvYXslu/8J+U+o7Gn2CK3mblB6dRXZeJNEW9tPtEXEsI/Ne9cpawNAXDYIOMEVyTwzpVtNh30JvKj/uL+VHlR/3F/Kn1e0mxN9eqjD90vzP9PT8a2ULuyRJraJpqW1i100aiSUDHHRf/AK9aNWpgBCQBgCqterSioRsgGSRpNE0ci7kcFSD3FeealYvp99JbtkgHKn1Xsa9GrF8R6b9ssfOjXM0IyMd17j+tcuPw/tafMt0NM4iiiivnygooooAKKKKACiiigAooooAtWWoXOnszWzhS3BJUH+ddR4e8XTRmWG8uVQsQVcoAPoeK42it6WInTas9O3QLHaeIfF0sixw2dyrsG3M4QEfTpWD/AMJLqn/Pcf8Aftf8KyamtLWS8uo7eIZdzgVUsVWnL3Xa/RBY3dM1DXNUuRFDMAo+85jXCj8q7yxaWyiAEgeTHLlBk/pVPTNOh0yzSCIc/wATd2NXK9mhSlGP7xtsi5b/ALSuv+eg/wC+RR/aV1/z0H/fIqpRWvJHsF2W/wC0rr/noP8AvkVq2D3IUSzP8x+6u0cVn6daea3nSD5B0Hqa2K56rj8KRSLH2yf+/wDoKwtdvJ2hdLOVUu8cMVBA+tT3975IMUZ/eHqfSsYkk5PWlSordg2eYazcahPeldROZ04yVAJ/LrWdXo3iHRl1OzLxqBcxjKn19q86ZSrFSMEHBFeXi6Mqc9Xe4ISiiiuUZZsf+PkfQ13Xhgf6HMf9v+lcLY/8fI+hruvDDf6JMvo+f0r1MASzcooor1RF7TL42VxzzE3DD+tdUrK6hlOVPIIrh61NL1Q2pEMxJhPQ/wB2uXEUeb3o7lRlbQ6WikVldQykFT0Ipa4DQKKKKACiiigAp8cjRtlTTKKLXA04pllXI4I6ipCMjB6VlI5jYMpwRWjDKJUyOvcVzzhbVDKlxB5Z3L90/pVetZgGUhuneuL8Ram0DG0tidrDmQenoK3w8ZVXyoT0OF+JmstcXcNjA37hV3OR/E2a8/roPFrZ1CEekf8AU1z9YYpctVx7EXuFFFFc4BRRRQAVpaPoV7rU+y2jwgPzytwq1P4c0CXXb7ZylvHzK47D0HvXrFpaQWNslvbRiOJBgAV1YfDOp70tgMHS/BOl2Cq06fa5h1aQfL+C/wCOa6OOKOFAkSKijoqjAFOor04U4wVooAprxpKhSRFdT1DDINOoqwOd1TwXpWoKzRR/ZZj0aIcfivT8sV59rPh++0SXFwm6Jj8sqfdP+Br2Oorm2hvLd4LiNZInGGVq5quFhNXWjA8Morc8TeHpNDvPky9rIcxue3sfesOvKlFxfKwCiiipAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAfDBLcOUiQuwUsQPQDJpldp4Z037LZ/aZF/ezDjPZe359fyrA1/Tf7PvyUXEEuWT29RXXUwkoUVVfX+kK+plUUUVyDCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDsPDOqieAWUrfvIx8hPdfT8K6GvMYpXglWWNirqcgiu70jVo9Tt+SFnUfOn9RXuYDFKcfZy3RLRp0UUV6QgooooAKKKKACiiigAorTtNBvLpQ5AiQ9C/U/hVxvC0wXK3KE+hXFZOvTTs2OzMCirN5p9zYtiePAPRhyDWJq+rR6ZbnkNOw+RP6mqlVhGHO3oI6SfxnpWl2MNjLJJ5wX5wq5wK8w8RX0Opa3PdW5YxPjGRg9KzppXnlaWRizsckmmV83Wr+0uktL3LCiiisACilVSzBVBJPQDvVkaZfEAiznx/1zNNJvYCrRVv+y7//AJ8rj/v2aa+n3salntZlUdyhFHK+wFaiiikAUUUUAamiar/Zt18+TC/Dgdveu5hmjnjEkTh0PIINeZVPb3lzaHMEzx+wPB/Cu/C450VyyV0Jq56VWbq2rw6bAfmDTkfKgP6muQfXdTkXa12+PYAfyFUfnmk5JZ2PUnJNdFXM01amtRWJ44nvHllY/Mec+pqsQQSD1FbMUYijCDt39ao30O1xIBw3X61wVKNoc3XqNMqUUUVzjAEqcg4I7irkV8y8SDcPUdap0VUZyjsBtg5AI6Glpsf+rX6U6vTRAUUUUDCiiigAopD0qGB5ZcswCrngDvScrOwE9FFFMAoorV0Kw+13nmOMxRcn3PYVUYuTshG5oth9isgzjEsnzN7DsK0qKK9GMVFWQARkYNcXq9j9hvWCj90/zJ/hXaVS1WxF9ZMgH7xfmQ+/pWdWHPEDiepwK7TSLH7DZKrD96/zP9fT8Kw9A08z3ZnkX5IT0I6t/wDWrq9pY4XqelZ4eFveYEc3+qNQxQyTNiNCx9q1oNNdhm6x/uitBI0jXaihR6AVs6yjohpGRFo8jcyuF9hyatJpFsv3tzfU1forJ1ZvqOyON1DwvpltckraLsf5h8x49R1qk3h/S2H/AB6gfRj/AI1295bC6t2T+IcqfeubIIJBGCOoq6VOlKOsV9wmYM3hSycfupJYz9cism68K3kILQMsy+g4NdpRSqYGhPpb0C7PMZYZYHKSxsjDswxTK9KurO3vI9lxErj36j6GuT1Xw3LaBprXMsI5I/iX/GvLxGAnT96OqGmYNFFFcAwooooAKKKKACux8GaeAkt+45J2J9O5rjq9R0a3FrpFrFjBCAn6nrXdl9Pmqcz6CZeooor2yQqa2gNxOqDp3PoKhrc0638m33EfO/P4VnUnyxGlctIiogVRgDgCoLy6FtFkffPCirDMEUsxwBya566nNzOXPToB6CuenDmepTdiJmLsWY5J6mkoorsICvP/ABZp4tNT85BiOcbvoe9egVz/AIwtxLo4lx80Tg59j1/pXLjKfPSflqNHC2tu93dw20eN8rhFz6k4r0mLwDpC2gjkMzzY5lD4OfYdK81t53tbmK4iIEkTh1J9Qc16NF8QdMNoHlhuFnA5jVQRn2OeleXhvZa+0KOLudOfSddnsnbcYujeoIyD+RFdJ4YlxNPEe4BFczPqEmq63NeyqFaXnaOwAwB+QFa2kXH2fUomJwrHafxrowrSd1tclna0UUV6wgooooAu2OpTWTYHzxnqh/pXR2t/BeL+7f5u6nrXH0oJU5UkEdxWFWhGeuzGpWO4orlY9eurUKHxKvo3X860IPE1nJxKkkR+mRXJLDVFsrlqSNqiqSatYSD5bqP/AIEdv86l+3Wf/P3B/wB/B/jWThJbod0WKKqPqljH967i/Bs/yqnN4jsYx8heU/7K4H61SpTeyC6Neo5dQh04ebNIFHp3P4Vy914lupQVgRYV9eprHklkmcvI7Ox6ljmuiGClL4yXPsdvcayb+IeQSsLfmfrWVeWwuoCn8XVT71laXdeVL5Ln5HPHsa23YIjOegGav2XsXaIXueNeJZC2tzIf+WeEI9x1rIrpvF9kTdf2gg4lOJPr2NczXkYqMo1pcwIKKKK5wCnRxtLIkaLud2CqB3JptdD4KsheeI4mYZWBTIfr0H86qEeaSiB6LoWlR6PpUVqgG/G6Rv7zHrWlRRXuxioqyAKKKKYBRRRQAUUUUAUdY0yLVtMltJAMsMox/hbsa8Ynhe3nkhkXa8bFWB7EV7rXlvjqyFr4gMqjC3CCT8eh/lmuHG0/dUwOZooorzQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKnsvs/2uM3RIhBywAyT7VBRTTs7gdsPFGmgYBlA/3KpatrOl6lYPDmQSD5oyU6NXLUV2zzCrOLjJKzFYKKKK4RhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVJBPLbTLLC5R1PBFR0U02ndAdvpPiCG+URTkRT+/RvpW1Xl2SDkVs6f4jurMBJf30Q7N1H0Neth8x+zV+8lo7iisyz16wuwAJfLc/wvxWkrKwypBHqDXqQqRmrxdxC0UUVYBW94e01Z3N1KuUQ4UHuawa7bRAqaRARgZBJ+tc2Km409Oo4q7NGioJLyGP+LcfQVQmvpJchflX9a86NOUjS5Y1CWF4HgZQ5YY+leE+IbS4stauIbh2ds5Vj3XtXslec/ERFXU7Vx95ojn8DU4qnal6CONooorzRBRRRQBp+Hv8AkYtP/wCu6/zr2WvGvD3/ACMWn/8AXdf517LXpYH4GAVXv/8AkHXP/XJ/5GrFV7//AJB1z/1yf+RrtlsB4g33j9aSlb7x+tJXgAFFFFABRRRQAVesYesrD2WqkMRmlCDv1PoK2FUKoUDAA4row8LvmYmxaZIgkQo3Q0+iu1q4jFdDG5RuoptaF9DuQSqOR1+lZ9ebUhySsUgoooqANqP/AFa/SnU2P/Vr9KdXqLYgKKKKYwooooASjoMClooAKKKKAFRGkkVEGWY4AHeu5sLNbGzSEdRyx9T3rh45HikDxsVYdCO1WP7Tvf8An5k/OtaVSMNWI7miuG/tO9/5+ZPzo/tO9/5+ZPzrf6zHsB3NFcN/ad7/AM/Mn50f2ne/8/Mn50fWY9gOi1Oa9spY/sccZjlPTbzv/wDr1rafNdW8QeYxtMRzheB9KztIhuBbCW6lZ3fkK38IrSrSMb6vr0Asy6lclcjZkf7NV/7Xuv8AY/75pKqSrskI7dq0jCPYLsuf2vdf7H/fNH9r3X+x/wB81Qoq/Zx7Bdl/+17r/Y/75qnLK00rSMAGbk4plFNRS2QBRRRTAKKKKAOb13QFlVrq0XEg5eMd/cVyRGDg16jXJeJdIETG9gXCMf3ijsfWvIx+DVvaw+Y0zm6KKK8goKKKKAAdRXrkQxCgHTaK8jr1exlE9hBKDkPGD+leplr1kvQUixRRRXqklizh8+5VT90cn6V0FZ2kxbYWlPVjgfStAkAEnoK5KsrysWtjO1W42oIVPLct9KyaluJTPO8h7nj6VFXRCPLGxDdwoooqwCsrxIAfD93n+6P5itWsXxVMItBmBP8ArCFH55/pWVZ2py9GCPOqKKK+bLLNj/x8j6GtMcHIrMsf+PkfQ1p13Yb4CWdtpd2LyxjfPzAbW+tXa47Rb/7Fd7XP7qThvY+tdiCCMjkV61KfNEQUUUVqAUUUUAQ3H3R9ar1YuPuj61XrSOwBRRRTAKswafd3IzFA7D1xxWroOkLcD7XcLmMH5FPf3rqAAoAAAA7CuOtilB8sdSlG5w0ukX0K7mt3wOpHNUiCDgjBr0esjWNHju4WmhULOozx/F7VNPGXdpobj2OPHByK07jUBLpyoD+8bhqyJ5kt4XllO1UGSTXM6TrT3GvSCQ4jnG1R6Y6VtWqwjOMZbtkI6K9tVvbOW3fo64z6HtXnEkbRStG4wynBFen1xPii0+z6n5qjCTLu/HvXHmdK8VUXQcTEooorxSgrtvhygN3fv3VEA/En/CuJrs/h1MF1G8hPV4ww/A//AF63w38VAei0UUV7IBRRRQAUUUUAFFFFABXBfEdADp8nc71/LH+Nd7Xn/wARpgZ7GHuqs/5nH9K58X/CYHD0UUV44BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBseGdJh1nVfss7sqbC2V68V2P/AAr3Tv8An4n/AErnvAX/ACMf/bFq9Qr0cLRhOneSA5A/D3TgP+Pif9K86uYxDdSxKchHZRn2Ne6HofpXh19/yELn/rq38zWeMpwglyoCCiiiuIAooooAKKKKACiiigAooooAKnhvLmA5inkT6GoKKabWqA1I/EOpRj/X7v8AeGal/wCEo1LH34/++BWNRWqxNZfaf3hY1JPEOpSD/X7f90Yrt/A+uve2UljcTM08Z3LuPJU15pU1pdzWVylxbyFJUOQRVQxM1NSk2wPcqK4zS/H9rLGqajG0Ug6ugyp/DtWpJ4z0NE3C7Ln+6qHP616Ua9Nq9wN4kAEkgAc15L4t1RdT1yRojmKIeWp9cdTWhr/jabUImtrFGggbhnJ+Zh/SuSrixWIU/djsAUUUVxAFFFFAF7RZ47bWrOeZtsccqszegr1MeKdEIz/aMP45rx6it6OIlSVkgPYf+Eo0T/oIw/mar33ifRWsZ0XUImZo2UAZOSRXk1FavGzfRAKeWP1pKKK4wCiiigAooqe1h86bn7q8mnGLk7IC3ZQ+XFvI+Zv0FWqKK9OMVFWRIUUUUwEIBBB6GsieIwyle3UfStiq93D5sWQPmXkVjWp80dN0CMuiiiuAo2o/9Wv0p1V0uoQgBfnHpS/a4f7/AOlekpxtuST0VB9rh/v/AKUfa4f7/wClP2ke4E9FQfa4f7/6U5LiJ2Cq2SaOePcCWiiiqAKKKKACiiigAooooAK0dFsvtl6CwzHH8zf0FZ1dhoVr9n05WI+aT5j/AErWjDmkI0+lFFFd4BUFwOFP4VPUc4/dGmtwKtFFFaAFFFFABRRRQAUUUUAFMliSeJ4pBlHGCKfRQ1fQDzjULNrG9kgb+E8H1HaqtdX4stN0UV2o5U7G/pXKV8ziqXsqrj0LQUUUVzgFd/4RvRcaT5BPzwHb+HauArT0LUzpeorIT+6f5ZB7etdOEq+yqpvZiZ6ZRTUdZEV0IKsMgirFqnmXUa+rV77dlck3oI/KgRPQCodQl8q0bHVvlFWqytXf5o4/bca44LmmW9jMooortICiiigArjfGt6Gkgs1P3fnf69q6q9vIrC0kuJThUH5n0ry+9upL28luJD8ztn6VwY+sow5FuxogoopUUu4VepNeKUWLH/j5H0NadV2i8mFTGMsg/P1qr9vk/urXbGSorlkTuaVdHoerAhbS4bkfcY9/auK+3yf3VoGoSg5AGa0hi4wd0Fj1WiuP0fxYTtt73A7LJ/jXTLcllDLtIPQivUo1Y1o3gxWLVFVvtDego+0N6CtuVgPuPuj61Xp7yFwAaZVJWQBRRRTA9As4hDZQxr0VAP0qeqWlXK3WmwuDyFCt9RV2vDmmpNM1WwUEgDJ6UjMqLuY4ArJvtQXy3O7ZCgJZj6CiMHIGzyjxvqJfW7qxh+WCOQk47k8/1rmIZWhmSVDhkIYVY1W8/tDVbq7HSWQsvsM8fpVSuKrUlOfM2SemwSrPBHKv3XUMPxrH8U2/m6WJQPmicH8Dwf6VL4bn8/RowTzGxQ/z/rV7UIftGn3EWMlkOPrX0Ev3+H9URszzeiiivmiwrX8MX407xBbSscRsfLf6H/6+KyKKqMnFpoD3jqKK53whri6tpiwyv/pUACuD1Ydmroq9yE1OKkgCiiiqAKKKKACiiigAryPxdqA1DxDOyHMcX7pfw6/rmu+8Va4uj6WwRv8ASpgVjA6j1b8K8lJJJJ6mvPxtTaCAKKKK88AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooqSCCW5lEcMbO57Cmk27ICOiuht/CdzIoM8yR/7IGTU7+EPl+S6591rpWCrtX5RXRy9FaV9od7YAu6b4x/GnOPrWbXPOEoO0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG/4Pv7bTtb8+6lEcflsNx9a7/wD4SzRP+f5K8horopYmVOPKkB66fFmiYP8ApyV5Rdusl7O6nKtIxB9RmoaKVavKra4BRRRWABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW34Xt4LjUX85VYom5FbpnPWsSnRSyQyCSJ2R16MpwRWlGahUUmr2A7HxPa250wzFFWVWARgME+35ZNcZU9ze3N4VNxO8m3puPAqCtMVWjWqc0VYEFFFFc4AATnA6daK7HQ9GjXSZPtKfPdLyO6r2/x/KuVvLWSyu5LeT7yHGfUdjXRVw06UIzfULkFFFFc4BRRRQAVagu1gj2iPJ7nPWqtFVGTi7oC9/aA/wCeZ/76o/tAf88z/wB9VRoq/b1O4rIvf2gP+eZ/76o/tAf88z/31VGij29TuFkXv7QH/PM/99Uf2gP+eZ/76qjRR7ep3CyHSMryFlXaD2ptFFZPXUYUUUUAFFFFABU1pxdJ9T/KoafE2yZG9CKqLtJMDZpwikYZEbEHuBTa9J8PEf2Daf7p/ma9WMeZknmxUqcMCD6EUVseKf8AkPz/AEX+QrHpNWdgCiiikAUUUUAPhj82eOP+8wFd8ihI1UcADFcVpKb9Ut1/2s/pXb114ZaNiCiiiukAqOb/AFRqSorg/IB6mmtwK1FFFaAFFFFABRRRQAUUUUAFFFFAFLVoBcaVcR452Fh+HNed16e670ZT0IxXmUg2yuPRjXjZpH3oyHEbRRRXlFBRRRQB03hzxF9j22d237gn5HP8H/1q9E0krLdK6kMu0kEV4rXcfDi7vJNWa0Vy0OzJVv4RntXo4bFSt7KQrHqkNtLcHEa5Hr2qpfaHLLcljMowAMYzXSwTQLGEX5AO1VJnVp3wQeacK81LTQuyOTudHurdS2BIo7rWfXc1zXiCG3sh9rLpHGTh8nABrso4jmdpEOPYy6iubmG0gaadwiL1JrCv/F1lbArbAzydiOF/OuP1HVbvU5d9xIdo+6g6Cpr42nTVo6sSRa13XJNWuNq5W3Q/Ivr7msiiivGnOU5c0tygq/Yw4BlYdeFqpBEZpQg6dz6CtcAKAAMAdK2w8LvmYmLWVdw+VLkD5W5FatRTxCaIr36j61vVhzxEmZFFBBBIPBFFeeUFaWna3daeQqtvi7o39KzaKuE5QfNF2YHd2XiCyvAAz+VIf4X/AMa1QwYZUgj1Bry+rNvqF3an9zcOvtnivSpZm1pUVxcp6RRXEReKNQj4fy3HuKsr4vuB1toz+JrrWY0Hu7CszrqK5BvF1yR8ttGPxNVZvEuoyjCusY/2RzSlmNBbXYWZ6Lp+rnSZC7MPJb76scfiK2ovGmi3IxBeRmT+6xxivDZrq4uDmaZ3Puairz62MjUldRKV0e233iTT41L3F/CAOihv5CvP/E/jBtUjazsQyWp++54L+3sK5KisamKlKPKtEAUUUVzAdX4QkzDcxejBh/n8K6auQ8Iti8uF9UB/Wuvr6LAO+HiS9zzO5j8q6lj/ALrkfrUVXNWXbq10P+mhqnXz81aTRQUUUVIFrT9QuNMvUurZ9sifkR6H2r1fQvENprluDGwS4UfPCTyPp6ivHqfDNLbyrLDI0cinKspwRW9CvKk/ID3WivOtL+IFzAqx6jB56j/lpHw34jof0rp7XxjolyB/pflN/dlUrj8elelDEU59QN6is7+39Hxn+07T/v8AL/jVO58YaJbKf9MErf3YlLZ/HpWjqQW7A3aytb1600S2LzMGlI+SIHlv8B71yWqfEGaVWj0238kH/lrLy34DoP1rjbi4mupmmnlaSRjksxyTXJVxkUrQ1YFjU9TuNWvnurlsu3QDoo9BVOiivObbd2AUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorT0/w9qmpx+ba2jNH/fYhQfpnrTUXJ2SAzKKuahpN9pbhLy2eLPQnkH6EcVToaadmAUUUUgCiiigAooooAKKKKACiiigAooooAkt4JLm4SCIZdzgV3+m6ZDptuEjALn77nqTXP8AhG2D3M9yw/1ahV+p/wD1V11e3l1BKHtXuyWwooor0xCEAjBGQexrj/EWjLaN9rt1xCxw6j+E/wCFdjUN3brdWksD9HUj6Vz4mgq0Gnv0BM80ooIKsQeoOKK+ZLCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKtXunz2HleeuPNQMPb2+tX/AA5pv22+86Rcwwncc927Cuo1nThqOnvGB+9X5oz7+n413UME6lFz69BN6nn1FKQVJBGCDgg9qSuEYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFamg6d/aF+N4zDF8z+/oPxrMVSzBVBJJwAO9eg6Pp406wSIgeY3zSH3/8ArdK7MDh/bVLvZCbL9c/4o03z7YXka/vIR8+O6/8A1q6CkZQylWAIPBB7171akqsHBknl9FX9Y086dqDxAfum+aM+3/1qoV8vODhJxluiwoooqQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA17eTzIFbvjB+tTiRwMB2A9AazLGba5jJ4bp9a0a9GlPmjclgSWOSST6miiitACiiigAooooAv6Jxq0H1P8AKu0rhtNk8rUrdv8AbA/Piu5rsw3wsQUUUV0AFVp2y+PSp3YIpNUycnJqorqAUUUVYBRRRQAUUUUAFFFFABRRRQAV5lcHNxJ/vGvSZ38uCRz/AAqT+leZudzsfUk15Gav4V6jiJTkjeVwkalmPQAZJptdF4SERu5i2PMC/Ln0715tCl7WooXtcpmLcWN1aqGngdFPcjioUjeQ4VSa9IvYIpdPn88Dy9p61x6qqLhRgV11sCqcrJ6CuZwsZT1wK774XWpi1W+d8ZEK4/OuUrqPAl4LXW2DHCyR7T+dEaEU7rcE9T1SsW4Yi5kwSPmNbQOeRWLdjF1J9a2obstkfmP/AH2/OsLxeok8M3m/naoYZ9c1t1x3j3VEh09dPRsyzEFgOyitKzUabbJPOKKKK8UAooqe0h82XJHyryacYuTsgLlnD5cW4j5m5qzRRXpxioqyJCiiimBn30O1hKo4PX61TradBIhRuhFY8iGOQo3UVw14cr5l1GhtFFW7O3EgZ3GV6CsoRcnZDKlFPljMUhQ9uh9aZSas7MAp8cTythBn3pYIjNIFHTua1URY1CqMCtaVLn1ewmyomnjHzufwp5sIv7zfnVuiutUYLoK5nSWDqMo27271UIIJBGDW5Ve5txMuQMOOnvWNTDq14jTMuigjBwetFcgwooooA6Dwl/yEJv8Arn/WuxrkvCCf6Tcv6IB+tdbX0OXr9wvmS9zzzWf+Qzd/9dDVGreqNv1S6b1kb+dVK8Gq71JerKCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALWm263ep2tu5+SSVVb6E817XFEkMSxRqFRRhQBwBXhkUjwzJLGcOjBlPoRXp2leNtMurZftkv2acD5gwJBPqCK7sHUhG6luBra9ZRX2iXcUqggRs6k9iBkGvGehrv8AxN4ytZbGSy01zI0o2vLggBe4GetcBUYucZSXKAUUUVyAFFFFABRRRQAUUUUAFFFFABRRRQB1nhBgYLpO4ZT+h/wrpa4Tw9fiy1ICQ4jlGxj6Hsa7uvoMvqKVFLsS9woooruEFB6UVma7frY6bIQf3sg2IPr3qak1CLk+gHCTMHnkYdCxI/OmUUV8m9SwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdHG8sixxqWdjgAdzTa6bwrpu52v5F4X5Ys+vc/0rahRdaooIGdBptimn2MduuCQMufVu5q3RRX08YqKUVsiDjfE+m/Z7oXka/u5j82Ozf/AF/8awK9JvbWO9tJLeT7rjGfQ9jXnVxBJa3EkEow6HBrwsww/s5862f5lJkdFFFeeMKKKKACiiigAooooAKKKKACiiigAooooAns7prO6S4WNHZOQHyRn1rY/wCEtvv+eNv/AN8t/jWBRWtOvUpq0HYLG/8A8Jbff88bf/vlv8aP+Etvv+eNv/3y3+NYFFafXK/8zCyNLUdan1SJEnhhBQ5VkByP1rNopQpY4UEn2rGc5VJc0ndgJRTzDIoyUYD6Uypaa3AKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAA4Oa1LW4EyYP3x196y6VHZGDKcEVpTqODBo26Kr290swAbh/T1qxXoRkpK6JCiiimAU6OKSZtsaMx9AKnsbN766WFeB1J9BXZ2tnDZxBIkAx1Pc1rTpOevQRyC6ZfxkSC2fg5FdnCxeCNyCCVBwRT60rNI7u2aFx86/dPeumMVSVw3M2inyxtDKyN1FMrYBkkfmY5ximC3UdSTU1FO7Aj8lPSl8pP7tPoouwI/JT0pDbqehIqWii7Arm3bsc1GyMvUGrlFNSYFGirTQq3sfaoHiZPcetUmmAyiiimBma/cfZ9ImOcM42D8a4Gui8V3okuY7VTxGMt9TXO18/mFXnrWXTQpBUlu8kc6NE7I+eGBwRUdT2Yzcr7VxwV5IZuS3tzPEsc0zOo7E1BRRXqNt7khWloMmzVoh/eBX9P/AK1ZtTWcvkXkMv8AdcGnF2kmI9TsNae3URzgug6EdRUGqa/pkFzmS42FkDYKn/PaqA5Ga5/xPBmOCcDoSprqqU1G847j5mT6p4/tIo2TT42ll7O4wo/xrz+7u5765e4uJC8jnJJqOQYkYe9Nrw6tadR+8UFFFFZAABJwOprXgiEMQXv1P1rIBIOQcEdxT/Ol/wCej/8AfRrWlUUHdoTNmisbzpf+ej/99Gjzpf8Ano//AH0a3+srsFjZorG86X/no/8A30aPOl/56P8A99Gj6yuwWNmqd9DuTzAOV6/SqXnS/wDPR/8Avo0GWQjBkfH+8aideMo2aCwkcZlkVB1NbCIEQKvQVWsYdieYR8zdPpVutaFPljd9RMq3sPmR7wPmX+VZtblZN1D5Mpx908is8RD7SGi5Ypth3d2NWqhtv+PZMelTV0U1aKQgoooqwCiiigDLvE2Tkjo3NV6u6h95PoapV51VWmykFFFFZgdd4Ri22dxL/ek2j8B/9euiYhVJPQDNZ2g2/wBn0eBSMFhvP41Lq8/2fSrmTODsIH1PFfS0F7LDq/RX/Uh7nnsrmSZ5D/Exb86bRRXzW5YUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFdNo3iQRItvek7RwsnoPeuZorWjWnRlzQBo9NininQNFIrg91OakrzFJZIzlHZT7HFPa8uXGGnkI92r01mqtrHX1J5Tur/WrOxQ7pBJJ2RDk/wD1q4rUNQm1G5M0p9lUdFFVM5OT1orixGMnX0eiGlYKKKK5BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUoYgcE/nSUUALub+8fzo3N/eP50lFFwF3N/eP50mc9aKKACiiigAoord0XSFlQXVyuVP3EPf3NaUqUqkuWIGPFa3E4zFDI49QvFLLaXEIzLBIo9SvFdyAFGAAAOwpSARgjI967vqEbbk8x5/RXQazpCLG11bLtxy6Dpj1Fc/XDVpSpy5ZFJhRRRWYBRRRQAUUUUAFFFFACqrOwVVLMegAq5/ZGobN/wBklx/u11uhaTHY2iSugNxINzE/w+wrXr1qOWc0bzdmK55rFbO8xRlK4+9kdK0kjSNcIMCuu1DTI7uzeVUAnUEhgOuO1cpU/VlQdtxXuFVri1WVSyjD+3erNFEoqSswMMjBwetFT3ahblgO/NQV5klZtFBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKADvVqG9dOH+YfrVWiqjJxd0BrJcxSdGwfQ1LkHpWJTg7L0YiuiOJfVCsd54YjG2eT+LIWuhrhfCd+63j2zOf3gyufUV3CqVHJya9fCzU6SaJY6praY286uOnf6VDRW7V1YC/qe1pY5F5DrmqFZX9up/ahtXb9yPlVvQ1rAEjIGRU02rWXQGJRRjHWirAKKKKACiiigAooooAKKKKAIpIQeV4NZuo3iafaSTSdRwo9T2rVd1jQu7BVUZJNcTrt3/a0u0ZEafc/wAazrVnCDtv0A5uaV55nlkOWckk0ynSRtE5Vhg02vm3e+pYVLbNsuEJ6ZxUVFCdncDcoqG3kMsIY9elTV6ad1dEhRRRTA7jTLj7Tp0Mmcnbtb6jim6tb/adMmQDLBdw+o5rK8M3X+ttWPX51/r/AErcnkwNo6nrXoU/3kBHk7HLE+9JWhrdl9h1ORAMRv8AOn0NZ9fOTg4ScXuiwoooqQCiiigAooooAKKKKACpbeHzpQP4RyairVtYfJi5+8eTWtGHPLyBk2MDFLRRXoEhUNzD50RH8Q5FTUUmk1ZgV7QOsO11IIPerFFFEVyqwBRRRTAKKKr3NwIUwD856D0pSkoq7Ap3r758DovFV6CcnJ60V5spczbKCp7K3N3eQwL1dgPw71BXS+E7LdNJeMOE+RPr3rTD0va1VAGdWqhECqMADAFc94tudlnFbA8yNuP0FdFXA6/efbNVkKnKR/Iv4df1r2sfU5KLXfQlblD7PPjPkyY/3TUdevDUtL/svb9pt93k4xkZztryGvFrUlTtZ3uUFFFFYgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAORd8ir/eIFd5GixxqijCqAAK4JWKsGHUHIru4JlngSVDlXUGvRwFveJZJRTlRnJCqTgE8elNr0RCMAylSMgjBFcJPH5VxJH/dYj9a7qSRYomkc4VRkmuDlcyzPIerMTXn4+1ojiNooorzSgooooAKKKKACgHBBoooA9OjdZIkdDlWAIPtT65DRPEK2kQtbvJjH3HHOPY10H9s6ds3fa4sfXmvpaOKp1IJ3syLGrFIqRMWOAoyfpXCE5Yn3qxrHiQTIYLLIQ/ec9x6VmxXsbj5ztb36Vx4jE05z5YvYdi1SVGbiEDPmL+BqpcXm8FI+AeprnnVjFXuFiC4fzJ2YdKioorz27u5QUUUUgCiiigAooooAKKKKACiiigAooooA6/wPpVjqTXf2y3WbYF27ieK7H/hFdD/6B0X5n/Gua+HP3776LXe16uGhF0k2gMf/AIRXQ/8AoHRfmf8AGvP/ABjY22n615NpCsUflg7R616xXmHj3/kYf+2S1OLhFU7pActRRRXmAFKqlmCgZJpK0bODYvmMPmPT2q6cHOVgZNaxfZQGU4k67hXU2PiJNgS7BDD+Md65uivUpydPSJJ2h1nTwuftC/TBzWVqPiHzEaK0BAPBc9fwrAorSVeTVhATk5PWvV/DF0v9iWizqrfJwxHPXvXlFTJe3UaBEnkVR0AY8VkrdRp2PStW2/2jJtxjjp9KpVxlprN3ayZLmVT1Vzmuis9atLsAb/Lk/uvxXZSqRaSEzRooByOKK3AKKKKACiikZlUEsQAO5NAC0yaaO3jMkrhVHUmsy91+2twVh/fSe3QfjXN3l/cX0m6Z8jso6CsZ1ox23At6rq73zeXHlYAendvrWXRRXHKTk7sCGeATJj+IdDWU6lGKsMEVt1UvIPMTeo+YdfeuWvS5lzLcaZnUUUVxFGraY+zLip6pWMw2mMnnqKu16NJpwViWFFFISFBJOAK0ENTUm068ikQZZTk/TvXbRyrNGsqHcrjcD615pPJ5szN27V1PhbUfMhaxkb5k+aPPcdxTwWJ/euD2ew2tC14j077ZYebGuZYfmHuO4riK9Rrhdf0s6feGSNf3Epyvse4p5lh/+XsfmCZkUUUV5BQUUUUAFFFFABRRSohdwqjJNAFiyh8yTeR8q/qa06jijEUYQduvvUlejShyRsSwooorQAooooAKKKKACiiigArPubRgTIhLDuD1rQoqJ01NWYGHRV67tesiD6iqNcE4ODsyh8ML3EyRRjLucAV6LY2iWNlHbp/COT6nuawvC+l7F+3zL8zDEQPp6101e1l2H5Ie0lu/yJbKGsXwsNOklBw5+VPqa89znk9a2fEWo/bb7yo2zDD8ox3Pc1jV5+Or+1q2WyGkFFFFcQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiit7R/Dy6hZ/aZpmRWJCBB6dzWlKlOrLlgtQMGirOoWbWF9LbMwbYRhh3BGRVaolFxbi90AUVp2Wg316Awj8uM/wAT8VtQeEYVAM1wzH0UYFdFPB1qiukK5yVFdsPC2nYwRL/33UUvhO0Yfu5ZEPvzWzy6uuwXRx1Fbd54YvLcFoSsy/7PX8qxXRo2KupVh1BrkqUp03aasMSiiiswCiiigAooooAK1dJ1c2X7mUFoSeMdVrKrR0XTjqOoLGw/dJ80h9vT8a1oOftFybgz0vQoomtftIZWMo49l/8Ar1lausOm3DeZIqRt8yEnt6VZACgADAHYVna3p39o6eyqMzR/NGff0/GvoKlOUYNx1ZBy+rax9rHkQZEPcnq3/wBasiggg4PBor52pUlUlzSLCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorV0HRH128kt0mWIom/LDPfFOMXJ2QGVRXSa54Qm0XT/tb3SSDeE2gHv8A/qrm6c4Sg7SAKKKKkAooooAKKKKAO6+HJAa+yey13u4eorwpJHj+47Ln0OKd9om/57Sf99Guyli/ZwUbAe57h6ivMPHvPiH/ALZLXN/aJv8AntJ/30aYzs5yzFj6k5pVsV7WPLYBKKKK5AJrWHzZRn7o5NatQWkXlwjPVuTVivQow5YksKKKK1AKKKKACiiigAooooAs2+o3dtjyp3A9CcitCPxLdrxJHG/6VjUVanJbMR0A8UHvaj8H/wDrUN4ob+G1H4v/APWrn6Kr20+4GvL4jvX4QRxj2GTWdPd3FyczTO/sTx+VQ0VDnKW7AKKKKkYUUUUAFFFFAGVdw+VLkfdbkVBWrdRebCR3HIrKrz60OWQ0AJU5BwRVyO/IGJFz7iqdFRGcobDNE38YHCsTVWe6ebjovoKgoqpVZyVmFgqS3nktbhJojh0ORUdFQm07oD0fT72PULRJ4+/DL6HuKde2cV9avBKPlYcHuD61xGjaq2mXWWyYH4df6iu9jkSWNZI2DIwyCO4r6LC144inaW/Uhqx5xe2UthdPBMMEdD2I9ar16FqulxanbbG+WVeUf0P+FcHdWstncNDMm11/WvHxeFdCV18LKTuQ0UUVyDCiiigArSs4PLTew+Zv0FU7WLzZgD0HJrVrqw8L+8xMWitvwvZW9/qMkVzEJEERYAnvkV1v/COaT/z5p/30f8a7owbVxWPN6K9I/wCEc0n/AJ80/wC+j/jVTU9B0yDS7qWO1VXSJmU5PBxT9mwscFRRRWYBRRRQAUUUUAFFFFACU/TtCN7e+YwxaqcsfU+lW9N02TUJsD5Yl++/pXYR20cNsIIlwqjitaeHVRpzWiFcrKoRQqgBQMADsKxvEOqixtDDG37+UYGP4R3NaGoX0WnWrTSnkcKvdj6V59d3Ut5cvPKcsx/L2rTHYpUo8kd3+A0iGiiivBKCiiigAooooAKKKKACiiigAooooAKKKKAADPSitXSLXObhxx0UH9TVO/tvs1yQB8jcrWroyUFMCtRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVp6drt3psLQxiN4ycgODwfbmsyirhUlTfNB2YFh2uNSvSxBknlPYV12k+HobJVluAJZ/fotLoGkCxthNKv+kSDJz/CPStqvZwmDUf3lXWTJbCiiivSEFFFFABVDUdJttRjIkXbJ2kA5FX6KmcIzXLJXQHnOo6dPptx5co4P3WHRhVSvR9QsYtQtWglH+63dT6157dW0lpcyQSjDocGvAxmF9hK6+FlJ3IqKKK4hhRRRQAVoWGsXOmxMlusXzHLFlyTWfRVQnKDvF2YG3/wlWo/9Mf8Avj/69H/CVaj/ANMf++P/AK9YlFbfWq/8zCyJLidrm4eZlVWc5IUYGajoorBu7uwCiiikAUUUUASQW81y+yGJpG64UZNWP7J1D/nyn/74Nb/gD/kPP/1yNem12UMKqkOZsDxaHRNRmmSMWcwLHGSh4rqT4QtYIAk6TCQj75OOfYV6CjFHDDqDWH4z1+2tPsxkVy5U4UDrXXSoUqT/AHmq7voDPKr+0axvJLdjnYeD6iq9WL27a9vJLhxguenoKr15U+XmfLsAUUUVIBRRRQAUUUUAFFFFABW54W1qDQ9QluJ0d1ePYAnXqKw+hoqoycZcyA7HxL4ts9Z0n7LBDKr+YGy2MYGf8a46iinUqSqO8gCiiioAKKKKACiiigAooooAKKKKACpIE8yZV7Z5qOrmnpl2f0GKunHmkkDL9LRRXpEhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVkXEflzsvbqK16oagnKP+FYYiN4X7AilRRRXCUFFFT2dq95dxwJ1c4z6U0m3ZAFrZXF7JsgiZz3I6CtdPCl6Vy0kan0611dnZw2NusMKgADk9zVivapZbTUf3mrJucBe6FfWSl3j3oP4k5xVnQtbNg4t5yTbMeD/cP+FdqQCCCMiuN8SaUtpKLmFcRSHkDsayrYWWG/fUXsF7nZKyugZSCpGQR3qlqWlwanBskGHH3HHUVyuja7Jp7CGbL2x7d1+ldpDPHcRLLC4dG6EGu6jXp4qFn80LY89v8ATrjTpvLmXg/dcdGqpXplxbw3ULRTIHQ9Qa5PU/DM1uTLZ5li/ufxD/GvMxOXyp+9T1X4lJnP0UEFSQQQR1Bo6mvOGaVjHth3d2NWqZEu2JV9BT69OEeWKRJ0fgz/AJC03/XE/wAxXc1w3gz/AJC03/XE/wAxXc100/hGgqjrP/IFvf8Ari/8jV6qOs/8gW9/64v/ACNW9hnmNFFFcpIUUUUAFFFPihknkCRIzsewFADK0tM0eW+YO+UgB5bufpWnp3h5Y8S3mGbqIweB9fWt0AKAAMAdAK6adC+shDIII7aFYolCovQCm3V1FaQNLK2FH5n6Uy9vobCHfK3J+6o6muPv7+a/m3yHCj7qjoK1qVVBWW4Gbrt7LfX3mPwn8C9gKy60NQXMat6Gs+vCr39o2y0FFFFYgFFFFACorO4VQSxOAB3rUfw5qSQeaYgcDJUMM/lUGjTRQarBJNgIG6ntXoDSIkZkZ1CAZ3Z4xXoYPCU60XKTE3Y8xIIOD1oqe+kSW+nkj+4zkioK4GrNoYUUUUgCiip7K1a8vIrdOrnGfQd6aTbsgJ9O0q41KTEQwg+856CuosvCVnuVZS8rHqc4ArVtbaK0t0hiXCKPzrVtItke8/eb+Ve7SwNOlG81dk3uU/7AsRGEjRkAGBg1g674clFqzRfvAvzKcciuyoIyMHpWk6UZR5WB4uRg4NFdH4u0gWF+LmFcQT5OP7rd65yvAqU3Tk4soKKKKgAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiipEgmk+5E7D1C00m9gI6KsjT7o/8ALFqa1lcr1gf8Bmq9nPsBBRSsrKcMCD6EUlQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU5YpG+6jH6ChK+wDaKl+yzH/lmaQ28w6xt+VVyS7AR0UEEHBBB96KkAooooAKKKKACiiigAooooAK1vDtiLzU1ZxmOEb29z2FZNdj4TgCadJNj5pJP0H+TXVgqaqVkntuJnQUUUV9ISFFFFABRRRQAUUUUAFcz4ssQ0Ud6g5U7H+nY101VNSgFzptxERndGcfUcisMTTVSk4gjzmiiivmCwors9C0myOlxTSQRzSSjJZ13Y56D0rn9fsobHVGjg4RlDbf7ue1dVTCTp0lUb3FczKKKK5RhRRRQAUUUUAFFFFABRRRQB1fgD/kPP/1yNem15N4R1O10rVmnu3KxmMrkDPNdx/wmuif8/D/98V6eEqQjTs2B0NcB8Rv9fZf7p/nW9/wmuif8/D/98VyPjPWbLV5bZrOQuIwQ2RiniakJU2kwOWooorywCiiigAoopQpY4AJPoKAEoqwtjdsMrazke0Z/wqOS3niGZIZEH+0pFOzAjqzYXK2d9DcNH5io2SvrVaiiLcWmugF7Vr9NRv2uEi8tSoGD1OO5qjRQBk4HWnOTnJye7AKKnWzmYZ2gfU1E8bxth1waHGSV2gG0UUVIBRRRQAUUUUAFFFFABRRRQAVpWK4gz6ms2tW0GLZK3w698TJ6KKK7hBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVWvlzbk+hBqzUNyM27j2qKivFgZNFFFeaUFbvhRFbU2Y9VQ4rCrQ0S8FlqccjHCN8rfQ1vhpKNaLfcGeg0UgIYAg5B6UtfTkBWV4iVW0abPbBH1rVrnPFV8qWy2in53O5h6CufFSUaMm+wLc5Grunapc6bLuibKE/Mh6GqVFfNxnKD5ouzLPQNO1m11JAEbZL3jY8/h61o15erMjBlJDA8EHpW/p/iieDEd2pmT+8PvD/ABr18PmSfu1dPMlo6K+0ez1AEyx4k7OvBrnLrwtdwSBrdlmTPTo35V09nqVpfLmCZWPdScMPwq4v3h9a6qmGo11zfihXaOLkikhbbIjIw7MMU2vQJIY5l2yxq49GGaz5tAsZclUaM/7Df0rKWHfRgc/o+qtpF086RCQsmzBOO4P9K2v+E2m/58k/7+H/AAqtJ4X/AOeVz+DLVZvDd4PuvE30JqOSpHoO5pf8JtN/z5J/38P+FQXfi6W7s5rc2iKJUKEh+mR9KoHw/fj+BD/wIUo8PX56rGP+BUrVOwXMqitpPDN0335YlH4mrUXhiMf624ZvZVxQqM30Ec3U0FpcXLYhhd/cDj8666DRbCDBEAZvVzmryqFGFAAHYCtI4Z9WBztp4aY4a7kwP7idfzrdt7SC0TZBGqD26n8amrPvNYtLPIL+Y/8AcTn/APVW6jCmrgaHSsfUdehtsx2+JZfUfdWsW+1q5vcoD5cR/hXv9TWdWM8R0iBJPcS3Mplmcux7mo6KK5hle8GbZvqKy61bv/j2asquHEfENBRRRXOMKKKKACnmWQpsMjFP7ueKZRQAUUUUAFFFFABW94UjDao7nqsZx+YrBrX8NXIg1dFY8SqU/Ht/KujCtKtFvuDO/t4vNlGfujk1pVFBF5UQH8R5NS19BJ3ZIUUUVAGN4ntkudIKN/eGD6V5lIjRSMjDDKcGvTPEU4W3jgB+Zm3H6CuI1e1yBcKORw39DXnY6lze8ug0ZFFFFeWMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVEaRwiAlj0AoAQDJwK0bbSZJQGmPlr6dzV6y09LYB3w0vr6fSrtd9HCLeYmyvDZW8H3Ixn1PJqxRRXYoqKskIKKKKYDXjSRcOqsPQjNUZ9JhkyYiY29OorQoqZ04z+JAcxPbS2zbZFx6EdDUVdVJGkqFHUMp6g1hX1g1qd6ZaI9/T6159bDOGsdhplKiiiuUYUUUUAFFFFABRRSqpdgqjJPagBKtQ2LvzIdo9O9Wbe1WEbm5f19Ks1108P1kK5FHbxR/dQZ9TzUtFFdKSWwgooopgNZVcYZQR7iq0tjG3KHaf0q3RUyhGW6AxpYXhbDj6HsaZW0yK6lWGQazbm2MJ3Lyh/SuOrRcdVsNMr0UUVgMKKKKACiiigArvPDgA0K3x33f+hGuDruPDEgfRkX/nm7Kfzz/WvRyx/vn6f5CZs0UUV7pIUUUUAFFFFABRRRQAUhGQQelLUdxIIbaWU9EQt+QobsrsDzM8MaSg9aK+RLL1lrF7YRGOCbCE52kA4PtVSaaW4maWZy8jHJY96ZRVOcmlFvRAFFFFSAUUUUAFFFFABRRRQAUUUUAFFKi7nVfUgV6Cvw7tWRW+3y8jP3B/jWlOlOp8IHntFSTxiG4kjByEYjNR1mAUUUUAFS29tNdzrDBG0kjdFUUtpaTX11HbQIWkkOAK9Z8P+HrfRLUAAPcsP3kpHP0HtW9Cg6r8gOe0jwAoVZdTkJPXykPT6muttNI0+yQLb2kSD12jNXaK9SFGEFogECgDAAH0FNeGKQYeNGHuAafRWoGFqPhHSdQUnyBDIf44uK4PXPCd7o+ZVHn23/PRRyPqK9ZpGVXUqwDKRgg9656uGhPyYHhFW7CMM7Oe3Sul8XeFhYFr+xT/AEcn94g/gPqPauXtJhDId33T+lecoOnUSmDNSoLqMPA2eo5FTBgRkHIqreTqsZjU5Y9cdq66jXK7kmdRRRXmlBRRRQAUUUUAFFFFABRRRQAVr23/AB7p9KyK1rU5tk+ldGG+JiZNRRRXaIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1Z6fc3zYhj+Xu54Aq9pGjG7xPcAiHsO7f/AFq6mONIkCIoVRwAO1dFOi5avYRi23hqBADcSNI3ovA/xrQj0qwjGBaxn/eGf51corpVOK2QFY6dZEYNpD/3wKpXegWE8LgRmMkdUb/IrWpknEbfSm4RejQHA33he5twXtmE6D+HGGH+NYTKysVYEMOCD1FeoVl6tokGpRlgBHcAfK4HX2PrXDiMtVual9w0zgqKluLeW1naGZSrqeRUVeO007Mo3NK8Ry2SCGdTLEOhzyK308Saa65MrL7Fa4Siuulj61Ncu68xWOuvfFcKoVtELuf4mGAK5WeeS4maWVizsckmo6KyrYmpWfvsaVgooorAAooooAVWZGDKxUjoQa17PxJf2pUO4mQdn6/nWPRV06s6bvB2A9EtvEtrKo86N4if+BCtKHULSf8A1dxGfbOD+Vef2r77dT3HBqavYhiZNJsg9DBBGQciiuASeaP7krr9GIqddVv06XUv4tmtViV1QHcUVxY1rUR/y8n/AL5H+FIdZ1A/8vLfgB/hT+sR7AdrSM6oMswA9zXDPqV6/wB66l/BiKgeR3PzuzfU5pPErogO0m1axg+9cIT6Kcn9KzbjxNGMi3gLH+85wPyrm6KzlXk9gLt1q15dZDylV/upwKpUUVi23uAUUUUhhRRRQBVvmxBj1NZtXL98uqenNU64K7vMaCiiisRhRRRQAUUUUAFFFFABRRRQAVo6Rbl5/tB4EZ+X/eqhHG0sixoMsxwK6aCFYIVjXoo6+tdWFpc8uZ7ITOu0zVI7uMRyMFmHUH+L6VpVwYJBBBwfar8OsXkK7RJuH+0M166n3EdbUF1dw2cReVvovc1zj65euMBlX6LVCSWSZ90jlmPc03U7ASXd095cNK/foPQVXZQ6FWGVIwRS0Vk9QOZuoDbXDRnoOh9RUNb2p2vn2+9R88fP1HesGvIr0vZzt0KQUUUViAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW7ptn5EQlcfvGH5Cs7Tbfz7oFhlE+Y/0roK7sJSv77E2FFFFdwgooooAKKKKACiiigApGVXUqwyp4INLRQBzd7am1nK9UPKn2qvXRahb/aLVgB86/Mtc7XlYil7OemzKQUUUVgAUUUUAFaVpb+Wm9h87fpVS0i82YZ+6vJrVrqw9O/vMTCiiiusQUUUUAFFFFABRRRQAUjAMpUjIPWlooAyLiEwyY/hPQ1FWrdRebCcfeHIrKrz6sOSWmw0FFFFZDCiiigAro/CV2EuJrVj/rBuX6jr/n2rnKltp3tbmOeM4dGyK2oVfZVFMGemVftNMknAeQ7EP5moPD/lapAl4OYvT/a9K6SvoJ1tPcJSKkem2qD/AFe7605tPtWGPKA+lWaKw55dyrGPc6QVBaA5/wBk1lkFSQRgjsa6yszVbMNGZ0HzL97HcVvTqu9pCaMaiiiugkKxvEt2LfSmjB+eY7B9O/8An3rYJCqSTgDkk1wWuaj/AGjflkP7mP5U9/euPHVlTpNdXoNIzKKKK+dKCiiigAooooAKKKKACiiigAooooAKKKKAFRtrq3oc13S/EUKgX+zugx/rP/rVwlFaU6s6fwsB88nnTySYxuYtj0plFFZgFFFS2sBuruG3XrI4QficUAeg+BNGFvZnUpV/ezcR57L/APXrsqitoUtraKFAAsahQPpUte5SgoQUUAUUUVoAUUUUAFFFSLBK/wB2Nj+FJuwEEsSTwvFIoZHBVge4rx3X9LbSNXmtudmd0Z9VPSvbRZXB/gx9TXHePfDt1dW1tdwxBpI2KNgjkHkf1rlxUFUj7u4HmAYjoTRV2XSNQh+/aSfgM/yqmysjbWUqR2IxXmShKPxKwCUUVIlvK4yqHHrSSb2AjoqVraVBkoce1RUNNbgFFFFIAooooAKKKKACtKxbNvj0JrNq7p78un41tQdpiZfooorvEFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABV/SLA392Aw/dJy5/pVCuy0W1Frp0ZI+eT52/Hp+la0oc0tRGgqhFCqAAOAB2paKK7wCiiigAqOc4iPvUlQXB6LTW4EFFFFaAY3iDShfWhmjX/AEiIZGP4h6Vw9eo1wOvWYstVkVRhJPnX8ev65rx8yoJWqr5jTMyiiivJKCiiigAooooAKKKKACiiigC5YSYYxnvyK0KxFYowYdQa14pBLGGHeuzDzuuUTJKKKK6RBRRRQAUUUUAFFFFABRRRQAUUUUAFISACT2pap3s21PLHU9fpUzkoxuwKUsnmSs3r0plFFea3d3KCgAk4AyT0Aore8M6b9puzdSL+6hPy57t/9b/CrpUnVmoLqBgkEHBord8Tab9lvPtMa/upjzjs3f8APr+dYVFWk6U3B9ACiiiswCiiigAooooAfFM8D7422t64zU/9pXf/AD2P/fI/wqrRVKco6JgWv7Su/wDnsf8Avkf4Uf2ld/8APY/98j/CqtFP2s/5mFi1/aV3/wA9j/3yP8KP7Su/+ex/75H+FVaKPaz/AJmFi1/aV3/z2P8A3yP8KP7Su/8Ansf++R/hVWij2s/5mFi1/aV3/wA9v/HRVUnJJPeiik5Slu7gFFFFSAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG7pEWy0393bP4Dj/ABq/UNouyzhH+wKmr2aUeWCRIUUUVYBRRRQAUUUUAFFFFABRRRQAVzV5F5N3Ig6A5H0PNdLWHrC4vAf7yCuXGRvC40Z9FFFeaMKKKKANKxTbBu7satVHAMQRj/ZFSV6VNWikSFFFFWAUUUUAFFFFABRRRQAUUUUAFY86eXO69s8VsVm34xcA+q1z4lXjcaKtFFFcQwooooAKKKKAPS/C0p03S7dcZSRd7j3POa7COVJow6MCp9K4rS3EmlWrDp5Sj8hitG3upbZ8xtx3B6GvpVRTpx5eyJTOmorPg1aGQASfu2/SryyI4yrqR7GsXFx3RQ6kZQylT0IwaWkZlUZLAfWpA5aRdkjJ/dJFMJCgknAHUms/U/ENhbTykS+axY4VOe9cpqWvXWoZQHyof7inr9TWtbG0qS3uybF7X9eE4a0tG/d9Hcfxew9q5yiivCrVpVpc0ikrBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa/haMS+JrFT/fJ/IE1kVq+GZRD4ksXPTzMfmCP61dP416gex0UUV7oBRRU1vbvcNgcKOppNpK7AiVWdgFBJPYVeh04nmU49hVyG3SBcKOe57mpa5p1m/hKsRR28UX3UH1qWiism29xhWbryhtImP8Adwf1rSrM199mkSg/xED9f/rVdL+JH1E9ji6gns7e5XbNCjj3FT0Dk4r2Wk1ZmRjSeEbdsy27FG7I3IrKurOezfZNGV9D2Nd2BgAUyaGO4jMcqB1PY1xyw0PsKwXOAqpdWwZS6DDDr710WqaI9pmaDLw9SO61j1x1aX2ZDMSinSDbKw9DTa8p6FBRRRQAUUUUAFS20nlzqe3Q1FRTTs7gblFQ20vmwqe44NTV6cXdXRIUUUUwCiiigAooooAKKKKACiiigAooooAKKKKAHwR+bPHH/eYCu/ACgADAHArhtOx/aVtn/nqv867quvDbNiCiiiukAooooAKqStukNWZG2IT+VU6uKAKKKKoArmPF8IMdtNjkEof5/wBK6esDxbj+y4v+uw/ka5car0JAtzjaKKK+bLCiiigAooooAKKKKACijqcCus0bw4iItxfJuc8rEeg+tbUKE60uWIN2OcttOvLzmC3kcf3scfn0rTttD1WFubcbT1HmL/jXaABVAAAA4AFLXr08thHVydybnIT2dzbDM0LoPUjj86hruUkAGxxlDwQRWRquhoUa4s1wRy0Y6H6U6mHcdUI52iiiuYYUUUUAFFFFABRRRQAUUVFNOkK5Y89hSbSV2ATTLChY9ewrJdy7lmPJqZHNxdx+ZyC4GPbNd0NE03/nzjrKFGeKvyuyQ9jz6ivQf7E03/nzj/Kj+xNN/wCfOP8AKtP7Lqd0HMcFBC9zOkMQy7kKBXotjaJY2cdvH0Qcn1Pc1paL4e0+Im6+yRhuQhx27mo7tFS7lVRhQ3ArrwWHVGTvqxMoX9ml/ZSW7/xDg+h7GvOpoXt5nhkGHQ7SPevTq5fxVpuQt/GvTCy4/Q/0/KpzHD88PaLdfkCZy1FFFeGUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHT25zaxH/YH8qlqrpz+ZYxH0G38qtV7UHeKZIUUUVQBRRRQAUUUUAFFFFABRRRQAViayf8ASkH+x/U1t1z+qPvvnH90Ba5sW7UwRTooorzCgooooA2YuYU/3RT6gtG3WyewxU9enB3imSFFFFUAUUUUAFFFFABRRRQAUUUUAFZ2of65f92tGsq8bdct7ACsMQ/cBEFFFFcJQUUUUAFFFFAHXeFb8PbtZOfnQlk9x3ro68ygnktplliYq6nIIrtNL8QW96ipMwin7gng/SvbwOLi4qnN6olo2aUMV6Ej6GmggjIORS16Yh/ny/8APV/++jWZrmpGy052MhMjjagJ70t/q9pp6EySBn7IpyTXEajqE2o3JllOB0VR0UVwYzFRpRcY/F+Q0ipRRRXgFBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVoWWi31/F5sMYEfZmOM/SqhCU3aKuBn0VNdWs9nOYZ4yjjse9Q0mmnZgFFFFIAp8MrQTxzJ95GDD6g5plFAHuFhdJe2MFzGcrIgYVYrgvAeuKA2lTvjktCT+o/rXfKpdgqjJJwK9ujUU4KQEtvA08m0cKOprYjjWJAqjAFNghEEQQde59TUlYVJ8z8ikgooorMYUUUUAFc54ouRiG2B5++39P61vzzpbwPLIcKoya4O9umvLuSd+rHgegrrwlPmnzdETJ6EFFFFemZlxG3KCKdVSOQofUVYWRG71m0A8gEEEZBrlNd0sWYa6hH7k/eX+6f8K6kyIBywqB0+3H7Nt3LJ8pB7is6lPniBxfhvTRdXEl7OgMakqoI4LHr+VZmr6edOv3iwfLb5oz6r/nivRH01NKVbWIYiUfIfUVka9pv9oWB2DM0XzJ7+o/GuOpgk8OlH4lr/AJjvqcHRRRXilBRRRQAUUUUAWLOby5dp+61alYdadpP5se0n5l/WurD1PssTLNFFOh2edH5n3Nw3fTvXWIPKk8vzPLbZ/e28fnTa78+T9n52eTt/4Dt/wrgpNvmvs+5k7fp2rWpT5LaiG0UUVkMKKKKACiiigAooooAKKKKAHwSeVcRyf3WB/Ku/BDAEcg157XZ6LdC602PJ+eP5G/Dp+ldOGlq0I0KKKK6wCiio5X2LgdTQtQIpn3NgdBUVFXtKiSS6+cA7RkA1bfKrgUirDqCPrSV088UckDq6jGPyrmDwSKmnU5wasFcx4vmAitoc8lix/Dj+tdPXA6/eC81WQqcpH8i/h1/XNcuYVFGi13GtzMooq3pmny6pqMNnD96RsE/3R3P4CvASbdkUKdLuhpI1Py/9GMnl7vf1+nb61Tr2o6TaHR/7L2f6N5fl47/X655+teP6lYS6ZqE1nMPnibGfUdiPqOa3r0HSSYFWiiiucAooooA2/DNgLq+M0gzHDzz3btXbVg+FIwulu/dpDn8AK3q+iwNNQop99SXuFFFFdggpySMnTp6U2igDmdbijtr8MvyrMNwHv3qhWp4tjBsIX7rJj8CDXKR3Esf3WOPQ14mJqKlVcWtBpGvRWeuoN/EgP0NSi/jPVWFQq0H1Cxboqr9ui/2vypragn8KMfrT9tDuFi5SMwUZYgD3rOe/kb7oC/rVd5Hc5ZifrWcsTFbBYuzXwHEXJ9TVFmZ2LMcmkorlnUlPcqxLbf8AH1D/AL6/zr0sdBXmlt/x9Q/76/zr0sdBXq5VtL5EyFooor1hF5dWnRAqpEABgDB/xridV8UX8WqXKKkGFcjlT/jXUV55rP8AyGLr/roa87HydKCdPR3GtS//AMJZqH9y3/75P+NMl8T3s0TxSRW7I42kFDyPzrForyniqz+0yrIKKKK5wCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDV0abBeAnr8w/r/SteuWhlaGVZF6qc10sMqzxLIh4YV6WEqc0eV9BMkooorqEFFFFABRRRQAUUUUAFFFFADZJFiiaRuijJrl3cySM7dWJJrU1a66W6H3f+grJrzcXU5pcq6DQUUUVyjCiiigC7p8nLRn6ir9YqOY3DDqDWvG4kQOp4NduHnePL2JY+iiiugAooooAKKKKACiiigAooooAa7BELHoBmsZmLMWPUnNXb6b/lkp92qjXFiJ3lZdBoKKKK5xhRRRQAUUUUAFFFFAFmLULyAYiuZFHsadJqt/KuHupSP96qlFX7SdrXYASWOWJJ9TRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAV6Fo88M+lwGEjCqFIHY157Tklkiz5bsmeu04rqwuJ9hJu17iaudB4snhe5hjQgyIPmx29q52gkk5PJorKtV9rUc+40FFFFZAFFFFADo5HhlWSNirqcqwPINexeBtdGr2m66AS4Q7AT0c+orxuvRtLtvsOnwQjhlXJI/vdTXfgKUqkpK9lYG7HqVFclY+Ip7cBJx5qDv3FbcGu2E4H73YfRxiuieHqQ6DUkzSoqFby2YZFxF/30Kjk1GziGXuY/zzWXLLsUWqZLLHBGZJHCoOpNY114lt4wRbo0jep4Fc9eajcXz5mfjso6CuinhZy+LREuSRa1fV2v5PLjysCngevuay6KK9KEFBcqM73CiiiqAKKKKACrVjdR2js7Rl2PAOegqrR1pNJqzAs6vqqvYvItszPENwAbqO9ch/wmEX/Pm/8A32P8K7OHSL24TK27bT3bjNef6z4V1TTbqfNm5hViQy8gDtXnYurOkl7F+vUaV9zJvp4rm8kmhiMSOd2wnOD3qvQRg4PWivEk3J3ZQUUUUgCiiigAp0btG4ZTyKbRRsBsQzLMgYfiPSpKxopWhfcv4j1rVimWZMqfqPSu+lVU1Z7ktE3mSeX5e9tn93PH5U2iitgCiiigAooooAKKKKACiiigAooooAK0NH1D7Bd5Y/un4f296z6KcW4u6EehKQyhlIIPII70tcro+tG1xb3BJh/hbuv/ANaun85DGJFYMpHBB616FOamtAFdwi5NVGYsxJpXcu2TTa3SsAU6OR4nDo2GHem05I3kOERmPoozTfmBZl1K4mjKEgA9cDrVSpfstx/zwl/74NZ+p3UunxHbazSzH7qLGT+fHFQ5QgrhqUtf1UWFoYo2/wBIlGFx/CPWuGqxfPdSXTSXiusrc4dSOPp6VXr53FYh1ql3sikrBXpXgXRfsdgdRmXE9yPkz/DH/wDX6/lXE+H9Oi1LVooriVI7dfnlZ2C5UdufWvWl1CwVQq3lsABgASLwK0wdNX52MtVx/jvRftdiNShXM1uMSY/iT1/D+Wa6f+0bH/n9t/8Av6v+NNa/090ZGu7ZlYYIMq4I/Ou6pGM4uLYHiVFaWvafHpurSwwSpJbsd8TIwb5T2+o6Vm14sk4uzAKKKKQHYeEpg1hNDnlJN34Ef/Wroa8/0TUf7Ov1dj+6f5X+nrXfqyuoZSCpGQR3r6DL6qnSUeqJYtFFFdwgooprusaM7sFVRkk9qAOd8XTAW0EGfmZ934Af/Xrkqv6vqB1G/eUf6sfKg9qoV81i6qq1nJbFLYKKKK5hhRRRQAUUUUAFFFFAEtt/x9Q/76/zr0sdBXmMbmOVHAyVIOK6uDxDdOAZLaNR6ZOa9PLq0KfMpdRM6UKWOAM1KtuT944rAHiWZRgW8Y/E0f8ACTz/APPvH+Zr0niYEnRiFB2z9a4jVYYv7VuTsXO89q1P+Enn/wCfeP8AM1kXM5ubmSZgAXOcCuevUjUSQFfyo/7i/lTGtoW6xj8Kmorm5U+gyo9hGfusV/WqslpLHzjcPUVq0VlKhB+QXMOitWa1jmGcYb1FZ0sDwthhx2NctSlKHoVcjooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACrlhem1k2tzE3X296p0VUJOD5kB1asHUMpBB6EUtc7aX8lqcfej7qf6VuQXUVyuY2ye6nqK9SlXjUXmS0TUUUVsAUUUUAFFFBIAyTgUAFU76+W1TauDKRwPT3NQXeqogKW/zN/e7CsdnZ2LMSWPUmuSviUlyw3GkDMWYsxyTySaSiivOGFFFFABRRRQAVPa3Hktg/cPX2qCinGTi7oDbBDAEEEHvS1kwXLwnHVfStKKZJhlD+Heu+nVU/UmxJRRRWoBRRRQAUUUhOBk9KAFqvc3IhXA5c9B6VHPequVi5Pr2FUGJYkk5J7muarXS0iNIQkkkk5JooorjGFFFFABRRRQAUUUUAFFFFABRRRQAUUVKltLJ0XA9TTSb2AiqeyUPfQKwBBkUEHvzUq6e38TgfSrdjYIt9Ad5OJB2961jQm3sFz1H+w9K/6B9t/37FH9h6V/0D7b/v2K0KK9jkj2A858e2NrZy2YtreOHcrbti4zXG13nxEjd5LIqpIAbOPwrg8Y615GJVqrAKKKKwAKKKKALNhaPfXkcCfxHk+g71p+IdIWxeOaBcQsNp9jWv4a037LafaZF/eyjjPZa1r21S9tJIJBww4Poa9ejgVLDu/xPUm+p5tRUtzA9rcPDIMMhwairyWmnZlBRRRSAKKKKACiiigAooooAKKKKALWmQ/aNTtoyMgyDP0HJr0euE8Nru1yE/3Qx/Q13de5lcbU2/MlhRRRXpCCiiigAooooAKKKKACiiigAooooAK6nQtISOFbqdQ0jcop/hFc1AgkuI0PRmA/WvQgAoAHAHQVx4yo4pRXUqCFrM1JMTK3ZlrTqhqY+WM+5rhpP3y2ec+MfDEUltJqVlGEljG6VFHDDufrXnle7SKrxsjDKsMEHuK8OuYxDdTRDojso/A1z4ymoyUl1JIqKKK4wCiiigAooooAKdHI0bblODTaKL22A04LtJeD8relWaw6sw3rx8P8y/rXXTxHSQrGnRUUdxHKPlbn0NS10pp6oQUUUUwCiiigAooooAKKKKACiopJ44h8zc+gqlNeu/CfKP1rOdWMdwsWp7pIRgct6VHaaze2cm6OXKnqjcqfwrPPNFcjrz5rp2HY7C18V2sgAuY2ib1HzD/GtSPV9PlGVvIv+BNt/nXndFdcMyqxVpWYcp6OdRsVGTeW/wD38FW9H1uwN5Ikc3mMI84Qe479K8trf8Jf8hKb/rkf5it6WPlWmqbWjFax6HcavLICsS+WPXqazySxJJyT3NJRXqRio7COK8V/8hdf+uS/zNYddHr9lPfa6sVuhZvJUn0AyazL7Rr3T4xJNGDH/eU5Ar57FUpurOSWlykZ9FFFcgwooooAKKKKACiiigArZ0jxBLp4EMwMtv2HdfpWNRWlOrKnLmg9QPRbXVLK8UGG4Qk/wk4b8jVyvLqXc2Mbjj0zXpRzRpe9H8Rcp6Hd6tZWaky3Cbh/Apy35CuS1fXpdS/dRgx2/wDd7t9f8KyKK5q+OqVVy7IEgoooriGFFFFABRRRQAUUUUAFHXpRV2yt8/vWH+6KuEHN2QElrahAHcfN2HpVuiivQhBRVkSFFFFUAUUUUAFFFFABRRRQAU10WRSrDIp1FDVwMm4tzC3qp6Goa2ZEWRCrDg1kyxGKQqa4K1Lkd1sNMZRRRWIwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAClVirAqSCO4NJRQBeh1W4jwHxIPfr+dXE1mE/fjdT7c1i0VvHEVI9Qsb41W1P8bD/gNNbV7YdN7fRawqKv63UFY1ZdZPSKLHux/pVCe7nuD+8kJHoOBUNFYzrTnux2CiiiswCiiigAooooAKKKKACiiigAoBIOQcH2oooAsx3sqcNhh71OuoRn7yMPpzWfRWsa011Cxp/bYfU/lSG+hHTcfwrNoqvrExWLr6gf4E/Emq0k8kv32JHp2qOis5VJS3Y7BRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAVPDaPLyflX1NT21p0eQfQVdrppUL6yE2RRW8cQ4XJ9TU1FFdaSWiEFSW7iO4jduisCajopiO+/4S7S/Wb/vj/69H/CXaX6zf98f/XrgaK09pIdze8S6tbao9ubbf8gOdwxXOSQRyj5l59RUtFZy97cDLns3j5X5lqvW5VO5tAwLxjDdx61yVKFtYjTM+p7MwLdRtc7vKBywAyTUB4ODRXMnZ3GdqPFOnKAAJQB0+Sj/AISrT/SX/vmuKoru/tKt5CsbGu31lqEiT2+8S4w25cZFY9FFcdSo6knJ7sYUVdsY0kV96g4PerX2eH/nmv5VpCg5K9xXMilVWdgqgljwAO9a32eH/nmv5V0PhvTICXu2iXKnanHT3rWng5TklcLmNaeFbqZA88iw5/h6mnXHhO4jQtBMshH8JGCa7zy0/uijy0/uivS+o0OW1hXZ5LLE8MjRyKVdeCDTK7/xHpkEluLoRLvQ4Y46iuX+zw/881/KvNqYNwlZMdzIorX+zw/881/KshvvH61hUpOG40zX8MkDW4h6q38q7qvPdEl8nWbVj3fb+fH9a9Cr2Msd6TXmSwooor0RBRRRQAUUUUAFFFFABRRRQAUUUUAKjFHVx1ByK9Btp0ureOZD8rjP0rz2tPStYk09tjAvCTkr6fSubE0XUjeO6Ki7HaVR1M/JGPc0sGrWU65WdQfRuDWN4h8SaXp5QTXSlgpYIvJP+cV50U4SvLQtvQj1K9j07Tp7qU4WNCcep7CvE5HMkjO3LMSTW74k8Tza5II0BitEOVTPLH1NYFcmKrKpKy2RIUUUVzAFFFFABRRRQAUUUUAFFFFAB0qaO7lT+LI9DUNFNScdgL6agP40I+lSreQt/Fj6isuitliJoVjYE8R6OtL5sf8AfX86xqKr6y+wWNgzRDq60xryFf4s/Ssqtvw/4buddmJB8q2Q/PKR+g9TTjXnN8sUFim+oKPuIT9aryXcsn8WB7V6pZ+ENGtIwv2QTN3eU5J/pS3fhHRbtCptFibs8R2kf0raWHrSWrHY8nihedvl/Emri2CAfMxJ9q39V8OyaJjafMt2OFkx39DWZUxw6j8W5LZSewGPkY59DVJ42jYqwwa627trCPS4ZYZ91w2Ny7s9ueO1Yl1CJIScfMvIorYdJe6NMy6KK6PQvB95rMIuXkFtbH7rsuS30HpXHCEpu0UM5ytPQ9Sh0y7eWZXZWTaAgGeo9TXSXvw6lSEvZ3olkA/1cibc/Q5ri5oZLeZ4ZUZJEJVlbqDWvLUoSUragdf/AMJbY/8APG4/75X/ABo/4S2x/wCeNx/3yv8AjXG0Vv8A2jX7r7hWR2+mavaX+ozGMMjMigB8AnGf8an124hh0mYSkZddqr6muBBIIIOCO4pzyPIcu7MfVjmrWYy9m4Nav9QsNooorzhhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBF5soXt3rXACgAdBVSwj2xlz1PFXK7qELRv3JYUUUVuAUUUUAFFFFABRRRQAUUUUAFFFFABVa8h8yLcB8y81qWGnT6hJtjGFH3nPQV0ltoNlAo8xPObuW6flVqg6qt0EeaUV6S+mWKsV+xwY/65iqF34csLlTsQwv2ZP8ACsZZZUSvFplcxwtFX9S0m40yTEg3Rn7rjoaoV584Sg+WSsxhRRRUgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRSqpdgoHJPFAFmyh3ybyPlX+dF7Dsk3gfK386vRRiKMIO360SxiWMoe/6V2+x/d8vUm+pj0UrKUYqRyDzSVxFBRRRQAUUUUAFFFFABRRRQAUUUUAFXbO2ziVx9BVe2h86UD+EcmtYAAYHSumhTv7zE2LRRRXYIKKKKACiiigAooooAKKKKACiiigCleW2QZEHI6iqFbdZd3D5UvH3W5Fcdenb3kNMgooormGFFFFAF/T/uP9RV2qWn/cf6irtehR+BEvcK6rw3IrWDRj7ysc1ytW9Ov30+4Ei8qeGX1FdNKfLK7EdxRVO21O0ukBSZQf7rHBFPn1G1t0LSTJ9Ack13cyte4FbXZFTS5AerkAVx1X9U1NtQmGAViX7q/1qhXFVmpS0AKxG+8frW3WI33j9a4MV0KQI5jkV1OGU5H1r0u3mW4topl+66hhXmddj4VvfOsmtWPzxHK/7p/+vW+WVeWo4PqEjoKKKK9wkKKKKACiiigAooooAKKKKACiiigAooooAK4DXrn7TrE7A5VDsH4f/XzXZ6neCx0+Wcn5gMJ7seledEliSTkk15OaVdFTXqOIUUAFjgAk+1SG3nAyYZMeu015CTZRHRRjFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAVFLuqKMljgD3r2vSrCPTNMgtIgMIoyfU9zXjFrIIbuGVuiOrH8DXuMbB41YEEEAgiu/Ape8wHUUUV6IFe9tUvbOW3kGVdcfQ9jXlsiGORkPVSQa9aJABJOAK8ou5BLeTSL0ZyR+dY1egmRU1vuHPpTqq3kwjjKA/M3FYTkoq7EZ6KHmVScBmAJ9K9ziiSCFIo1CoihVUdgOleFV6b4c8YWd3Zx29/OsF0gClpDhZPfPTNY4OcYtp9Sjq68y+IEEcWvRSIAGlgDPjuQSM/kB+VdzeeItJsYDJLfQtgZCRuHY/QCvLNb1aTWtUlvHXap+VEz91R0H9a1xlSPJy9QM6iirFnYXN9Jst4i57nsPqa86MXJ2SAr1JDBNcPshieRvRVzXV2HhWCIB7x/Nf+4pwo/qa3oYYoECQxpGo7KMCvRo5bOWs3YVzjbbwtfzYMpjgX/aOT+QrVg8JWqf66eWQ/7OFH9a6CqU+safbZEl3HkdlO4/pXcsHhqSvL8WK7Io/D+mRdLVWPqzE1ZXTbFPu2VuP+2Y/wAKy5fFlinEcc0nvgAfqaqt4wX+CyJ+smP6Ue3wkNrfcFmdD9itMf8AHrB/37FMbTbF/vWVuf8AtmP8K57/AITB/wDnyX/v5/8AWp6+MF/jsiPpJn+lH1zCvr+H/ACzNWTw/pkvW1VT6qxFUZ/CVq/+pnljP+1hh/SnxeLLF+JI5o/fAI/Q1oQaxp9zgR3ceT2Y7T+tPlwlXa35Bqcvc+Fr+HJiMc6/7JwfyNZE0E1u+yaJ429GXFemUyaGKdCk0aSKezDIrGplkH8DsFzzKiuvv/CsEoL2b+U/9xjlT/UVzF5YXNjJsuIih7Hsfoa8ythatH4lp3KTK9FFFc4BRRRQAUUUUAFFFFABRRTohulQepFC1YGvEuyJV9BT6Slr1UrKxIUUUUAFFFFABRRRQAVoadpE9/8AP/q4v7xHX6VFptn9tvUi/h6t9K7ZEWNFRAAqjAArejS59XsIzYfD9jGvzI0h9Wb/AApZdAsJFwIyh9VY1p0V1ezh2A5DUdEmsgZEPmReo6j61Qtbd7q5jhTq5x9K70gMCCMg9QayLHTFtNYmdR8mzKe2T/8AWrCdBcytsBpW1tHaQLDEuFUfmamoorqStoBXuByDUNWbgfux9arVpHYCG5toru3eCZQyMPy9688vrR7G8kt36oeD6jsa9JrkvF0IW5t5gOXUqfw//XXnZlRUqftOqGjm6KKK8MoKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACr1jD1lYey1UhjMsoQd+vsK2FAVQoGAOldGHhd8zE2LRRRXaIo30PSVR7NVGttlDKVIyD1rHmjMUpQ9unuK4sRCz5kNDKKKK5xhRRRQAUUUUAFFFFABRRTo13yKvqaANGzj8uEE9W5qzSAYAFLXpxjyqxIUUUVQBRRRQAUUUUAFFFFABRRRQAUUUUAFQXUfmQn1HIqekpSV1ZgYlFSTp5czL71HXmNWdigrUsNAvL9Q4AjjP8T96k8Paat9eF5RmKLkj1PYV3AAAAAwB0Ar0cHglVXPPYTZhWfhQpG3+kgsT/d4qte6Tc2I3Ou5P7y9K6+36NUrKrqVYAg8EGvQeGglaOhJ57RV/V7EWN6VX/Vv8y1QrjaadmAUUUUhhRRRQAViN94/WtusRvvH61y4roNCVa069fT76O4XkA4Yeo71VorljJxakt0M9OhlSeFJY23I4yCKfXG+HdZ+ySC0uG/cuflY/wn/CuxByMivpsNXjXhzLfqQ1YWiiitwCiiigAooooAKKKKACiiigAoorC8QayLOI2sDfv3HJH8A/xrOrVjSg5yAx/Eupi7uxbxNmKE8kfxN3qjpemS6ncbE+VB99/SqPWu+0K0W00uLj53G5jXiUIPF13Ke39aFPRE1npVpYxhYolLd2YZJq5tBGMDHpilor3YwjFWirEmbf6LaX6HMYSTs6jFcTfWUthctBKOR0PYivSKwvFFos2nicD54j19q4MdhYyg6kVZoaZxdFFFeEUFFFFABRRRQAUUUUAFFFdj4B8LRa9eyXV4pNnbkAr/fb0+lVGLk7IDlIrW4mGYoJHHqqk1EyMjbXUqfQjFfScFvDbRLFBEkUajAVFAArF8R+FrHxBZSK8SJdAHy51GCD7+orZ0NNGOx4LRUlxBJa3MtvKu2SNirD0IpgBYgAZJOAK5/IRYsbGfULgQwLk9Sx6KPU17J4UkgisYbG6k8yeJdqu/RhXKaRpyadYrGAPMYbpG9TV8cHI617uHwKhT95+8yebU9GCgDAAA9qa8Mcg+dFP4VxcGt38C7Vn3KOgcZon1y/nXaZtoP9wYpfU6l9yudB40upLHTJYtOPmTMMOByUXvXla6g2PmTJ9q9EJJOSck1xPiTTVsrwTRLiKbJwOgbv/jWeMozpxVSLvbcV7me9+5GEUD3qqzFjljkmkoryZTlLdjCiiipAKAMnAp0UbzSLHGpZ2OAoHJrtNG0COwCz3AElz+ifT3966MPhp15WW3cG7GZpXhl5gs19lE6iIcMfr6fzrqoYYreJY4UVEHRVGKkPAya53VfE8cBaGy2ySdDIfuj6ete1GNDCQu/+CyNWblzd29nF5lxKsa+56/Qd65y98W9Usof+2kn9BXOXFzNdSmWeRpHPdjUVedWzGpPSGi/EpItXWo3l4T59w7g/w5wPyHFVaKK8+UnJ3k7jCiiikAUUUUAFFFFAFq11G8syPIuHQD+HOR+R4resvFvRL2H/ALaR/wBRXL0VvSxNWl8LCx6XbXdveReZbyrIvsen1HanTQxXETRzIroeqsM15vb3M1rKJYJGjcd1NdVpXieOcrDe7Y5OgkH3T9fSvWoZhCr7tTR/gS0U9V8MvCGmscunUxHlh9PX+dc4Rg4NeojkZFYms6BHfhp7cCO5/R/r7+9ZYrL0/fpfd/kCZxNaP9iXZ0L+19v+j+ZsxjnH976Z4pNM0i41HWI9P2sjlv3mR9xR1Neviwthp32Dyh9m8vytn+zjFcNDDupdv+mUeIUVe1jTJNI1Sazkydhyjf3lPQ1RrmaadmAUUUUgCpIP9en1qOnxHEqH/aFOO6A2aKKK9QkKKKKACiiigAooooA3/DCAyTv3AArpK5Xw5cCK9eJjjzF4+orqq7qD9wQUUUVsAUmVDY/iP+f60tYuq6mLTUrYA5CcuB6H/OamclFXYG1RTUdZEV0IKsMginVQEc/+qP1qrVm4P7v8arVpHYArlfGEgL2sfcBm/PH+FdQzKiF2IVQMkntXn2r339oajJMPuD5U+grgzGoo0uTqxoo0UUV4JQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVPaw+bLyPlXk04pydkBbs4fLi3EfM38qtUUV6cYqKsiQooopgFVbyHzItwHzL/KrVFTKKkrMDDoqe6h8qXgfK3IqCvNknF2ZQUUUUgCiiigAooooAKsWa5uR7DNV6tWH+uJ9qukrzQM0qKKK9IkKKKKACiiigAooooAKKKKACiiigAooooAKKKKAM2/XE4PqKq1d1D7yfSqVedWVpspbHYeEgosJiOpfmuhrjPDGoLbXTW8hwkvQn1rs697AzUqCS6EvcsW/RqmqG36NU1dEtxHPeJwNsB75Nc7Wnrt6t3e7UOUjG0H1PesyvOqtObaAKKKKzGFFFFABWI33j9a26raXo8upzMc7IVPzP/hWFaEpuMYrUaMyiu8h8O6dEgUw7z6sc1VvvC9rNGWtcxSdh1BqpZbWUb6BzI42ui0TxCbcLbXhJi6K/dfr7VgzwSW0zRSrtdTgio65KVWdGd47j3PT0dZEDIwZTyCO9Orz/TdZutObCNvi7xt0/D0rrLDXrK+AG/ypP7j8fka92hjadXR6Mlo1KKKK7BBRRRQAUUUUAFFVLzUrSxUmeZQf7o5J/CuW1PxLPdBorYGGI9T/ABGuavi6dFavXsCRr6z4gjs1aC2IefoSOif/AF6415GkdndizMcknvTTycmivCxGJnXleW3YtKwV6TYur2MDL0KD+VebV1/hjUllt/scjYkT7me4rpy2oo1HF9RM6KiilX76/WvdJDa390/lWbrwK6LcZU8jA471v1zXiG/WRhaxnIU5cj19K568/wB20+oHD+VJ/cb8qPKk/uN+VbNFeJ9WXcq5jeVJ/cb8qPKk/uN+VbNFH1ZdwuYxjcDJRsfSm1sTf6l/901j1jVp8jsCdwooorIYV658K5o20C6hBAkS4JYexUYP6H8q8jrX8OeIbnw5qQuoBvRhtliJ4cf4+9aU5KMrsaPoGiuStPiN4euIA8txJbvjJR4ySPxHBrB8TfEqCS0ktNFDlpAVNww27R/sg85rqc4pXuO5xHieaO48T6lLDgxtcPgjvz1qDRIhNrVqjdN+78hn+lUCSTk9TV/RJRDrVq56b9v5jH9a5qTTqxb7r8yWehUUUV9SQFFFFABWN4niEmiux6xurD88f1rZrH8TyiPRZFPWRlUfnn+lYYm3sZX7MEcNRRRXzBYU5EaR1RFLMxwAOpNNrr/Dej+REL2df3rj92D/AAr6/U1vh6Eq0+VA3Yt6JoqabF5kgDXLj5j/AHfYVqSypDE0kjhUUZLHoKV3WNGd2CqoySegFcPresvqUxjjJW2Q/KP73ua9urVp4SmlFeiI3JNZ1+S+LQW5Mdt0PYv9fb2rEoorwatWVWXNNlhRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG3o2vyWJWC4Jktug7lPp7e1dnFKk0SyRuGRhkMOhrzGtfRNZfTZhHIS1s5+Yf3fcV6WDxrg1Cpt+Qmj1XStPsIoGvHmt0vZFxkuAQo6A/wA/ypH1fTI3KPqNorKcEGdQQfzrDR1kRXRgysMgjoRXP+JNH8+I3sC/vUH7wD+JfX6iu+vCcIucNQTNPxommappwure/s3urfoqzKS69x1/H8/WvPaKK8KrU9pLmtYYUUUVmAVpaRpMupznB2RJ99/6D3rNr0LRrVbTS4EA5Zdze5NdmCw6rVPe2QmzRtNNs7eJfLhUnH3mGTU0lpbzLtkgjYe6ii3bKlfSpq9zlS0sSczq2hi3Rri1yUH3kPOPpWFXoZAYEEZBGCK4S/gFtfTRDorHH0rkr01HVAV6KKK5xhRRRQA6N2ikV0OGU5BrsNM1WK+jCsQs4HKnv9K42gEqQQSCO9aU6jgxHodFcXDrV/CoUTlh/tDNOl1y/lXHnbR/sgCuj6xEDpdQ1OGwiJYhpSPlQHmuNnme4meWQ5Zjk0xnZ2LMxZj1JNJWFSo5sDV0rWXsf3UoLwfqtdPb3dvdJuhlVh7HkVwdAYocqSCO4pwrOOjA7u4PIFUri9t7RN88yIPc8muBn1K7eVsXU+3oB5hqozs7bmYsT3JzWcszSVoxHym3rOvtfgwW4KQdyer/AP1qw6KK8yrVnVlzTZQUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAAZOB1rWt4fJhC/xHk/WqljDufzCOF6fWtGuzD07LmYmFFFFdIgooooAKKKKAIbiHzoSv8Q5H1rJIwcHrW5WdfQ7X8wDhuv1rmxFO65kNFSiiiuMYUUUUAFFFFABVqwOJyPUVVqa1bbcL78VdN2mmDNaiiivSJCiiigAooooAKKKKACiiigAooooAKKKKACiiigDP1A/vEHtVOrF6264I9Biq9edVd5spACQcjg1v6f4omt0EdynmoOjDrWBRRSrTpO8HYDvbTxPZvGxCSZHbFVb/XprpTHEvlRnrzya5vT/ALj/AFFXa9OOIqVIXZLQUUUVIBRRRQAUUUUAFdRpNuttpsKKOo3H3Jrl66TRbtbvTYyD8yfKw9K6cK17TXewjRooor0AOT8W26rNDOBgsNp965quh8V3ay3Uduhz5Yy31rnq+bxrTry5SlsFFFFcoy7a6tfWeBFcMFH8J5H5Vqw+LrhQBNBG/uODXO0VvDE1aekZBY61fF8JHzWrj6Nn+lKfF1uBxbSH/gQrkaK2/tCv3/AVkdNL4vkI/dWqj/fbNZlz4g1G5BBm8tT2Tisyisp4utPeQ7IVmZySxJPqTSUUVzgFFFFABTo5HicOjFWByCKbRQB0tl4rdECXcW/H8a9a0V8U2G5cCUnI421xNOj/ANan+8K7YY+vFWvcVkdpe+IZZkKW6+Wp6sTzWKSSck5NJS11Sm5askKKKKkYUVPY2wvL6C2LbRI4XdjOM10lz4OS3tZZvtrHy0LY8vrgZ9apRb2A5Cb/AFL/AO6ax62Jv9S/+6ax64cTuhoKKKK5hhRRRQAUVpWWhX19B58SKEP3S7Y3fSqE0MlvM0MqFJEOCp7Vcqc4pSa0YDKASrAg4IOQaKKgD0LSdRTUbFJQR5ijbIvoav15vY38+n3AmgbB6FT0YehrsbHxFY3agSOIJO6uePwPSvfwuNhUiozdpfmS0a9FNV0ddyMrD1BzUFxf2lqpM9xGmOxbn8utdzkkrtiLNcT4k1Jby8EETZihyMjoW71Pq3iVrhGgsgyRnhpDwSPb0rna8bHYyM17Ont1KSCiilVS7BVBJJwAO9eWM1vD+mfb73fIuYIsFs/xHsK7qqWl2K6fp8cAxvxucjux6/4VDrmpf2dYEof30nyx+3qfwr6HD044WjzS33ZL1ZieJdXMshsYG/dof3pH8R9Pw/z0rnKCSTknJNFeHWrSrTc5FIKKKKyAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDo/DWrmKQWM7fu3P7on+E+n4/56111eXAkHIOCK77Q9S/tGwBc/vo/lk9/Q/jXs5dieZeyl02JaOY8QaZ9gvd8a4glyVx/Ce4rIr0TVLFdQ0+SA4343IT2YdP8K88ZSjFWBBBwQe1ceOoeyqXWzGmJRRRXEMK9G02ZZ9Nt5FPBQfnXnNb3h/Wlsj9muDiBjlW/un/Cu7AV40qlpbMTR2sbbHB7d6uCs9HWRA6MGUjIIOQaswSfwn8K96SvqiSeuH1SUTanO6nI3YBroNX1iO2iaGBg05GCR/D/APXrlCc1w4iafuoAooormGFFFFABRRRQAUUUUAFFFFABVa7m8uLA+83FTu4RCzHgVkzSmaQsfwFY16nLGy3BEdFFFcBQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFORC7hV6mm1fsYcKZWHJ4H0q6cOeVgZajQRxhB0FPoor0kraEBRRRQMKKKKACiiigApkiCSMoehp9FDV9AMV0KOVbqKbV++hyolUcjg/SqFebUhySsUgoooqACiiigApQSrAjsaSigDaRg6Kw7inVSsJcqYz1HIq7XpU5c0bkhRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUjEKpJ6AUtVL6XbHsHVqmcuWNwKDtvdmPc02iivMKCiiigBQxHQkfSje394/nSUUALvb+8fzo3t/eP50lFF2Au9v7x/Oje394/nSU5Udvuqx+gp6gJvb+8fzo3t/eP508wSj/AJZP/wB8mmEEHBBH1FGoBvb+8fzq1p+oz6dP5kLcH7ynoaqUU4ylF3T1A7CHxZasg82KRG9uRVW+8Vl4ylpEVJ/jbtXM0V1Sx9dxtcVkK7tI5dySx5JPekoorjGFFFFABRRRQAUUUUAFFFFABRRRQAVp6LpB1WdwzlIowNxHU56AfkazK0dH1Z9KndgnmRyABlzjp0I/WtaHs/aL2mwMta3oK6ZEk8MjPETtIbqDWJWzrOutqkawpF5cSnccnJJrGqsT7L2j9lsCCnR/61P94U2nR/61P94VitwNmlpKWvUJCiiigCxY3Is76C5K7hG4baDjOK6S58Yx3FrLCLNgZEK58zpkY9K5OiqUmtgI5v8AUv8A7prHrYm/1L/7prHrhxO6GgooormGFFFFAHaaRrdiNMhilmWKSJArK3fHcVzWs3kd/qck8Q/d8KpI6471Qorqq4udWmqctkKwUUUVyjCiiigAooooAKKKmtLV7u4WGMcnqfQU0m3ZAMihkncJEhZj2FdV4a8MTS363E5ULD82MZ57f4/hVqzsYbKIJGvPdu5Ndbo8PlWIcjmQ7vw7V6lHCRhaUtxXGnS+OJP0rgPEtrd3F+8ijzIYxtTb6dz+dekahP8AZ7KRwcMRtX6muUrqrRdaHJJi2PPyMHBorp9X0hZkaeBcSjkgfxVzFeLWoypSsykwooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtPQb77DqaFjiKT5H/HofzrMoq6c3CSkugHqNcR4msvs2p+cowk43f8AAu/+P411GjXf23SoZScuBtf6jj/69VfE1r5+ktIB80LBx9Oh/wAfwr3sXFVsPzL1JW5w9FFFfPFBRRRQBPb3t1a/6i4kjHorcflUsurX8y7Xu5SPQNj+VU6KtVJpWTdgNK2uhINrnD/zq1WHnBq7Be4wsvP+1XRSr9JCaL9FNVg4ypBHtTq6iQooooGFFFFABRRRQAU1mCKWY4AqOW4jhHJy3oKzprh5jycDsBWNSsoeoWHXNyZmwOEHQVBRRXDKTk7soKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBEZpQvbv9K1wAAABwKr2kPlRZI+ZuTVmu+hT5Y3e7JYUVcstLur7mNMJ/fbgVrJ4XGPnujn/ZT/AOvXVGnOWqQjnaK3LjwzMikwTLJ/ssNprGlhkgkMcqFHHUGlKEo7oBlFFFQMKKKKACiiigBCAQQRwayJ4jDKV7dvpWxVa7h82LIHzLyKxr0+aN1ugRmUUUVwFBRRRQAUUUUAOjcxuGHUVrxyCVAy9DWNU1tcGF+funqK2o1OR2ewmjWopqsHUMpyDTq7yQooooGFFFFABRRRQAUUUUAFFFISACScAUCEdxGhZjwKyJZDLIWP4VLdXBmbav3B+tV64a1TmdlsUkFFFFYDCiiigAooooAK09N0O61HDAeXF/fb+lX9B0H7QFurpf3X8CH+L/61dcqhVCqAAOgHavTwmA51z1NuwmzJtPDlhbAF085/V+n5VppDFEMRxov+6oFSUV68KUIK0VYkOtQTWVtOCJYI2+q1PRVtJ6MDnr3wrbygtasYn/unkVy95Y3FjL5c8ZU9j2Nek1BdWkN7AYp0DKfzH0rgxGX05q8NH+A0zzWitDVtKk0y42n5om+4/rWfXhzhKEnGW5QUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU6P/Wp/vCm06PAkUn1FNbgbNLUfnRf89F/Ojzov+ei/nXp8y7kklFR+dF/z0X86POi/wCei/nRzLuBJRUfnRf89F/Ojzov+ei/nRzLuATf6l/901j1qyzRmFwHUnae9ZVcmJabVhoKKKK5hhRRQAT0GaACiiigAooooAKKKKACiiigArpvDtqEtWuCPmkOB9BXM12mlADS7fH9yuzBRTqX7CZdUFmAHUnFdjEgiiSMdFAArlrBPMv4F/2wfy5rq69USMXXpf8AVQj3Y/yH9axav6xJv1Fx2UBf0z/WqFMTCuP1m2FtqLhRhXG8f1rsK53xMB5tue+DXJjIp0r9howaKKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6nwhccXNsT6SKP0P8ASukniE9vJC3R1Kn8RXE+GpfL1uJe0isp/LP9K7qvoMvlz0LPpoS9zy9lKOVYYKnBpKu6vF5Or3SdP3hP58/1qlXgzjyycexQUUUVIBRRRQAUUUUAPSV4zlGIq1HfnpIv4iqVFXGpKOzCxqrdwt/Hj61IJYz0dfzrGorZYmXVCsbW9P7y/nTTPEvWRfzrHoo+svsFjSe+iX7uWqrJeyPwPlHtVeis5Vpy6jsB560UUVkAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVi0h82XJHyryargEkAck1rwRCGIL37/WtqMOaV3shMlrR0fT/ALfdfP8A6pOW9/as6uu8PxCPTA3d2JNepSjzS1JNREVECIAqjgAdqWiiu8AqjqenR39uRgCVR8jf0q9RSaTVmB566FHKMMMDgikrS12IRapJjowDVm150lZtAFFFFSMKKKKACiiigDLu4fKlyB8rciq9a88QmiK9+31rIIIJB4IrgrQ5ZXWzGgooorEYUUUUAFFFFAE0Fw0J9V7itKOVJVyp/CselV2RsqSDW1Os4aPYTRt0VQiv+0g/EVbSaOT7rg12RqxlsxElFFFWAUUUUAFFRvLHGPmYCqst+OkY/E1EqkY7sC28ixruY4rNuLppjgcJ6etRPI0jZc5NNrjqVnPRbDSCiiisRhRRRQAUUUUAFaeiad/aN8FYfuk+Z/8ACsyu58N2gttKVyPnmO4/TtXXgqPtaqT2Woma6qFUKoAAGAB2paKK+jJCiiigAooooAKKKKAKuoWUeoWbwSDqPlPoa87mhe3neGQYZDg16dXH+K7QR3cdyo4lGG+orzMyopw9ot0NM56iiivEKCirem2DaleLbrIEyCSxGentTL+0awvZLZnDlCPmHfIz/Wr9nLk57abAV6KKKgAooooAKKKKACrdlpt1fti3iLAdWPAH41a0PSTqdwWfIt4/vkd/YV3MUUcESxxIERRgADpXoYTAusueeiE2ctF4QkK/vrtVPoq5/wAKJfCEoX9zdKx9GXb/AI11lFel/Z+Hta34sV2ecXum3Vg2LiIqD0Ycg/jVWvTpoY54mjlQOjDBBFcLreknTLgFMmCT7hPb2Nebi8C6K546oadzLooorzxhRRRQAUUUUAFFFFABRRRQAUUUUAFegeCPD8ZsJr+8iDfaVMcasP4OhP4/y+tcloGkvrOrRWoyI/vSsP4VHX/D8a9jjjSGJIo1CogCqo6ADoK7cHR5nzsDxnW9Lk0fVZrR8lQd0bH+JD0P+e9Z9epeNNF/tPSjcxLm5tgWGOrJ3H9f/wBdeW1hXpeznboAU+KJpm2qPxplatrGI4R6nk0qVPnlYGyJbBAPmYk+1JJYLj5GIPoau0V2exha1ibmK6NGxVhgim1o30YaLf3Ws6uKpDklYpBXW6DOJdNVM/NGSprkqv6Tfmxust/q34YVphaip1LvZiZ3+jjOpRn0BP6V01c1oTrJeo6EFShIIrpa9kSOTvm3X85/2yKr1Nd/8fk//XRv51DTEFcr4hnEt+IweI1wfrW/qF8ljblyRvI+VfU1xkjtLIzscsxyTXBjaqUeRDQ2iiivMKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALmkvs1e0P/AE1UfmcV6LXm+n/8hO0x/wA9k/mK9Ir2srfuS9SZHCeJV265Mf7yqf0A/pWTWz4o/wCQy3+4tY1eZif40vVlLYKKKKwAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopdrbQ2DtJwDjg/5yKAEooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiinRoZJAg6mhK+gFqxhy3msOBwPrWhTUQRoEXoBTq9KnDkjYkK67w/KJNMC90Yg1yNaOj6h9guvn/ANU/De3vXRSlyy1EdlRSI6yIHRgykZBHelrvAKKKo6nqMdhbk5BlYfIv9aTaSuwOc12US6pJjooC1m0ruXcuxyxOSaSvOk7tsAoooqRhRRRQAUUUUAFZ99DhvNUcHg/WtCmugkQo3QioqQ542AxaKdIhjkKHqKbXmvTQoKKKKACiiigAooooAKKKKAHrNIvR2qQXcw/j/SoKKpTktmBP9rmP8f6Uxp5W6u1R0UOcnuwDOeTRRRUgFFFFABRRRQAUUUUAFFFFACqMsB6mvTIIxFbxRj+FAv6V5pHxKn1FenZyM16+VL4n6EyFooor1xBRRRQAUUUUAFFFFABWJ4piD6Rv/wCebg/0/rW3WT4kIGhze5X+YrDEq9GV+wI4SiiivmCxUd43DozKw6FTgihmZ2LMSzE5JPJNJRR5AFFFFABRRRQAUUUDqKAPQ9HtBZ6XBGBhioZvqf8AOKvUi42jHTHFLX1kIqMVFdCAoooqgCqGs2gvNLnjxllXev1H+cVfpr42NnpjmpnFSi4vqB5hRRRXyZYUUUUAFFFFABRRRQAUUUUAFFFOikaGVJUxuRgwyMjI9j1oA9U8H6L/AGTpIllXFzc4d8jlR2X/AD3NdFXk/wDwmuv/APP6v/flP8KP+E11/wD5/V/78p/hXpQxdKEVFJgesV5N4u0X+yNXZolxa3GXjx0U91/D+RFL/wAJrr//AD+r/wB+U/wqnqPiHUtWtxBezrIituA8tQQfqBWVfEU6sbWdwMutiFg0KkelY9WrW58r5H+7/KsKE1GWomaVFNV1YZVgRSPIkYyzAV3XVriIrxgtu3vxWXU9zcGd+OFHSoK4K01KWg0FFFFZDOi8JanNbaxFDndG4YYP0J/pXo8eoQuPmypryPSJfJ1e1fp+8A/Pj+teiV7WXWnSafRksytS1Ozhv7hWmGRITisi68QxqCLdCzerVR8SxeXrUp7SKrD8sf0rIrlr4qpGbgtLDSJbi5luZTJKxYmoqKK4G23djCiiikAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBc0lN+r2g/6aqfyOa9FrhfDUXma3E3aNWY/lj+td1XuZZG1JvzJZwniVt2uTD+6qj9Af61k1d1eXztXun6/vCPy4/pVKvIry5qsn5spBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAPhhe4mSGMZdztA967W50ON9DWyjA8yMbkb1fv+f+elUPCum4DX8i9crFn9T/T866ivawOFXsnKa+L8iWzy8qVYqwIIOCD2pK6DxRpv2e5F5Gv7uY/Pjs3/ANeufryq1J0puDKCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtCxh2p5hHLdPpVS3i86UL/AAjk/StYDAwOldOHhd8zExaKKK7BBRRRQBcstUurHiJ8p/cbkVrJ4oG357Xn/Zf/AOtXO0VpGpOOiYjcn8TTOCIIVj/2mO41jSzSTyGSVy7nqSaZRSlOUt2AUUUVAwooooAKKKKACiiigAooooAp30O5PMA5Xr9Kz62yMjB6Vk3EXkylf4TyPpXHiIWfMhoiooormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAADgg16RYTC4sIJQc7kGfr3rzeuu8KXwktntHPzRncv0r0ctqKNVxfUTOjooor3SQooooAKKKKACiiigArn/Fk4SwjhzzI+fwH+RXQVwniK9F5qbKpzHENg+veuLH1FCi11eg1uZNFFFfPFBRRRQAUUUUAFFFFABRRRQB6Fo12LzS4ZAcsq7H+o/zmr9cFourNplyd+WgfhwO3uK7mGeO4iWWJw6N0INfR4PEKrTS6ohqxJRRWt4etUuNS3SDKxLvAPc9q6ZyUIuTBakcGhX9xGHEQRT03nBP4Vj+JorjRdMmeeMqXGyNgcgk+/wCtemM6opZjgD1rn9aii1m0ltJlzC6lRnsex+tef9Yq1E0i+VI8IopXQo7Ieqkg0leGAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACgkdCRSEk9TmiigAooooAKKKKAFVijhlOCpyK9MglE9vHMvR1DD8RXmVdx4ZuvP0lYyfmhYofp1H+H4V6eWVLTcO4pFDxfb8W1yB6xsf1H9a5avQtZtPtulTxAZcDcn1HP/1q89rPMafLW5u4IKKKK4BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB1PhC34ubkj0jU/qf6V0k8ogt5Jm6IpY/gKqaNafYtKhiIw5G5/qef8A61VfE115GktGD80zBB9Op/w/GvoqS+r4a76IndnEMxdyzHJY5NJRRXzpQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABUttGktzGkkgjjJ+Zz2FRUU1owO+i1fSYYkijuolRAFUDPAp/9uab/wA/kf6159RXorM6i05ULlO6vNR0m9tJLeS7j2uMZ54PY1wzrsdlDBsEjI6GkormxGJddpyVmhpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigByuyZ2sRn0NL50v/PR/wDvqmUU7sB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76pGdnxuYnHqabRRdgFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKns7uSyuknjPKnp6j0qCimm4u6A9JsryK+tlniOQRyPQ+lWK880zVJtMn3p80Z+8h6Gu3sdSttQiDwuN3dD1FfQ4XFxrKz0kQ1YuUUUV2AFFFFABRRWLq2vw2KtHCRJP6Dov1qKlWNOPNNgLr+rCxtjDG37+QYGP4R61w55OTUk88lxM0srFnY5JNR187icQ68+bp0LSsFFFFcwBRRRQAUUUUAFFFFABRRRQAVZs9QurF91vKy56r1B/Cq1FOMnF3i7AdHF4vnVcS20bn1Viv+NamiePDZ6ojS2yxwONkjbixUHv09cVxFFdLxldqzldBY95+1/bI1lWUSRsMqynII9qyde1u30XT3ld1M7KRDHnlj9PSvJLe/vLRSttdzwg9RHIVz+RqGWWSaQySyNI56s5yT+NaPG+7aKswGkkkknJPWiiiuEAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtrwze/ZtT8ljhJxt/4F2/w/GsWlVijBlJBByCO1aUqjpzU10A9QrgdesfsOpuFGIpPnT8eo/OvSPB0Uev2y3cv3IxtkUd39Pp3/EV2VzYxSWpjSJBt+6oUY+levjJ060VFetxRTPnKivQfGfhi2WyfUrKJYpIuZUQYDD1x2Irz6vIq0nTlysYUUUVmAUUUqqWOACT7UAJRVhLKVuuFHvUo0/1k/IVoqU30C5Soq8dP9JP0qJ7GVemG+lDozXQLlailZWQ4YEH3pKzAKKKKACiiigAooooAKKKKACtPQbH7dqaBhmKP53/DoPzrMAJOAMk132h6b/Z1gA4/fSfNJ7eg/CuvBUPa1ddkJs064jxNe/adT8lTlIBt/wCBd/8AD8K6rVL5dP0+Sc4342oD3Y9P8a88Zi7FmJJJySe9d2Z1rRVJddxISiiivGKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACit/SdFimgW4uQWDcqmccepq3d6DayxHyF8qQdCCcH611RwlSUeYVzlaKVlKOVYYYHBFJXKMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKfFLJDIHidkYdCpxTKKL22A37TxVdQgLcIsw9ehrVi8VWDj5xJGfdc/yri6K7KePrwVr39RWR3J8TaYB/rXP/AAA1Wn8W2yg+TDI57Z4FcfRVyzKu9rILI1b3xDe3gKhvKjP8Kf41lHk5NFFcc6k6jvN3GFFFFQAUUUUASW9vNdTLDAheRugFWL3SrzT1VriLajHAYEEZ9OKt+HL6Cy1FmnIVZEKBz2OQf6Vs+ItUs30x7eKaOWSQjGxt2MHOc/hXZToUpUHUlLVCvqcfRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA9J+FupRwx3lkzAMXEmD3BGM/hgfnXp9fNtpeXFhdJc20rRyochh/nmvS/D3xEuLyP7JdQQ/aVHyMCQHH09a7KElO0Oo07G7442Wnhy+nxxJGY8f7Tcf/XrxGvWdRvptUJFyVZCCPLA+UA9eK891vRn02YyRgtbOflP932NbYzDVIxU3rYV7syKKKs2lv5rbm+4P1rz4xcnZAJb2rS/MeE/nWhHEkQwq4p4AAwKWu+nSjD1JuFFFFaAFFFFADHjSQYZQRWfcWjRZZOV/lWnSdazqUozWoXMSirV3beWd6D5T1HpVWuCUXF2ZQUUUVIBRRRQAUUVr6Joz6lMJJAVtkPzH+97Crp05VJKMdwLnhrSDLIL6df3aH90D/EfX8P89K66moixoqIoVVGAB0Arn/EmsCCI2UDfvXH7wj+FfT6mvoIxhg6Ov/Dsjcx/EGp/b73ZG2YIshcfxHuayKKK+fqVJVJuct2WFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB2ek3CT6bDtPKKEYehFW3dY0LuwVVGST2rhYLia2ffDIyH2PWpLi/urpds0zMvp0H6V6MMclCzWorEdzKJrqWUDAdyw/E1HRRXnt3dxhRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKANHRdGm1u8a2gkjRgpbL5xitDV/CF5o9gbuaeB0DBcJnPP4VH4U1e20bVHuLrfsMZUbFyc1t+JvFem6tozWtsJvMLhvnQAYH410wjSdJtvUDh6KKK5gCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigApyO0bq6MVZTkEdQabRQB3Wia0mpReXIQtyg+Yf3vcVqSxJNE0ciBkYYKnoa8zikeGRZI2KupyGB5Fdpo2vx34WC4Ijuf0f6e/tXuYPGqovZ1N/wAyWjF1bw9LaSeZbAyW5P1KfX296ZGgjQKOgrvYFyxJ6CszUfD6TEy2mI37ofun6elE8HGEnKmK5zFFPmglt5DHNGyMOxFMrEYUUUUgCiiigAooooAayh1KnoayJUMchQ9jWzVDUE+ZX9eDXPiIXjfsCKVFFFcRQUVLb2011KIoI2kc9lFdVpXhiOAia9xJJ1EY+6Pr61vQw1Ss/dWncG7GXo2gSXxWe4Bjtuo7F/p7e9dnFEkMSxxoFRRgKOgp44GBWJrOvx2AaC3Ikuf0T6+/tXt06dLCU7v7yNyTW9aTTYvLjIa5cfKP7vua4d3aR2d2LMxySepNEsjzSNJIxZ2OSxPJpteNicTKvK726FpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopVVnYKoJZjgAd6AEorrLnw6q6CqIoN1FmQkfxHuP8+lcnW1ahOi0pdQTCiiisQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACgHByKKKAOv0DxC6Q+XekuucCTuPr611sUsc8YkidXQ9CDXmlgf3B+taVreXFnJvgkK+o7H6ivZw+IkoLm1JZ29xbQ3UeyeNXX3HT6VhXfhrq1pL/AMAk/wAams/EcMmFuk8tv7y8r/iK2Ypo5kDxSK6+qnNddqdURw9xYXVqT50DqP72Mj8+lV69DqpNpdlcEmS2TJ7qNp/SspYbswOHorqpPDdm3KPKn4gj+VV28Lj+G7I+sf8A9es3QmBztFdB/wAIu/8Az9j/AL4/+vTl8Lj+K7J+kf8A9el7GfYDnarXwzb59DXZx+G7NeXeV/xAH8qsnS7GCP5LaPPqw3H9abwspqz0C551a6deXhHkW7uD/FjA/M8VvWXhLo97N/2zj/qa6imTTRQRl5pFjQd2OBV08upU9Z6/kO422tLezi8u3iWNfYdfqe9Ommit4mkmdUQdWY4rBv8AxVBEClmnmv8A32GFH9TXMXl/c30m+4lLnsOw+gorY+lSXLT1/ILG3qvid5g0NjlE6GU8Mfp6fzrnCcnJoorxq1adaXNNlWCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArovC+m+dcG9kX5IjhM929fwrCtbaS7uY4Ihl3OB7e9ejWltHZ2sdvEPkQY+vvXoZfh/aT53svzE2TVw3iLTfsV95sa4hm+YY7HuK7mqep2K6jYyQNgN1Q+jdq9XF0PbU7LdbEp2POqKdIjRSNG6lXUkEHsabXzRYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAXdPfl0/Gr9Y8EnlTK3bvWuCCMiu7DyvG3Yli0+KaWB98UjI3qpxTKK3A14PEV5FgSBJR/tDB/MVoxeJrZv9bDIh9sMK5eitVWmuojtI9a0+TpcBfZgRU639m3S6hP/bQVwlFWsRLsB3v2u2/5+Iv++xTWv7Net1CP+2grhKKf1l9gO0k1rT4+twG9lBNZOo+K7aFQsUEkjH1wo/rWBWVcy+bMSOg4FYV8ZOEfd0Y0jVufFN/NkRCOBf8AZGT+ZrImnmuH3zSvI3qzZqOivMqVqlT43coKKKKzAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA0dI1OPS5XlNt50jDap37do79jWv/wAJj/04f+Rv/sa5eiuini61OPLB2XogsdR/wmP/AE4f+Rv/ALGj/hMf+nD/AMjf/Y1y9FafX8R/N+C/yFZFzVL2PULs3CW/kswG4bt2T69BVOiiuWUnOTk92MKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq/ZXGR5THkdKoUAkHI61cJuDugNyiqdveBgFkOG9fWrlehGakrokKKKKoAooooAKKKq3F2sYKoct/KplJRV2Al5cbF8tT8x6+wrOpWJYkk5JpK8+pNzdykFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVNFdSRcZyvoahopqTi7oDRS/jb7wKmpRcwn/AJaCsmitliJrcVjWNzCP+WgqN76NfugsazaKbxEugWJ5buSXjO1fQVBRRWEpOWrGFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD//2Q=="/></g><path fill="#130f45" fill-opacity="0.7308" d="m0 0.503937l960.0 0l0 540.0l-960.0 0z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m50.824146 47.711285l157.23622 0l0 62.895016l-157.23622 0z" fill-rule="evenodd"/><g transform="matrix(0.31447244094488186 0.0 0.0 0.3144750656167979 50.824146981627294 47.71128608923885)"><clipPath id="g3a04b465b0_0_0.2"><path d="m2.842171E-14 0l500.0 0l0 200.0l-500.0 0z" clip-rule="evenodd"/></clipPath><image clip-path="url(#g3a04b465b0_0_0.2)" fill="#000" width="500.0" height="200.0" x="0.0" y="0.0" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAYAAAAeGRPoAAAOPklEQVR42u3dbZHqwLqA0S0BCUhAQiQgAQlIQAISkIAEJCABCTjoc3ZVuGcuNWxC+u1OJ6xUrT/7Y4av9JN0QvInpfQHAJg3LwIACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgexEAQNABAEEHAAQdABB0ABB0AEDQAQBBBwAEHQAEHQAQdABA0AEAQQcAQQcABB0AEHQAQNABQNABAEEHgAG6/zqMtPvxc9Y//nyf+ZhWT79H0Bux7j8w2xcfiH3/950VCxjp71gydum8dqOXy9OGQdTr+vyYBH3irb3LyA/I9b9O/ZbfykAFCPosg37J2AlMgj6dTR/he4pfzv3evUELEPR6U+7PO2Xvpty7oNf2JOjTfRAuqc5ye/rwAAh6vdd0SA9S5l76+sV7JOiFj4vXCvlvU/JWQEDQ2w96+nCG9STode1TG8vBCgcIevNBv2XunQt6Aav+eHZLy8WJc4CgNx30NPBw6UnQ68X8mtpcrqIO4iPoTQf9lvF/Bf1LYi7qgKC3GfTug730y1P8O0Ev45zmsVysgCA+gt5M0H8L9ZD/txP0ZZ8A50Q5QNDnF/TnP9sP2Dv/I+hlvpp2T/NbNlZEEHRBbyLoz8G+Px0efTUtL+jBTmmei6l3EB9Bbyfo63/MpF5ejN2CHrx3PufFCgqCbrxoI+jPO4iPvfTdP94HQQ90DA7svd/6OvziXGBq3146CLqgtxP0553Ec3+8/NWYLeiBbkFhvaXh11/fBE/zr62QIOiC3kTQ3x3G7QS9jE1QUA8Zvz/ie+97KyQIuqA3E/T1BzOqgh5k30hMc/fWz1ZIEHRBbybor96nTtDbPX4eefw6Z0/9ZoUEQRf0poK+ejpn6pLxswR9gEtm0LeBjyX3bHsrJQi6oLcT9D99Ix4nRa8Fve2gRz+es6ADgr6YoP+p/LMEvYHp9p9v7GEkKyUIuqAj6I5bsyCrfuDuDODFrX+8zhtBR9DnO+W++vKB7HF86PLmpL5b/2+O/bcCNpUf5yczHd2HP3vfHyp59fyv/d/vU5nrBXQ/3oP7gI3QGo9lqE8ew+bH87z9Y9bs7zdGdgXWzVX/eT8OHDeuBR/LXIL++DycB7xml/7fHWx0CPpUQT98YcT3Kea787d+wOsqDCqfLKeBP3PsZ+cS8JzX/ePMvergNQ2/GFKJ0Az53bs0/uJPp4ANly7F3Fb5HPhZbzXoj0ucRt2G+lxog4iFBv2Q+YG7p++4SltOwIbGfddI0O9vQhr1OlxGzFQ8Ql7i9d9OsD6d3pwdfAt6fqcRUeiCNlwj3vfWgx61gfmvdfKYXBFT0N/YBnzYrgv+oJUOeY2wdyMex+bFnmKJAeuQ6mx8lgpfzmN8tfF0KhSFIRstq8A9zH8t+zT/oK9S/TtVHuyxC/q/PpA1B4s5nVR1TNMtl8CNpC5gsD1NGNJV5Y2qa8aAOSY0m6fnep0wpJvAWYGowzutBn1fcI+81owSCwt67ne/fzvmM/e99dqDWumNpDFBv1SM+b9CWiNwkVEfE5rDBM/19OJzP0WgTmleQa81gzFkOQqtoJeYdv9tJZ1j2HepvSX3WvndyN97mGCW4tRAzH9GvUZobul/Z0LXXHYNxHxsmKYK+mbiz+SrjW9T8IL+/9wKDtBzCXuLMc+dmswJ+pSDe9fIwFkzNFMsu36D/t7AY9mmtoO+aeR1ipxRYqFBLz3oR35l5dtinrunPregt7Z0ablBb2m5fxCl2kFvOeaiLujVzqz97UPX2vcqdzMa9MacAS/o+VOagl5nqfGNh0+Dvp5BzCNm8lhY0Gses2zle5WbGa2sj9ft09dM0OttSAl6nb30mkG/zuw1zD3nhoUEfaqt0Usqd1GVVjZgptpjFPS6r7mg19lLrxX04wxfv2+52JegN77X+jjbt9Z0/KHAivS4FvNfP+8DfE6xJx5+sgEk6DHLJgl6rXGghaCXWG8e93M49OvwLv3v2yTX4N8jwoLexNcz7hXCvg5eebYfDBKXoNdolaYN+uOwyfbHIPm4y9m+8ufncROQ7sfr0qXY62of03RBf2zs/ryj2eMuZ8dU77oJtd7zbZo+6NfA927oeUPr/vWN2KFygxdBb+oCCvdU7uYvp6AVdexKE/FVoaGvTYmgD/3d+8KfkaEXMuoCold6z/HVOjD0cq2lT2odupEd8Z6f0rRB3wW9d2OPZ68DNijspQt6c5c4zA1nqb3z3Gt+RxzauKX6Qb+nz2+sUepbBLtU//yQdaoX9DFfQyp1Dfja7/ktTRv0iI2/iFsk576f9tIF/eVgOPXlDo9B0/C5K0nkV0Nyoz5k7y0y6F2abkZkzAxBdGh2qU7Qbxmf9ejp96ne8/VEQc+9cmb098GvjYxVgr7AJ1X77mO/rSw5W76rzICWmMbKmaI8Vwx6zuGP6HMWproq4rvj6IeJIxo9IzLle76dKOg5Oy73FLNnHvU63oVY0IcOGlOeNLeZYLD75ES0mpGpEfRbwHO/NhC73K8ivduYiAj6OfP5Rd5Bccr3/DBB0HNfu1J3QDs0+JgE3R775FHPmQYsecGGXcHARQT9MPGgFDlD0mV+7ko/x4g9vOsC3vPzBEHfTvzZLLGXbtpd0Ed94E6p7slzY6I+9vHdCr9+q4IDb0TQIy5UEXFXv93Er3VKZYN+Dfo8HRfwnl8mCPqx0M+d8jbX1yTGgp4xWNacjv/kqkjrzIH2UNitwMAXEfSoASFiwyLqkEepKf/coEd9TfOwgPf8PkHQrxmPtfT4kDMTKsiCHnIGd9RFEiKmurZpmcs9lQ1pVGRWld7nIS6FgpAb0qi9vN1C3vPaQV/q4utrgh5+jLjksfYhx7eXfFnOkkGPHAxylmNaftBbuR3ytpH3vGbQNwseH6a4V4agf4HHsfYSe6nvpmOPC15hu4KD+7qRwT1yUGox6JHnaSzlPa8Z9CXf86DUFTcFnf+bijtW/tBeFrzClgz6n0YG98iZghaDHnlIYSnvec2g7xY8PhyT5gh6pT32qNDe0vcGfVtocL81NLhHXrCjxaBHfr2o5Ffzlhr0JR+Sc113Qa9+vfjSYVty0A+FBvfLDAb3pQQ9clp06e+5oAu6oDcuYsrrKOiCLuiCLuiCLujz31O/CrqgC7qgC7qgC3obroUGAUEXdEEX9C6VPewn6IJe3djlltqfen918tRpwSvsNgm6oAt6zvu35K+tCbqgv1xWjT++b5xS65KgC7qgC/rvixu0LDzoOdPa28YfX/T3TOe+dSvogi7ow96/lndyEPQiA9qp8cdX4tKOK0EXdEFffNDH3iDJPccFfVK5x5PXMwx6zuCyE3RBF/TFB33suHgWPEGf89fDSu+llzqefG5kkBN0QRf09oKec0LuWvQEfSoRdxbqCj22bcHHlbMhsxV0QRf0RQd9nfFz7aUL+qRy71N+L7RVeik48K8zn+9K0AVd0Bcb9DmcMIygF/te9i3F3jTjEPB43v2Oc8bPvxaK+qZ/7mMIuqALelzQc6bd78Hj4cMqY3xwKOBLgh71vct7ijlpLOJ2qkOmvXKn9C/BUd9kzJZcDe6CLuihQV9lzl5GR32VOWsg6F906ddbilsuI6ectoGPY1fpeV+DVtpt5uCxM7gLuqCHBj1ipvDvOr0PeO3WmTF3QZkvC/ouxS+3/oO0fRG9Tf93x+ANivTBnnPU8z6N3AJeZ079Dz28IOiCLuifBz13L/3naznm5OHHFHvuY9gkIf66m7NER3Wq5VxxUP/td+/exH3d/5tz0O/cGdwFXdCLBD36UtHXfo998ybi234nIWJjwt75lwZ9Kdcw/nRLeFPwsVyelPj5BndBF/Sy48S10PhwfRofoneqSn0DSdBn4pjmvYwdhOZ4w5ZPV1ZBF3RBHxf0zUzHw30S4K8Oeu6ZlHMKXMmp9xrLzuAu6IJebSZvN7PxYc5XtRT0QOugYzdz2xqd08bMyeAu6N7zqkGPumZHjeWW3PlN0FPMd6LnEri5bsxcDO6C7j2fJOhziHqpi9ow46DPKeqnAs+71T31nCvUCbqgC3p+0FuOupgL+mzjViLmLU+/nzKn0QRd0AU9JugtnkAcffltFhj0R9xa3CI9VHjuxwU9V0EXdEGPC/rjRLkWZjGjL0PNgoNe4tKsuVui3Zc878jnKuiCLuixQX+cdzPlN2QOSWQFPWNvPeJShGOPDx0m2hKt/bxLPFdBF3RBjw/6z731mhv+l+SiMYIeGLh9pQ/wbcKQ/7Y1XjLs936av8SKKuiCLujlgl4r7OfKM5R8QdCfB43oG6z8Ddvjxi6tbtBEXo/9cQ34VeH3SdAFXdDLBv3nax91PfbHTo09ckGvvge76wM/9NrEt/7fHtP7Gxe0Gvdtv8INec6P53vo/98q1Z1dGGMX/FgOGaL3psY+jvWbwXzsz+2854Pf867Q+1fi20L7fsP93Ubkvf83p/T+Rk8I+uTB/7avVnTJGajA6zFRtAUdABB0AEDQAUDQAQBBBwAEHQAQdAAQdABA0AEAQQcABB0ABB0AEHQAQNABAEEHALwIACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agu5FAABBBwAm9x+vDo6+g0o7jgAAAABJRU5ErkJggg=="/></g></g></svg>
\ No newline at end of file
diff --git a/docs/language/ql-training/cpp/bad-overflow-guard.rst b/docs/language/ql-training/cpp/bad-overflow-guard.rst
index 12f35440906..3ac9ee55f3b 100644
--- a/docs/language/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/language/ql-training/cpp/bad-overflow-guard.rst
@@ -4,10 +4,6 @@ Example: Bad overflow guard
 
 QL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index ea8e2c1b158..e4d17fff844 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -4,10 +4,6 @@ Analyzing control flow
 
 QL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. Include information slides here
 
 .. rst-class:: setup
diff --git a/docs/language/ql-training/cpp/data-flow-cpp.rst b/docs/language/ql-training/cpp/data-flow-cpp.rst
index 36b5eb6b525..6ece12d1525 100644
--- a/docs/language/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/data-flow-cpp.rst
@@ -4,10 +4,6 @@ Introduction to data flow
 
 Finding string formatting vulnerabilities in C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/global-data-flow-cpp.rst b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
index 6033581ffc3..02c37b5fb4c 100644
--- a/docs/language/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
@@ -3,10 +3,6 @@ Introduction to global data flow
 ================================
 
 QL for C/C++
-
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
    
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index 82eb62a3ba8..fedbed7f0f5 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -4,10 +4,6 @@ Introduction to variant analysis
 
 QL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 1850e3e5671..4555d918822 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -4,10 +4,6 @@ Program representation
 
 QL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: agenda
 
 Agenda
diff --git a/docs/language/ql-training/cpp/snprintf.rst b/docs/language/ql-training/cpp/snprintf.rst
index 77e46933fcb..5f1a27bf8db 100644
--- a/docs/language/ql-training/cpp/snprintf.rst
+++ b/docs/language/ql-training/cpp/snprintf.rst
@@ -4,10 +4,6 @@ Exercise: ``snprintf`` overflow
 
 QL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/index.rst b/docs/language/ql-training/index.rst
index 0cc4ca9b024..6f3aea9a17a 100644
--- a/docs/language/ql-training/index.rst
+++ b/docs/language/ql-training/index.rst
@@ -1,10 +1,6 @@
 QL training and variant analysis examples
 =========================================
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. toctree::
    :glob:
    :maxdepth: 1
diff --git a/docs/language/ql-training/java/apache-struts-java.rst b/docs/language/ql-training/java/apache-struts-java.rst
index 7fcd2e003cd..c39652fa2a5 100644
--- a/docs/language/ql-training/java/apache-struts-java.rst
+++ b/docs/language/ql-training/java/apache-struts-java.rst
@@ -8,10 +8,6 @@ Exercise: Apache Struts
 
    CVE-2017-9805
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/data-flow-java.rst b/docs/language/ql-training/java/data-flow-java.rst
index be9ba98456e..78e4bf54946 100644
--- a/docs/language/ql-training/java/data-flow-java.rst
+++ b/docs/language/ql-training/java/data-flow-java.rst
@@ -2,10 +2,6 @@
 Introduction to data flow
 =========================
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 Finding SPARQL injection vulnerabilities in Java
 
 .. rst-class:: setup
diff --git a/docs/language/ql-training/java/global-data-flow-java.rst b/docs/language/ql-training/java/global-data-flow-java.rst
index 665899f8459..6d821d60ea2 100644
--- a/docs/language/ql-training/java/global-data-flow-java.rst
+++ b/docs/language/ql-training/java/global-data-flow-java.rst
@@ -4,10 +4,6 @@ Introduction to global data flow
 
 QL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index 392c18309cb..611be7dfd6e 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -4,10 +4,6 @@ Introduction to variant analysis
 
 QL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/program-representation-java.rst b/docs/language/ql-training/java/program-representation-java.rst
index d090c30aebe..ddd8103454f 100644
--- a/docs/language/ql-training/java/program-representation-java.rst
+++ b/docs/language/ql-training/java/program-representation-java.rst
@@ -4,10 +4,6 @@ Program representation
 
 QL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: agenda
 
 Agenda
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index 67f7fe21a76..de5d9623bfc 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -4,10 +4,6 @@ Example: Query injection
 
 QL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/template.rst b/docs/language/ql-training/template.rst
index 0cce4a11435..21c5abef144 100644
--- a/docs/language/ql-training/template.rst
+++ b/docs/language/ql-training/template.rst
@@ -27,10 +27,6 @@ Template slide deck
    
    Second subheading
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. Set up slide. Include link to QL4E snapshots required for examples 
 
 .. rst-class:: setup

From 55c26a8880bca000c2253349b08cb298a9fadb49 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 1 Oct 2019 15:11:18 -0700
Subject: [PATCH 012/232] [CPP-434] Initial version of query + test cases.

---
 .../Arithmetic/SignedComparisons.ql           | 33 ++++++++++++++++
 .../SignedComparisons/SignedComparisons.cpp   | 38 +++++++++++++++++++
 .../SignedComparisons/SignedComparisons.qlref |  1 +
 3 files changed, 72 insertions(+)
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql
new file mode 100644
index 00000000000..b6dd8fb1d42
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql	
@@ -0,0 +1,33 @@
+/**
+ * @name Undefined result of signed test for overflow
+ * @description Testing for signed integer overflow by adding a value to
+ *              a variable (or subtracting a value from a variable) and
+ *              then comparing the result to said variable is not defined
+ *              by the C or C++ standards.  The comparison may produce an
+ *              unintended result, or may be deleted by the compiler
+ *              entirely.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/signed-overflow-check
+ * @tags reliability
+ *       security
+ */
+
+import cpp
+
+from RelationalOperation ro, BinaryArithmeticOperation bao, VariableAccess va1, VariableAccess va2
+where
+  ro.getAnOperand() = bao and
+  (bao instanceof AddExpr or bao instanceof SubExpr) and
+  bao.getAnOperand() = va1 and
+  ro.getAnOperand() = va2 and
+  va1.getTarget() = va2.getTarget() and
+  /*
+   * if the addition/subtraction (`bao`) has been promoted to a signed type,
+   * then the other operand (`va2`) must also be signed and we have a signed
+   * comparison
+   */
+
+  bao.getFullyConverted().getType().(IntegralType).isSigned()
+select ro, "Testing for signed overflow/underflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp
new file mode 100644
index 00000000000..32d3bab19c7
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp	
@@ -0,0 +1,38 @@
+// Signed-comparison tests
+
+/* 1. Signed-signed comparison.  The semantics are undefined. */
+bool cannotHoldAnother8(int n1) {
+    // clang 8.0.0 -O2: deleted (silently)
+    // gcc 9.2 -O2: deleted (silently)
+    // msvc 19.22 /O2: not deleted
+    return n1 + 8 < n1; // BAD
+}
+bool canHoldPreceding16(int n1) {
+	return n1 - 16 < n1;
+}
+
+/* 2. Signed comparison with a narrower unsigned type.  The narrower
+      type gets promoted to the (signed) larger type, and so the
+      semantics are undefined. */
+bool cannotHoldAnotherUShort(int n1, unsigned short delta) {
+    // clang 8.0.0 -O2: deleted (silently)
+    // gcc 9.2 -O2: deleted (silently)
+    // msvc 19.22 /O2: not deleted
+    return n1 + delta < n1; // BAD
+}
+bool canHoldPrecedingUShort(int n1, unsigned short delta) {
+	return n1 - delta < n1;
+}
+
+/* 3. Signed comparison with a non-narrower unsigned type.  The
+      signed type gets promoted to (a possibly wider) unsigned type,
+      and the resulting comparison is unsigned. */
+bool cannotHoldAnotherUInt(int n1, unsigned int delta) {
+    // clang 8.0.0 -O2: not deleted
+    // gcc 9.2 -O2: not deleted
+    // msvc 19.22 /O2: not deleted
+    return n1 + delta < n1; // GOOD
+}
+bool canHoldPrecedingUInt(int n1, unsigned int delta) {
+	return n1 - delta < n1;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref
new file mode 100644
index 00000000000..f645e2e2408
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref	
@@ -0,0 +1 @@
+Likely Bugs/Arithmetic/SignedComparisons.ql

From c9a9aff221ce2ecb60d7aef8bfceb6ece52c47df Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 1 Oct 2019 15:13:08 -0700
Subject: [PATCH 013/232] [CPP-434] Expected result.

---
 .../Arithmetic/SignedComparisons/SignedComparisons.expected   | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected
new file mode 100644
index 00000000000..bceb4fd0802
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected	
@@ -0,0 +1,4 @@
+| SignedComparisons.cpp:8:12:8:22 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
+| SignedComparisons.cpp:11:9:11:20 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
+| SignedComparisons.cpp:21:12:21:26 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
+| SignedComparisons.cpp:24:9:24:23 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |

From 8c6caf2b4e79ffe785f79c067619e8e8ae1a87e8 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 2 Oct 2019 12:27:16 -0700
Subject: [PATCH 014/232] [CPP-434] Rename everything to SignedOverflowCheck. 
 Add .qlhelp.  Deal with addition only, not subtraction.

---
 .../Arithmetic/SignedOverflowCheck-bad.cpp    |  3 ++
 .../Arithmetic/SignedOverflowCheck-good.cpp   |  3 ++
 .../Arithmetic/SignedOverflowCheck.qhelp      | 42 +++++++++++++++++++
 ...dComparisons.ql => SignedOverflowCheck.ql} | 15 +++----
 .../SignedComparisons.expected                |  4 --
 .../SignedComparisons/SignedComparisons.qlref |  1 -
 .../SignedOverflowCheck.cpp}                  |  9 ----
 .../SignedOverflowCheck.expected              |  2 +
 .../SignedOverflowCheck.qlref                 |  1 +
 9 files changed, 57 insertions(+), 23 deletions(-)
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
 rename cpp/ql/src/Likely Bugs/Arithmetic/{SignedComparisons.ql => SignedOverflowCheck.ql} (55%)
 delete mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected
 delete mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref
 rename cpp/ql/test/query-tests/Likely Bugs/Arithmetic/{SignedComparisons/SignedComparisons.cpp => SignedOverflowCheck/SignedOverflowCheck.cpp} (82%)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp
new file mode 100644
index 00000000000..e50273aacde
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp	
@@ -0,0 +1,3 @@
+bool foo(int n1, unsigned short delta) {
+    return n1 + delta < n1; // BAD
+}
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp
new file mode 100644
index 00000000000..2554e0d9371
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp	
@@ -0,0 +1,3 @@
+bool bar(int n1, unsigned int delta) {
+    return n1 + delta < n1; // GOOD
+}
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
new file mode 100644
index 00000000000..253950c3bf4
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -0,0 +1,42 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>
+Testing for <code>signed</code> integer overflow by adding a
+value to a variable and then comparing the result to said variable
+is not defined by the C or C++ standards.  The comparison may
+produce an unintended result, or may be deleted by the compiler
+entirely.
+</p>
+</overview>
+<recommendation>
+<p>
+Make sure that the comparison in question uses <i>unsigned</i> values.
+</p>
+</recommendation>
+<example>
+<p>
+In the following example, even though <code>delta</code> has been declared
+<code>unsigned short</code>, C/C++ type promotion rules require that its
+type is promoted to the larger type used in the addition and comparison,
+namely a <code>signed int</code>.  As a result, the entire expression is
+evaluated using <code>signed values</code> and its value is therefore undefined.
+</p>
+<sample src="SignedOverflowCheck-bad.cpp" />
+<p>
+In the next example, a value of type <code>signed int</code> is
+getting added to a value ot type <code>unsigned int</code>.  Because
+the types are of the same size, C/C++ promotion rules dictate that
+<code>unsigned int</code> is chosen as the overall type of the addition
+operation. The entire expression is evaluated using <code>unsigned</code>
+values, which is allowed and defined behavior per the C/C++ standard.
+</p>
+<sample src="SignedOverflowCheck-good.cpp" />
+</example>
+<references>
+<li><a href="http://c-faq.com/expr/preservingrules.html">Preserving Rules</a></li>
+<li><a href="https://www.securecoding.cert.org/confluence/plugins/servlet/mobile#content/view/20086942">Understand integer conversion rules</a></li>
+</references>
+</qhelp>
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
similarity index 55%
rename from cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql
rename to cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index b6dd8fb1d42..9414ee773d7 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedComparisons.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -1,11 +1,8 @@
 /**
  * @name Undefined result of signed test for overflow
- * @description Testing for signed integer overflow by adding a value to
- *              a variable (or subtracting a value from a variable) and
- *              then comparing the result to said variable is not defined
- *              by the C or C++ standards.  The comparison may produce an
- *              unintended result, or may be deleted by the compiler
- *              entirely.
+ * @description Testing for oveflow by adding a value to a variable
+ *              to see if it "wraps around" works only for
+ *              `unsigned` integer values.
  * @kind problem
  * @problem.severity warning
  * @precision medium
@@ -19,14 +16,14 @@ import cpp
 from RelationalOperation ro, BinaryArithmeticOperation bao, VariableAccess va1, VariableAccess va2
 where
   ro.getAnOperand() = bao and
-  (bao instanceof AddExpr or bao instanceof SubExpr) and
+  bao instanceof AddExpr and
   bao.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
   va1.getTarget() = va2.getTarget() and
   /*
    * if the addition/subtraction (`bao`) has been promoted to a signed type,
-   * then the other operand (`va2`) must also be signed and we have a signed
-   * comparison
+   * then the other operand (`va2`) must have been likewise promoted and so
+   * have a signed comparison
    */
 
   bao.getFullyConverted().getType().(IntegralType).isSigned()
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected
deleted file mode 100644
index bceb4fd0802..00000000000
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.expected	
+++ /dev/null
@@ -1,4 +0,0 @@
-| SignedComparisons.cpp:8:12:8:22 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
-| SignedComparisons.cpp:11:9:11:20 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
-| SignedComparisons.cpp:21:12:21:26 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
-| SignedComparisons.cpp:24:9:24:23 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref
deleted file mode 100644
index f645e2e2408..00000000000
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.qlref	
+++ /dev/null
@@ -1 +0,0 @@
-Likely Bugs/Arithmetic/SignedComparisons.ql
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
similarity index 82%
rename from cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp
rename to cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index 32d3bab19c7..4f5ea296d7c 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedComparisons/SignedComparisons.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -7,9 +7,6 @@ bool cannotHoldAnother8(int n1) {
     // msvc 19.22 /O2: not deleted
     return n1 + 8 < n1; // BAD
 }
-bool canHoldPreceding16(int n1) {
-	return n1 - 16 < n1;
-}
 
 /* 2. Signed comparison with a narrower unsigned type.  The narrower
       type gets promoted to the (signed) larger type, and so the
@@ -20,9 +17,6 @@ bool cannotHoldAnotherUShort(int n1, unsigned short delta) {
     // msvc 19.22 /O2: not deleted
     return n1 + delta < n1; // BAD
 }
-bool canHoldPrecedingUShort(int n1, unsigned short delta) {
-	return n1 - delta < n1;
-}
 
 /* 3. Signed comparison with a non-narrower unsigned type.  The
       signed type gets promoted to (a possibly wider) unsigned type,
@@ -33,6 +27,3 @@ bool cannotHoldAnotherUInt(int n1, unsigned int delta) {
     // msvc 19.22 /O2: not deleted
     return n1 + delta < n1; // GOOD
 }
-bool canHoldPrecedingUInt(int n1, unsigned int delta) {
-	return n1 - delta < n1;
-}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
new file mode 100644
index 00000000000..5963f1b340f
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -0,0 +1,2 @@
+| SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
+| SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref
new file mode 100644
index 00000000000..dde64840202
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref	
@@ -0,0 +1 @@
+Likely Bugs/Arithmetic/SignedOverflowCheck.ql

From 16411d1b6e0bd9f57299a9934913d170b2cfd4ee Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 2 Oct 2019 12:32:11 -0700
Subject: [PATCH 015/232] [CPP-434] Remove references to underflow and
 subtraction.

---
 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 9414ee773d7..18c54c01629 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -21,10 +21,10 @@ where
   ro.getAnOperand() = va2 and
   va1.getTarget() = va2.getTarget() and
   /*
-   * if the addition/subtraction (`bao`) has been promoted to a signed type,
+   * if the addition (`bao`) has been promoted to a signed type,
    * then the other operand (`va2`) must have been likewise promoted and so
    * have a signed comparison
    */
 
   bao.getFullyConverted().getType().(IntegralType).isSigned()
-select ro, "Testing for signed overflow/underflow may produce undefined results."
+select ro, "Testing for signed overflow may produce undefined results."

From 341dc12fc86713880ba56efd389ce2e74d9ad223 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 2 Oct 2019 15:02:44 -0700
Subject: [PATCH 016/232] [CPP-434] Adjust expected output.

---
 .../SignedOverflowCheck/SignedOverflowCheck.expected          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
index 5963f1b340f..4fc4cce41a2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -1,2 +1,2 @@
-| SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
-| SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow/underflow may produce undefined results. |
+| SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |

From 872054a89a8ed4d8687402ca6d4f41344e036d94 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 2 Oct 2019 17:59:19 -0700
Subject: [PATCH 017/232] [CPP-434] Narrow down query.

---
 .../Arithmetic/SignedOverflowCheck.ql         | 14 ++---
 .../SignedOverflowCheck.cpp                   | 52 +++++++++++++++++++
 .../SignedOverflowCheck.expected              |  1 +
 3 files changed, 60 insertions(+), 7 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 18c54c01629..490b1a53a17 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -1,6 +1,6 @@
 /**
  * @name Undefined result of signed test for overflow
- * @description Testing for oveflow by adding a value to a variable
+ * @description Testing for overflow by adding a value to a variable
  *              to see if it "wraps around" works only for
  *              `unsigned` integer values.
  * @kind problem
@@ -13,18 +13,18 @@
 
 import cpp
 
-from RelationalOperation ro, BinaryArithmeticOperation bao, VariableAccess va1, VariableAccess va2
+from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
-  ro.getAnOperand() = bao and
-  bao instanceof AddExpr and
-  bao.getAnOperand() = va1 and
+  ro.getAnOperand() = add and
+  add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
   va1.getTarget() = va2.getTarget() and
+  (not exists(va1.getQualifier()) or va1.getQualifier() = va2.getQualifier()) and 
   /*
-   * if the addition (`bao`) has been promoted to a signed type,
+   * if the addition (`add`) has been promoted to a signed type,
    * then the other operand (`va2`) must have been likewise promoted and so
    * have a signed comparison
    */
 
-  bao.getFullyConverted().getType().(IntegralType).isSigned()
+  add.getExplicitlyConverted().getType().(IntegralType).isSigned()
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index 4f5ea296d7c..92edcf1daf2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -27,3 +27,55 @@ bool cannotHoldAnotherUInt(int n1, unsigned int delta) {
     // msvc 19.22 /O2: not deleted
     return n1 + delta < n1; // GOOD
 }
+
+bool shortShort1(unsigned short n1, unsigned short delta) {
+    // clang 8.0.0 -O2: deleted
+    // gcc 9.2 -O2: deleted
+    // msvc 19.22 /O2: not deleted
+	return n1 + delta < n1; // BAD
+}
+
+bool shortShort2(unsigned short n1, unsigned short delta) {
+    // clang 8.0.0 -O2: not deleted
+    // gcc 9.2 -O2: not deleted
+    // msvc 19.22 /O2: not deleted
+	return (unsigned short)(n1 + delta) < n1; // GOOD
+}
+
+/* Distinguish `varname` from `ptr->varname` and `obj.varname` */
+struct N {
+	unsigned short n1;
+} n, *np;
+
+bool shortStruct1(unsigned short n1, unsigned short delta) {
+	return np->n1 + delta < n1; // GOOD
+}
+
+bool shortStruct1a(unsigned short n1, unsigned short delta) {
+	return n1 + delta < n.n1; // GOOD
+}
+
+bool shortStruct2(unsigned short n1, unsigned short delta) {
+	return (unsigned short)(n1 + delta) < n.n1; // GOOD
+}
+
+struct se {
+        short xPos;
+        short yPos;
+        short xSize;
+        short ySize;
+};
+
+extern se *getSo(void);
+
+bool func1(se *so) {
+	se *o = getSo();
+	if (so->xPos + so->xSize < o->xPos // GOOD
+	    || so->xPos > o->xPos + o->xSize) { // GOOD
+    	// clang 8.0.0 -O2: not deleted
+    	// gcc 9.2 -O2: not deleted
+    	// msvc 19.22 /O2: not deleted
+		return false;
+	}
+	return true;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
index 4fc4cce41a2..c1867e71c18 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -1,2 +1,3 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |

From afa34b5054a13843c0425cd4613fd29694fecf27 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 8 Oct 2019 14:07:20 -0700
Subject: [PATCH 018/232] [CPP-434] Improvements to Qhelp; hashCons-ify query.

---
 .../Arithmetic/SignedOverflowCheck.qhelp      |  8 ++++----
 .../Arithmetic/SignedOverflowCheck.ql         | 20 +++++++++----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 253950c3bf4..0fe57891534 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -5,7 +5,7 @@
 <overview>
 <p>
 Testing for <code>signed</code> integer overflow by adding a
-value to a variable and then comparing the result to said variable
+value to a variable and then comparing the result to that variable
 is not defined by the C or C++ standards.  The comparison may
 produce an unintended result, or may be deleted by the compiler
 entirely.
@@ -27,7 +27,7 @@ evaluated using <code>signed values</code> and its value is therefore undefined.
 <sample src="SignedOverflowCheck-bad.cpp" />
 <p>
 In the next example, a value of type <code>signed int</code> is
-getting added to a value ot type <code>unsigned int</code>.  Because
+added to a value of type <code>unsigned int</code>.  Because
 the types are of the same size, C/C++ promotion rules dictate that
 <code>unsigned int</code> is chosen as the overall type of the addition
 operation. The entire expression is evaluated using <code>unsigned</code>
@@ -36,7 +36,7 @@ values, which is allowed and defined behavior per the C/C++ standard.
 <sample src="SignedOverflowCheck-good.cpp" />
 </example>
 <references>
-<li><a href="http://c-faq.com/expr/preservingrules.html">Preserving Rules</a></li>
-<li><a href="https://www.securecoding.cert.org/confluence/plugins/servlet/mobile#content/view/20086942">Understand integer conversion rules</a></li>
+<li><a href="http://c-faq.com/expr/preservingrules.html">comp.lang.c FAQ list · Question 3.19 (Preserving rules)</a></li>
+<li><a href="https://wiki.sei.cmu.edu/confluence/display/c/INT31-C.+Ensure+that+integer+conversions+do+not+result+in+lost+or+misinterpreted+data">INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data</a></li>
 </references>
 </qhelp>
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 490b1a53a17..f01ee5dd607 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -12,19 +12,19 @@
  */
 
 import cpp
+import semmle.code.cpp.valuenumbering.HashCons
+
+private predicate sameAccess(VariableAccess va1, VariableAccess va2) {
+  hashCons(va1) = hashCons(va2)
+}
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
   ro.getAnOperand() = add and
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
-  va1.getTarget() = va2.getTarget() and
-  (not exists(va1.getQualifier()) or va1.getQualifier() = va2.getQualifier()) and 
-  /*
-   * if the addition (`add`) has been promoted to a signed type,
-   * then the other operand (`va2`) must have been likewise promoted and so
-   * have a signed comparison
-   */
-
-  add.getExplicitlyConverted().getType().(IntegralType).isSigned()
-select ro, "Testing for signed overflow may produce undefined results."
+  sameAccess(va1, va2) and
+  add.getExplicitlyConverted().getType().(IntegralType).isSigned() and
+  va2.getExplicitlyConverted().getType().(IntegralType).isSigned()
+select va1, va1.getQualifier().getAQlClass(), va2, va2.getQualifier().getAQlClass(), ro,
+  "Testing for signed overflow may produce undefined results."

From bd87d7bc76134f44b3884adc1220e00ead70a92b Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 8 Oct 2019 16:33:05 -0700
Subject: [PATCH 019/232] [CPP-434] Switch to global value numbering (GVN). 
 Improve qlhelp doc.

---
 .../Arithmetic/SignedOverflowCheck-bad2.cpp           |  3 +++
 .../Arithmetic/SignedOverflowCheck-good.cpp           |  2 +-
 .../Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp  | 11 ++++++++++-
 .../src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql |  9 ++++-----
 4 files changed, 18 insertions(+), 7 deletions(-)
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp
new file mode 100644
index 00000000000..293a8c6e49e
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp	
@@ -0,0 +1,3 @@
+bool bar(unsigned short n1, unsigned short delta) {
+    return n1 + delta < n1; // BAD
+}
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp
index 2554e0d9371..2670a4371f6 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp	
@@ -1,3 +1,3 @@
-bool bar(int n1, unsigned int delta) {
+bool baz(int n1, unsigned int delta) {
     return n1 + delta < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 0fe57891534..c3147d23284 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -22,10 +22,19 @@ In the following example, even though <code>delta</code> has been declared
 <code>unsigned short</code>, C/C++ type promotion rules require that its
 type is promoted to the larger type used in the addition and comparison,
 namely a <code>signed int</code>.  As a result, the entire expression is
-evaluated using <code>signed values</code> and its value is therefore undefined.
+evaluated using <code>signed</code> values and its value is therefore undefined.
 </p>
 <sample src="SignedOverflowCheck-bad.cpp" />
 <p>
+In the following example, even though both <code>n</code> and <code>delta</code> 
+have been declared <code>unsigned short</code>, C/C++ type promotion rules 
+require that both parameters be promoted to the next bigger <code>signed</code>
+integer type (in this case <code>signed int</code>) before being added together
+ so as to avoid overflows or underflows.  As a result, the entire expression is
+evaluated using <code>signed</code> values and its value is therefore undefined.
+</p>
+<sample src="SignedOverflowCheck-bad2.cpp" />
+<p>
 In the next example, a value of type <code>signed int</code> is
 added to a value of type <code>unsigned int</code>.  Because
 the types are of the same size, C/C++ promotion rules dictate that
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index f01ee5dd607..21e602e2eb4 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -5,17 +5,17 @@
  *              `unsigned` integer values.
  * @kind problem
  * @problem.severity warning
- * @precision medium
+ * @precision high
  * @id cpp/signed-overflow-check
  * @tags reliability
  *       security
  */
 
 import cpp
-import semmle.code.cpp.valuenumbering.HashCons
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 private predicate sameAccess(VariableAccess va1, VariableAccess va2) {
-  hashCons(va1) = hashCons(va2)
+  globalValueNumber(va1) = globalValueNumber(va2)
 }
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
@@ -26,5 +26,4 @@ where
   sameAccess(va1, va2) and
   add.getExplicitlyConverted().getType().(IntegralType).isSigned() and
   va2.getExplicitlyConverted().getType().(IntegralType).isSigned()
-select va1, va1.getQualifier().getAQlClass(), va2, va2.getQualifier().getAQlClass(), ro,
-  "Testing for signed overflow may produce undefined results."
+select ro, "Testing for signed overflow may produce undefined results."

From e617a05a1f12ccb3588524132f8856151ce7cf5d Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 8 Oct 2019 17:20:25 -0700
Subject: [PATCH 020/232] [CPP-434] One bad usage is undetected; adjust test
 accordingly.

---
 .../Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp      | 2 +-
 .../Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index 92edcf1daf2..78d228890f0 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // BAD
+	return n1 + delta < n1; // BAD [NOT DETECTED]
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
index c1867e71c18..4fc4cce41a2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -1,3 +1,2 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
-| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |

From 0ccc0057f95314fa179a80216558bb6704eb1a94 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik@semmle.com>
Date: Tue, 8 Oct 2019 15:04:11 +0200
Subject: [PATCH 021/232] add Deferred model to Promises.qll

---
 change-notes/1.23/analysis-javascript.md      |  1 +
 .../ql/src/semmle/javascript/Promises.qll     | 33 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 04b5e6cb541..87b12c19230 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -38,3 +38,4 @@
 ## Changes to QL libraries
 
 * `Expr.getDocumentation()` now handles chain assignments.
+* Added `Deferred` as a promise library in Promises.qll
diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index 858064e85a0..794a866aee2 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -32,6 +32,39 @@ module Bluebird {
   }
 }
 
+/**
+ * Provides classes for working with various Deferred implementations
+ */
+module Deferred {
+  private DataFlow::SourceNode deferred() {
+    exists(VarAccess var, DataFlow::NewNode instantiation |
+      var.getName() = "Deferred" and
+      result = DataFlow::exprNode(var).getALocalSource() and
+      // Sanity check that result really is a Deferred implementation
+      instantiation = result.getAnInstantiation() and
+      exists(instantiation.getAMemberCall("resolve"))
+    )
+  }
+
+  /**
+   * A promise object created by a Deferred constructor
+   */
+  private class DeferredPromiseDefinition extends PromiseDefinition, DataFlow::NewNode {
+    DeferredPromiseDefinition() { this = deferred().getAnInstantiation() }
+
+    override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
+  }
+
+  /**
+   * A resolved promise created by a `new Deferred().resolve()` call.
+   */
+  class ResolvedDeferredPromiseDefinition extends ResolvedPromiseDefinition {
+    ResolvedDeferredPromiseDefinition() { this = any(DeferredPromiseDefinition def).getAMemberCall("resolve") }
+
+    override DataFlow::Node getValue() { result = getArgument(0) }
+  }
+}
+
 /**
  * Provides classes for working with the `q` library (https://github.com/kriskowal/q).
  */

From 411ed702fb1eabc9f308a34abe6105b688d12c36 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik@semmle.com>
Date: Wed, 9 Oct 2019 13:50:12 +0200
Subject: [PATCH 022/232] change change-notes

---
 change-notes/1.23/analysis-javascript.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 87b12c19230..70d903cb944 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -9,6 +9,7 @@
   - [rate-limiter-flexible](https://www.npmjs.com/package/rate-limiter-flexible)
 
 * The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
+* Promises derived from a Deferred object are now recognized.
 
 ## New queries
 
@@ -38,4 +39,3 @@
 ## Changes to QL libraries
 
 * `Expr.getDocumentation()` now handles chain assignments.
-* Added `Deferred` as a promise library in Promises.qll

From c7eb0f17a9e35a0d9e0be951373df7bcad9c4f87 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik@semmle.com>
Date: Wed, 9 Oct 2019 13:59:00 +0200
Subject: [PATCH 023/232] add TaintTracking test for new Deferred model

---
 .../TaintTracking/BasicTaintTracking.expected            | 1 +
 .../ql/test/library-tests/TaintTracking/promise.js       | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index 2722f67d6fd..77592a2e855 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -69,6 +69,7 @@ typeInferenceMismatch
 | promise.js:5:25:5:32 | source() | promise.js:5:8:5:33 | bluebir ... urce()) |
 | promise.js:10:24:10:31 | source() | promise.js:10:8:10:32 | Promise ... urce()) |
 | promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise |
+| promise.js:22:23:22:30 | source() | promise.js:22:7:22:31 | promise ... urce()) |
 | sanitizer-guards.js:2:11:2:18 | source() | sanitizer-guards.js:4:8:4:8 | x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/promise.js b/javascript/ql/test/library-tests/TaintTracking/promise.js
index cd5351720ba..87e89451d99 100644
--- a/javascript/ql/test/library-tests/TaintTracking/promise.js
+++ b/javascript/ql/test/library-tests/TaintTracking/promise.js
@@ -12,3 +12,12 @@ function closure() {
   resolver.resolve(source());
   sink(resolver.promise); // NOT OK
 }
+
+class Deferred {
+	
+}
+
+function deferred() {
+	var promise = new Deferred();
+	sink(promise.resolve(source())); // NOT OK
+}
\ No newline at end of file

From 4ec825b5b6f3dbb1ba8c5e20bf70963772c9bda0 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik@semmle.com>
Date: Wed, 9 Oct 2019 16:18:04 +0200
Subject: [PATCH 024/232] made model of Deferred more precise

---
 .../ql/src/semmle/javascript/Promises.qll     | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index 794a866aee2..362bb2f5063 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -37,10 +37,23 @@ module Bluebird {
  */
 module Deferred {
   private DataFlow::SourceNode deferred() {
-    exists(VarAccess var, DataFlow::NewNode instantiation |
-      var.getName() = "Deferred" and
-      result = DataFlow::exprNode(var).getALocalSource() and
-      // Sanity check that result really is a Deferred implementation
+    (
+      exists(Variable var | 
+        var.getName() = "Deferred" and
+        (var.getADeclaration() instanceof LocalNamespaceDecl or var.getScope() instanceof GlobalScope) and
+        result = DataFlow::valueNode(var.getADefinition())
+  	  ) 
+  	  or
+  	  result.(DataFlow::ParameterNode).getName() = "Deferred" 
+  	  or
+        exists(Function f |
+        f.getName() = "Deferred" and 
+        result = DataFlow::valueNode(f)
+      )
+    ) 
+    and
+    // Sanity check that it is a Deferred implementation
+    exists(DataFlow::NewNode instantiation |
       instantiation = result.getAnInstantiation() and
       exists(instantiation.getAMemberCall("resolve"))
     )

From 7fc47d496a6cc817761fcfe06acb320dd0931a50 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 9 Oct 2019 16:40:19 -0700
Subject: [PATCH 025/232] [CPP-434] Much improved query (producing only true
 positives on a run of 75 projects).

---
 .../src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql  | 10 +++-------
 .../SignedOverflowCheck/SignedOverflowCheck.cpp        |  2 +-
 .../SignedOverflowCheck/SignedOverflowCheck.expected   |  1 +
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 21e602e2eb4..96de06c48b4 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -14,16 +14,12 @@
 import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
-private predicate sameAccess(VariableAccess va1, VariableAccess va2) {
-  globalValueNumber(va1) = globalValueNumber(va2)
-}
-
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
   ro.getAnOperand() = add and
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
-  sameAccess(va1, va2) and
-  add.getExplicitlyConverted().getType().(IntegralType).isSigned() and
-  va2.getExplicitlyConverted().getType().(IntegralType).isSigned()
+  globalValueNumber(va1) = globalValueNumber(va2) and
+  add.getFullyConverted().getType().getUnspecifiedType().(IntegralType).isSigned() and
+  not add.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index 78d228890f0..92edcf1daf2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // BAD [NOT DETECTED]
+	return n1 + delta < n1; // BAD
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
index 4fc4cce41a2..c1867e71c18 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -1,2 +1,3 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |

From 1ab965761b13be373375ce694d2bb887ed6d4351 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 9 Oct 2019 17:30:30 -0700
Subject: [PATCH 026/232] [CPP-434] Incorporate test from
 BadAdditionOverflowCheck.

---
 .../Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index 92edcf1daf2..e04a6d25f55 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -79,3 +79,7 @@ bool func1(se *so) {
 	}
 	return true;
 }
+
+bool checkOverflow3(unsigned int a, unsigned short b) {
+  return (a + b < a);  // GOOD
+}

From 0a6b343820e43fd47efa61cf8acec0deab53c458 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 10 Oct 2019 11:50:34 +0200
Subject: [PATCH 027/232] add "class Deferred{...}" as potential Deferred
 implementation to fix the tests

---
 javascript/ql/src/semmle/javascript/Promises.qll | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index 362bb2f5063..488adebab6e 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -46,10 +46,15 @@ module Deferred {
   	  or
   	  result.(DataFlow::ParameterNode).getName() = "Deferred" 
   	  or
-        exists(Function f |
+      exists(Function f |
         f.getName() = "Deferred" and 
         result = DataFlow::valueNode(f)
       )
+      or
+      exists(ClassDefinition c | 
+      	c.getName() = "Deferred" and
+      	result = DataFlow::valueNode(c)
+      )
     ) 
     and
     // Sanity check that it is a Deferred implementation

From 33cd6de7294705a865fd901190b174ec0e268791 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Thu, 10 Oct 2019 18:11:35 -0700
Subject: [PATCH 028/232] [CPP-434] Improved query and test suite.

---
 .../Arithmetic/SignedOverflowCheck.ql         |  9 +++++++--
 .../SignedOverflowCheck.cpp                   | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 96de06c48b4..2dd4ae40152 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -14,12 +14,17 @@
 import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
+private predicate isSignedWithoutUnsignedCast(Expr e) {
+  e.getType().getUnspecifiedType().(IntegralType).isSigned() and
+  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
+}
+
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
   ro.getAnOperand() = add and
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
   globalValueNumber(va1) = globalValueNumber(va2) and
-  add.getFullyConverted().getType().getUnspecifiedType().(IntegralType).isSigned() and
-  not add.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
+  isSignedWithoutUnsignedCast(add) and
+  isSignedWithoutUnsignedCast(va2)
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index e04a6d25f55..be8dd05f4f0 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -83,3 +83,22 @@ bool func1(se *so) {
 bool checkOverflow3(unsigned int a, unsigned short b) {
   return (a + b < a);  // GOOD
 }
+
+struct C {
+  unsigned int length;
+};
+
+int checkOverflow4(unsigned int ioff, C c) {
+  // not deleted by gcc or clang
+  if ((int)(ioff + c.length) < (int)ioff) return 0; // GOOD
+  return 1;
+}
+
+#define AV_INPUT_BUFFER_PADDING_SIZE 64
+
+int overflow12(int codecdata_length) {
+	if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length) { // GOOD
+	  return -1;
+	}
+	return 1;
+}

From 31009d979d323eb496530ae99c9f719ebed67272 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 11 Oct 2019 12:04:34 +0200
Subject: [PATCH 029/232] add type tracking to detect instances

---
 .../ql/src/semmle/javascript/Promises.qll     | 73 ++++++++++++-------
 .../library-tests/TaintTracking/promise.js    |  2 +
 2 files changed, 50 insertions(+), 25 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index 488adebab6e..13eb1e8114e 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -36,39 +36,60 @@ module Bluebird {
  * Provides classes for working with various Deferred implementations
  */
 module Deferred {
-  private DataFlow::SourceNode deferred() {
-    (
-      exists(Variable var | 
+  class DeferredClass extends DataFlow::SourceNode {
+    DeferredClass() {
+      exists(Variable var |
         var.getName() = "Deferred" and
-        (var.getADeclaration() instanceof LocalNamespaceDecl or var.getScope() instanceof GlobalScope) and
-        result = DataFlow::valueNode(var.getADefinition())
-  	  ) 
-  	  or
-  	  result.(DataFlow::ParameterNode).getName() = "Deferred" 
-  	  or
-      exists(Function f |
-        f.getName() = "Deferred" and 
-        result = DataFlow::valueNode(f)
+        (
+          var.getADeclaration() instanceof LocalNamespaceDecl or
+          var.getScope() instanceof GlobalScope
+        ) and
+        this = DataFlow::valueNode(var.getADefinition())
       )
       or
-      exists(ClassDefinition c | 
-      	c.getName() = "Deferred" and
-      	result = DataFlow::valueNode(c)
+      this.(DataFlow::ParameterNode).getName() = "Deferred"
+      or
+      exists(Function f |
+        f.getName() = "Deferred" and
+        this = DataFlow::valueNode(f)
       )
-    ) 
-    and
-    // Sanity check that it is a Deferred implementation
-    exists(DataFlow::NewNode instantiation |
-      instantiation = result.getAnInstantiation() and
-      exists(instantiation.getAMemberCall("resolve"))
-    )
+      or
+      exists(ClassDefinition c |
+        c.getName() = "Deferred" and
+        this = DataFlow::valueNode(c)
+      )
+    }
+  }
+
+  class DeferredInstance extends DataFlow::NewNode {
+    DeferredClass deferredClass;
+
+    DeferredInstance() { this = deferredClass.getAnInstantiation() }
+
+    private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
+      t.start() and
+      result = this
+      or
+      exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
+    }
+
+    DeferredClass getDeferredClass() { result = deferredClass }
+
+    DataFlow::CallNode getPromiseMemberCall(string methodName) {
+      result = ref(DataFlow::TypeTracker::end()).getAMemberCall(methodName)
+    }
   }
 
   /**
    * A promise object created by a Deferred constructor
    */
-  private class DeferredPromiseDefinition extends PromiseDefinition, DataFlow::NewNode {
-    DeferredPromiseDefinition() { this = deferred().getAnInstantiation() }
+  private class DeferredPromiseDefinition extends PromiseDefinition, DeferredInstance {
+    DeferredPromiseDefinition() { 
+      this = any(DeferredClass c |
+        exists(any(DeferredInstance i | i.getDeferredClass() = c).getPromiseMemberCall("resolve")) and
+        exists(any(DeferredInstance i | i.getDeferredClass() = c).getPromiseMemberCall("reject"))
+      ).getAnInstantiation() 
+    }
 
     override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
   }
@@ -77,7 +98,9 @@ module Deferred {
    * A resolved promise created by a `new Deferred().resolve()` call.
    */
   class ResolvedDeferredPromiseDefinition extends ResolvedPromiseDefinition {
-    ResolvedDeferredPromiseDefinition() { this = any(DeferredPromiseDefinition def).getAMemberCall("resolve") }
+    ResolvedDeferredPromiseDefinition() {
+      this = any(DeferredPromiseDefinition def).getPromiseMemberCall("resolve")
+    }
 
     override DataFlow::Node getValue() { result = getArgument(0) }
   }
diff --git a/javascript/ql/test/library-tests/TaintTracking/promise.js b/javascript/ql/test/library-tests/TaintTracking/promise.js
index 87e89451d99..d16e57241e8 100644
--- a/javascript/ql/test/library-tests/TaintTracking/promise.js
+++ b/javascript/ql/test/library-tests/TaintTracking/promise.js
@@ -20,4 +20,6 @@ class Deferred {
 function deferred() {
 	var promise = new Deferred();
 	sink(promise.resolve(source())); // NOT OK
+	
+	new Deferred().reject("foo") // <- a reject has to exist.
 }
\ No newline at end of file

From 592cb18bf486ba6f8b37abf291516e365d4f8e25 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik@semmle.com>
Date: Fri, 4 Oct 2019 16:28:38 +0200
Subject: [PATCH 030/232] add array callbacks to useOfReturnlessFunction query

---
 .../ql/src/Expressions/ExprHasNoEffect.ql     | 115 +----------------
 .../ql/src/Expressions/ExprHasNoEffect.qll    | 121 ++++++++++++++++++
 .../src/Statements/UseOfReturnlessFunction.ql |  63 ++++++++-
 3 files changed, 178 insertions(+), 121 deletions(-)

diff --git a/javascript/ql/src/Expressions/ExprHasNoEffect.ql b/javascript/ql/src/Expressions/ExprHasNoEffect.ql
index 14024ec8f38..929e84616f0 100644
--- a/javascript/ql/src/Expressions/ExprHasNoEffect.ql
+++ b/javascript/ql/src/Expressions/ExprHasNoEffect.ql
@@ -13,122 +13,9 @@
  */
 
 import javascript
-import DOMProperties
-import semmle.javascript.frameworks.xUnit
-import semmle.javascript.RestrictedLocations
 import ExprHasNoEffect
 
-/**
- * Holds if `e` is of the form `x;` or `e.p;` and has a JSDoc comment containing a tag.
- * In that case, it is probably meant as a declaration and shouldn't be flagged by this query.
- *
- * This will still flag cases where the JSDoc comment contains no tag at all (and hence carries
- * no semantic information), and expression statements with an ordinary (non-JSDoc) comment
- * attached to them.
- */
-predicate isDeclaration(Expr e) {
-  (e instanceof VarAccess or e instanceof PropAccess) and
-  exists(e.getParent().(ExprStmt).getDocumentation().getATag())
-}
-
-/**
- * Holds if there exists a getter for a property called `name` anywhere in the program.
- */
-predicate isGetterProperty(string name) {
-  // there is a call of the form `Object.defineProperty(..., name, descriptor)` ...
-  exists(CallToObjectDefineProperty defProp | name = defProp.getPropertyName() |
-    // ... where `descriptor` defines a getter
-    defProp.hasPropertyAttributeWrite("get", _)
-    or
-    // ... where `descriptor` may define a getter
-    exists(DataFlow::SourceNode descriptor | descriptor.flowsTo(defProp.getPropertyDescriptor()) |
-      descriptor.isIncomplete(_)
-      or
-      // minimal escape analysis for the descriptor
-      exists(DataFlow::InvokeNode invk |
-        not invk = defProp and
-        descriptor.flowsTo(invk.getAnArgument())
-      )
-    )
-  )
-  or
-  // there is an object expression with a getter property `name`
-  exists(ObjectExpr obj | obj.getPropertyByName(name) instanceof PropertyGetter)
-}
-
-/**
- * A property access that may invoke a getter.
- */
-class GetterPropertyAccess extends PropAccess {
-  override predicate isImpure() { isGetterProperty(getPropertyName()) }
-}
-
-/**
- * Holds if `c` is an indirect eval call of the form `(dummy, eval)(...)`, where
- * `dummy` is some expression whose value is discarded, and which simply
- * exists to prevent the call from being interpreted as a direct eval.
- */
-predicate isIndirectEval(CallExpr c, Expr dummy) {
-  exists(SeqExpr seq | seq = c.getCallee().stripParens() |
-    dummy = seq.getOperand(0) and
-    seq.getOperand(1).(GlobalVarAccess).getName() = "eval" and
-    seq.getNumOperands() = 2
-  )
-}
-
-/**
- * Holds if `c` is a call of the form `(dummy, e[p])(...)`, where `dummy` is
- * some expression whose value is discarded, and which simply exists
- * to prevent the call from being interpreted as a method call.
- */
-predicate isReceiverSuppressingCall(CallExpr c, Expr dummy, PropAccess callee) {
-  exists(SeqExpr seq | seq = c.getCallee().stripParens() |
-    dummy = seq.getOperand(0) and
-    seq.getOperand(1) = callee and
-    seq.getNumOperands() = 2
-  )
-}
-
-/**
- * Holds if evaluating `e` has no side effects (except potentially allocating
- * and initializing a new object).
- *
- * For calls, we do not check whether their arguments have any side effects:
- * even if they do, the call itself is useless and should be flagged by this
- * query.
- */
-predicate noSideEffects(Expr e) {
-  e.isPure()
-  or
-  // `new Error(...)`, `new SyntaxError(...)`, etc.
-  forex(Function f | f = e.flow().(DataFlow::NewNode).getACallee() |
-    f.(ExternalType).getASupertype*().getName() = "Error"
-  )
-}
 
 from Expr e
-where
-  noSideEffects(e) and
-  inVoidContext(e) and
-  // disregard pure expressions wrapped in a void(...)
-  not e instanceof VoidExpr and
-  // filter out directives (unknown directives are handled by UnknownDirective.ql)
-  not exists(Directive d | e = d.getExpr()) and
-  // or about externs
-  not e.inExternsFile() and
-  // don't complain about declarations
-  not isDeclaration(e) and
-  // exclude DOM properties, which sometimes have magical auto-update properties
-  not isDOMProperty(e.(PropAccess).getPropertyName()) and
-  // exclude xUnit.js annotations
-  not e instanceof XUnitAnnotation and
-  // exclude common patterns that are most likely intentional
-  not isIndirectEval(_, e) and
-  not isReceiverSuppressingCall(_, e, _) and
-  // exclude anonymous function expressions as statements; these can only arise
-  // from a syntax error we already flag
-  not exists(FunctionExpr fe, ExprStmt es | fe = e |
-    fe = es.getExpr() and
-    not exists(fe.getName())
-  )
+where hasNoEffect(e)
 select e.(FirstLineOf), "This expression has no effect."
diff --git a/javascript/ql/src/Expressions/ExprHasNoEffect.qll b/javascript/ql/src/Expressions/ExprHasNoEffect.qll
index 858f719ba0a..822bcbb26fa 100644
--- a/javascript/ql/src/Expressions/ExprHasNoEffect.qll
+++ b/javascript/ql/src/Expressions/ExprHasNoEffect.qll
@@ -3,6 +3,9 @@
  */
 
 import javascript
+import DOMProperties
+import semmle.javascript.frameworks.xUnit
+import semmle.javascript.RestrictedLocations
 
 /**
  * Holds if `e` appears in a syntactic context where its value is discarded.
@@ -37,3 +40,121 @@ predicate inVoidContext(Expr e) {
   or
   exists(LogicalBinaryExpr logical | e = logical.getRightOperand() and inVoidContext(logical))
 }
+
+
+/**
+ * Holds if `e` is of the form `x;` or `e.p;` and has a JSDoc comment containing a tag.
+ * In that case, it is probably meant as a declaration and shouldn't be flagged by this query.
+ *
+ * This will still flag cases where the JSDoc comment contains no tag at all (and hence carries
+ * no semantic information), and expression statements with an ordinary (non-JSDoc) comment
+ * attached to them.
+ */
+predicate isDeclaration(Expr e) {
+  (e instanceof VarAccess or e instanceof PropAccess) and
+  exists(e.getParent().(ExprStmt).getDocumentation().getATag())
+}
+
+/**
+ * Holds if there exists a getter for a property called `name` anywhere in the program.
+ */
+predicate isGetterProperty(string name) {
+  // there is a call of the form `Object.defineProperty(..., name, descriptor)` ...
+  exists(CallToObjectDefineProperty defProp | name = defProp.getPropertyName() |
+    // ... where `descriptor` defines a getter
+    defProp.hasPropertyAttributeWrite("get", _)
+    or
+    // ... where `descriptor` may define a getter
+    exists(DataFlow::SourceNode descriptor | descriptor.flowsTo(defProp.getPropertyDescriptor()) |
+      descriptor.isIncomplete(_)
+      or
+      // minimal escape analysis for the descriptor
+      exists(DataFlow::InvokeNode invk |
+        not invk = defProp and
+        descriptor.flowsTo(invk.getAnArgument())
+      )
+    )
+  )
+  or
+  // there is an object expression with a getter property `name`
+  exists(ObjectExpr obj | obj.getPropertyByName(name) instanceof PropertyGetter)
+}
+
+/**
+ * A property access that may invoke a getter.
+ */
+class GetterPropertyAccess extends PropAccess {
+  override predicate isImpure() { isGetterProperty(getPropertyName()) }
+}
+
+/**
+ * Holds if `c` is an indirect eval call of the form `(dummy, eval)(...)`, where
+ * `dummy` is some expression whose value is discarded, and which simply
+ * exists to prevent the call from being interpreted as a direct eval.
+ */
+predicate isIndirectEval(CallExpr c, Expr dummy) {
+  exists(SeqExpr seq | seq = c.getCallee().stripParens() |
+    dummy = seq.getOperand(0) and
+    seq.getOperand(1).(GlobalVarAccess).getName() = "eval" and
+    seq.getNumOperands() = 2
+  )
+}
+
+/**
+ * Holds if `c` is a call of the form `(dummy, e[p])(...)`, where `dummy` is
+ * some expression whose value is discarded, and which simply exists
+ * to prevent the call from being interpreted as a method call.
+ */
+predicate isReceiverSuppressingCall(CallExpr c, Expr dummy, PropAccess callee) {
+  exists(SeqExpr seq | seq = c.getCallee().stripParens() |
+    dummy = seq.getOperand(0) and
+    seq.getOperand(1) = callee and
+    seq.getNumOperands() = 2
+  )
+}
+
+/**
+ * Holds if evaluating `e` has no side effects (except potentially allocating
+ * and initializing a new object).
+ *
+ * For calls, we do not check whether their arguments have any side effects:
+ * even if they do, the call itself is useless and should be flagged by this
+ * query.
+ */
+predicate noSideEffects(Expr e) {
+  e.isPure()
+  or
+  // `new Error(...)`, `new SyntaxError(...)`, etc.
+  forex(Function f | f = e.flow().(DataFlow::NewNode).getACallee() |
+    f.(ExternalType).getASupertype*().getName() = "Error"
+  )
+}
+
+/**
+ * Holds if the expression `e` should be reported as having no effect.
+ */
+predicate hasNoEffect(Expr e) {
+  noSideEffects(e) and
+  inVoidContext(e) and
+  // disregard pure expressions wrapped in a void(...)
+  not e instanceof VoidExpr and
+  // filter out directives (unknown directives are handled by UnknownDirective.ql)
+  not exists(Directive d | e = d.getExpr()) and
+  // or about externs
+  not e.inExternsFile() and
+  // don't complain about declarations
+  not isDeclaration(e) and
+  // exclude DOM properties, which sometimes have magical auto-update properties
+  not isDOMProperty(e.(PropAccess).getPropertyName()) and
+  // exclude xUnit.js annotations
+  not e instanceof XUnitAnnotation and
+  // exclude common patterns that are most likely intentional
+  not isIndirectEval(_, e) and
+  not isReceiverSuppressingCall(_, e, _) and
+  // exclude anonymous function expressions as statements; these can only arise
+  // from a syntax error we already flag
+  not exists(FunctionExpr fe, ExprStmt es | fe = e |
+    fe = es.getExpr() and
+    not exists(fe.getName())
+  )	
+}
\ No newline at end of file
diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index c63127b83a3..61a485313e4 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -82,17 +82,66 @@ predicate alwaysThrows(Function f) {
   )
 }
 
-from DataFlow::CallNode call
-where
+predicate callToVoidFunction(DataFlow::CallNode call, Function func) {
   not call.isIndefinite(_) and 
-  forex(Function f | f = call.getACallee() |
+  func = call.getACallee() and
+  forall(Function f | f = call.getACallee() |
     returnsVoid(f) and not isStub(f) and not alwaysThrows(f)
+  )
+}
+
+predicate hasNonVoidCallbackMethod(string name) {
+  name = "every" or
+  name = "filter" or
+  name = "find" or
+  name = "findIndex" or
+  name = "flatMap" or
+  name = "map" or
+  name = "reduce" or
+  name = "reduceRight" or
+  name = "some" or
+  name = "sort"
+}
+
+DataFlow::SourceNode array(DataFlow::TypeTracker t) {
+  t.start() and result instanceof DataFlow::ArrayCreationNode
+  or
+  exists (DataFlow::TypeTracker t2 |
+    result = array(t2).track(t2, t)
+  )
+}
+
+DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
+
+predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {
+  hasNonVoidCallbackMethod(call.getMethodName()) and
+  func = call.getAnArgument().getALocalSource().asExpr() and
+  1 = count(DataFlow::Node arg | arg = call.getAnArgument() and arg.getALocalSource().asExpr() instanceof Function) and
+  returnsVoid(func) and
+  not isStub(func) and
+  not alwaysThrows(func) and
+  (
+    call.getReceiver().getALocalSource() = array()
+    or
+    call.getCalleeNode() instanceof LodashUnderscore::Member
+  )
+}
+
+from DataFlow::CallNode call, Function func, string name, string msg
+where
+  (
+    callToVoidFunction(call, func) and 
+    msg = "the $@ does not return anything, yet the return value is used." and
+    name = "function " + call.getCalleeName()
+    or
+    voidArrayCallback(call, func) and 
+    msg = "the $@ does not return anything, yet the return value from the call to " + call.getCalleeName() + "() is used." and
+    name = "callback function"
   ) and
-  
   not benignContext(call.asExpr()) and
-  
+  // Avoid double reporting from js/useless-expression
+  not hasNoEffect(func.getBodyStmt(func.getNumBodyStmt() - 1).(ExprStmt).getExpr()) and
   // anonymous one-shot closure. Those are used in weird ways and we ignore them.
   not oneshotClosure(call.asExpr())
 select
-  call, "the function $@ does not return anything, yet the return value is used.", call.getACallee(), call.getCalleeName()
-  
+  call, msg, func, name

From a7c1c34e1e48a311057ae223d545ed59a54439ee Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 11 Oct 2019 17:14:58 +0200
Subject: [PATCH 031/232] fix test output, and add new test for array callbacks

---
 .../UseOfReturnlessFunction.expected                  | 11 ++++++-----
 .../Statements/UseOfReturnlessFunction/tst.js         |  7 +++++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
index 500d900ff9e..0dc283d5edc 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
@@ -1,5 +1,6 @@
-| tst.js:20:17:20:33 | onlySideEffects() | the function $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | onlySideEffects |
-| tst.js:24:13:24:29 | onlySideEffects() | the function $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | onlySideEffects |
-| tst.js:30:20:30:36 | onlySideEffects() | the function $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | onlySideEffects |
-| tst.js:53:10:53:34 | bothOnl ... fects() | the function $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | bothOnlyHaveSideEffects |
-| tst.js:53:10:53:34 | bothOnl ... fects() | the function $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | bothOnlyHaveSideEffects |
+| tst.js:20:17:20:33 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
+| tst.js:24:13:24:29 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
+| tst.js:30:20:30:36 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
+| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
+| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
+| tst.js:76:12:76:46 | [1,2,3] ... n, 3)}) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:76:27:76:45 | n => {equals(n, 3)} | callback function |
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
index 8bb49f7e761..1306c6e7f65 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
@@ -68,4 +68,11 @@
 	
 	var h = returnsValue() || alwaysThrows(); // OK!
 	console.log(h);
+	
+	function equals(x, y) {
+		return x === y;
+	}
+	
+	var foo = [1,2,3].filter(n => {equals(n, 3)}) // NOT OK!
+	console.log(foo);
 })();
\ No newline at end of file

From 5558922b31f4ad6290109d593f49d228177f27fa Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 11 Oct 2019 17:01:16 -0700
Subject: [PATCH 032/232] [CPP-434] Drop the requirement that RHS not be cast
 to unsigned, since overflow occurs on LHS.  Adjust test case.

---
 .../src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql  |  3 +--
 .../SignedOverflowCheck/SignedOverflowCheck.cpp        | 10 +++-------
 .../SignedOverflowCheck/SignedOverflowCheck.expected   |  1 +
 3 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 2dd4ae40152..076e47df701 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -25,6 +25,5 @@ where
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
   globalValueNumber(va1) = globalValueNumber(va2) and
-  isSignedWithoutUnsignedCast(add) and
-  isSignedWithoutUnsignedCast(va2)
+  isSignedWithoutUnsignedCast(add)
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
index be8dd05f4f0..4396d857884 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
@@ -94,11 +94,7 @@ int checkOverflow4(unsigned int ioff, C c) {
   return 1;
 }
 
-#define AV_INPUT_BUFFER_PADDING_SIZE 64
-
-int overflow12(int codecdata_length) {
-	if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length) { // GOOD
-	  return -1;
-	}
-	return 1;
+int overflow12(int n) {
+    // not deleted by gcc or clang
+	return (n + 32 <= (unsigned)n? -1: 1); // BAD
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
index c1867e71c18..bc7b98fd3e2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
@@ -1,3 +1,4 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |

From 28056791a57d53a265cf6348d71e93a4aa60a4f8 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 14 Oct 2019 14:14:26 +0200
Subject: [PATCH 033/232] add .getALocalSource() when testing for
 lodash-members

---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql     | 6 +++---
 .../UseOfReturnlessFunction.expected                        | 1 +
 .../query-tests/Statements/UseOfReturnlessFunction/tst.js   | 4 ++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 61a485313e4..2d70cecb0d3 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -113,8 +113,8 @@ DataFlow::SourceNode array(DataFlow::TypeTracker t) {
 
 DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
 
-predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {
-  hasNonVoidCallbackMethod(call.getMethodName()) and
+predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
+  hasNonVoidCallbackMethod(call.getCalleeName()) and
   func = call.getAnArgument().getALocalSource().asExpr() and
   1 = count(DataFlow::Node arg | arg = call.getAnArgument() and arg.getALocalSource().asExpr() instanceof Function) and
   returnsVoid(func) and
@@ -123,7 +123,7 @@ predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {
   (
     call.getReceiver().getALocalSource() = array()
     or
-    call.getCalleeNode() instanceof LodashUnderscore::Member
+    call.getCalleeNode().getALocalSource() instanceof LodashUnderscore::Member
   )
 }
 
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
index 0dc283d5edc..98ae4e3696c 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
@@ -4,3 +4,4 @@
 | tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
 | tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
 | tst.js:76:12:76:46 | [1,2,3] ... n, 3)}) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:76:27:76:45 | n => {equals(n, 3)} | callback function |
+| tst.js:80:12:80:50 | filter( ...  3) } ) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:80:28:80:48 | x => {  ... x, 3) } | callback function |
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
index 1306c6e7f65..2b523223e91 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
@@ -75,4 +75,8 @@
 	
 	var foo = [1,2,3].filter(n => {equals(n, 3)}) // NOT OK!
 	console.log(foo);
+	
+	import { filter } from 'lodash'
+	var bar = filter([1,2,4], x => { equals(x, 3) } ) // NOT OK!
+	console.log(bar);
 })();
\ No newline at end of file

From f40c21bf6ea0f9e4bc25e8bfa4897eb6b1950333 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Mon, 14 Oct 2019 08:06:02 -0700
Subject: [PATCH 034/232] [CPP-434] Add release note.

---
 change-notes/1.23/analysis-cpp.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index 5a97e1347bb..24fa06e9bbf 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -9,6 +9,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
 | Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail.  This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
+| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | This query checks for when two signed values are added together to test for overflow (`a + b < a`), which is undefined behavior. |
 
 ## Changes to existing queries
 

From fb625c12ef7d5d00f33bb88437c3575515301a6b Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Wed, 16 Oct 2019 14:31:11 -0700
Subject: [PATCH 035/232] [CPP-434] Move SignedOverflowCheck test to
 BadAdditionOverflowCheck directory; add additional tests.

---
 .../BadAdditionOverflowCheck.expected              |  2 ++
 .../SignedOverflowCheck.cpp                        | 14 ++++++++++++++
 .../SignedOverflowCheck.expected                   |  3 +++
 .../SignedOverflowCheck.qlref                      |  0
 4 files changed, 19 insertions(+)
 rename cpp/ql/test/query-tests/Likely Bugs/Arithmetic/{SignedOverflowCheck => BadAdditionOverflowCheck}/SignedOverflowCheck.cpp (86%)
 rename cpp/ql/test/query-tests/Likely Bugs/Arithmetic/{SignedOverflowCheck => BadAdditionOverflowCheck}/SignedOverflowCheck.expected (57%)
 rename cpp/ql/test/query-tests/Likely Bugs/Arithmetic/{SignedOverflowCheck => BadAdditionOverflowCheck}/SignedOverflowCheck.qlref (100%)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.expected
index 9cb1aaa02af..920a1f820f8 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.expected	
@@ -1 +1,3 @@
+| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Bad overflow check. |
+| SignedOverflowCheck.cpp:113:12:113:66 | ... < ... | Bad overflow check. |
 | test.cpp:3:11:3:19 | ... < ... | Bad overflow check. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
similarity index 86%
rename from cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
rename to cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index 4396d857884..4ef9d83b63d 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -98,3 +98,17 @@ int overflow12(int n) {
     // not deleted by gcc or clang
 	return (n + 32 <= (unsigned)n? -1: 1); // BAD
 }
+
+bool multipleCasts(char x) {
+    // clang 9.0.0 -O2: deleted
+    // gcc 9.2 -O2: deleted
+    // msvc 19.22 /O2: deleted
+    return (int)(unsigned short)x + 2 < (int)(unsigned short)x; // BAD
+}
+
+bool multipleCasts2(char x) {
+    // clang 9.0.0 -O2: not deleted
+    // gcc 9.2 -O2: not deleted
+    // msvc 19.22 /O2: not deleted
+    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // GOOD [FALSE POSITIVE]
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
similarity index 57%
rename from cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
rename to cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
index bc7b98fd3e2..d4fd6334eaa 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
@@ -2,3 +2,6 @@
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:106:12:106:62 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:113:12:113:66 | ... < ... | Testing for signed overflow may produce undefined results. |
+| test.cpp:3:11:3:19 | ... < ... | Testing for signed overflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref
similarity index 100%
rename from cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.qlref
rename to cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref

From 70441edacf71f7c7a57a367ebb4448b031dfbf35 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Thu, 17 Oct 2019 16:41:17 -0700
Subject: [PATCH 036/232] [CPP-434] Additional test case; improve QHelp by
 including themes from the BadAdditionOverflowCheck QHelp.

---
 ...k-bad.cpp => SignedOverflowCheck-bad1.cpp} |  0
 .../Arithmetic/SignedOverflowCheck-good1.cpp  |  3 +++
 ...good.cpp => SignedOverflowCheck-good2.cpp} |  0
 .../Arithmetic/SignedOverflowCheck.qhelp      | 21 ++++++++++++++-----
 .../SignedOverflowCheck.cpp                   |  4 ++++
 5 files changed, 23 insertions(+), 5 deletions(-)
 rename cpp/ql/src/Likely Bugs/Arithmetic/{SignedOverflowCheck-bad.cpp => SignedOverflowCheck-bad1.cpp} (100%)
 create mode 100644 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp
 rename cpp/ql/src/Likely Bugs/Arithmetic/{SignedOverflowCheck-good.cpp => SignedOverflowCheck-good2.cpp} (100%)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad1.cpp
similarity index 100%
rename from cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad.cpp
rename to cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad1.cpp
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp
new file mode 100644
index 00000000000..d79d3ccbe93
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp	
@@ -0,0 +1,3 @@
+bool baf(unsigned short n1, unsigned short delta) {
+    return n1 + (unsigned)delta < n1; // GOOD
+}
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp
similarity index 100%
rename from cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good.cpp
rename to cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index c3147d23284..49fc8afb757 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -24,17 +24,28 @@ type is promoted to the larger type used in the addition and comparison,
 namely a <code>signed int</code>.  As a result, the entire expression is
 evaluated using <code>signed</code> values and its value is therefore undefined.
 </p>
-<sample src="SignedOverflowCheck-bad.cpp" />
+<sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
 In the following example, even though both <code>n</code> and <code>delta</code> 
 have been declared <code>unsigned short</code>, C/C++ type promotion rules 
 require that both parameters be promoted to the next bigger <code>signed</code>
-integer type (in this case <code>signed int</code>) before being added together
- so as to avoid overflows or underflows.  As a result, the entire expression is
-evaluated using <code>signed</code> values and its value is therefore undefined.
+integer type (in this case <code>signed int</code>) before being added together.  
+As a result, the entire expression is evaluated using <code>signed</code> values
+and its value is therefore undefined.  (Note, however, that the addition cannot
+overflow since we are adding two "small" <code>unsigned short</code> values.)
 </p>
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
+The following example builds upon the previous one.  Again, we have two
+<code>unsigned short</code> values getting promoted to a wider type.  However,
+since <code>delta</code> is explicitly cast to an <code>unsigned</code> type,
+<code>n1</code> (on both sides of the comparison) is promoted to
+<code>unsigned</code> as well.  Since we are now operating on
+<code>unsigned</code> values, the overflow check is defined and supported by
+standard C/C++.
+</p>
+<sample src="SignedOverflowCheck-good1.cpp" />
+<p>
 In the next example, a value of type <code>signed int</code> is
 added to a value of type <code>unsigned int</code>.  Because
 the types are of the same size, C/C++ promotion rules dictate that
@@ -42,7 +53,7 @@ the types are of the same size, C/C++ promotion rules dictate that
 operation. The entire expression is evaluated using <code>unsigned</code>
 values, which is allowed and defined behavior per the C/C++ standard.
 </p>
-<sample src="SignedOverflowCheck-good.cpp" />
+<sample src="SignedOverflowCheck-good2.cpp" />
 </example>
 <references>
 <li><a href="http://c-faq.com/expr/preservingrules.html">comp.lang.c FAQ list · Question 3.19 (Preserving rules)</a></li>
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index 4ef9d83b63d..febb45e8ecc 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -112,3 +112,7 @@ bool multipleCasts2(char x) {
     // msvc 19.22 /O2: not deleted
     return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // GOOD [FALSE POSITIVE]
 }
+
+int does_it_overflow(int n1, unsigned short delta) {
+    return n1 + (unsigned)delta < n1; // GOOD
+}

From 6772fa1352ca82568d384566df0d80033176c6f5 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Thu, 17 Oct 2019 17:21:14 -0700
Subject: [PATCH 037/232] [CPP-434] Reformat QHelp.

---
 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 49fc8afb757..741dda54a82 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -26,10 +26,10 @@ evaluated using <code>signed</code> values and its value is therefore undefined.
 </p>
 <sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
-In the following example, even though both <code>n</code> and <code>delta</code> 
-have been declared <code>unsigned short</code>, C/C++ type promotion rules 
+In the following example, even though both <code>n</code> and <code>delta</code>
+have been declared <code>unsigned short</code>, C/C++ type promotion rules
 require that both parameters be promoted to the next bigger <code>signed</code>
-integer type (in this case <code>signed int</code>) before being added together.  
+integer type (in this case <code>signed int</code>) before being added together.
 As a result, the entire expression is evaluated using <code>signed</code> values
 and its value is therefore undefined.  (Note, however, that the addition cannot
 overflow since we are adding two "small" <code>unsigned short</code> values.)

From 2e0244cda62deea17afe438c30e289d5c97913ca Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 21 Oct 2019 20:21:41 +0200
Subject: [PATCH 038/232] address review feedback

---
 .../ql/src/Expressions/ExprHasNoEffect.ql     |  1 +
 .../ql/src/Expressions/ExprHasNoEffect.qll    |  1 -
 .../src/Statements/UseOfReturnlessFunction.ql | 25 +++++++++++++++----
 .../UseOfReturnlessFunction.expected          |  8 +++---
 .../Statements/UseOfReturnlessFunction/tst.js |  3 +++
 5 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/javascript/ql/src/Expressions/ExprHasNoEffect.ql b/javascript/ql/src/Expressions/ExprHasNoEffect.ql
index 929e84616f0..917ab81a3e7 100644
--- a/javascript/ql/src/Expressions/ExprHasNoEffect.ql
+++ b/javascript/ql/src/Expressions/ExprHasNoEffect.ql
@@ -14,6 +14,7 @@
 
 import javascript
 import ExprHasNoEffect
+import semmle.javascript.RestrictedLocations
 
 
 from Expr e
diff --git a/javascript/ql/src/Expressions/ExprHasNoEffect.qll b/javascript/ql/src/Expressions/ExprHasNoEffect.qll
index 822bcbb26fa..bee980e5fd8 100644
--- a/javascript/ql/src/Expressions/ExprHasNoEffect.qll
+++ b/javascript/ql/src/Expressions/ExprHasNoEffect.qll
@@ -5,7 +5,6 @@
 import javascript
 import DOMProperties
 import semmle.javascript.frameworks.xUnit
-import semmle.javascript.RestrictedLocations
 
 /**
  * Holds if `e` appears in a syntactic context where its value is discarded.
diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 2d70cecb0d3..fe03c66cf4a 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -82,8 +82,19 @@ predicate alwaysThrows(Function f) {
   )
 }
 
+/**
+ * Holds if the last statement in the function is flagged by the js/useless-expression query.
+ */
+predicate alwaysHasNoEffect(Function f) {
+  exists(ReachableBasicBlock entry, DataFlow::Node noEffect |
+    entry = f.getEntryBB() and
+    hasNoEffect(noEffect.asExpr()) and
+    entry.dominates(noEffect.getBasicBlock())
+  )
+}
+
 predicate callToVoidFunction(DataFlow::CallNode call, Function func) {
-  not call.isIndefinite(_) and 
+  not call.isIncomplete() and 
   func = call.getACallee() and
   forall(Function f | f = call.getACallee() |
     returnsVoid(f) and not isStub(f) and not alwaysThrows(f)
@@ -113,6 +124,11 @@ DataFlow::SourceNode array(DataFlow::TypeTracker t) {
 
 DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
 
+/**
+ * Holds if `call` is an Array or Lodash method accepting a callback `func`,
+ * where the `call` expects a callback that returns an expression, 
+ * but `func` does return a value. 
+ */
 predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
   hasNonVoidCallbackMethod(call.getCalleeName()) and
   func = call.getAnArgument().getALocalSource().asExpr() and
@@ -132,15 +148,14 @@ where
   (
     callToVoidFunction(call, func) and 
     msg = "the $@ does not return anything, yet the return value is used." and
-    name = "function " + call.getCalleeName()
+    name = func.describe()
     or
     voidArrayCallback(call, func) and 
-    msg = "the $@ does not return anything, yet the return value from the call to " + call.getCalleeName() + "() is used." and
+    msg = "the $@ does not return anything, yet the return value from the call to " + call.getCalleeName() + " is used." and
     name = "callback function"
   ) and
   not benignContext(call.asExpr()) and
-  // Avoid double reporting from js/useless-expression
-  not hasNoEffect(func.getBodyStmt(func.getNumBodyStmt() - 1).(ExprStmt).getExpr()) and
+  not alwaysHasNoEffect(func) and
   // anonymous one-shot closure. Those are used in weird ways and we ignore them.
   not oneshotClosure(call.asExpr())
 select
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
index 98ae4e3696c..f23b702bf20 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
@@ -1,7 +1,7 @@
 | tst.js:20:17:20:33 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
 | tst.js:24:13:24:29 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
 | tst.js:30:20:30:36 | onlySideEffects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
-| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
-| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
-| tst.js:76:12:76:46 | [1,2,3] ... n, 3)}) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:76:27:76:45 | n => {equals(n, 3)} | callback function |
-| tst.js:80:12:80:50 | filter( ...  3) } ) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:80:28:80:48 | x => {  ... x, 3) } | callback function |
+| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function onlySideEffects |
+| tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | function onlySideEffects2 |
+| tst.js:76:12:76:46 | [1,2,3] ... n, 3)}) | the $@ does not return anything, yet the return value from the call to filter is used. | tst.js:76:27:76:45 | n => {equals(n, 3)} | callback function |
+| tst.js:80:12:80:50 | filter( ...  3) } ) | the $@ does not return anything, yet the return value from the call to filter is used. | tst.js:80:28:80:48 | x => {  ... x, 3) } | callback function |
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
index 2b523223e91..8a6a44707ed 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
@@ -79,4 +79,7 @@
 	import { filter } from 'lodash'
 	var bar = filter([1,2,4], x => { equals(x, 3) } ) // NOT OK!
 	console.log(bar);
+	
+	var baz = [1,2,3].filter(n => {n === 3}) // OK
+	console.log(baz);
 })();
\ No newline at end of file

From 22925189335f54dbd08c08cf1f4e20d178d94816 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Mon, 21 Oct 2019 17:04:46 -0700
Subject: [PATCH 039/232] [CPP-434] Change query so it flags overflows that
 were cast to `unsigned`.

---
 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql      | 4 ++--
 .../BadAdditionOverflowCheck/SignedOverflowCheck.cpp          | 2 +-
 .../BadAdditionOverflowCheck/SignedOverflowCheck.expected     | 2 ++
 .../Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp  | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 076e47df701..9ad9fa15727 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -15,8 +15,8 @@ import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 private predicate isSignedWithoutUnsignedCast(Expr e) {
-  e.getType().getUnspecifiedType().(IntegralType).isSigned() and
-  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
+  e.getType().getUnspecifiedType().(IntegralType).isSigned() /*and
+  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()*/
 }
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index febb45e8ecc..86757984326 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -39,7 +39,7 @@ bool shortShort2(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: not deleted
     // gcc 9.2 -O2: not deleted
     // msvc 19.22 /O2: not deleted
-	return (unsigned short)(n1 + delta) < n1; // GOOD
+	return (unsigned short)(n1 + delta) < n1; // BAD: n1 + delta overflow undefined
 }
 
 /* Distinguish `varname` from `ptr->varname` and `obj.varname` */
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
index d4fd6334eaa..9f35d51c4e3 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
@@ -1,7 +1,9 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:42:9:42:41 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:106:12:106:62 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:113:12:113:66 | ... < ... | Testing for signed overflow may produce undefined results. |
 | test.cpp:3:11:3:19 | ... < ... | Testing for signed overflow may produce undefined results. |
+| test.cpp:8:11:8:37 | ... < ... | Testing for signed overflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp
index 4669b709bc4..3c82f602cb9 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp	
@@ -5,7 +5,7 @@ bool checkOverflow1(unsigned short a, unsigned short b) {
 
 // Test for BadAdditionOverflowCheck.
 bool checkOverflow2(unsigned short a, unsigned short b) {
-  return ((unsigned short)(a + b) < a);  // GOOD: explicit cast
+  return ((unsigned short)(a + b) < a);  // BAD: a + b overflow undefined
 }
 
 // Test for PointlessSelfComparison.

From 9bc4c2d9a506a53568d1b1b68d1b065de0bbc8cc Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Mon, 21 Oct 2019 18:40:20 -0700
Subject: [PATCH 040/232] [CPP-434] Ctrl + Shift + F.

---
 .../src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql  | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 9ad9fa15727..387a9397e43 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -15,9 +15,13 @@ import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 private predicate isSignedWithoutUnsignedCast(Expr e) {
-  e.getType().getUnspecifiedType().(IntegralType).isSigned() /*and
-  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()*/
-}
+  e.getType().getUnspecifiedType().(IntegralType).isSigned()
+  /*
+   * and
+   *  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
+   */
+
+  }
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where

From db22916850202d1e159fc21e651670f501d29bc2 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 22 Oct 2019 09:37:19 +0200
Subject: [PATCH 041/232] fix the alwaysHasNoEffect predicate, and rename it to
 lastStatementHasNoEffect

---
 .../ql/src/Statements/UseOfReturnlessFunction.ql     | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index fe03c66cf4a..0f168e263dd 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -85,11 +85,11 @@ predicate alwaysThrows(Function f) {
 /**
  * Holds if the last statement in the function is flagged by the js/useless-expression query.
  */
-predicate alwaysHasNoEffect(Function f) {
-  exists(ReachableBasicBlock entry, DataFlow::Node noEffect |
-    entry = f.getEntryBB() and
-    hasNoEffect(noEffect.asExpr()) and
-    entry.dominates(noEffect.getBasicBlock())
+predicate lastStatementHasNoEffect(Function f) {
+  exists(DataFlow::Node noEffect |
+    noEffect.getContainer() = f and
+    hasNoEffect(noEffect.asExpr()) and 
+    not exists(noEffect.getASuccessor())
   )
 }
 
@@ -155,7 +155,7 @@ where
     name = "callback function"
   ) and
   not benignContext(call.asExpr()) and
-  not alwaysHasNoEffect(func) and
+  not lastStatementHasNoEffect(func) and
   // anonymous one-shot closure. Those are used in weird ways and we ignore them.
   not oneshotClosure(call.asExpr())
 select

From ad3185c5586efc622cea59956868e729a545ae4a Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 22 Oct 2019 10:33:05 +0200
Subject: [PATCH 042/232] simplify lastStatementHasNoEffect and use the
 control-flow to determine which statement is the last

---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 0f168e263dd..2fc3f01a560 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -86,11 +86,7 @@ predicate alwaysThrows(Function f) {
  * Holds if the last statement in the function is flagged by the js/useless-expression query.
  */
 predicate lastStatementHasNoEffect(Function f) {
-  exists(DataFlow::Node noEffect |
-    noEffect.getContainer() = f and
-    hasNoEffect(noEffect.asExpr()) and 
-    not exists(noEffect.getASuccessor())
-  )
+  hasNoEffect(f.getExit().getAPredecessor())
 }
 
 predicate callToVoidFunction(DataFlow::CallNode call, Function func) {

From 06f63c54779ddb2232dceccb071d1189a055a585 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 22 Oct 2019 13:06:33 -0700
Subject: [PATCH 043/232] [CPP-434] Incremental changes to
 SignedOverflowCheck.cpp test suite.

---
 .../BadAdditionOverflowCheck/SignedOverflowCheck.cpp  | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index 86757984326..af6593dc0c3 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -32,14 +32,14 @@ bool shortShort1(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // BAD
+	return n1 + delta < n1; // BAD: will always be false
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: not deleted
     // gcc 9.2 -O2: not deleted
     // msvc 19.22 /O2: not deleted
-	return (unsigned short)(n1 + delta) < n1; // BAD: n1 + delta overflow undefined
+	return (unsigned short)(n1 + delta) < n1; // GOOD
 }
 
 /* Distinguish `varname` from `ptr->varname` and `obj.varname` */
@@ -110,9 +110,14 @@ bool multipleCasts2(char x) {
     // clang 9.0.0 -O2: not deleted
     // gcc 9.2 -O2: not deleted
     // msvc 19.22 /O2: not deleted
-    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // GOOD [FALSE POSITIVE]
+    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // BAD
 }
 
 int does_it_overflow(int n1, unsigned short delta) {
     return n1 + (unsigned)delta < n1; // GOOD
 }
+
+int overflow12b(int n) {
+    // not deleted by gcc or clang
+	return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // BAD
+}

From ad5aa182dfb0b4e8a6342c66c527a4265aae6d3b Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 22 Oct 2019 15:21:30 -0700
Subject: [PATCH 044/232] [CPP-434] When analyzing overflow, discard any
 explicit casts.           Use the simple range analysis library to detect
 which           additions may in fact overflow.

---
 .../Likely Bugs/Arithmetic/SignedOverflowCheck.ql | 15 ++++-----------
 .../SignedOverflowCheck.cpp                       | 12 ++++++------
 .../SignedOverflowCheck.expected                  |  7 +------
 .../Arithmetic/BadAdditionOverflowCheck/test.cpp  |  4 ++--
 4 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 387a9397e43..f1b65dd4a96 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -12,16 +12,8 @@
  */
 
 import cpp
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-
-private predicate isSignedWithoutUnsignedCast(Expr e) {
-  e.getType().getUnspecifiedType().(IntegralType).isSigned()
-  /*
-   * and
-   *  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
-   */
-
-  }
+private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+private import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
@@ -29,5 +21,6 @@ where
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
   globalValueNumber(va1) = globalValueNumber(va2) and
-  isSignedWithoutUnsignedCast(add)
+  add.getType().getUnspecifiedType().(IntegralType).isSigned() and
+  exprMightOverflowPositively(add)
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index af6593dc0c3..72767c54aab 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // BAD: will always be false
+	return n1 + delta < n1; // GOOD: always false, but will never overflow
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
@@ -96,28 +96,28 @@ int checkOverflow4(unsigned int ioff, C c) {
 
 int overflow12(int n) {
     // not deleted by gcc or clang
-	return (n + 32 <= (unsigned)n? -1: 1); // BAD
+	return (n + 32 <= (unsigned)n? -1: 1); // BAD: n + 32 can overflow
 }
 
 bool multipleCasts(char x) {
     // clang 9.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: deleted
-    return (int)(unsigned short)x + 2 < (int)(unsigned short)x; // BAD
+    return (int)(unsigned short)x + 2 < (int)(unsigned short)x; // GOOD: cannot overflow
 }
 
 bool multipleCasts2(char x) {
     // clang 9.0.0 -O2: not deleted
     // gcc 9.2 -O2: not deleted
     // msvc 19.22 /O2: not deleted
-    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // BAD
+    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // GOOD: cannot overflow
 }
 
 int does_it_overflow(int n1, unsigned short delta) {
-    return n1 + (unsigned)delta < n1; // GOOD
+    return n1 + (unsigned)delta < n1; // GOOD: everything converted to unsigned
 }
 
 int overflow12b(int n) {
     // not deleted by gcc or clang
-	return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // BAD
+	return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // BAD: n + 32 may overflow
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
index 9f35d51c4e3..eaf6a7ac1e4 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
@@ -1,9 +1,4 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
-| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |
-| SignedOverflowCheck.cpp:42:9:42:41 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |
-| SignedOverflowCheck.cpp:106:12:106:62 | ... < ... | Testing for signed overflow may produce undefined results. |
-| SignedOverflowCheck.cpp:113:12:113:66 | ... < ... | Testing for signed overflow may produce undefined results. |
-| test.cpp:3:11:3:19 | ... < ... | Testing for signed overflow may produce undefined results. |
-| test.cpp:8:11:8:37 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:122:10:122:42 | ... <= ... | Testing for signed overflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp
index 3c82f602cb9..e36956f9c69 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp	
@@ -1,11 +1,11 @@
 // Test for BadAdditionOverflowCheck.
 bool checkOverflow1(unsigned short a, unsigned short b) {
-  return (a + b < a);  // BAD: a + b is automatically promoted to int.
+  return (a + b < a);  // BAD: comparison always false (due to promotion).
 }
 
 // Test for BadAdditionOverflowCheck.
 bool checkOverflow2(unsigned short a, unsigned short b) {
-  return ((unsigned short)(a + b) < a);  // BAD: a + b overflow undefined
+  return ((unsigned short)(a + b) < a);  // GOOD
 }
 
 // Test for PointlessSelfComparison.

From 6eb0f0709ae6e191a15c831d0708c9f187580d5d Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Tue, 22 Oct 2019 17:28:35 -0700
Subject: [PATCH 045/232] [CPP-434] Update Qhelp.

---
 .../Arithmetic/SignedOverflowCheck-bad2.cpp   |  3 ++-
 .../Arithmetic/SignedOverflowCheck.qhelp      | 20 ++++++++++---------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp
index 293a8c6e49e..d4d9cd75393 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp	
@@ -1,3 +1,4 @@
 bool bar(unsigned short n1, unsigned short delta) {
-    return n1 + delta < n1; // BAD
+    // NB: Comparison is always false
+    return n1 + delta < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 741dda54a82..9b9d358dea2 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -22,17 +22,19 @@ In the following example, even though <code>delta</code> has been declared
 <code>unsigned short</code>, C/C++ type promotion rules require that its
 type is promoted to the larger type used in the addition and comparison,
 namely a <code>signed int</code>.  As a result, the entire expression is
-evaluated using <code>signed</code> values and its value is therefore undefined.
+evaluated using <code>signed</code> integers and may overflow, and hence
+is undefined.
 </p>
 <sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
 In the following example, even though both <code>n</code> and <code>delta</code>
-have been declared <code>unsigned short</code>, C/C++ type promotion rules
-require that both parameters be promoted to the next bigger <code>signed</code>
-integer type (in this case <code>signed int</code>) before being added together.
-As a result, the entire expression is evaluated using <code>signed</code> values
-and its value is therefore undefined.  (Note, however, that the addition cannot
-overflow since we are adding two "small" <code>unsigned short</code> values.)
+have been declared <code>unsigned short</code>, both are promoted to 
+<code>signed int</code> prior to addition.  Because we started out with the
+narrower <code>short</code> type, the addition is guaranteed not to overflow
+and is therefore defined.  But the fact that <code>n1 + delta</code> never 
+overflows means that the condition <code>n1 + delta &lt; n1</code> will never
+hold true, which likely is not what the programmer intended. (see also the
+<code>BadArithmeticOverflow.Check.ql</code> query).
 </p>
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
@@ -40,7 +42,7 @@ The following example builds upon the previous one.  Again, we have two
 <code>unsigned short</code> values getting promoted to a wider type.  However,
 since <code>delta</code> is explicitly cast to an <code>unsigned</code> type,
 <code>n1</code> (on both sides of the comparison) is promoted to
-<code>unsigned</code> as well.  Since we are now operating on
+<code>unsigned int</code> as well.  Since we are now operating on
 <code>unsigned</code> values, the overflow check is defined and supported by
 standard C/C++.
 </p>
@@ -48,7 +50,7 @@ standard C/C++.
 <p>
 In the next example, a value of type <code>signed int</code> is
 added to a value of type <code>unsigned int</code>.  Because
-the types are of the same size, C/C++ promotion rules dictate that
+the types are of the same size, C/C++ conversion rules dictate that
 <code>unsigned int</code> is chosen as the overall type of the addition
 operation. The entire expression is evaluated using <code>unsigned</code>
 values, which is allowed and defined behavior per the C/C++ standard.

From 7a6ec83572aa387e042328328b2607148dc19410 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Wed, 23 Oct 2019 11:50:58 +0200
Subject: [PATCH 046/232] C++: No CopyValue for immediately discarded exprs

Expressions like the `e` in `e;` or `e, e2`, whose result is immediately
discarded, should not get a synthetic `CopyValue`. This removes a lot of
redundancy from the IR.

To prevent these expressions from being confused with the expressions
from which they get their result, the predicate
`getInstructionConvertedResultExpression` now suppresses results for
expressions that don't produce their own result. This should fix the
mapping between expressions and IR data-flow nodes.
---
 .../raw/internal/IRConstruction.qll           |   11 +-
 .../raw/internal/TranslatedExpr.qll           |   64 +-
 .../ir/escape/points_to.expected              |   19 -
 .../test/library-tests/ir/ir/raw_ir.expected  | 2120 ++++++++---------
 .../ir/ssa/aliased_ssa_ir.expected            |   83 +-
 .../ir/ssa/unaliased_ssa_ir.expected          |   83 +-
 .../syntax-zoo/aliased_ssa_sanity.expected    |    2 +-
 .../syntax-zoo/raw_sanity.expected            |   13 +-
 .../syntax-zoo/unaliased_ssa_sanity.expected  |    2 +-
 9 files changed, 1094 insertions(+), 1303 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
index 314eda43a4c..d0f70f61498 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
@@ -49,20 +49,23 @@ private module Cached {
   Expr getInstructionConvertedResultExpression(Instruction instruction) {
     exists(TranslatedExpr translatedExpr |
       translatedExpr = getTranslatedExpr(result) and
-      instruction = translatedExpr.getResult()
+      instruction = translatedExpr.getResult() and
+      // Only associate `instruction` with this expression if the translated
+      // expression actually produced the instruction; not if it merely
+      // forwarded the result of another translated expression.
+      instruction = translatedExpr.getInstruction(_)
     )
   }
 
   cached
   Expr getInstructionUnconvertedResultExpression(Instruction instruction) {
-    exists(Expr converted, TranslatedExpr translatedExpr |
+    exists(Expr converted |
       result = converted.(Conversion).getExpr+()
       or
       result = converted
     |
       not result instanceof Conversion and
-      translatedExpr = getTranslatedExpr(converted) and
-      instruction = translatedExpr.getResult()
+      converted = getInstructionConvertedResultExpression(instruction)
     )
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index fbecb10cd24..7b9417b570d 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -2547,27 +2547,45 @@ class TranslatedErrorExpr extends TranslatedSingleInstructionExpr {
 // This should ideally be a dispatch predicate on TranslatedNonConstantExpr,
 // but it doesn't look monotonic to QL.
 predicate exprNeedsCopyIfNotLoaded(Expr expr) {
-  expr instanceof AssignExpr
-  or
-  expr instanceof AssignOperation and
-  not expr.isPRValueCategory() // is C++
-  or
-  expr instanceof PrefixCrementOperation and
-  not expr.isPRValueCategory() // is C++
-  or
-  expr instanceof PointerDereferenceExpr
-  or
-  expr instanceof AddressOfExpr
-  or
-  expr instanceof BuiltInOperationBuiltInAddressOf
-  or
-  // No case for ParenthesisExpr to avoid getting too many instructions
-  expr instanceof ReferenceDereferenceExpr
-  or
-  expr instanceof ReferenceToExpr
-  or
-  expr instanceof CommaExpr
-  or
-  expr instanceof ConditionDeclExpr
-  // TODO: simplify TranslatedStmtExpr too
+  (
+    expr instanceof AssignExpr
+    or
+    expr instanceof AssignOperation and
+    not expr.isPRValueCategory() // is C++
+    or
+    expr instanceof PrefixCrementOperation and
+    not expr.isPRValueCategory() // is C++
+    or
+    expr instanceof PointerDereferenceExpr
+    or
+    expr instanceof AddressOfExpr
+    or
+    expr instanceof BuiltInOperationBuiltInAddressOf
+    or
+    // No case for ParenthesisExpr to avoid getting too many instructions
+    expr instanceof ReferenceDereferenceExpr
+    or
+    expr instanceof ReferenceToExpr
+    or
+    expr instanceof CommaExpr
+    or
+    expr instanceof ConditionDeclExpr
+    // TODO: simplify TranslatedStmtExpr too
+  ) and
+  not exprImmediatelyDiscarded(expr)
+}
+
+/**
+ * Holds if `expr` is immediately discarded. Such expressions do not need a
+ * `CopyValue` because it's unlikely that anyone is interested in their value.
+ */
+private predicate exprImmediatelyDiscarded(Expr expr) {
+  exists(ExprStmt s |
+    s = expr.getParent() and
+    not exists(StmtExpr se | s = se.getStmt().(Block).getLastStmt())
+  )
+  or
+  exists(CommaExpr c | c.getLeftOperand() = expr)
+  or
+  exists(ForStmt for | for.getUpdate() = expr)
 }
diff --git a/cpp/ql/test/library-tests/ir/escape/points_to.expected b/cpp/ql/test/library-tests/ir/escape/points_to.expected
index e6fefda7bb5..c58d97f7988 100644
--- a/cpp/ql/test/library-tests/ir/escape/points_to.expected
+++ b/cpp/ql/test/library-tests/ir/escape/points_to.expected
@@ -1,24 +1,14 @@
-| escape.cpp:108:5:108:11 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:109:5:109:13 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:110:5:110:19 | CopyValue | no_result+0:0 | no_result+0:0 |
-| escape.cpp:111:5:111:21 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:111:18:111:21 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:114:5:114:8 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:115:5:115:29 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:115:19:115:28 | PointerAdd[4] | no_+0:0 | no_+0:0 |
 | escape.cpp:115:20:115:23 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:116:5:116:29 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:116:19:116:28 | PointerSub[4] | no_+0:0 | no_+0:0 |
 | escape.cpp:116:20:116:23 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:117:5:117:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:117:19:117:26 | PointerAdd[4] | no_+0:0 | no_+0:0 |
 | escape.cpp:117:23:117:26 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:118:9:118:12 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:120:12:120:15 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:123:14:123:17 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:124:9:124:12 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:124:15:124:18 | CopyValue | no_+0:0 | no_+0:0 |
-| escape.cpp:124:21:124:24 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:127:9:127:12 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:129:12:129:15 | CopyValue | no_+0:0 | no_+0:0 |
 | escape.cpp:134:5:134:18 | Convert | no_Array+0:0 | no_Array+0:0 |
@@ -27,38 +17,31 @@
 | escape.cpp:135:5:135:15 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:136:5:136:15 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:136:7:136:14 | Convert | no_Array+0:0 | no_Array+0:0 |
-| escape.cpp:137:5:137:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:137:17:137:24 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:137:17:137:27 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
-| escape.cpp:138:5:138:27 | CopyValue | no_result+0:0 | no_result+0:0 |
 | escape.cpp:138:17:138:27 | PointerAdd[4] | no_Array+20:0 | no_Array+20:0 |
 | escape.cpp:138:19:138:26 | Convert | no_Array+0:0 | no_Array+0:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[x] | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:140:21:140:32 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:141:27:141:27 | FieldAddress[x] | no_Point+0:0 | no_Point+0:0 |
-| escape.cpp:142:5:142:21 | CopyValue | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:142:14:142:14 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:143:19:143:27 | CopyValue | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:143:31:143:31 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
-| escape.cpp:144:5:144:25 | CopyValue | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:144:6:144:14 | CopyValue | no_Point+0:0 | no_Point+0:0 |
 | escape.cpp:144:18:144:18 | FieldAddress[y] | no_Point+4:0 | no_Point+4:0 |
 | escape.cpp:145:20:145:30 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:145:30:145:30 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:5:146:18 | CopyValue | no_Point+8:0 | no_Point+8:0 |
-| escape.cpp:146:5:146:25 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:7:146:17 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:17:146:17 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:149:5:149:14 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:149:5:149:14 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
-| escape.cpp:149:5:149:20 | CopyValue | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:149:16:149:16 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:18:150:27 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:18:150:27 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:29:150:29 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:151:5:151:14 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
-| escape.cpp:151:5:151:21 | CopyValue | no_Derived+16:0 | no_Derived+16:0 |
 | escape.cpp:151:16:151:17 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
 | escape.cpp:152:19:152:28 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
 | escape.cpp:152:30:152:31 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
@@ -97,9 +80,7 @@
 | escape.cpp:217:14:217:16 | CopyValue | c2+0:0 | c2+0:0 |
 | escape.cpp:221:8:221:19 | Call | none | c3+0:0 |
 | escape.cpp:225:17:225:28 | Call | none | c4+0:0 |
-| escape.cpp:247:2:247:27 | CopyValue | no_condTemp+0:0 | no_condTemp+0:0 |
 | escape.cpp:247:2:247:27 | Store | condEscape1+0:0 | condEscape1+0:0 |
 | escape.cpp:247:16:247:27 | CopyValue | condEscape1+0:0 | condEscape1+0:0 |
-| escape.cpp:249:9:249:34 | CopyValue | no_condTemp+0:0 | no_condTemp+0:0 |
 | escape.cpp:249:9:249:34 | Store | condEscape2+0:0 | condEscape2+0:0 |
 | escape.cpp:249:23:249:34 | CopyValue | condEscape2+0:0 | condEscape2+0:0 |
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 9c80e889a02..d7c144f7181 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -66,11 +66,10 @@ bad_asts.cpp:
 #-----|     r0_10(error)       = Load                    : &:r0_9, ~mu0_2
 #   33|     r0_11(glval<int>)  = VariableAddress[x]      : 
 #   33|     mu0_12(int)        = Store                   : &:r0_11, r0_10
-#   33|     r0_13(glval<int>)  = CopyValue               : r0_11
-#   34|     v0_14(void)        = NoOp                    : 
-#   30|     v0_15(void)        = ReturnVoid              : 
-#   30|     v0_16(void)        = UnmodeledUse            : mu*
-#   30|     v0_17(void)        = ExitFunction            : 
+#   34|     v0_13(void)        = NoOp                    : 
+#   30|     v0_14(void)        = ReturnVoid              : 
+#   30|     v0_15(void)        = UnmodeledUse            : mu*
+#   30|     v0_16(void)        = ExitFunction            : 
 
 clang.cpp:
 #    5| int* globalIntAddress()
@@ -202,20 +201,18 @@ ir.cpp:
 #   46|     r0_15(short)        = Convert             : r0_14
 #   46|     r0_16(glval<short>) = VariableAddress[y]  : 
 #   46|     mu0_17(short)       = Store               : &:r0_16, r0_15
-#   46|     r0_18(glval<short>) = CopyValue           : r0_16
-#   47|     r0_19(glval<int>)   = VariableAddress[x]  : 
-#   47|     r0_20(int)          = Load                : &:r0_19, ~mu0_2
-#   47|     r0_21(glval<short>) = VariableAddress[y]  : 
-#   47|     r0_22(short)        = Load                : &:r0_21, ~mu0_2
-#   47|     r0_23(int)          = Convert             : r0_22
-#   47|     r0_24(int)          = Mul                 : r0_20, r0_23
-#   47|     r0_25(glval<int>)   = VariableAddress[x]  : 
-#   47|     mu0_26(int)         = Store               : &:r0_25, r0_24
-#   47|     r0_27(glval<int>)   = CopyValue           : r0_25
-#   48|     v0_28(void)         = NoOp                : 
-#   43|     v0_29(void)         = ReturnVoid          : 
-#   43|     v0_30(void)         = UnmodeledUse        : mu*
-#   43|     v0_31(void)         = ExitFunction        : 
+#   47|     r0_18(glval<int>)   = VariableAddress[x]  : 
+#   47|     r0_19(int)          = Load                : &:r0_18, ~mu0_2
+#   47|     r0_20(glval<short>) = VariableAddress[y]  : 
+#   47|     r0_21(short)        = Load                : &:r0_20, ~mu0_2
+#   47|     r0_22(int)          = Convert             : r0_21
+#   47|     r0_23(int)          = Mul                 : r0_19, r0_22
+#   47|     r0_24(glval<int>)   = VariableAddress[x]  : 
+#   47|     mu0_25(int)         = Store               : &:r0_24, r0_23
+#   48|     v0_26(void)         = NoOp                : 
+#   43|     v0_27(void)         = ReturnVoid          : 
+#   43|     v0_28(void)         = UnmodeledUse        : mu*
+#   43|     v0_29(void)         = ExitFunction        : 
 
 #   50| void IntegerOps(int, int)
 #   50|   Block 0
@@ -235,185 +232,160 @@ ir.cpp:
 #   53|     r0_13(int)         = Add                    : r0_10, r0_12
 #   53|     r0_14(glval<int>)  = VariableAddress[z]     : 
 #   53|     mu0_15(int)        = Store                  : &:r0_14, r0_13
-#   53|     r0_16(glval<int>)  = CopyValue              : r0_14
-#   54|     r0_17(glval<int>)  = VariableAddress[x]     : 
-#   54|     r0_18(int)         = Load                   : &:r0_17, ~mu0_2
-#   54|     r0_19(glval<int>)  = VariableAddress[y]     : 
-#   54|     r0_20(int)         = Load                   : &:r0_19, ~mu0_2
-#   54|     r0_21(int)         = Sub                    : r0_18, r0_20
-#   54|     r0_22(glval<int>)  = VariableAddress[z]     : 
-#   54|     mu0_23(int)        = Store                  : &:r0_22, r0_21
-#   54|     r0_24(glval<int>)  = CopyValue              : r0_22
-#   55|     r0_25(glval<int>)  = VariableAddress[x]     : 
+#   54|     r0_16(glval<int>)  = VariableAddress[x]     : 
+#   54|     r0_17(int)         = Load                   : &:r0_16, ~mu0_2
+#   54|     r0_18(glval<int>)  = VariableAddress[y]     : 
+#   54|     r0_19(int)         = Load                   : &:r0_18, ~mu0_2
+#   54|     r0_20(int)         = Sub                    : r0_17, r0_19
+#   54|     r0_21(glval<int>)  = VariableAddress[z]     : 
+#   54|     mu0_22(int)        = Store                  : &:r0_21, r0_20
+#   55|     r0_23(glval<int>)  = VariableAddress[x]     : 
+#   55|     r0_24(int)         = Load                   : &:r0_23, ~mu0_2
+#   55|     r0_25(glval<int>)  = VariableAddress[y]     : 
 #   55|     r0_26(int)         = Load                   : &:r0_25, ~mu0_2
-#   55|     r0_27(glval<int>)  = VariableAddress[y]     : 
-#   55|     r0_28(int)         = Load                   : &:r0_27, ~mu0_2
-#   55|     r0_29(int)         = Mul                    : r0_26, r0_28
-#   55|     r0_30(glval<int>)  = VariableAddress[z]     : 
-#   55|     mu0_31(int)        = Store                  : &:r0_30, r0_29
-#   55|     r0_32(glval<int>)  = CopyValue              : r0_30
-#   56|     r0_33(glval<int>)  = VariableAddress[x]     : 
-#   56|     r0_34(int)         = Load                   : &:r0_33, ~mu0_2
-#   56|     r0_35(glval<int>)  = VariableAddress[y]     : 
-#   56|     r0_36(int)         = Load                   : &:r0_35, ~mu0_2
-#   56|     r0_37(int)         = Div                    : r0_34, r0_36
-#   56|     r0_38(glval<int>)  = VariableAddress[z]     : 
-#   56|     mu0_39(int)        = Store                  : &:r0_38, r0_37
-#   56|     r0_40(glval<int>)  = CopyValue              : r0_38
-#   57|     r0_41(glval<int>)  = VariableAddress[x]     : 
-#   57|     r0_42(int)         = Load                   : &:r0_41, ~mu0_2
-#   57|     r0_43(glval<int>)  = VariableAddress[y]     : 
-#   57|     r0_44(int)         = Load                   : &:r0_43, ~mu0_2
-#   57|     r0_45(int)         = Rem                    : r0_42, r0_44
-#   57|     r0_46(glval<int>)  = VariableAddress[z]     : 
-#   57|     mu0_47(int)        = Store                  : &:r0_46, r0_45
-#   57|     r0_48(glval<int>)  = CopyValue              : r0_46
-#   59|     r0_49(glval<int>)  = VariableAddress[x]     : 
-#   59|     r0_50(int)         = Load                   : &:r0_49, ~mu0_2
-#   59|     r0_51(glval<int>)  = VariableAddress[y]     : 
-#   59|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
-#   59|     r0_53(int)         = BitAnd                 : r0_50, r0_52
-#   59|     r0_54(glval<int>)  = VariableAddress[z]     : 
-#   59|     mu0_55(int)        = Store                  : &:r0_54, r0_53
-#   59|     r0_56(glval<int>)  = CopyValue              : r0_54
-#   60|     r0_57(glval<int>)  = VariableAddress[x]     : 
-#   60|     r0_58(int)         = Load                   : &:r0_57, ~mu0_2
-#   60|     r0_59(glval<int>)  = VariableAddress[y]     : 
-#   60|     r0_60(int)         = Load                   : &:r0_59, ~mu0_2
-#   60|     r0_61(int)         = BitOr                  : r0_58, r0_60
-#   60|     r0_62(glval<int>)  = VariableAddress[z]     : 
-#   60|     mu0_63(int)        = Store                  : &:r0_62, r0_61
-#   60|     r0_64(glval<int>)  = CopyValue              : r0_62
-#   61|     r0_65(glval<int>)  = VariableAddress[x]     : 
-#   61|     r0_66(int)         = Load                   : &:r0_65, ~mu0_2
-#   61|     r0_67(glval<int>)  = VariableAddress[y]     : 
-#   61|     r0_68(int)         = Load                   : &:r0_67, ~mu0_2
-#   61|     r0_69(int)         = BitXor                 : r0_66, r0_68
-#   61|     r0_70(glval<int>)  = VariableAddress[z]     : 
-#   61|     mu0_71(int)        = Store                  : &:r0_70, r0_69
-#   61|     r0_72(glval<int>)  = CopyValue              : r0_70
-#   63|     r0_73(glval<int>)  = VariableAddress[x]     : 
-#   63|     r0_74(int)         = Load                   : &:r0_73, ~mu0_2
-#   63|     r0_75(glval<int>)  = VariableAddress[y]     : 
-#   63|     r0_76(int)         = Load                   : &:r0_75, ~mu0_2
-#   63|     r0_77(int)         = ShiftLeft              : r0_74, r0_76
-#   63|     r0_78(glval<int>)  = VariableAddress[z]     : 
-#   63|     mu0_79(int)        = Store                  : &:r0_78, r0_77
-#   63|     r0_80(glval<int>)  = CopyValue              : r0_78
-#   64|     r0_81(glval<int>)  = VariableAddress[x]     : 
-#   64|     r0_82(int)         = Load                   : &:r0_81, ~mu0_2
-#   64|     r0_83(glval<int>)  = VariableAddress[y]     : 
-#   64|     r0_84(int)         = Load                   : &:r0_83, ~mu0_2
-#   64|     r0_85(int)         = ShiftRight             : r0_82, r0_84
-#   64|     r0_86(glval<int>)  = VariableAddress[z]     : 
-#   64|     mu0_87(int)        = Store                  : &:r0_86, r0_85
-#   64|     r0_88(glval<int>)  = CopyValue              : r0_86
-#   66|     r0_89(glval<int>)  = VariableAddress[x]     : 
-#   66|     r0_90(int)         = Load                   : &:r0_89, ~mu0_2
-#   66|     r0_91(glval<int>)  = VariableAddress[z]     : 
-#   66|     mu0_92(int)        = Store                  : &:r0_91, r0_90
-#   66|     r0_93(glval<int>)  = CopyValue              : r0_91
-#   68|     r0_94(glval<int>)  = VariableAddress[x]     : 
-#   68|     r0_95(int)         = Load                   : &:r0_94, ~mu0_2
-#   68|     r0_96(glval<int>)  = VariableAddress[z]     : 
-#   68|     r0_97(int)         = Load                   : &:r0_96, ~mu0_2
-#   68|     r0_98(int)         = Add                    : r0_97, r0_95
-#   68|     mu0_99(int)        = Store                  : &:r0_96, r0_98
-#   68|     r0_100(glval<int>) = CopyValue              : r0_96
-#   69|     r0_101(glval<int>) = VariableAddress[x]     : 
-#   69|     r0_102(int)        = Load                   : &:r0_101, ~mu0_2
-#   69|     r0_103(glval<int>) = VariableAddress[z]     : 
-#   69|     r0_104(int)        = Load                   : &:r0_103, ~mu0_2
-#   69|     r0_105(int)        = Sub                    : r0_104, r0_102
-#   69|     mu0_106(int)       = Store                  : &:r0_103, r0_105
-#   69|     r0_107(glval<int>) = CopyValue              : r0_103
-#   70|     r0_108(glval<int>) = VariableAddress[x]     : 
-#   70|     r0_109(int)        = Load                   : &:r0_108, ~mu0_2
-#   70|     r0_110(glval<int>) = VariableAddress[z]     : 
-#   70|     r0_111(int)        = Load                   : &:r0_110, ~mu0_2
-#   70|     r0_112(int)        = Mul                    : r0_111, r0_109
-#   70|     mu0_113(int)       = Store                  : &:r0_110, r0_112
-#   70|     r0_114(glval<int>) = CopyValue              : r0_110
-#   71|     r0_115(glval<int>) = VariableAddress[x]     : 
-#   71|     r0_116(int)        = Load                   : &:r0_115, ~mu0_2
-#   71|     r0_117(glval<int>) = VariableAddress[z]     : 
-#   71|     r0_118(int)        = Load                   : &:r0_117, ~mu0_2
-#   71|     r0_119(int)        = Div                    : r0_118, r0_116
-#   71|     mu0_120(int)       = Store                  : &:r0_117, r0_119
-#   71|     r0_121(glval<int>) = CopyValue              : r0_117
-#   72|     r0_122(glval<int>) = VariableAddress[x]     : 
-#   72|     r0_123(int)        = Load                   : &:r0_122, ~mu0_2
-#   72|     r0_124(glval<int>) = VariableAddress[z]     : 
-#   72|     r0_125(int)        = Load                   : &:r0_124, ~mu0_2
-#   72|     r0_126(int)        = Rem                    : r0_125, r0_123
-#   72|     mu0_127(int)       = Store                  : &:r0_124, r0_126
-#   72|     r0_128(glval<int>) = CopyValue              : r0_124
-#   74|     r0_129(glval<int>) = VariableAddress[x]     : 
-#   74|     r0_130(int)        = Load                   : &:r0_129, ~mu0_2
-#   74|     r0_131(glval<int>) = VariableAddress[z]     : 
-#   74|     r0_132(int)        = Load                   : &:r0_131, ~mu0_2
-#   74|     r0_133(int)        = BitAnd                 : r0_132, r0_130
-#   74|     mu0_134(int)       = Store                  : &:r0_131, r0_133
-#   74|     r0_135(glval<int>) = CopyValue              : r0_131
-#   75|     r0_136(glval<int>) = VariableAddress[x]     : 
-#   75|     r0_137(int)        = Load                   : &:r0_136, ~mu0_2
-#   75|     r0_138(glval<int>) = VariableAddress[z]     : 
-#   75|     r0_139(int)        = Load                   : &:r0_138, ~mu0_2
-#   75|     r0_140(int)        = BitOr                  : r0_139, r0_137
-#   75|     mu0_141(int)       = Store                  : &:r0_138, r0_140
-#   75|     r0_142(glval<int>) = CopyValue              : r0_138
-#   76|     r0_143(glval<int>) = VariableAddress[x]     : 
-#   76|     r0_144(int)        = Load                   : &:r0_143, ~mu0_2
-#   76|     r0_145(glval<int>) = VariableAddress[z]     : 
-#   76|     r0_146(int)        = Load                   : &:r0_145, ~mu0_2
-#   76|     r0_147(int)        = BitXor                 : r0_146, r0_144
-#   76|     mu0_148(int)       = Store                  : &:r0_145, r0_147
-#   76|     r0_149(glval<int>) = CopyValue              : r0_145
-#   78|     r0_150(glval<int>) = VariableAddress[x]     : 
-#   78|     r0_151(int)        = Load                   : &:r0_150, ~mu0_2
-#   78|     r0_152(glval<int>) = VariableAddress[z]     : 
-#   78|     r0_153(int)        = Load                   : &:r0_152, ~mu0_2
-#   78|     r0_154(int)        = ShiftLeft              : r0_153, r0_151
-#   78|     mu0_155(int)       = Store                  : &:r0_152, r0_154
-#   78|     r0_156(glval<int>) = CopyValue              : r0_152
-#   79|     r0_157(glval<int>) = VariableAddress[x]     : 
-#   79|     r0_158(int)        = Load                   : &:r0_157, ~mu0_2
-#   79|     r0_159(glval<int>) = VariableAddress[z]     : 
-#   79|     r0_160(int)        = Load                   : &:r0_159, ~mu0_2
-#   79|     r0_161(int)        = ShiftRight             : r0_160, r0_158
-#   79|     mu0_162(int)       = Store                  : &:r0_159, r0_161
-#   79|     r0_163(glval<int>) = CopyValue              : r0_159
-#   81|     r0_164(glval<int>) = VariableAddress[x]     : 
-#   81|     r0_165(int)        = Load                   : &:r0_164, ~mu0_2
-#   81|     r0_166(int)        = CopyValue              : r0_165
-#   81|     r0_167(glval<int>) = VariableAddress[z]     : 
-#   81|     mu0_168(int)       = Store                  : &:r0_167, r0_166
-#   81|     r0_169(glval<int>) = CopyValue              : r0_167
-#   82|     r0_170(glval<int>) = VariableAddress[x]     : 
-#   82|     r0_171(int)        = Load                   : &:r0_170, ~mu0_2
-#   82|     r0_172(int)        = Negate                 : r0_171
-#   82|     r0_173(glval<int>) = VariableAddress[z]     : 
-#   82|     mu0_174(int)       = Store                  : &:r0_173, r0_172
-#   82|     r0_175(glval<int>) = CopyValue              : r0_173
-#   83|     r0_176(glval<int>) = VariableAddress[x]     : 
-#   83|     r0_177(int)        = Load                   : &:r0_176, ~mu0_2
-#   83|     r0_178(int)        = BitComplement          : r0_177
-#   83|     r0_179(glval<int>) = VariableAddress[z]     : 
-#   83|     mu0_180(int)       = Store                  : &:r0_179, r0_178
-#   83|     r0_181(glval<int>) = CopyValue              : r0_179
-#   84|     r0_182(glval<int>) = VariableAddress[x]     : 
-#   84|     r0_183(int)        = Load                   : &:r0_182, ~mu0_2
-#   84|     r0_184(int)        = Constant[0]            : 
-#   84|     r0_185(bool)       = CompareNE              : r0_183, r0_184
-#   84|     r0_186(bool)       = LogicalNot             : r0_185
-#   84|     r0_187(int)        = Convert                : r0_186
-#   84|     r0_188(glval<int>) = VariableAddress[z]     : 
-#   84|     mu0_189(int)       = Store                  : &:r0_188, r0_187
-#   84|     r0_190(glval<int>) = CopyValue              : r0_188
-#   85|     v0_191(void)       = NoOp                   : 
-#   50|     v0_192(void)       = ReturnVoid             : 
-#   50|     v0_193(void)       = UnmodeledUse           : mu*
-#   50|     v0_194(void)       = ExitFunction           : 
+#   55|     r0_27(int)         = Mul                    : r0_24, r0_26
+#   55|     r0_28(glval<int>)  = VariableAddress[z]     : 
+#   55|     mu0_29(int)        = Store                  : &:r0_28, r0_27
+#   56|     r0_30(glval<int>)  = VariableAddress[x]     : 
+#   56|     r0_31(int)         = Load                   : &:r0_30, ~mu0_2
+#   56|     r0_32(glval<int>)  = VariableAddress[y]     : 
+#   56|     r0_33(int)         = Load                   : &:r0_32, ~mu0_2
+#   56|     r0_34(int)         = Div                    : r0_31, r0_33
+#   56|     r0_35(glval<int>)  = VariableAddress[z]     : 
+#   56|     mu0_36(int)        = Store                  : &:r0_35, r0_34
+#   57|     r0_37(glval<int>)  = VariableAddress[x]     : 
+#   57|     r0_38(int)         = Load                   : &:r0_37, ~mu0_2
+#   57|     r0_39(glval<int>)  = VariableAddress[y]     : 
+#   57|     r0_40(int)         = Load                   : &:r0_39, ~mu0_2
+#   57|     r0_41(int)         = Rem                    : r0_38, r0_40
+#   57|     r0_42(glval<int>)  = VariableAddress[z]     : 
+#   57|     mu0_43(int)        = Store                  : &:r0_42, r0_41
+#   59|     r0_44(glval<int>)  = VariableAddress[x]     : 
+#   59|     r0_45(int)         = Load                   : &:r0_44, ~mu0_2
+#   59|     r0_46(glval<int>)  = VariableAddress[y]     : 
+#   59|     r0_47(int)         = Load                   : &:r0_46, ~mu0_2
+#   59|     r0_48(int)         = BitAnd                 : r0_45, r0_47
+#   59|     r0_49(glval<int>)  = VariableAddress[z]     : 
+#   59|     mu0_50(int)        = Store                  : &:r0_49, r0_48
+#   60|     r0_51(glval<int>)  = VariableAddress[x]     : 
+#   60|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
+#   60|     r0_53(glval<int>)  = VariableAddress[y]     : 
+#   60|     r0_54(int)         = Load                   : &:r0_53, ~mu0_2
+#   60|     r0_55(int)         = BitOr                  : r0_52, r0_54
+#   60|     r0_56(glval<int>)  = VariableAddress[z]     : 
+#   60|     mu0_57(int)        = Store                  : &:r0_56, r0_55
+#   61|     r0_58(glval<int>)  = VariableAddress[x]     : 
+#   61|     r0_59(int)         = Load                   : &:r0_58, ~mu0_2
+#   61|     r0_60(glval<int>)  = VariableAddress[y]     : 
+#   61|     r0_61(int)         = Load                   : &:r0_60, ~mu0_2
+#   61|     r0_62(int)         = BitXor                 : r0_59, r0_61
+#   61|     r0_63(glval<int>)  = VariableAddress[z]     : 
+#   61|     mu0_64(int)        = Store                  : &:r0_63, r0_62
+#   63|     r0_65(glval<int>)  = VariableAddress[x]     : 
+#   63|     r0_66(int)         = Load                   : &:r0_65, ~mu0_2
+#   63|     r0_67(glval<int>)  = VariableAddress[y]     : 
+#   63|     r0_68(int)         = Load                   : &:r0_67, ~mu0_2
+#   63|     r0_69(int)         = ShiftLeft              : r0_66, r0_68
+#   63|     r0_70(glval<int>)  = VariableAddress[z]     : 
+#   63|     mu0_71(int)        = Store                  : &:r0_70, r0_69
+#   64|     r0_72(glval<int>)  = VariableAddress[x]     : 
+#   64|     r0_73(int)         = Load                   : &:r0_72, ~mu0_2
+#   64|     r0_74(glval<int>)  = VariableAddress[y]     : 
+#   64|     r0_75(int)         = Load                   : &:r0_74, ~mu0_2
+#   64|     r0_76(int)         = ShiftRight             : r0_73, r0_75
+#   64|     r0_77(glval<int>)  = VariableAddress[z]     : 
+#   64|     mu0_78(int)        = Store                  : &:r0_77, r0_76
+#   66|     r0_79(glval<int>)  = VariableAddress[x]     : 
+#   66|     r0_80(int)         = Load                   : &:r0_79, ~mu0_2
+#   66|     r0_81(glval<int>)  = VariableAddress[z]     : 
+#   66|     mu0_82(int)        = Store                  : &:r0_81, r0_80
+#   68|     r0_83(glval<int>)  = VariableAddress[x]     : 
+#   68|     r0_84(int)         = Load                   : &:r0_83, ~mu0_2
+#   68|     r0_85(glval<int>)  = VariableAddress[z]     : 
+#   68|     r0_86(int)         = Load                   : &:r0_85, ~mu0_2
+#   68|     r0_87(int)         = Add                    : r0_86, r0_84
+#   68|     mu0_88(int)        = Store                  : &:r0_85, r0_87
+#   69|     r0_89(glval<int>)  = VariableAddress[x]     : 
+#   69|     r0_90(int)         = Load                   : &:r0_89, ~mu0_2
+#   69|     r0_91(glval<int>)  = VariableAddress[z]     : 
+#   69|     r0_92(int)         = Load                   : &:r0_91, ~mu0_2
+#   69|     r0_93(int)         = Sub                    : r0_92, r0_90
+#   69|     mu0_94(int)        = Store                  : &:r0_91, r0_93
+#   70|     r0_95(glval<int>)  = VariableAddress[x]     : 
+#   70|     r0_96(int)         = Load                   : &:r0_95, ~mu0_2
+#   70|     r0_97(glval<int>)  = VariableAddress[z]     : 
+#   70|     r0_98(int)         = Load                   : &:r0_97, ~mu0_2
+#   70|     r0_99(int)         = Mul                    : r0_98, r0_96
+#   70|     mu0_100(int)       = Store                  : &:r0_97, r0_99
+#   71|     r0_101(glval<int>) = VariableAddress[x]     : 
+#   71|     r0_102(int)        = Load                   : &:r0_101, ~mu0_2
+#   71|     r0_103(glval<int>) = VariableAddress[z]     : 
+#   71|     r0_104(int)        = Load                   : &:r0_103, ~mu0_2
+#   71|     r0_105(int)        = Div                    : r0_104, r0_102
+#   71|     mu0_106(int)       = Store                  : &:r0_103, r0_105
+#   72|     r0_107(glval<int>) = VariableAddress[x]     : 
+#   72|     r0_108(int)        = Load                   : &:r0_107, ~mu0_2
+#   72|     r0_109(glval<int>) = VariableAddress[z]     : 
+#   72|     r0_110(int)        = Load                   : &:r0_109, ~mu0_2
+#   72|     r0_111(int)        = Rem                    : r0_110, r0_108
+#   72|     mu0_112(int)       = Store                  : &:r0_109, r0_111
+#   74|     r0_113(glval<int>) = VariableAddress[x]     : 
+#   74|     r0_114(int)        = Load                   : &:r0_113, ~mu0_2
+#   74|     r0_115(glval<int>) = VariableAddress[z]     : 
+#   74|     r0_116(int)        = Load                   : &:r0_115, ~mu0_2
+#   74|     r0_117(int)        = BitAnd                 : r0_116, r0_114
+#   74|     mu0_118(int)       = Store                  : &:r0_115, r0_117
+#   75|     r0_119(glval<int>) = VariableAddress[x]     : 
+#   75|     r0_120(int)        = Load                   : &:r0_119, ~mu0_2
+#   75|     r0_121(glval<int>) = VariableAddress[z]     : 
+#   75|     r0_122(int)        = Load                   : &:r0_121, ~mu0_2
+#   75|     r0_123(int)        = BitOr                  : r0_122, r0_120
+#   75|     mu0_124(int)       = Store                  : &:r0_121, r0_123
+#   76|     r0_125(glval<int>) = VariableAddress[x]     : 
+#   76|     r0_126(int)        = Load                   : &:r0_125, ~mu0_2
+#   76|     r0_127(glval<int>) = VariableAddress[z]     : 
+#   76|     r0_128(int)        = Load                   : &:r0_127, ~mu0_2
+#   76|     r0_129(int)        = BitXor                 : r0_128, r0_126
+#   76|     mu0_130(int)       = Store                  : &:r0_127, r0_129
+#   78|     r0_131(glval<int>) = VariableAddress[x]     : 
+#   78|     r0_132(int)        = Load                   : &:r0_131, ~mu0_2
+#   78|     r0_133(glval<int>) = VariableAddress[z]     : 
+#   78|     r0_134(int)        = Load                   : &:r0_133, ~mu0_2
+#   78|     r0_135(int)        = ShiftLeft              : r0_134, r0_132
+#   78|     mu0_136(int)       = Store                  : &:r0_133, r0_135
+#   79|     r0_137(glval<int>) = VariableAddress[x]     : 
+#   79|     r0_138(int)        = Load                   : &:r0_137, ~mu0_2
+#   79|     r0_139(glval<int>) = VariableAddress[z]     : 
+#   79|     r0_140(int)        = Load                   : &:r0_139, ~mu0_2
+#   79|     r0_141(int)        = ShiftRight             : r0_140, r0_138
+#   79|     mu0_142(int)       = Store                  : &:r0_139, r0_141
+#   81|     r0_143(glval<int>) = VariableAddress[x]     : 
+#   81|     r0_144(int)        = Load                   : &:r0_143, ~mu0_2
+#   81|     r0_145(int)        = CopyValue              : r0_144
+#   81|     r0_146(glval<int>) = VariableAddress[z]     : 
+#   81|     mu0_147(int)       = Store                  : &:r0_146, r0_145
+#   82|     r0_148(glval<int>) = VariableAddress[x]     : 
+#   82|     r0_149(int)        = Load                   : &:r0_148, ~mu0_2
+#   82|     r0_150(int)        = Negate                 : r0_149
+#   82|     r0_151(glval<int>) = VariableAddress[z]     : 
+#   82|     mu0_152(int)       = Store                  : &:r0_151, r0_150
+#   83|     r0_153(glval<int>) = VariableAddress[x]     : 
+#   83|     r0_154(int)        = Load                   : &:r0_153, ~mu0_2
+#   83|     r0_155(int)        = BitComplement          : r0_154
+#   83|     r0_156(glval<int>) = VariableAddress[z]     : 
+#   83|     mu0_157(int)       = Store                  : &:r0_156, r0_155
+#   84|     r0_158(glval<int>) = VariableAddress[x]     : 
+#   84|     r0_159(int)        = Load                   : &:r0_158, ~mu0_2
+#   84|     r0_160(int)        = Constant[0]            : 
+#   84|     r0_161(bool)       = CompareNE              : r0_159, r0_160
+#   84|     r0_162(bool)       = LogicalNot             : r0_161
+#   84|     r0_163(int)        = Convert                : r0_162
+#   84|     r0_164(glval<int>) = VariableAddress[z]     : 
+#   84|     mu0_165(int)       = Store                  : &:r0_164, r0_163
+#   85|     v0_166(void)       = NoOp                   : 
+#   50|     v0_167(void)       = ReturnVoid             : 
+#   50|     v0_168(void)       = UnmodeledUse           : mu*
+#   50|     v0_169(void)       = ExitFunction           : 
 
 #   87| void IntegerCompare(int, int)
 #   87|   Block 0
@@ -433,51 +405,45 @@ ir.cpp:
 #   90|     r0_13(bool)        = CompareEQ              : r0_10, r0_12
 #   90|     r0_14(glval<bool>) = VariableAddress[b]     : 
 #   90|     mu0_15(bool)       = Store                  : &:r0_14, r0_13
-#   90|     r0_16(glval<bool>) = CopyValue              : r0_14
-#   91|     r0_17(glval<int>)  = VariableAddress[x]     : 
-#   91|     r0_18(int)         = Load                   : &:r0_17, ~mu0_2
-#   91|     r0_19(glval<int>)  = VariableAddress[y]     : 
-#   91|     r0_20(int)         = Load                   : &:r0_19, ~mu0_2
-#   91|     r0_21(bool)        = CompareNE              : r0_18, r0_20
-#   91|     r0_22(glval<bool>) = VariableAddress[b]     : 
-#   91|     mu0_23(bool)       = Store                  : &:r0_22, r0_21
-#   91|     r0_24(glval<bool>) = CopyValue              : r0_22
-#   92|     r0_25(glval<int>)  = VariableAddress[x]     : 
+#   91|     r0_16(glval<int>)  = VariableAddress[x]     : 
+#   91|     r0_17(int)         = Load                   : &:r0_16, ~mu0_2
+#   91|     r0_18(glval<int>)  = VariableAddress[y]     : 
+#   91|     r0_19(int)         = Load                   : &:r0_18, ~mu0_2
+#   91|     r0_20(bool)        = CompareNE              : r0_17, r0_19
+#   91|     r0_21(glval<bool>) = VariableAddress[b]     : 
+#   91|     mu0_22(bool)       = Store                  : &:r0_21, r0_20
+#   92|     r0_23(glval<int>)  = VariableAddress[x]     : 
+#   92|     r0_24(int)         = Load                   : &:r0_23, ~mu0_2
+#   92|     r0_25(glval<int>)  = VariableAddress[y]     : 
 #   92|     r0_26(int)         = Load                   : &:r0_25, ~mu0_2
-#   92|     r0_27(glval<int>)  = VariableAddress[y]     : 
-#   92|     r0_28(int)         = Load                   : &:r0_27, ~mu0_2
-#   92|     r0_29(bool)        = CompareLT              : r0_26, r0_28
-#   92|     r0_30(glval<bool>) = VariableAddress[b]     : 
-#   92|     mu0_31(bool)       = Store                  : &:r0_30, r0_29
-#   92|     r0_32(glval<bool>) = CopyValue              : r0_30
-#   93|     r0_33(glval<int>)  = VariableAddress[x]     : 
-#   93|     r0_34(int)         = Load                   : &:r0_33, ~mu0_2
-#   93|     r0_35(glval<int>)  = VariableAddress[y]     : 
-#   93|     r0_36(int)         = Load                   : &:r0_35, ~mu0_2
-#   93|     r0_37(bool)        = CompareGT              : r0_34, r0_36
-#   93|     r0_38(glval<bool>) = VariableAddress[b]     : 
-#   93|     mu0_39(bool)       = Store                  : &:r0_38, r0_37
-#   93|     r0_40(glval<bool>) = CopyValue              : r0_38
-#   94|     r0_41(glval<int>)  = VariableAddress[x]     : 
-#   94|     r0_42(int)         = Load                   : &:r0_41, ~mu0_2
-#   94|     r0_43(glval<int>)  = VariableAddress[y]     : 
-#   94|     r0_44(int)         = Load                   : &:r0_43, ~mu0_2
-#   94|     r0_45(bool)        = CompareLE              : r0_42, r0_44
-#   94|     r0_46(glval<bool>) = VariableAddress[b]     : 
-#   94|     mu0_47(bool)       = Store                  : &:r0_46, r0_45
-#   94|     r0_48(glval<bool>) = CopyValue              : r0_46
-#   95|     r0_49(glval<int>)  = VariableAddress[x]     : 
-#   95|     r0_50(int)         = Load                   : &:r0_49, ~mu0_2
-#   95|     r0_51(glval<int>)  = VariableAddress[y]     : 
-#   95|     r0_52(int)         = Load                   : &:r0_51, ~mu0_2
-#   95|     r0_53(bool)        = CompareGE              : r0_50, r0_52
-#   95|     r0_54(glval<bool>) = VariableAddress[b]     : 
-#   95|     mu0_55(bool)       = Store                  : &:r0_54, r0_53
-#   95|     r0_56(glval<bool>) = CopyValue              : r0_54
-#   96|     v0_57(void)        = NoOp                   : 
-#   87|     v0_58(void)        = ReturnVoid             : 
-#   87|     v0_59(void)        = UnmodeledUse           : mu*
-#   87|     v0_60(void)        = ExitFunction           : 
+#   92|     r0_27(bool)        = CompareLT              : r0_24, r0_26
+#   92|     r0_28(glval<bool>) = VariableAddress[b]     : 
+#   92|     mu0_29(bool)       = Store                  : &:r0_28, r0_27
+#   93|     r0_30(glval<int>)  = VariableAddress[x]     : 
+#   93|     r0_31(int)         = Load                   : &:r0_30, ~mu0_2
+#   93|     r0_32(glval<int>)  = VariableAddress[y]     : 
+#   93|     r0_33(int)         = Load                   : &:r0_32, ~mu0_2
+#   93|     r0_34(bool)        = CompareGT              : r0_31, r0_33
+#   93|     r0_35(glval<bool>) = VariableAddress[b]     : 
+#   93|     mu0_36(bool)       = Store                  : &:r0_35, r0_34
+#   94|     r0_37(glval<int>)  = VariableAddress[x]     : 
+#   94|     r0_38(int)         = Load                   : &:r0_37, ~mu0_2
+#   94|     r0_39(glval<int>)  = VariableAddress[y]     : 
+#   94|     r0_40(int)         = Load                   : &:r0_39, ~mu0_2
+#   94|     r0_41(bool)        = CompareLE              : r0_38, r0_40
+#   94|     r0_42(glval<bool>) = VariableAddress[b]     : 
+#   94|     mu0_43(bool)       = Store                  : &:r0_42, r0_41
+#   95|     r0_44(glval<int>)  = VariableAddress[x]     : 
+#   95|     r0_45(int)         = Load                   : &:r0_44, ~mu0_2
+#   95|     r0_46(glval<int>)  = VariableAddress[y]     : 
+#   95|     r0_47(int)         = Load                   : &:r0_46, ~mu0_2
+#   95|     r0_48(bool)        = CompareGE              : r0_45, r0_47
+#   95|     r0_49(glval<bool>) = VariableAddress[b]     : 
+#   95|     mu0_50(bool)       = Store                  : &:r0_49, r0_48
+#   96|     v0_51(void)        = NoOp                   : 
+#   87|     v0_52(void)        = ReturnVoid             : 
+#   87|     v0_53(void)        = UnmodeledUse           : mu*
+#   87|     v0_54(void)        = ExitFunction           : 
 
 #   98| void IntegerCrement(int)
 #   98|   Block 0
@@ -495,35 +461,31 @@ ir.cpp:
 #  101|     mu0_11(int)       = Store                  : &:r0_7, r0_10
 #  101|     r0_12(glval<int>) = VariableAddress[y]     : 
 #  101|     mu0_13(int)       = Store                  : &:r0_12, r0_10
-#  101|     r0_14(glval<int>) = CopyValue              : r0_12
-#  102|     r0_15(glval<int>) = VariableAddress[x]     : 
-#  102|     r0_16(int)        = Load                   : &:r0_15, ~mu0_2
-#  102|     r0_17(int)        = Constant[1]            : 
-#  102|     r0_18(int)        = Sub                    : r0_16, r0_17
-#  102|     mu0_19(int)       = Store                  : &:r0_15, r0_18
-#  102|     r0_20(glval<int>) = VariableAddress[y]     : 
-#  102|     mu0_21(int)       = Store                  : &:r0_20, r0_18
-#  102|     r0_22(glval<int>) = CopyValue              : r0_20
-#  103|     r0_23(glval<int>) = VariableAddress[x]     : 
-#  103|     r0_24(int)        = Load                   : &:r0_23, ~mu0_2
-#  103|     r0_25(int)        = Constant[1]            : 
-#  103|     r0_26(int)        = Add                    : r0_24, r0_25
-#  103|     mu0_27(int)       = Store                  : &:r0_23, r0_26
-#  103|     r0_28(glval<int>) = VariableAddress[y]     : 
-#  103|     mu0_29(int)       = Store                  : &:r0_28, r0_24
-#  103|     r0_30(glval<int>) = CopyValue              : r0_28
-#  104|     r0_31(glval<int>) = VariableAddress[x]     : 
-#  104|     r0_32(int)        = Load                   : &:r0_31, ~mu0_2
-#  104|     r0_33(int)        = Constant[1]            : 
-#  104|     r0_34(int)        = Sub                    : r0_32, r0_33
-#  104|     mu0_35(int)       = Store                  : &:r0_31, r0_34
-#  104|     r0_36(glval<int>) = VariableAddress[y]     : 
-#  104|     mu0_37(int)       = Store                  : &:r0_36, r0_32
-#  104|     r0_38(glval<int>) = CopyValue              : r0_36
-#  105|     v0_39(void)       = NoOp                   : 
-#   98|     v0_40(void)       = ReturnVoid             : 
-#   98|     v0_41(void)       = UnmodeledUse           : mu*
-#   98|     v0_42(void)       = ExitFunction           : 
+#  102|     r0_14(glval<int>) = VariableAddress[x]     : 
+#  102|     r0_15(int)        = Load                   : &:r0_14, ~mu0_2
+#  102|     r0_16(int)        = Constant[1]            : 
+#  102|     r0_17(int)        = Sub                    : r0_15, r0_16
+#  102|     mu0_18(int)       = Store                  : &:r0_14, r0_17
+#  102|     r0_19(glval<int>) = VariableAddress[y]     : 
+#  102|     mu0_20(int)       = Store                  : &:r0_19, r0_17
+#  103|     r0_21(glval<int>) = VariableAddress[x]     : 
+#  103|     r0_22(int)        = Load                   : &:r0_21, ~mu0_2
+#  103|     r0_23(int)        = Constant[1]            : 
+#  103|     r0_24(int)        = Add                    : r0_22, r0_23
+#  103|     mu0_25(int)       = Store                  : &:r0_21, r0_24
+#  103|     r0_26(glval<int>) = VariableAddress[y]     : 
+#  103|     mu0_27(int)       = Store                  : &:r0_26, r0_22
+#  104|     r0_28(glval<int>) = VariableAddress[x]     : 
+#  104|     r0_29(int)        = Load                   : &:r0_28, ~mu0_2
+#  104|     r0_30(int)        = Constant[1]            : 
+#  104|     r0_31(int)        = Sub                    : r0_29, r0_30
+#  104|     mu0_32(int)       = Store                  : &:r0_28, r0_31
+#  104|     r0_33(glval<int>) = VariableAddress[y]     : 
+#  104|     mu0_34(int)       = Store                  : &:r0_33, r0_29
+#  105|     v0_35(void)       = NoOp                   : 
+#   98|     v0_36(void)       = ReturnVoid             : 
+#   98|     v0_37(void)       = UnmodeledUse           : mu*
+#   98|     v0_38(void)       = ExitFunction           : 
 
 #  107| void IntegerCrement_LValue(int)
 #  107|   Block 0
@@ -543,21 +505,19 @@ ir.cpp:
 #  110|     r0_13(int *)        = CopyValue              : r0_12
 #  110|     r0_14(glval<int *>) = VariableAddress[p]     : 
 #  110|     mu0_15(int *)       = Store                  : &:r0_14, r0_13
-#  110|     r0_16(glval<int *>) = CopyValue              : r0_14
-#  111|     r0_17(glval<int>)   = VariableAddress[x]     : 
-#  111|     r0_18(int)          = Load                   : &:r0_17, ~mu0_2
-#  111|     r0_19(int)          = Constant[1]            : 
-#  111|     r0_20(int)          = Sub                    : r0_18, r0_19
-#  111|     mu0_21(int)         = Store                  : &:r0_17, r0_20
-#  111|     r0_22(glval<int>)   = CopyValue              : r0_17
-#  111|     r0_23(int *)        = CopyValue              : r0_22
-#  111|     r0_24(glval<int *>) = VariableAddress[p]     : 
-#  111|     mu0_25(int *)       = Store                  : &:r0_24, r0_23
-#  111|     r0_26(glval<int *>) = CopyValue              : r0_24
-#  112|     v0_27(void)         = NoOp                   : 
-#  107|     v0_28(void)         = ReturnVoid             : 
-#  107|     v0_29(void)         = UnmodeledUse           : mu*
-#  107|     v0_30(void)         = ExitFunction           : 
+#  111|     r0_16(glval<int>)   = VariableAddress[x]     : 
+#  111|     r0_17(int)          = Load                   : &:r0_16, ~mu0_2
+#  111|     r0_18(int)          = Constant[1]            : 
+#  111|     r0_19(int)          = Sub                    : r0_17, r0_18
+#  111|     mu0_20(int)         = Store                  : &:r0_16, r0_19
+#  111|     r0_21(glval<int>)   = CopyValue              : r0_16
+#  111|     r0_22(int *)        = CopyValue              : r0_21
+#  111|     r0_23(glval<int *>) = VariableAddress[p]     : 
+#  111|     mu0_24(int *)       = Store                  : &:r0_23, r0_22
+#  112|     v0_25(void)         = NoOp                   : 
+#  107|     v0_26(void)         = ReturnVoid             : 
+#  107|     v0_27(void)         = UnmodeledUse           : mu*
+#  107|     v0_28(void)         = ExitFunction           : 
 
 #  114| void FloatOps(double, double)
 #  114|   Block 0
@@ -577,80 +537,69 @@ ir.cpp:
 #  117|     r0_13(double)        = Add                    : r0_10, r0_12
 #  117|     r0_14(glval<double>) = VariableAddress[z]     : 
 #  117|     mu0_15(double)       = Store                  : &:r0_14, r0_13
-#  117|     r0_16(glval<double>) = CopyValue              : r0_14
-#  118|     r0_17(glval<double>) = VariableAddress[x]     : 
-#  118|     r0_18(double)        = Load                   : &:r0_17, ~mu0_2
-#  118|     r0_19(glval<double>) = VariableAddress[y]     : 
-#  118|     r0_20(double)        = Load                   : &:r0_19, ~mu0_2
-#  118|     r0_21(double)        = Sub                    : r0_18, r0_20
-#  118|     r0_22(glval<double>) = VariableAddress[z]     : 
-#  118|     mu0_23(double)       = Store                  : &:r0_22, r0_21
-#  118|     r0_24(glval<double>) = CopyValue              : r0_22
-#  119|     r0_25(glval<double>) = VariableAddress[x]     : 
+#  118|     r0_16(glval<double>) = VariableAddress[x]     : 
+#  118|     r0_17(double)        = Load                   : &:r0_16, ~mu0_2
+#  118|     r0_18(glval<double>) = VariableAddress[y]     : 
+#  118|     r0_19(double)        = Load                   : &:r0_18, ~mu0_2
+#  118|     r0_20(double)        = Sub                    : r0_17, r0_19
+#  118|     r0_21(glval<double>) = VariableAddress[z]     : 
+#  118|     mu0_22(double)       = Store                  : &:r0_21, r0_20
+#  119|     r0_23(glval<double>) = VariableAddress[x]     : 
+#  119|     r0_24(double)        = Load                   : &:r0_23, ~mu0_2
+#  119|     r0_25(glval<double>) = VariableAddress[y]     : 
 #  119|     r0_26(double)        = Load                   : &:r0_25, ~mu0_2
-#  119|     r0_27(glval<double>) = VariableAddress[y]     : 
-#  119|     r0_28(double)        = Load                   : &:r0_27, ~mu0_2
-#  119|     r0_29(double)        = Mul                    : r0_26, r0_28
-#  119|     r0_30(glval<double>) = VariableAddress[z]     : 
-#  119|     mu0_31(double)       = Store                  : &:r0_30, r0_29
-#  119|     r0_32(glval<double>) = CopyValue              : r0_30
-#  120|     r0_33(glval<double>) = VariableAddress[x]     : 
-#  120|     r0_34(double)        = Load                   : &:r0_33, ~mu0_2
-#  120|     r0_35(glval<double>) = VariableAddress[y]     : 
-#  120|     r0_36(double)        = Load                   : &:r0_35, ~mu0_2
-#  120|     r0_37(double)        = Div                    : r0_34, r0_36
-#  120|     r0_38(glval<double>) = VariableAddress[z]     : 
-#  120|     mu0_39(double)       = Store                  : &:r0_38, r0_37
-#  120|     r0_40(glval<double>) = CopyValue              : r0_38
-#  122|     r0_41(glval<double>) = VariableAddress[x]     : 
-#  122|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
-#  122|     r0_43(glval<double>) = VariableAddress[z]     : 
-#  122|     mu0_44(double)       = Store                  : &:r0_43, r0_42
-#  122|     r0_45(glval<double>) = CopyValue              : r0_43
-#  124|     r0_46(glval<double>) = VariableAddress[x]     : 
-#  124|     r0_47(double)        = Load                   : &:r0_46, ~mu0_2
-#  124|     r0_48(glval<double>) = VariableAddress[z]     : 
-#  124|     r0_49(double)        = Load                   : &:r0_48, ~mu0_2
-#  124|     r0_50(double)        = Add                    : r0_49, r0_47
-#  124|     mu0_51(double)       = Store                  : &:r0_48, r0_50
-#  124|     r0_52(glval<double>) = CopyValue              : r0_48
-#  125|     r0_53(glval<double>) = VariableAddress[x]     : 
-#  125|     r0_54(double)        = Load                   : &:r0_53, ~mu0_2
-#  125|     r0_55(glval<double>) = VariableAddress[z]     : 
-#  125|     r0_56(double)        = Load                   : &:r0_55, ~mu0_2
-#  125|     r0_57(double)        = Sub                    : r0_56, r0_54
-#  125|     mu0_58(double)       = Store                  : &:r0_55, r0_57
-#  125|     r0_59(glval<double>) = CopyValue              : r0_55
-#  126|     r0_60(glval<double>) = VariableAddress[x]     : 
-#  126|     r0_61(double)        = Load                   : &:r0_60, ~mu0_2
-#  126|     r0_62(glval<double>) = VariableAddress[z]     : 
-#  126|     r0_63(double)        = Load                   : &:r0_62, ~mu0_2
-#  126|     r0_64(double)        = Mul                    : r0_63, r0_61
-#  126|     mu0_65(double)       = Store                  : &:r0_62, r0_64
-#  126|     r0_66(glval<double>) = CopyValue              : r0_62
-#  127|     r0_67(glval<double>) = VariableAddress[x]     : 
-#  127|     r0_68(double)        = Load                   : &:r0_67, ~mu0_2
-#  127|     r0_69(glval<double>) = VariableAddress[z]     : 
-#  127|     r0_70(double)        = Load                   : &:r0_69, ~mu0_2
-#  127|     r0_71(double)        = Div                    : r0_70, r0_68
-#  127|     mu0_72(double)       = Store                  : &:r0_69, r0_71
-#  127|     r0_73(glval<double>) = CopyValue              : r0_69
-#  129|     r0_74(glval<double>) = VariableAddress[x]     : 
-#  129|     r0_75(double)        = Load                   : &:r0_74, ~mu0_2
-#  129|     r0_76(double)        = CopyValue              : r0_75
-#  129|     r0_77(glval<double>) = VariableAddress[z]     : 
-#  129|     mu0_78(double)       = Store                  : &:r0_77, r0_76
-#  129|     r0_79(glval<double>) = CopyValue              : r0_77
-#  130|     r0_80(glval<double>) = VariableAddress[x]     : 
-#  130|     r0_81(double)        = Load                   : &:r0_80, ~mu0_2
-#  130|     r0_82(double)        = Negate                 : r0_81
-#  130|     r0_83(glval<double>) = VariableAddress[z]     : 
-#  130|     mu0_84(double)       = Store                  : &:r0_83, r0_82
-#  130|     r0_85(glval<double>) = CopyValue              : r0_83
-#  131|     v0_86(void)          = NoOp                   : 
-#  114|     v0_87(void)          = ReturnVoid             : 
-#  114|     v0_88(void)          = UnmodeledUse           : mu*
-#  114|     v0_89(void)          = ExitFunction           : 
+#  119|     r0_27(double)        = Mul                    : r0_24, r0_26
+#  119|     r0_28(glval<double>) = VariableAddress[z]     : 
+#  119|     mu0_29(double)       = Store                  : &:r0_28, r0_27
+#  120|     r0_30(glval<double>) = VariableAddress[x]     : 
+#  120|     r0_31(double)        = Load                   : &:r0_30, ~mu0_2
+#  120|     r0_32(glval<double>) = VariableAddress[y]     : 
+#  120|     r0_33(double)        = Load                   : &:r0_32, ~mu0_2
+#  120|     r0_34(double)        = Div                    : r0_31, r0_33
+#  120|     r0_35(glval<double>) = VariableAddress[z]     : 
+#  120|     mu0_36(double)       = Store                  : &:r0_35, r0_34
+#  122|     r0_37(glval<double>) = VariableAddress[x]     : 
+#  122|     r0_38(double)        = Load                   : &:r0_37, ~mu0_2
+#  122|     r0_39(glval<double>) = VariableAddress[z]     : 
+#  122|     mu0_40(double)       = Store                  : &:r0_39, r0_38
+#  124|     r0_41(glval<double>) = VariableAddress[x]     : 
+#  124|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
+#  124|     r0_43(glval<double>) = VariableAddress[z]     : 
+#  124|     r0_44(double)        = Load                   : &:r0_43, ~mu0_2
+#  124|     r0_45(double)        = Add                    : r0_44, r0_42
+#  124|     mu0_46(double)       = Store                  : &:r0_43, r0_45
+#  125|     r0_47(glval<double>) = VariableAddress[x]     : 
+#  125|     r0_48(double)        = Load                   : &:r0_47, ~mu0_2
+#  125|     r0_49(glval<double>) = VariableAddress[z]     : 
+#  125|     r0_50(double)        = Load                   : &:r0_49, ~mu0_2
+#  125|     r0_51(double)        = Sub                    : r0_50, r0_48
+#  125|     mu0_52(double)       = Store                  : &:r0_49, r0_51
+#  126|     r0_53(glval<double>) = VariableAddress[x]     : 
+#  126|     r0_54(double)        = Load                   : &:r0_53, ~mu0_2
+#  126|     r0_55(glval<double>) = VariableAddress[z]     : 
+#  126|     r0_56(double)        = Load                   : &:r0_55, ~mu0_2
+#  126|     r0_57(double)        = Mul                    : r0_56, r0_54
+#  126|     mu0_58(double)       = Store                  : &:r0_55, r0_57
+#  127|     r0_59(glval<double>) = VariableAddress[x]     : 
+#  127|     r0_60(double)        = Load                   : &:r0_59, ~mu0_2
+#  127|     r0_61(glval<double>) = VariableAddress[z]     : 
+#  127|     r0_62(double)        = Load                   : &:r0_61, ~mu0_2
+#  127|     r0_63(double)        = Div                    : r0_62, r0_60
+#  127|     mu0_64(double)       = Store                  : &:r0_61, r0_63
+#  129|     r0_65(glval<double>) = VariableAddress[x]     : 
+#  129|     r0_66(double)        = Load                   : &:r0_65, ~mu0_2
+#  129|     r0_67(double)        = CopyValue              : r0_66
+#  129|     r0_68(glval<double>) = VariableAddress[z]     : 
+#  129|     mu0_69(double)       = Store                  : &:r0_68, r0_67
+#  130|     r0_70(glval<double>) = VariableAddress[x]     : 
+#  130|     r0_71(double)        = Load                   : &:r0_70, ~mu0_2
+#  130|     r0_72(double)        = Negate                 : r0_71
+#  130|     r0_73(glval<double>) = VariableAddress[z]     : 
+#  130|     mu0_74(double)       = Store                  : &:r0_73, r0_72
+#  131|     v0_75(void)          = NoOp                   : 
+#  114|     v0_76(void)          = ReturnVoid             : 
+#  114|     v0_77(void)          = UnmodeledUse           : mu*
+#  114|     v0_78(void)          = ExitFunction           : 
 
 #  133| void FloatCompare(double, double)
 #  133|   Block 0
@@ -670,51 +619,45 @@ ir.cpp:
 #  136|     r0_13(bool)          = CompareEQ              : r0_10, r0_12
 #  136|     r0_14(glval<bool>)   = VariableAddress[b]     : 
 #  136|     mu0_15(bool)         = Store                  : &:r0_14, r0_13
-#  136|     r0_16(glval<bool>)   = CopyValue              : r0_14
-#  137|     r0_17(glval<double>) = VariableAddress[x]     : 
-#  137|     r0_18(double)        = Load                   : &:r0_17, ~mu0_2
-#  137|     r0_19(glval<double>) = VariableAddress[y]     : 
-#  137|     r0_20(double)        = Load                   : &:r0_19, ~mu0_2
-#  137|     r0_21(bool)          = CompareNE              : r0_18, r0_20
-#  137|     r0_22(glval<bool>)   = VariableAddress[b]     : 
-#  137|     mu0_23(bool)         = Store                  : &:r0_22, r0_21
-#  137|     r0_24(glval<bool>)   = CopyValue              : r0_22
-#  138|     r0_25(glval<double>) = VariableAddress[x]     : 
+#  137|     r0_16(glval<double>) = VariableAddress[x]     : 
+#  137|     r0_17(double)        = Load                   : &:r0_16, ~mu0_2
+#  137|     r0_18(glval<double>) = VariableAddress[y]     : 
+#  137|     r0_19(double)        = Load                   : &:r0_18, ~mu0_2
+#  137|     r0_20(bool)          = CompareNE              : r0_17, r0_19
+#  137|     r0_21(glval<bool>)   = VariableAddress[b]     : 
+#  137|     mu0_22(bool)         = Store                  : &:r0_21, r0_20
+#  138|     r0_23(glval<double>) = VariableAddress[x]     : 
+#  138|     r0_24(double)        = Load                   : &:r0_23, ~mu0_2
+#  138|     r0_25(glval<double>) = VariableAddress[y]     : 
 #  138|     r0_26(double)        = Load                   : &:r0_25, ~mu0_2
-#  138|     r0_27(glval<double>) = VariableAddress[y]     : 
-#  138|     r0_28(double)        = Load                   : &:r0_27, ~mu0_2
-#  138|     r0_29(bool)          = CompareLT              : r0_26, r0_28
-#  138|     r0_30(glval<bool>)   = VariableAddress[b]     : 
-#  138|     mu0_31(bool)         = Store                  : &:r0_30, r0_29
-#  138|     r0_32(glval<bool>)   = CopyValue              : r0_30
-#  139|     r0_33(glval<double>) = VariableAddress[x]     : 
-#  139|     r0_34(double)        = Load                   : &:r0_33, ~mu0_2
-#  139|     r0_35(glval<double>) = VariableAddress[y]     : 
-#  139|     r0_36(double)        = Load                   : &:r0_35, ~mu0_2
-#  139|     r0_37(bool)          = CompareGT              : r0_34, r0_36
-#  139|     r0_38(glval<bool>)   = VariableAddress[b]     : 
-#  139|     mu0_39(bool)         = Store                  : &:r0_38, r0_37
-#  139|     r0_40(glval<bool>)   = CopyValue              : r0_38
-#  140|     r0_41(glval<double>) = VariableAddress[x]     : 
-#  140|     r0_42(double)        = Load                   : &:r0_41, ~mu0_2
-#  140|     r0_43(glval<double>) = VariableAddress[y]     : 
-#  140|     r0_44(double)        = Load                   : &:r0_43, ~mu0_2
-#  140|     r0_45(bool)          = CompareLE              : r0_42, r0_44
-#  140|     r0_46(glval<bool>)   = VariableAddress[b]     : 
-#  140|     mu0_47(bool)         = Store                  : &:r0_46, r0_45
-#  140|     r0_48(glval<bool>)   = CopyValue              : r0_46
-#  141|     r0_49(glval<double>) = VariableAddress[x]     : 
-#  141|     r0_50(double)        = Load                   : &:r0_49, ~mu0_2
-#  141|     r0_51(glval<double>) = VariableAddress[y]     : 
-#  141|     r0_52(double)        = Load                   : &:r0_51, ~mu0_2
-#  141|     r0_53(bool)          = CompareGE              : r0_50, r0_52
-#  141|     r0_54(glval<bool>)   = VariableAddress[b]     : 
-#  141|     mu0_55(bool)         = Store                  : &:r0_54, r0_53
-#  141|     r0_56(glval<bool>)   = CopyValue              : r0_54
-#  142|     v0_57(void)          = NoOp                   : 
-#  133|     v0_58(void)          = ReturnVoid             : 
-#  133|     v0_59(void)          = UnmodeledUse           : mu*
-#  133|     v0_60(void)          = ExitFunction           : 
+#  138|     r0_27(bool)          = CompareLT              : r0_24, r0_26
+#  138|     r0_28(glval<bool>)   = VariableAddress[b]     : 
+#  138|     mu0_29(bool)         = Store                  : &:r0_28, r0_27
+#  139|     r0_30(glval<double>) = VariableAddress[x]     : 
+#  139|     r0_31(double)        = Load                   : &:r0_30, ~mu0_2
+#  139|     r0_32(glval<double>) = VariableAddress[y]     : 
+#  139|     r0_33(double)        = Load                   : &:r0_32, ~mu0_2
+#  139|     r0_34(bool)          = CompareGT              : r0_31, r0_33
+#  139|     r0_35(glval<bool>)   = VariableAddress[b]     : 
+#  139|     mu0_36(bool)         = Store                  : &:r0_35, r0_34
+#  140|     r0_37(glval<double>) = VariableAddress[x]     : 
+#  140|     r0_38(double)        = Load                   : &:r0_37, ~mu0_2
+#  140|     r0_39(glval<double>) = VariableAddress[y]     : 
+#  140|     r0_40(double)        = Load                   : &:r0_39, ~mu0_2
+#  140|     r0_41(bool)          = CompareLE              : r0_38, r0_40
+#  140|     r0_42(glval<bool>)   = VariableAddress[b]     : 
+#  140|     mu0_43(bool)         = Store                  : &:r0_42, r0_41
+#  141|     r0_44(glval<double>) = VariableAddress[x]     : 
+#  141|     r0_45(double)        = Load                   : &:r0_44, ~mu0_2
+#  141|     r0_46(glval<double>) = VariableAddress[y]     : 
+#  141|     r0_47(double)        = Load                   : &:r0_46, ~mu0_2
+#  141|     r0_48(bool)          = CompareGE              : r0_45, r0_47
+#  141|     r0_49(glval<bool>)   = VariableAddress[b]     : 
+#  141|     mu0_50(bool)         = Store                  : &:r0_49, r0_48
+#  142|     v0_51(void)          = NoOp                   : 
+#  133|     v0_52(void)          = ReturnVoid             : 
+#  133|     v0_53(void)          = UnmodeledUse           : mu*
+#  133|     v0_54(void)          = ExitFunction           : 
 
 #  144| void FloatCrement(float)
 #  144|   Block 0
@@ -732,35 +675,31 @@ ir.cpp:
 #  147|     mu0_11(float)       = Store                  : &:r0_7, r0_10
 #  147|     r0_12(glval<float>) = VariableAddress[y]     : 
 #  147|     mu0_13(float)       = Store                  : &:r0_12, r0_10
-#  147|     r0_14(glval<float>) = CopyValue              : r0_12
-#  148|     r0_15(glval<float>) = VariableAddress[x]     : 
-#  148|     r0_16(float)        = Load                   : &:r0_15, ~mu0_2
-#  148|     r0_17(float)        = Constant[1.0]          : 
-#  148|     r0_18(float)        = Sub                    : r0_16, r0_17
-#  148|     mu0_19(float)       = Store                  : &:r0_15, r0_18
-#  148|     r0_20(glval<float>) = VariableAddress[y]     : 
-#  148|     mu0_21(float)       = Store                  : &:r0_20, r0_18
-#  148|     r0_22(glval<float>) = CopyValue              : r0_20
-#  149|     r0_23(glval<float>) = VariableAddress[x]     : 
-#  149|     r0_24(float)        = Load                   : &:r0_23, ~mu0_2
-#  149|     r0_25(float)        = Constant[1.0]          : 
-#  149|     r0_26(float)        = Add                    : r0_24, r0_25
-#  149|     mu0_27(float)       = Store                  : &:r0_23, r0_26
-#  149|     r0_28(glval<float>) = VariableAddress[y]     : 
-#  149|     mu0_29(float)       = Store                  : &:r0_28, r0_24
-#  149|     r0_30(glval<float>) = CopyValue              : r0_28
-#  150|     r0_31(glval<float>) = VariableAddress[x]     : 
-#  150|     r0_32(float)        = Load                   : &:r0_31, ~mu0_2
-#  150|     r0_33(float)        = Constant[1.0]          : 
-#  150|     r0_34(float)        = Sub                    : r0_32, r0_33
-#  150|     mu0_35(float)       = Store                  : &:r0_31, r0_34
-#  150|     r0_36(glval<float>) = VariableAddress[y]     : 
-#  150|     mu0_37(float)       = Store                  : &:r0_36, r0_32
-#  150|     r0_38(glval<float>) = CopyValue              : r0_36
-#  151|     v0_39(void)         = NoOp                   : 
-#  144|     v0_40(void)         = ReturnVoid             : 
-#  144|     v0_41(void)         = UnmodeledUse           : mu*
-#  144|     v0_42(void)         = ExitFunction           : 
+#  148|     r0_14(glval<float>) = VariableAddress[x]     : 
+#  148|     r0_15(float)        = Load                   : &:r0_14, ~mu0_2
+#  148|     r0_16(float)        = Constant[1.0]          : 
+#  148|     r0_17(float)        = Sub                    : r0_15, r0_16
+#  148|     mu0_18(float)       = Store                  : &:r0_14, r0_17
+#  148|     r0_19(glval<float>) = VariableAddress[y]     : 
+#  148|     mu0_20(float)       = Store                  : &:r0_19, r0_17
+#  149|     r0_21(glval<float>) = VariableAddress[x]     : 
+#  149|     r0_22(float)        = Load                   : &:r0_21, ~mu0_2
+#  149|     r0_23(float)        = Constant[1.0]          : 
+#  149|     r0_24(float)        = Add                    : r0_22, r0_23
+#  149|     mu0_25(float)       = Store                  : &:r0_21, r0_24
+#  149|     r0_26(glval<float>) = VariableAddress[y]     : 
+#  149|     mu0_27(float)       = Store                  : &:r0_26, r0_22
+#  150|     r0_28(glval<float>) = VariableAddress[x]     : 
+#  150|     r0_29(float)        = Load                   : &:r0_28, ~mu0_2
+#  150|     r0_30(float)        = Constant[1.0]          : 
+#  150|     r0_31(float)        = Sub                    : r0_29, r0_30
+#  150|     mu0_32(float)       = Store                  : &:r0_28, r0_31
+#  150|     r0_33(glval<float>) = VariableAddress[y]     : 
+#  150|     mu0_34(float)       = Store                  : &:r0_33, r0_29
+#  151|     v0_35(void)         = NoOp                   : 
+#  144|     v0_36(void)         = ReturnVoid             : 
+#  144|     v0_37(void)         = UnmodeledUse           : mu*
+#  144|     v0_38(void)         = ExitFunction           : 
 
 #  153| void PointerOps(int*, int)
 #  153|   Block 0
@@ -782,70 +721,61 @@ ir.cpp:
 #  157|     r0_15(int *)        = PointerAdd[4]          : r0_12, r0_14
 #  157|     r0_16(glval<int *>) = VariableAddress[q]     : 
 #  157|     mu0_17(int *)       = Store                  : &:r0_16, r0_15
-#  157|     r0_18(glval<int *>) = CopyValue              : r0_16
-#  158|     r0_19(glval<int>)   = VariableAddress[i]     : 
-#  158|     r0_20(int)          = Load                   : &:r0_19, ~mu0_2
-#  158|     r0_21(glval<int *>) = VariableAddress[p]     : 
-#  158|     r0_22(int *)        = Load                   : &:r0_21, ~mu0_2
-#  158|     r0_23(int *)        = PointerAdd[4]          : r0_22, r0_20
-#  158|     r0_24(glval<int *>) = VariableAddress[q]     : 
-#  158|     mu0_25(int *)       = Store                  : &:r0_24, r0_23
-#  158|     r0_26(glval<int *>) = CopyValue              : r0_24
-#  159|     r0_27(glval<int *>) = VariableAddress[p]     : 
-#  159|     r0_28(int *)        = Load                   : &:r0_27, ~mu0_2
-#  159|     r0_29(glval<int>)   = VariableAddress[i]     : 
-#  159|     r0_30(int)          = Load                   : &:r0_29, ~mu0_2
-#  159|     r0_31(int *)        = PointerSub[4]          : r0_28, r0_30
-#  159|     r0_32(glval<int *>) = VariableAddress[q]     : 
-#  159|     mu0_33(int *)       = Store                  : &:r0_32, r0_31
-#  159|     r0_34(glval<int *>) = CopyValue              : r0_32
-#  160|     r0_35(glval<int *>) = VariableAddress[p]     : 
-#  160|     r0_36(int *)        = Load                   : &:r0_35, ~mu0_2
-#  160|     r0_37(glval<int *>) = VariableAddress[q]     : 
-#  160|     r0_38(int *)        = Load                   : &:r0_37, ~mu0_2
-#  160|     r0_39(long)         = PointerDiff[4]         : r0_36, r0_38
-#  160|     r0_40(int)          = Convert                : r0_39
-#  160|     r0_41(glval<int>)   = VariableAddress[i]     : 
-#  160|     mu0_42(int)         = Store                  : &:r0_41, r0_40
-#  160|     r0_43(glval<int>)   = CopyValue              : r0_41
-#  162|     r0_44(glval<int *>) = VariableAddress[p]     : 
-#  162|     r0_45(int *)        = Load                   : &:r0_44, ~mu0_2
-#  162|     r0_46(glval<int *>) = VariableAddress[q]     : 
-#  162|     mu0_47(int *)       = Store                  : &:r0_46, r0_45
-#  162|     r0_48(glval<int *>) = CopyValue              : r0_46
-#  164|     r0_49(glval<int>)   = VariableAddress[i]     : 
-#  164|     r0_50(int)          = Load                   : &:r0_49, ~mu0_2
-#  164|     r0_51(glval<int *>) = VariableAddress[q]     : 
-#  164|     r0_52(int *)        = Load                   : &:r0_51, ~mu0_2
-#  164|     r0_53(int *)        = PointerAdd[4]          : r0_52, r0_50
-#  164|     mu0_54(int *)       = Store                  : &:r0_51, r0_53
-#  164|     r0_55(glval<int *>) = CopyValue              : r0_51
-#  165|     r0_56(glval<int>)   = VariableAddress[i]     : 
-#  165|     r0_57(int)          = Load                   : &:r0_56, ~mu0_2
-#  165|     r0_58(glval<int *>) = VariableAddress[q]     : 
-#  165|     r0_59(int *)        = Load                   : &:r0_58, ~mu0_2
-#  165|     r0_60(int *)        = PointerSub[4]          : r0_59, r0_57
-#  165|     mu0_61(int *)       = Store                  : &:r0_58, r0_60
-#  165|     r0_62(glval<int *>) = CopyValue              : r0_58
-#  167|     r0_63(glval<int *>) = VariableAddress[p]     : 
-#  167|     r0_64(int *)        = Load                   : &:r0_63, ~mu0_2
-#  167|     r0_65(int *)        = Constant[0]            : 
-#  167|     r0_66(bool)         = CompareNE              : r0_64, r0_65
-#  167|     r0_67(glval<bool>)  = VariableAddress[b]     : 
-#  167|     mu0_68(bool)        = Store                  : &:r0_67, r0_66
-#  167|     r0_69(glval<bool>)  = CopyValue              : r0_67
-#  168|     r0_70(glval<int *>) = VariableAddress[p]     : 
-#  168|     r0_71(int *)        = Load                   : &:r0_70, ~mu0_2
-#  168|     r0_72(int *)        = Constant[0]            : 
-#  168|     r0_73(bool)         = CompareNE              : r0_71, r0_72
-#  168|     r0_74(bool)         = LogicalNot             : r0_73
-#  168|     r0_75(glval<bool>)  = VariableAddress[b]     : 
-#  168|     mu0_76(bool)        = Store                  : &:r0_75, r0_74
-#  168|     r0_77(glval<bool>)  = CopyValue              : r0_75
-#  169|     v0_78(void)         = NoOp                   : 
-#  153|     v0_79(void)         = ReturnVoid             : 
-#  153|     v0_80(void)         = UnmodeledUse           : mu*
-#  153|     v0_81(void)         = ExitFunction           : 
+#  158|     r0_18(glval<int>)   = VariableAddress[i]     : 
+#  158|     r0_19(int)          = Load                   : &:r0_18, ~mu0_2
+#  158|     r0_20(glval<int *>) = VariableAddress[p]     : 
+#  158|     r0_21(int *)        = Load                   : &:r0_20, ~mu0_2
+#  158|     r0_22(int *)        = PointerAdd[4]          : r0_21, r0_19
+#  158|     r0_23(glval<int *>) = VariableAddress[q]     : 
+#  158|     mu0_24(int *)       = Store                  : &:r0_23, r0_22
+#  159|     r0_25(glval<int *>) = VariableAddress[p]     : 
+#  159|     r0_26(int *)        = Load                   : &:r0_25, ~mu0_2
+#  159|     r0_27(glval<int>)   = VariableAddress[i]     : 
+#  159|     r0_28(int)          = Load                   : &:r0_27, ~mu0_2
+#  159|     r0_29(int *)        = PointerSub[4]          : r0_26, r0_28
+#  159|     r0_30(glval<int *>) = VariableAddress[q]     : 
+#  159|     mu0_31(int *)       = Store                  : &:r0_30, r0_29
+#  160|     r0_32(glval<int *>) = VariableAddress[p]     : 
+#  160|     r0_33(int *)        = Load                   : &:r0_32, ~mu0_2
+#  160|     r0_34(glval<int *>) = VariableAddress[q]     : 
+#  160|     r0_35(int *)        = Load                   : &:r0_34, ~mu0_2
+#  160|     r0_36(long)         = PointerDiff[4]         : r0_33, r0_35
+#  160|     r0_37(int)          = Convert                : r0_36
+#  160|     r0_38(glval<int>)   = VariableAddress[i]     : 
+#  160|     mu0_39(int)         = Store                  : &:r0_38, r0_37
+#  162|     r0_40(glval<int *>) = VariableAddress[p]     : 
+#  162|     r0_41(int *)        = Load                   : &:r0_40, ~mu0_2
+#  162|     r0_42(glval<int *>) = VariableAddress[q]     : 
+#  162|     mu0_43(int *)       = Store                  : &:r0_42, r0_41
+#  164|     r0_44(glval<int>)   = VariableAddress[i]     : 
+#  164|     r0_45(int)          = Load                   : &:r0_44, ~mu0_2
+#  164|     r0_46(glval<int *>) = VariableAddress[q]     : 
+#  164|     r0_47(int *)        = Load                   : &:r0_46, ~mu0_2
+#  164|     r0_48(int *)        = PointerAdd[4]          : r0_47, r0_45
+#  164|     mu0_49(int *)       = Store                  : &:r0_46, r0_48
+#  165|     r0_50(glval<int>)   = VariableAddress[i]     : 
+#  165|     r0_51(int)          = Load                   : &:r0_50, ~mu0_2
+#  165|     r0_52(glval<int *>) = VariableAddress[q]     : 
+#  165|     r0_53(int *)        = Load                   : &:r0_52, ~mu0_2
+#  165|     r0_54(int *)        = PointerSub[4]          : r0_53, r0_51
+#  165|     mu0_55(int *)       = Store                  : &:r0_52, r0_54
+#  167|     r0_56(glval<int *>) = VariableAddress[p]     : 
+#  167|     r0_57(int *)        = Load                   : &:r0_56, ~mu0_2
+#  167|     r0_58(int *)        = Constant[0]            : 
+#  167|     r0_59(bool)         = CompareNE              : r0_57, r0_58
+#  167|     r0_60(glval<bool>)  = VariableAddress[b]     : 
+#  167|     mu0_61(bool)        = Store                  : &:r0_60, r0_59
+#  168|     r0_62(glval<int *>) = VariableAddress[p]     : 
+#  168|     r0_63(int *)        = Load                   : &:r0_62, ~mu0_2
+#  168|     r0_64(int *)        = Constant[0]            : 
+#  168|     r0_65(bool)         = CompareNE              : r0_63, r0_64
+#  168|     r0_66(bool)         = LogicalNot             : r0_65
+#  168|     r0_67(glval<bool>)  = VariableAddress[b]     : 
+#  168|     mu0_68(bool)        = Store                  : &:r0_67, r0_66
+#  169|     v0_69(void)         = NoOp                   : 
+#  153|     v0_70(void)         = ReturnVoid             : 
+#  153|     v0_71(void)         = UnmodeledUse           : mu*
+#  153|     v0_72(void)         = ExitFunction           : 
 
 #  171| void ArrayAccess(int*, int)
 #  171|   Block 0
@@ -866,76 +796,68 @@ ir.cpp:
 #  174|     r0_14(int)            = Load                   : &:r0_13, ~mu0_2
 #  174|     r0_15(glval<int>)     = VariableAddress[x]     : 
 #  174|     mu0_16(int)           = Store                  : &:r0_15, r0_14
-#  174|     r0_17(glval<int>)     = CopyValue              : r0_15
-#  175|     r0_18(glval<int *>)   = VariableAddress[p]     : 
-#  175|     r0_19(int *)          = Load                   : &:r0_18, ~mu0_2
-#  175|     r0_20(glval<int>)     = VariableAddress[i]     : 
-#  175|     r0_21(int)            = Load                   : &:r0_20, ~mu0_2
-#  175|     r0_22(glval<int>)     = PointerAdd[4]          : r0_19, r0_21
-#  175|     r0_23(int)            = Load                   : &:r0_22, ~mu0_2
-#  175|     r0_24(glval<int>)     = VariableAddress[x]     : 
-#  175|     mu0_25(int)           = Store                  : &:r0_24, r0_23
-#  175|     r0_26(glval<int>)     = CopyValue              : r0_24
-#  177|     r0_27(glval<int>)     = VariableAddress[x]     : 
-#  177|     r0_28(int)            = Load                   : &:r0_27, ~mu0_2
-#  177|     r0_29(glval<int *>)   = VariableAddress[p]     : 
-#  177|     r0_30(int *)          = Load                   : &:r0_29, ~mu0_2
-#  177|     r0_31(glval<int>)     = VariableAddress[i]     : 
-#  177|     r0_32(int)            = Load                   : &:r0_31, ~mu0_2
-#  177|     r0_33(glval<int>)     = PointerAdd[4]          : r0_30, r0_32
-#  177|     mu0_34(int)           = Store                  : &:r0_33, r0_28
-#  177|     r0_35(glval<int>)     = CopyValue              : r0_33
-#  178|     r0_36(glval<int>)     = VariableAddress[x]     : 
-#  178|     r0_37(int)            = Load                   : &:r0_36, ~mu0_2
-#  178|     r0_38(glval<int *>)   = VariableAddress[p]     : 
-#  178|     r0_39(int *)          = Load                   : &:r0_38, ~mu0_2
-#  178|     r0_40(glval<int>)     = VariableAddress[i]     : 
-#  178|     r0_41(int)            = Load                   : &:r0_40, ~mu0_2
-#  178|     r0_42(glval<int>)     = PointerAdd[4]          : r0_39, r0_41
-#  178|     mu0_43(int)           = Store                  : &:r0_42, r0_37
-#  178|     r0_44(glval<int>)     = CopyValue              : r0_42
-#  180|     r0_45(glval<int[10]>) = VariableAddress[a]     : 
-#  180|     mu0_46(int[10])       = Uninitialized[a]       : &:r0_45
-#  181|     r0_47(glval<int[10]>) = VariableAddress[a]     : 
-#  181|     r0_48(int *)          = Convert                : r0_47
-#  181|     r0_49(glval<int>)     = VariableAddress[i]     : 
-#  181|     r0_50(int)            = Load                   : &:r0_49, ~mu0_2
-#  181|     r0_51(glval<int>)     = PointerAdd[4]          : r0_48, r0_50
-#  181|     r0_52(int)            = Load                   : &:r0_51, ~mu0_2
-#  181|     r0_53(glval<int>)     = VariableAddress[x]     : 
-#  181|     mu0_54(int)           = Store                  : &:r0_53, r0_52
-#  181|     r0_55(glval<int>)     = CopyValue              : r0_53
-#  182|     r0_56(glval<int[10]>) = VariableAddress[a]     : 
-#  182|     r0_57(int *)          = Convert                : r0_56
-#  182|     r0_58(glval<int>)     = VariableAddress[i]     : 
-#  182|     r0_59(int)            = Load                   : &:r0_58, ~mu0_2
-#  182|     r0_60(glval<int>)     = PointerAdd[4]          : r0_57, r0_59
-#  182|     r0_61(int)            = Load                   : &:r0_60, ~mu0_2
-#  182|     r0_62(glval<int>)     = VariableAddress[x]     : 
-#  182|     mu0_63(int)           = Store                  : &:r0_62, r0_61
-#  182|     r0_64(glval<int>)     = CopyValue              : r0_62
-#  183|     r0_65(glval<int>)     = VariableAddress[x]     : 
-#  183|     r0_66(int)            = Load                   : &:r0_65, ~mu0_2
-#  183|     r0_67(glval<int[10]>) = VariableAddress[a]     : 
-#  183|     r0_68(int *)          = Convert                : r0_67
-#  183|     r0_69(glval<int>)     = VariableAddress[i]     : 
-#  183|     r0_70(int)            = Load                   : &:r0_69, ~mu0_2
-#  183|     r0_71(glval<int>)     = PointerAdd[4]          : r0_68, r0_70
-#  183|     mu0_72(int)           = Store                  : &:r0_71, r0_66
-#  183|     r0_73(glval<int>)     = CopyValue              : r0_71
-#  184|     r0_74(glval<int>)     = VariableAddress[x]     : 
-#  184|     r0_75(int)            = Load                   : &:r0_74, ~mu0_2
-#  184|     r0_76(glval<int[10]>) = VariableAddress[a]     : 
-#  184|     r0_77(int *)          = Convert                : r0_76
-#  184|     r0_78(glval<int>)     = VariableAddress[i]     : 
-#  184|     r0_79(int)            = Load                   : &:r0_78, ~mu0_2
-#  184|     r0_80(glval<int>)     = PointerAdd[4]          : r0_77, r0_79
-#  184|     mu0_81(int)           = Store                  : &:r0_80, r0_75
-#  184|     r0_82(glval<int>)     = CopyValue              : r0_80
-#  185|     v0_83(void)           = NoOp                   : 
-#  171|     v0_84(void)           = ReturnVoid             : 
-#  171|     v0_85(void)           = UnmodeledUse           : mu*
-#  171|     v0_86(void)           = ExitFunction           : 
+#  175|     r0_17(glval<int *>)   = VariableAddress[p]     : 
+#  175|     r0_18(int *)          = Load                   : &:r0_17, ~mu0_2
+#  175|     r0_19(glval<int>)     = VariableAddress[i]     : 
+#  175|     r0_20(int)            = Load                   : &:r0_19, ~mu0_2
+#  175|     r0_21(glval<int>)     = PointerAdd[4]          : r0_18, r0_20
+#  175|     r0_22(int)            = Load                   : &:r0_21, ~mu0_2
+#  175|     r0_23(glval<int>)     = VariableAddress[x]     : 
+#  175|     mu0_24(int)           = Store                  : &:r0_23, r0_22
+#  177|     r0_25(glval<int>)     = VariableAddress[x]     : 
+#  177|     r0_26(int)            = Load                   : &:r0_25, ~mu0_2
+#  177|     r0_27(glval<int *>)   = VariableAddress[p]     : 
+#  177|     r0_28(int *)          = Load                   : &:r0_27, ~mu0_2
+#  177|     r0_29(glval<int>)     = VariableAddress[i]     : 
+#  177|     r0_30(int)            = Load                   : &:r0_29, ~mu0_2
+#  177|     r0_31(glval<int>)     = PointerAdd[4]          : r0_28, r0_30
+#  177|     mu0_32(int)           = Store                  : &:r0_31, r0_26
+#  178|     r0_33(glval<int>)     = VariableAddress[x]     : 
+#  178|     r0_34(int)            = Load                   : &:r0_33, ~mu0_2
+#  178|     r0_35(glval<int *>)   = VariableAddress[p]     : 
+#  178|     r0_36(int *)          = Load                   : &:r0_35, ~mu0_2
+#  178|     r0_37(glval<int>)     = VariableAddress[i]     : 
+#  178|     r0_38(int)            = Load                   : &:r0_37, ~mu0_2
+#  178|     r0_39(glval<int>)     = PointerAdd[4]          : r0_36, r0_38
+#  178|     mu0_40(int)           = Store                  : &:r0_39, r0_34
+#  180|     r0_41(glval<int[10]>) = VariableAddress[a]     : 
+#  180|     mu0_42(int[10])       = Uninitialized[a]       : &:r0_41
+#  181|     r0_43(glval<int[10]>) = VariableAddress[a]     : 
+#  181|     r0_44(int *)          = Convert                : r0_43
+#  181|     r0_45(glval<int>)     = VariableAddress[i]     : 
+#  181|     r0_46(int)            = Load                   : &:r0_45, ~mu0_2
+#  181|     r0_47(glval<int>)     = PointerAdd[4]          : r0_44, r0_46
+#  181|     r0_48(int)            = Load                   : &:r0_47, ~mu0_2
+#  181|     r0_49(glval<int>)     = VariableAddress[x]     : 
+#  181|     mu0_50(int)           = Store                  : &:r0_49, r0_48
+#  182|     r0_51(glval<int[10]>) = VariableAddress[a]     : 
+#  182|     r0_52(int *)          = Convert                : r0_51
+#  182|     r0_53(glval<int>)     = VariableAddress[i]     : 
+#  182|     r0_54(int)            = Load                   : &:r0_53, ~mu0_2
+#  182|     r0_55(glval<int>)     = PointerAdd[4]          : r0_52, r0_54
+#  182|     r0_56(int)            = Load                   : &:r0_55, ~mu0_2
+#  182|     r0_57(glval<int>)     = VariableAddress[x]     : 
+#  182|     mu0_58(int)           = Store                  : &:r0_57, r0_56
+#  183|     r0_59(glval<int>)     = VariableAddress[x]     : 
+#  183|     r0_60(int)            = Load                   : &:r0_59, ~mu0_2
+#  183|     r0_61(glval<int[10]>) = VariableAddress[a]     : 
+#  183|     r0_62(int *)          = Convert                : r0_61
+#  183|     r0_63(glval<int>)     = VariableAddress[i]     : 
+#  183|     r0_64(int)            = Load                   : &:r0_63, ~mu0_2
+#  183|     r0_65(glval<int>)     = PointerAdd[4]          : r0_62, r0_64
+#  183|     mu0_66(int)           = Store                  : &:r0_65, r0_60
+#  184|     r0_67(glval<int>)     = VariableAddress[x]     : 
+#  184|     r0_68(int)            = Load                   : &:r0_67, ~mu0_2
+#  184|     r0_69(glval<int[10]>) = VariableAddress[a]     : 
+#  184|     r0_70(int *)          = Convert                : r0_69
+#  184|     r0_71(glval<int>)     = VariableAddress[i]     : 
+#  184|     r0_72(int)            = Load                   : &:r0_71, ~mu0_2
+#  184|     r0_73(glval<int>)     = PointerAdd[4]          : r0_70, r0_72
+#  184|     mu0_74(int)           = Store                  : &:r0_73, r0_68
+#  185|     v0_75(void)           = NoOp                   : 
+#  171|     v0_76(void)           = ReturnVoid             : 
+#  171|     v0_77(void)           = UnmodeledUse           : mu*
+#  171|     v0_78(void)           = ExitFunction           : 
 
 #  187| void StringLiteral(int)
 #  187|   Block 0
@@ -988,51 +910,45 @@ ir.cpp:
 #  196|     r0_13(bool)         = CompareEQ              : r0_10, r0_12
 #  196|     r0_14(glval<bool>)  = VariableAddress[b]     : 
 #  196|     mu0_15(bool)        = Store                  : &:r0_14, r0_13
-#  196|     r0_16(glval<bool>)  = CopyValue              : r0_14
-#  197|     r0_17(glval<int *>) = VariableAddress[p]     : 
-#  197|     r0_18(int *)        = Load                   : &:r0_17, ~mu0_2
-#  197|     r0_19(glval<int *>) = VariableAddress[q]     : 
-#  197|     r0_20(int *)        = Load                   : &:r0_19, ~mu0_2
-#  197|     r0_21(bool)         = CompareNE              : r0_18, r0_20
-#  197|     r0_22(glval<bool>)  = VariableAddress[b]     : 
-#  197|     mu0_23(bool)        = Store                  : &:r0_22, r0_21
-#  197|     r0_24(glval<bool>)  = CopyValue              : r0_22
-#  198|     r0_25(glval<int *>) = VariableAddress[p]     : 
+#  197|     r0_16(glval<int *>) = VariableAddress[p]     : 
+#  197|     r0_17(int *)        = Load                   : &:r0_16, ~mu0_2
+#  197|     r0_18(glval<int *>) = VariableAddress[q]     : 
+#  197|     r0_19(int *)        = Load                   : &:r0_18, ~mu0_2
+#  197|     r0_20(bool)         = CompareNE              : r0_17, r0_19
+#  197|     r0_21(glval<bool>)  = VariableAddress[b]     : 
+#  197|     mu0_22(bool)        = Store                  : &:r0_21, r0_20
+#  198|     r0_23(glval<int *>) = VariableAddress[p]     : 
+#  198|     r0_24(int *)        = Load                   : &:r0_23, ~mu0_2
+#  198|     r0_25(glval<int *>) = VariableAddress[q]     : 
 #  198|     r0_26(int *)        = Load                   : &:r0_25, ~mu0_2
-#  198|     r0_27(glval<int *>) = VariableAddress[q]     : 
-#  198|     r0_28(int *)        = Load                   : &:r0_27, ~mu0_2
-#  198|     r0_29(bool)         = CompareLT              : r0_26, r0_28
-#  198|     r0_30(glval<bool>)  = VariableAddress[b]     : 
-#  198|     mu0_31(bool)        = Store                  : &:r0_30, r0_29
-#  198|     r0_32(glval<bool>)  = CopyValue              : r0_30
-#  199|     r0_33(glval<int *>) = VariableAddress[p]     : 
-#  199|     r0_34(int *)        = Load                   : &:r0_33, ~mu0_2
-#  199|     r0_35(glval<int *>) = VariableAddress[q]     : 
-#  199|     r0_36(int *)        = Load                   : &:r0_35, ~mu0_2
-#  199|     r0_37(bool)         = CompareGT              : r0_34, r0_36
-#  199|     r0_38(glval<bool>)  = VariableAddress[b]     : 
-#  199|     mu0_39(bool)        = Store                  : &:r0_38, r0_37
-#  199|     r0_40(glval<bool>)  = CopyValue              : r0_38
-#  200|     r0_41(glval<int *>) = VariableAddress[p]     : 
-#  200|     r0_42(int *)        = Load                   : &:r0_41, ~mu0_2
-#  200|     r0_43(glval<int *>) = VariableAddress[q]     : 
-#  200|     r0_44(int *)        = Load                   : &:r0_43, ~mu0_2
-#  200|     r0_45(bool)         = CompareLE              : r0_42, r0_44
-#  200|     r0_46(glval<bool>)  = VariableAddress[b]     : 
-#  200|     mu0_47(bool)        = Store                  : &:r0_46, r0_45
-#  200|     r0_48(glval<bool>)  = CopyValue              : r0_46
-#  201|     r0_49(glval<int *>) = VariableAddress[p]     : 
-#  201|     r0_50(int *)        = Load                   : &:r0_49, ~mu0_2
-#  201|     r0_51(glval<int *>) = VariableAddress[q]     : 
-#  201|     r0_52(int *)        = Load                   : &:r0_51, ~mu0_2
-#  201|     r0_53(bool)         = CompareGE              : r0_50, r0_52
-#  201|     r0_54(glval<bool>)  = VariableAddress[b]     : 
-#  201|     mu0_55(bool)        = Store                  : &:r0_54, r0_53
-#  201|     r0_56(glval<bool>)  = CopyValue              : r0_54
-#  202|     v0_57(void)         = NoOp                   : 
-#  193|     v0_58(void)         = ReturnVoid             : 
-#  193|     v0_59(void)         = UnmodeledUse           : mu*
-#  193|     v0_60(void)         = ExitFunction           : 
+#  198|     r0_27(bool)         = CompareLT              : r0_24, r0_26
+#  198|     r0_28(glval<bool>)  = VariableAddress[b]     : 
+#  198|     mu0_29(bool)        = Store                  : &:r0_28, r0_27
+#  199|     r0_30(glval<int *>) = VariableAddress[p]     : 
+#  199|     r0_31(int *)        = Load                   : &:r0_30, ~mu0_2
+#  199|     r0_32(glval<int *>) = VariableAddress[q]     : 
+#  199|     r0_33(int *)        = Load                   : &:r0_32, ~mu0_2
+#  199|     r0_34(bool)         = CompareGT              : r0_31, r0_33
+#  199|     r0_35(glval<bool>)  = VariableAddress[b]     : 
+#  199|     mu0_36(bool)        = Store                  : &:r0_35, r0_34
+#  200|     r0_37(glval<int *>) = VariableAddress[p]     : 
+#  200|     r0_38(int *)        = Load                   : &:r0_37, ~mu0_2
+#  200|     r0_39(glval<int *>) = VariableAddress[q]     : 
+#  200|     r0_40(int *)        = Load                   : &:r0_39, ~mu0_2
+#  200|     r0_41(bool)         = CompareLE              : r0_38, r0_40
+#  200|     r0_42(glval<bool>)  = VariableAddress[b]     : 
+#  200|     mu0_43(bool)        = Store                  : &:r0_42, r0_41
+#  201|     r0_44(glval<int *>) = VariableAddress[p]     : 
+#  201|     r0_45(int *)        = Load                   : &:r0_44, ~mu0_2
+#  201|     r0_46(glval<int *>) = VariableAddress[q]     : 
+#  201|     r0_47(int *)        = Load                   : &:r0_46, ~mu0_2
+#  201|     r0_48(bool)         = CompareGE              : r0_45, r0_47
+#  201|     r0_49(glval<bool>)  = VariableAddress[b]     : 
+#  201|     mu0_50(bool)        = Store                  : &:r0_49, r0_48
+#  202|     v0_51(void)         = NoOp                   : 
+#  193|     v0_52(void)         = ReturnVoid             : 
+#  193|     v0_53(void)         = UnmodeledUse           : mu*
+#  193|     v0_54(void)         = ExitFunction           : 
 
 #  204| void PointerCrement(int*)
 #  204|   Block 0
@@ -1050,35 +966,31 @@ ir.cpp:
 #  207|     mu0_11(int *)       = Store                  : &:r0_7, r0_10
 #  207|     r0_12(glval<int *>) = VariableAddress[q]     : 
 #  207|     mu0_13(int *)       = Store                  : &:r0_12, r0_10
-#  207|     r0_14(glval<int *>) = CopyValue              : r0_12
-#  208|     r0_15(glval<int *>) = VariableAddress[p]     : 
-#  208|     r0_16(int *)        = Load                   : &:r0_15, ~mu0_2
-#  208|     r0_17(int)          = Constant[1]            : 
-#  208|     r0_18(int *)        = PointerSub[4]          : r0_16, r0_17
-#  208|     mu0_19(int *)       = Store                  : &:r0_15, r0_18
-#  208|     r0_20(glval<int *>) = VariableAddress[q]     : 
-#  208|     mu0_21(int *)       = Store                  : &:r0_20, r0_18
-#  208|     r0_22(glval<int *>) = CopyValue              : r0_20
-#  209|     r0_23(glval<int *>) = VariableAddress[p]     : 
-#  209|     r0_24(int *)        = Load                   : &:r0_23, ~mu0_2
-#  209|     r0_25(int)          = Constant[1]            : 
-#  209|     r0_26(int *)        = PointerAdd[4]          : r0_24, r0_25
-#  209|     mu0_27(int *)       = Store                  : &:r0_23, r0_26
-#  209|     r0_28(glval<int *>) = VariableAddress[q]     : 
-#  209|     mu0_29(int *)       = Store                  : &:r0_28, r0_24
-#  209|     r0_30(glval<int *>) = CopyValue              : r0_28
-#  210|     r0_31(glval<int *>) = VariableAddress[p]     : 
-#  210|     r0_32(int *)        = Load                   : &:r0_31, ~mu0_2
-#  210|     r0_33(int)          = Constant[1]            : 
-#  210|     r0_34(int *)        = PointerSub[4]          : r0_32, r0_33
-#  210|     mu0_35(int *)       = Store                  : &:r0_31, r0_34
-#  210|     r0_36(glval<int *>) = VariableAddress[q]     : 
-#  210|     mu0_37(int *)       = Store                  : &:r0_36, r0_32
-#  210|     r0_38(glval<int *>) = CopyValue              : r0_36
-#  211|     v0_39(void)         = NoOp                   : 
-#  204|     v0_40(void)         = ReturnVoid             : 
-#  204|     v0_41(void)         = UnmodeledUse           : mu*
-#  204|     v0_42(void)         = ExitFunction           : 
+#  208|     r0_14(glval<int *>) = VariableAddress[p]     : 
+#  208|     r0_15(int *)        = Load                   : &:r0_14, ~mu0_2
+#  208|     r0_16(int)          = Constant[1]            : 
+#  208|     r0_17(int *)        = PointerSub[4]          : r0_15, r0_16
+#  208|     mu0_18(int *)       = Store                  : &:r0_14, r0_17
+#  208|     r0_19(glval<int *>) = VariableAddress[q]     : 
+#  208|     mu0_20(int *)       = Store                  : &:r0_19, r0_17
+#  209|     r0_21(glval<int *>) = VariableAddress[p]     : 
+#  209|     r0_22(int *)        = Load                   : &:r0_21, ~mu0_2
+#  209|     r0_23(int)          = Constant[1]            : 
+#  209|     r0_24(int *)        = PointerAdd[4]          : r0_22, r0_23
+#  209|     mu0_25(int *)       = Store                  : &:r0_21, r0_24
+#  209|     r0_26(glval<int *>) = VariableAddress[q]     : 
+#  209|     mu0_27(int *)       = Store                  : &:r0_26, r0_22
+#  210|     r0_28(glval<int *>) = VariableAddress[p]     : 
+#  210|     r0_29(int *)        = Load                   : &:r0_28, ~mu0_2
+#  210|     r0_30(int)          = Constant[1]            : 
+#  210|     r0_31(int *)        = PointerSub[4]          : r0_29, r0_30
+#  210|     mu0_32(int *)       = Store                  : &:r0_28, r0_31
+#  210|     r0_33(glval<int *>) = VariableAddress[q]     : 
+#  210|     mu0_34(int *)       = Store                  : &:r0_33, r0_29
+#  211|     v0_35(void)         = NoOp                   : 
+#  204|     v0_36(void)         = ReturnVoid             : 
+#  204|     v0_37(void)         = UnmodeledUse           : mu*
+#  204|     v0_38(void)         = ExitFunction           : 
 
 #  213| void CompoundAssignment()
 #  213|   Block 0
@@ -1093,40 +1005,36 @@ ir.cpp:
 #  216|     r0_8(int)           = Load                : &:r0_7, ~mu0_2
 #  216|     r0_9(int)           = Add                 : r0_8, r0_6
 #  216|     mu0_10(int)         = Store               : &:r0_7, r0_9
-#  216|     r0_11(glval<int>)   = CopyValue           : r0_7
-#  219|     r0_12(glval<short>) = VariableAddress[y]  : 
-#  219|     r0_13(short)        = Constant[5]         : 
-#  219|     mu0_14(short)       = Store               : &:r0_12, r0_13
-#  220|     r0_15(glval<int>)   = VariableAddress[x]  : 
-#  220|     r0_16(int)          = Load                : &:r0_15, ~mu0_2
-#  220|     r0_17(glval<short>) = VariableAddress[y]  : 
-#  220|     r0_18(short)        = Load                : &:r0_17, ~mu0_2
-#  220|     r0_19(int)          = Convert             : r0_18
-#  220|     r0_20(int)          = Add                 : r0_19, r0_16
-#  220|     r0_21(short)        = Convert             : r0_20
-#  220|     mu0_22(short)       = Store               : &:r0_17, r0_21
-#  220|     r0_23(glval<short>) = CopyValue           : r0_17
-#  223|     r0_24(int)          = Constant[1]         : 
-#  223|     r0_25(glval<short>) = VariableAddress[y]  : 
-#  223|     r0_26(short)        = Load                : &:r0_25, ~mu0_2
-#  223|     r0_27(short)        = ShiftLeft           : r0_26, r0_24
-#  223|     mu0_28(short)       = Store               : &:r0_25, r0_27
-#  223|     r0_29(glval<short>) = CopyValue           : r0_25
-#  226|     r0_30(glval<long>)  = VariableAddress[z]  : 
-#  226|     r0_31(long)         = Constant[7]         : 
-#  226|     mu0_32(long)        = Store               : &:r0_30, r0_31
-#  227|     r0_33(float)        = Constant[2.0]       : 
-#  227|     r0_34(glval<long>)  = VariableAddress[z]  : 
-#  227|     r0_35(long)         = Load                : &:r0_34, ~mu0_2
-#  227|     r0_36(float)        = Convert             : r0_35
-#  227|     r0_37(float)        = Add                 : r0_36, r0_33
-#  227|     r0_38(long)         = Convert             : r0_37
-#  227|     mu0_39(long)        = Store               : &:r0_34, r0_38
-#  227|     r0_40(glval<long>)  = CopyValue           : r0_34
-#  228|     v0_41(void)         = NoOp                : 
-#  213|     v0_42(void)         = ReturnVoid          : 
-#  213|     v0_43(void)         = UnmodeledUse        : mu*
-#  213|     v0_44(void)         = ExitFunction        : 
+#  219|     r0_11(glval<short>) = VariableAddress[y]  : 
+#  219|     r0_12(short)        = Constant[5]         : 
+#  219|     mu0_13(short)       = Store               : &:r0_11, r0_12
+#  220|     r0_14(glval<int>)   = VariableAddress[x]  : 
+#  220|     r0_15(int)          = Load                : &:r0_14, ~mu0_2
+#  220|     r0_16(glval<short>) = VariableAddress[y]  : 
+#  220|     r0_17(short)        = Load                : &:r0_16, ~mu0_2
+#  220|     r0_18(int)          = Convert             : r0_17
+#  220|     r0_19(int)          = Add                 : r0_18, r0_15
+#  220|     r0_20(short)        = Convert             : r0_19
+#  220|     mu0_21(short)       = Store               : &:r0_16, r0_20
+#  223|     r0_22(int)          = Constant[1]         : 
+#  223|     r0_23(glval<short>) = VariableAddress[y]  : 
+#  223|     r0_24(short)        = Load                : &:r0_23, ~mu0_2
+#  223|     r0_25(short)        = ShiftLeft           : r0_24, r0_22
+#  223|     mu0_26(short)       = Store               : &:r0_23, r0_25
+#  226|     r0_27(glval<long>)  = VariableAddress[z]  : 
+#  226|     r0_28(long)         = Constant[7]         : 
+#  226|     mu0_29(long)        = Store               : &:r0_27, r0_28
+#  227|     r0_30(float)        = Constant[2.0]       : 
+#  227|     r0_31(glval<long>)  = VariableAddress[z]  : 
+#  227|     r0_32(long)         = Load                : &:r0_31, ~mu0_2
+#  227|     r0_33(float)        = Convert             : r0_32
+#  227|     r0_34(float)        = Add                 : r0_33, r0_30
+#  227|     r0_35(long)         = Convert             : r0_34
+#  227|     mu0_36(long)        = Store               : &:r0_31, r0_35
+#  228|     v0_37(void)         = NoOp                : 
+#  213|     v0_38(void)         = ReturnVoid          : 
+#  213|     v0_39(void)         = UnmodeledUse        : mu*
+#  213|     v0_40(void)         = ExitFunction        : 
 
 #  230| void UninitializedVariables()
 #  230|   Block 0
@@ -1194,7 +1102,6 @@ ir.cpp:
 #  244|     r2_1(int)        = Load               : &:r2_0, ~mu0_2
 #  244|     r2_2(glval<int>) = VariableAddress[x] : 
 #  244|     mu2_3(int)       = Store              : &:r2_2, r2_1
-#  244|     r2_4(glval<int>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  247|   Block 3
@@ -1210,14 +1117,12 @@ ir.cpp:
 #  248|     r4_0(int)        = Constant[2]        : 
 #  248|     r4_1(glval<int>) = VariableAddress[x] : 
 #  248|     mu4_2(int)       = Store              : &:r4_1, r4_0
-#  248|     r4_3(glval<int>) = CopyValue          : r4_1
 #-----|   Goto -> Block 6
 
 #  250|   Block 5
 #  250|     r5_0(int)        = Constant[7]        : 
 #  250|     r5_1(glval<int>) = VariableAddress[x] : 
 #  250|     mu5_2(int)       = Store              : &:r5_1, r5_0
-#  250|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 6
 
 #  251|   Block 6
@@ -1245,7 +1150,6 @@ ir.cpp:
 #  255|     r1_2(int)        = Load               : &:r1_1, ~mu0_2
 #  255|     r1_3(int)        = Sub                : r1_2, r1_0
 #  255|     mu1_4(int)       = Store              : &:r1_1, r1_3
-#  255|     r1_5(glval<int>) = CopyValue          : r1_1
 #-----|   Goto (back edge) -> Block 3
 
 #  257|   Block 2
@@ -1278,12 +1182,11 @@ ir.cpp:
 #  261|     r1_2(int)        = Load               : &:r1_1, ~mu0_2
 #  261|     r1_3(int)        = Sub                : r1_2, r1_0
 #  261|     mu1_4(int)       = Store              : &:r1_1, r1_3
-#  261|     r1_5(glval<int>) = CopyValue          : r1_1
-#  262|     r1_6(glval<int>) = VariableAddress[n] : 
-#  262|     r1_7(int)        = Load               : &:r1_6, ~mu0_2
-#  262|     r1_8(int)        = Constant[0]        : 
-#  262|     r1_9(bool)       = CompareGT          : r1_7, r1_8
-#  262|     v1_10(void)      = ConditionalBranch  : r1_9
+#  262|     r1_5(glval<int>) = VariableAddress[n] : 
+#  262|     r1_6(int)        = Load               : &:r1_5, ~mu0_2
+#  262|     r1_7(int)        = Constant[0]        : 
+#  262|     r1_8(bool)       = CompareGT          : r1_6, r1_7
+#  262|     v1_9(void)       = ConditionalBranch  : r1_8
 #-----|   False -> Block 2
 #-----|   True (back edge) -> Block 1
 
@@ -1381,7 +1284,6 @@ ir.cpp:
 #  287|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  287|     r2_4(int)        = Add                : r2_3, r2_1
 #  287|     mu2_5(int)       = Store              : &:r2_2, r2_4
-#  287|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 2
 
 #  292| void For_InitCondition()
@@ -1435,7 +1337,6 @@ ir.cpp:
 #  299|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  299|     r2_4(int)        = Add                : r2_3, r2_1
 #  299|     mu2_5(int)       = Store              : &:r2_2, r2_4
-#  299|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 2
 
 #  304| void For_ConditionUpdate()
@@ -1464,7 +1365,6 @@ ir.cpp:
 #  306|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  306|     r2_4(int)        = Add                : r2_3, r2_1
 #  306|     mu2_5(int)       = Store              : &:r2_2, r2_4
-#  306|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 1
 
 #  309|   Block 3
@@ -1499,7 +1399,6 @@ ir.cpp:
 #  312|     r2_3(int)        = Load               : &:r2_2, ~mu0_2
 #  312|     r2_4(int)        = Add                : r2_3, r2_1
 #  312|     mu2_5(int)       = Store              : &:r2_2, r2_4
-#  312|     r2_6(glval<int>) = CopyValue          : r2_2
 #-----|   Goto (back edge) -> Block 1
 
 #  315|   Block 3
@@ -1533,7 +1432,6 @@ ir.cpp:
 #  318|     r2_2(int)        = Load               : &:r2_1, ~mu0_2
 #  318|     r2_3(int)        = Add                : r2_2, r2_0
 #  318|     mu2_4(int)       = Store              : &:r2_1, r2_3
-#  318|     r2_5(glval<int>) = CopyValue          : r2_1
 #-----|   Goto (back edge) -> Block 1
 
 #  319|   Block 3
@@ -1595,7 +1493,6 @@ ir.cpp:
 #  326|     r4_3(int)        = Load               : &:r4_2, ~mu0_2
 #  326|     r4_4(int)        = Add                : r4_3, r4_1
 #  326|     mu4_5(int)       = Store              : &:r4_2, r4_4
-#  326|     r4_6(glval<int>) = CopyValue          : r4_2
 #-----|   Goto (back edge) -> Block 1
 
 #  331|   Block 5
@@ -1658,16 +1555,15 @@ ir.cpp:
 #  342|     r0_7(int *)         = Load                     : &:r0_6, ~mu0_2
 #  342|     r0_8(glval<int>)    = CopyValue                : r0_7
 #  342|     mu0_9(int)          = Store                    : &:r0_8, r0_5
-#  342|     r0_10(glval<int>)   = CopyValue                : r0_8
-#  343|     r0_11(glval<int>)   = VariableAddress[#return] : 
-#  343|     r0_12(glval<int *>) = VariableAddress[p]       : 
-#  343|     r0_13(int *)        = Load                     : &:r0_12, ~mu0_2
-#  343|     r0_14(int)          = Load                     : &:r0_13, ~mu0_2
-#  343|     mu0_15(int)         = Store                    : &:r0_11, r0_14
-#  341|     r0_16(glval<int>)   = VariableAddress[#return] : 
-#  341|     v0_17(void)         = ReturnValue              : &:r0_16, ~mu0_2
-#  341|     v0_18(void)         = UnmodeledUse             : mu*
-#  341|     v0_19(void)         = ExitFunction             : 
+#  343|     r0_10(glval<int>)   = VariableAddress[#return] : 
+#  343|     r0_11(glval<int *>) = VariableAddress[p]       : 
+#  343|     r0_12(int *)        = Load                     : &:r0_11, ~mu0_2
+#  343|     r0_13(int)          = Load                     : &:r0_12, ~mu0_2
+#  343|     mu0_14(int)         = Store                    : &:r0_10, r0_13
+#  341|     r0_15(glval<int>)   = VariableAddress[#return] : 
+#  341|     v0_16(void)         = ReturnValue              : &:r0_15, ~mu0_2
+#  341|     v0_17(void)         = UnmodeledUse             : mu*
+#  341|     v0_18(void)         = ExitFunction             : 
 
 #  348| int* AddressOf()
 #  348|   Block 0
@@ -1711,7 +1607,6 @@ ir.cpp:
 #  356|     r3_2(int)        = Load               : &:r3_1, ~mu0_2
 #  356|     r3_3(int)        = Sub                : r3_2, r3_0
 #  356|     mu3_4(int)       = Store              : &:r3_1, r3_3
-#  356|     r3_5(glval<int>) = CopyValue          : r3_1
 #-----|   Goto (back edge) -> Block 5
 
 #  357|   Block 4
@@ -1758,7 +1653,6 @@ ir.cpp:
 #  365|     r3_2(int)        = Load               : &:r3_1, ~mu0_2
 #  365|     r3_3(int)        = Sub                : r3_2, r3_0
 #  365|     mu3_4(int)       = Store              : &:r3_1, r3_3
-#  365|     r3_5(glval<int>) = CopyValue          : r3_1
 #-----|   Goto -> Block 4
 
 #  361|   Block 4
@@ -1863,7 +1757,6 @@ ir.cpp:
 #  387|     r1_0(int)        = Constant[1234]     : 
 #  387|     r1_1(glval<int>) = VariableAddress[y] : 
 #  387|     mu1_2(int)       = Store              : &:r1_1, r1_0
-#  387|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 2
 
 #  389|   Block 2
@@ -1871,8 +1764,7 @@ ir.cpp:
 #  390|     r2_1(int)        = Constant[-1]       : 
 #  390|     r2_2(glval<int>) = VariableAddress[y] : 
 #  390|     mu2_3(int)       = Store              : &:r2_2, r2_1
-#  390|     r2_4(glval<int>) = CopyValue          : r2_2
-#  391|     v2_5(void)       = NoOp               : 
+#  391|     v2_4(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  393|   Block 3
@@ -1884,8 +1776,7 @@ ir.cpp:
 #  395|     r4_1(int)        = Constant[1]        : 
 #  395|     r4_2(glval<int>) = VariableAddress[y] : 
 #  395|     mu4_3(int)       = Store              : &:r4_2, r4_1
-#  395|     r4_4(glval<int>) = CopyValue          : r4_2
-#  396|     v4_5(void)       = NoOp               : 
+#  396|     v4_4(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  398|   Block 5
@@ -1893,7 +1784,6 @@ ir.cpp:
 #  399|     r5_1(int)        = Constant[3]        : 
 #  399|     r5_2(glval<int>) = VariableAddress[y] : 
 #  399|     mu5_3(int)       = Store              : &:r5_2, r5_1
-#  399|     r5_4(glval<int>) = CopyValue          : r5_2
 #-----|   Goto -> Block 6
 
 #  400|   Block 6
@@ -1901,8 +1791,7 @@ ir.cpp:
 #  401|     r6_1(int)        = Constant[4]        : 
 #  401|     r6_2(glval<int>) = VariableAddress[y] : 
 #  401|     mu6_3(int)       = Store              : &:r6_2, r6_1
-#  401|     r6_4(glval<int>) = CopyValue          : r6_2
-#  402|     v6_5(void)       = NoOp               : 
+#  402|     v6_4(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  404|   Block 7
@@ -1910,15 +1799,13 @@ ir.cpp:
 #  405|     r7_1(int)        = Constant[0]        : 
 #  405|     r7_2(glval<int>) = VariableAddress[y] : 
 #  405|     mu7_3(int)       = Store              : &:r7_2, r7_1
-#  405|     r7_4(glval<int>) = CopyValue          : r7_2
-#  406|     v7_5(void)       = NoOp               : 
+#  406|     v7_4(void)       = NoOp               : 
 #-----|   Goto -> Block 9
 
 #  408|   Block 8
 #  408|     r8_0(int)        = Constant[5678]     : 
 #  408|     r8_1(glval<int>) = VariableAddress[y] : 
 #  408|     mu8_2(int)       = Store              : &:r8_1, r8_0
-#  408|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 9
 
 #  409|   Block 9
@@ -1955,23 +1842,21 @@ ir.cpp:
 #  428|     r0_6(glval<Point>)  = VariableAddress[pt] : 
 #  428|     r0_7(glval<int>)    = FieldAddress[x]     : r0_6
 #  428|     mu0_8(int)          = Store               : &:r0_7, r0_5
-#  428|     r0_9(glval<int>)    = CopyValue           : r0_7
-#  429|     r0_10(glval<Point>) = VariableAddress[pt] : 
-#  429|     r0_11(glval<int>)   = FieldAddress[x]     : r0_10
-#  429|     r0_12(int)          = Load                : &:r0_11, ~mu0_2
-#  429|     r0_13(glval<Point>) = VariableAddress[pt] : 
-#  429|     r0_14(glval<int>)   = FieldAddress[y]     : r0_13
-#  429|     mu0_15(int)         = Store               : &:r0_14, r0_12
-#  429|     r0_16(glval<int>)   = CopyValue           : r0_14
-#  430|     r0_17(glval<int *>) = VariableAddress[p]  : 
-#  430|     r0_18(glval<Point>) = VariableAddress[pt] : 
-#  430|     r0_19(glval<int>)   = FieldAddress[y]     : r0_18
-#  430|     r0_20(int *)        = CopyValue           : r0_19
-#  430|     mu0_21(int *)       = Store               : &:r0_17, r0_20
-#  431|     v0_22(void)         = NoOp                : 
-#  426|     v0_23(void)         = ReturnVoid          : 
-#  426|     v0_24(void)         = UnmodeledUse        : mu*
-#  426|     v0_25(void)         = ExitFunction        : 
+#  429|     r0_9(glval<Point>)  = VariableAddress[pt] : 
+#  429|     r0_10(glval<int>)   = FieldAddress[x]     : r0_9
+#  429|     r0_11(int)          = Load                : &:r0_10, ~mu0_2
+#  429|     r0_12(glval<Point>) = VariableAddress[pt] : 
+#  429|     r0_13(glval<int>)   = FieldAddress[y]     : r0_12
+#  429|     mu0_14(int)         = Store               : &:r0_13, r0_11
+#  430|     r0_15(glval<int *>) = VariableAddress[p]  : 
+#  430|     r0_16(glval<Point>) = VariableAddress[pt] : 
+#  430|     r0_17(glval<int>)   = FieldAddress[y]     : r0_16
+#  430|     r0_18(int *)        = CopyValue           : r0_17
+#  430|     mu0_19(int *)       = Store               : &:r0_15, r0_18
+#  431|     v0_20(void)         = NoOp                : 
+#  426|     v0_21(void)         = ReturnVoid          : 
+#  426|     v0_22(void)         = UnmodeledUse        : mu*
+#  426|     v0_23(void)         = ExitFunction        : 
 
 #  433| void LogicalOr(bool, bool)
 #  433|   Block 0
@@ -2001,7 +1886,6 @@ ir.cpp:
 #  436|     r2_0(int)        = Constant[7]        : 
 #  436|     r2_1(glval<int>) = VariableAddress[x] : 
 #  436|     mu2_2(int)       = Store              : &:r2_1, r2_0
-#  436|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #  439|   Block 3
@@ -2022,14 +1906,12 @@ ir.cpp:
 #  440|     r5_0(int)        = Constant[1]        : 
 #  440|     r5_1(glval<int>) = VariableAddress[x] : 
 #  440|     mu5_2(int)       = Store              : &:r5_1, r5_0
-#  440|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 7
 
 #  443|   Block 6
 #  443|     r6_0(int)        = Constant[5]        : 
 #  443|     r6_1(glval<int>) = VariableAddress[x] : 
 #  443|     mu6_2(int)       = Store              : &:r6_1, r6_0
-#  443|     r6_3(glval<int>) = CopyValue          : r6_1
 #-----|   Goto -> Block 7
 
 #  445|   Block 7
@@ -2066,7 +1948,6 @@ ir.cpp:
 #  450|     r2_0(int)        = Constant[7]        : 
 #  450|     r2_1(glval<int>) = VariableAddress[x] : 
 #  450|     mu2_2(int)       = Store              : &:r2_1, r2_0
-#  450|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #  453|   Block 3
@@ -2087,14 +1968,12 @@ ir.cpp:
 #  454|     r5_0(int)        = Constant[1]        : 
 #  454|     r5_1(glval<int>) = VariableAddress[x] : 
 #  454|     mu5_2(int)       = Store              : &:r5_1, r5_0
-#  454|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 7
 
 #  457|   Block 6
 #  457|     r6_0(int)        = Constant[5]        : 
 #  457|     r6_1(glval<int>) = VariableAddress[x] : 
 #  457|     mu6_2(int)       = Store              : &:r6_1, r6_0
-#  457|     r6_3(glval<int>) = CopyValue          : r6_1
 #-----|   Goto -> Block 7
 
 #  459|   Block 7
@@ -2124,7 +2003,6 @@ ir.cpp:
 #  464|     r1_0(int)        = Constant[1]        : 
 #  464|     r1_1(glval<int>) = VariableAddress[x] : 
 #  464|     mu1_2(int)       = Store              : &:r1_1, r1_0
-#  464|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 2
 
 #  467|   Block 2
@@ -2145,14 +2023,12 @@ ir.cpp:
 #  468|     r4_0(int)        = Constant[2]        : 
 #  468|     r4_1(glval<int>) = VariableAddress[x] : 
 #  468|     mu4_2(int)       = Store              : &:r4_1, r4_0
-#  468|     r4_3(glval<int>) = CopyValue          : r4_1
 #-----|   Goto -> Block 6
 
 #  471|   Block 5
 #  471|     r5_0(int)        = Constant[3]        : 
 #  471|     r5_1(glval<int>) = VariableAddress[x] : 
 #  471|     mu5_2(int)       = Store              : &:r5_1, r5_0
-#  471|     r5_3(glval<int>) = CopyValue          : r5_1
 #-----|   Goto -> Block 6
 
 #  473|   Block 6
@@ -2196,10 +2072,9 @@ ir.cpp:
 #  478|     r3_1(bool)        = Load                        : &:r3_0, ~mu0_2
 #  478|     r3_2(glval<bool>) = VariableAddress[x]          : 
 #  478|     mu3_3(bool)       = Store                       : &:r3_2, r3_1
-#  478|     r3_4(glval<bool>) = CopyValue                   : r3_2
-#  479|     r3_5(glval<bool>) = VariableAddress[a]          : 
-#  479|     r3_6(bool)        = Load                        : &:r3_5, ~mu0_2
-#  479|     v3_7(void)        = ConditionalBranch           : r3_6
+#  479|     r3_4(glval<bool>) = VariableAddress[a]          : 
+#  479|     r3_5(bool)        = Load                        : &:r3_4, ~mu0_2
+#  479|     v3_6(void)        = ConditionalBranch           : r3_5
 #-----|   False -> Block 9
 #-----|   True -> Block 8
 
@@ -2228,11 +2103,10 @@ ir.cpp:
 #  479|     r7_2(bool)        = LogicalNot                   : r7_1
 #  479|     r7_3(glval<bool>) = VariableAddress[x]           : 
 #  479|     mu7_4(bool)       = Store                        : &:r7_3, r7_2
-#  479|     r7_5(glval<bool>) = CopyValue                    : r7_3
-#  480|     v7_6(void)        = NoOp                         : 
-#  475|     v7_7(void)        = ReturnVoid                   : 
-#  475|     v7_8(void)        = UnmodeledUse                 : mu*
-#  475|     v7_9(void)        = ExitFunction                 : 
+#  480|     v7_5(void)        = NoOp                         : 
+#  475|     v7_6(void)        = ReturnVoid                   : 
+#  475|     v7_7(void)        = UnmodeledUse                 : mu*
+#  475|     v7_8(void)        = ExitFunction                 : 
 
 #  479|   Block 8
 #  479|     r8_0(glval<bool>) = VariableAddress[#temp479:11] : 
@@ -2258,10 +2132,9 @@ ir.cpp:
 #  477|     r11_1(bool)        = Load                        : &:r11_0, ~mu0_2
 #  477|     r11_2(glval<bool>) = VariableAddress[x]          : 
 #  477|     mu11_3(bool)       = Store                       : &:r11_2, r11_1
-#  477|     r11_4(glval<bool>) = CopyValue                   : r11_2
-#  478|     r11_5(glval<bool>) = VariableAddress[a]          : 
-#  478|     r11_6(bool)        = Load                        : &:r11_5, ~mu0_2
-#  478|     v11_7(void)        = ConditionalBranch           : r11_6
+#  478|     r11_4(glval<bool>) = VariableAddress[a]          : 
+#  478|     r11_5(bool)        = Load                        : &:r11_4, ~mu0_2
+#  478|     v11_6(void)        = ConditionalBranch           : r11_5
 #-----|   False -> Block 5
 #-----|   True -> Block 4
 
@@ -2334,11 +2207,10 @@ ir.cpp:
 #  489|     r1_0(glval<int>) = VariableAddress[#temp489:6] : 
 #  489|     r1_1(glval<int>) = Load                        : &:r1_0, ~mu0_2
 #  489|     mu1_2(int)       = Store                       : &:r1_1, r0_9
-#  489|     r1_3(glval<int>) = CopyValue                   : r1_1
-#  490|     v1_4(void)       = NoOp                        : 
-#  486|     v1_5(void)       = ReturnVoid                  : 
-#  486|     v1_6(void)       = UnmodeledUse                : mu*
-#  486|     v1_7(void)       = ExitFunction                : 
+#  490|     v1_3(void)       = NoOp                        : 
+#  486|     v1_4(void)       = ReturnVoid                  : 
+#  486|     v1_5(void)       = UnmodeledUse                : mu*
+#  486|     v1_6(void)       = ExitFunction                : 
 
 #  489|   Block 2
 #  489|     r2_0(glval<int>) = VariableAddress[x]          : 
@@ -2397,15 +2269,13 @@ ir.cpp:
 #  499|     r0_9(int *)         = Constant[0]         : 
 #  499|     r0_10(glval<int *>) = VariableAddress[p]  : 
 #  499|     mu0_11(int *)       = Store               : &:r0_10, r0_9
-#  499|     r0_12(glval<int *>) = CopyValue           : r0_10
-#  500|     r0_13(int *)        = Constant[0]         : 
-#  500|     r0_14(glval<int *>) = VariableAddress[q]  : 
-#  500|     mu0_15(int *)       = Store               : &:r0_14, r0_13
-#  500|     r0_16(glval<int *>) = CopyValue           : r0_14
-#  501|     v0_17(void)         = NoOp                : 
-#  496|     v0_18(void)         = ReturnVoid          : 
-#  496|     v0_19(void)         = UnmodeledUse        : mu*
-#  496|     v0_20(void)         = ExitFunction        : 
+#  500|     r0_12(int *)        = Constant[0]         : 
+#  500|     r0_13(glval<int *>) = VariableAddress[q]  : 
+#  500|     mu0_14(int *)       = Store               : &:r0_13, r0_12
+#  501|     v0_15(void)         = NoOp                : 
+#  496|     v0_16(void)         = ReturnVoid          : 
+#  496|     v0_17(void)         = UnmodeledUse        : mu*
+#  496|     v0_18(void)         = ExitFunction        : 
 
 #  503| void InitList(int, float)
 #  503|   Block 0
@@ -2633,8 +2503,7 @@ ir.cpp:
 #  540|     r3_1(int)        = Load               : &:r3_0, ~mu0_2
 #  540|     r3_2(glval<int>) = VariableAddress[y] : 
 #  540|     mu3_3(int)       = Store              : &:r3_2, r3_1
-#  540|     r3_4(glval<int>) = CopyValue          : r3_2
-#  541|     v3_5(void)       = NoOp               : 
+#  541|     v3_4(void)       = NoOp               : 
 #-----|   Goto -> Block 1
 
 #  543| int EarlyReturnValue(int, int)
@@ -2837,24 +2706,21 @@ ir.cpp:
 #  592|     r0_7(..(*)(..))         = CopyValue                      : r0_6
 #  592|     r0_8(glval<..(*)(..)>)  = VariableAddress[pfn]           : 
 #  592|     mu0_9(..(*)(..))        = Store                          : &:r0_8, r0_7
-#  592|     r0_10(glval<..(*)(..)>) = CopyValue                      : r0_8
-#  593|     r0_11(glval<..(*)(..)>) = FunctionAddress[FuncPtrTarget] : 
-#  593|     r0_12(..(*)(..))        = CopyValue                      : r0_11
-#  593|     r0_13(glval<..(*)(..)>) = VariableAddress[pfn]           : 
-#  593|     mu0_14(..(*)(..))       = Store                          : &:r0_13, r0_12
-#  593|     r0_15(glval<..(*)(..)>) = CopyValue                      : r0_13
-#  594|     r0_16(glval<..()(..)>)  = FunctionAddress[FuncPtrTarget] : 
+#  593|     r0_10(glval<..(*)(..)>) = FunctionAddress[FuncPtrTarget] : 
+#  593|     r0_11(..(*)(..))        = CopyValue                      : r0_10
+#  593|     r0_12(glval<..(*)(..)>) = VariableAddress[pfn]           : 
+#  593|     mu0_13(..(*)(..))       = Store                          : &:r0_12, r0_11
+#  594|     r0_14(glval<..()(..)>)  = FunctionAddress[FuncPtrTarget] : 
+#  594|     r0_15(..(*)(..))        = CopyValue                      : r0_14
+#  594|     r0_16(..(*)(..))        = CopyValue                      : r0_15
 #  594|     r0_17(..(*)(..))        = CopyValue                      : r0_16
 #  594|     r0_18(..(*)(..))        = CopyValue                      : r0_17
-#  594|     r0_19(..(*)(..))        = CopyValue                      : r0_18
-#  594|     r0_20(..(*)(..))        = CopyValue                      : r0_19
-#  594|     r0_21(glval<..(*)(..)>) = VariableAddress[pfn]           : 
-#  594|     mu0_22(..(*)(..))       = Store                          : &:r0_21, r0_20
-#  594|     r0_23(glval<..(*)(..)>) = CopyValue                      : r0_21
-#  595|     v0_24(void)             = NoOp                           : 
-#  590|     v0_25(void)             = ReturnVoid                     : 
-#  590|     v0_26(void)             = UnmodeledUse                   : mu*
-#  590|     v0_27(void)             = ExitFunction                   : 
+#  594|     r0_19(glval<..(*)(..)>) = VariableAddress[pfn]           : 
+#  594|     mu0_20(..(*)(..))       = Store                          : &:r0_19, r0_18
+#  595|     v0_21(void)             = NoOp                           : 
+#  590|     v0_22(void)             = ReturnVoid                     : 
+#  590|     v0_23(void)             = UnmodeledUse                   : mu*
+#  590|     v0_24(void)             = ExitFunction                   : 
 
 #  615| void DeclareObject()
 #  615|   Block 0
@@ -2991,43 +2857,37 @@ ir.cpp:
 #  643|     r0_5(C *)         = CopyValue           : r0_3
 #  643|     r0_6(glval<int>)  = FieldAddress[m_a]   : r0_5
 #  643|     mu0_7(int)        = Store               : &:r0_6, r0_4
-#  643|     r0_8(glval<int>)  = CopyValue           : r0_6
-#  644|     r0_9(int)         = Constant[1]         : 
-#  644|     r0_10(C *)        = CopyValue           : r0_3
-#  644|     r0_11(glval<C>)   = CopyValue           : r0_10
-#  644|     r0_12(glval<int>) = FieldAddress[m_a]   : r0_11
-#  644|     mu0_13(int)       = Store               : &:r0_12, r0_9
-#  644|     r0_14(glval<int>) = CopyValue           : r0_12
-#  645|     r0_15(int)        = Constant[2]         : 
-#-----|     r0_16(C *)        = CopyValue           : r0_3
-#  645|     r0_17(glval<int>) = FieldAddress[m_a]   : r0_16
-#  645|     mu0_18(int)       = Store               : &:r0_17, r0_15
-#  645|     r0_19(glval<int>) = CopyValue           : r0_17
-#  646|     r0_20(glval<int>) = VariableAddress[x]  : 
-#  646|     mu0_21(int)       = Uninitialized[x]    : &:r0_20
-#  647|     r0_22(C *)        = CopyValue           : r0_3
-#  647|     r0_23(glval<int>) = FieldAddress[m_a]   : r0_22
-#  647|     r0_24(int)        = Load                : &:r0_23, ~mu0_2
-#  647|     r0_25(glval<int>) = VariableAddress[x]  : 
-#  647|     mu0_26(int)       = Store               : &:r0_25, r0_24
-#  647|     r0_27(glval<int>) = CopyValue           : r0_25
-#  648|     r0_28(C *)        = CopyValue           : r0_3
-#  648|     r0_29(glval<C>)   = CopyValue           : r0_28
-#  648|     r0_30(glval<int>) = FieldAddress[m_a]   : r0_29
-#  648|     r0_31(int)        = Load                : &:r0_30, ~mu0_2
-#  648|     r0_32(glval<int>) = VariableAddress[x]  : 
-#  648|     mu0_33(int)       = Store               : &:r0_32, r0_31
-#  648|     r0_34(glval<int>) = CopyValue           : r0_32
-#-----|     r0_35(C *)        = CopyValue           : r0_3
-#  649|     r0_36(glval<int>) = FieldAddress[m_a]   : r0_35
-#  649|     r0_37(int)        = Load                : &:r0_36, ~mu0_2
-#  649|     r0_38(glval<int>) = VariableAddress[x]  : 
-#  649|     mu0_39(int)       = Store               : &:r0_38, r0_37
-#  649|     r0_40(glval<int>) = CopyValue           : r0_38
-#  650|     v0_41(void)       = NoOp                : 
-#  642|     v0_42(void)       = ReturnVoid          : 
-#  642|     v0_43(void)       = UnmodeledUse        : mu*
-#  642|     v0_44(void)       = ExitFunction        : 
+#  644|     r0_8(int)         = Constant[1]         : 
+#  644|     r0_9(C *)         = CopyValue           : r0_3
+#  644|     r0_10(glval<C>)   = CopyValue           : r0_9
+#  644|     r0_11(glval<int>) = FieldAddress[m_a]   : r0_10
+#  644|     mu0_12(int)       = Store               : &:r0_11, r0_8
+#  645|     r0_13(int)        = Constant[2]         : 
+#-----|     r0_14(C *)        = CopyValue           : r0_3
+#  645|     r0_15(glval<int>) = FieldAddress[m_a]   : r0_14
+#  645|     mu0_16(int)       = Store               : &:r0_15, r0_13
+#  646|     r0_17(glval<int>) = VariableAddress[x]  : 
+#  646|     mu0_18(int)       = Uninitialized[x]    : &:r0_17
+#  647|     r0_19(C *)        = CopyValue           : r0_3
+#  647|     r0_20(glval<int>) = FieldAddress[m_a]   : r0_19
+#  647|     r0_21(int)        = Load                : &:r0_20, ~mu0_2
+#  647|     r0_22(glval<int>) = VariableAddress[x]  : 
+#  647|     mu0_23(int)       = Store               : &:r0_22, r0_21
+#  648|     r0_24(C *)        = CopyValue           : r0_3
+#  648|     r0_25(glval<C>)   = CopyValue           : r0_24
+#  648|     r0_26(glval<int>) = FieldAddress[m_a]   : r0_25
+#  648|     r0_27(int)        = Load                : &:r0_26, ~mu0_2
+#  648|     r0_28(glval<int>) = VariableAddress[x]  : 
+#  648|     mu0_29(int)       = Store               : &:r0_28, r0_27
+#-----|     r0_30(C *)        = CopyValue           : r0_3
+#  649|     r0_31(glval<int>) = FieldAddress[m_a]   : r0_30
+#  649|     r0_32(int)        = Load                : &:r0_31, ~mu0_2
+#  649|     r0_33(glval<int>) = VariableAddress[x]  : 
+#  649|     mu0_34(int)       = Store               : &:r0_33, r0_32
+#  650|     v0_35(void)       = NoOp                : 
+#  642|     v0_36(void)       = ReturnVoid          : 
+#  642|     v0_37(void)       = UnmodeledUse        : mu*
+#  642|     v0_38(void)       = ExitFunction        : 
 
 #  652| void C::MethodCalls()
 #  652|   Block 0
@@ -3363,7 +3223,6 @@ ir.cpp:
 #  731|     r6_4(int)        = Load                         : &:r6_3, ~mu0_2
 #  731|     r6_5(glval<int>) = VariableAddress[x]           : 
 #  731|     mu6_6(int)       = Store                        : &:r6_5, r6_4
-#  731|     r6_7(glval<int>) = CopyValue                    : r6_5
 #-----|   Goto -> Block 8
 
 #  731|   Block 7
@@ -3382,7 +3241,6 @@ ir.cpp:
 #  733|     r8_0(int)        = Constant[7]        : 
 #  733|     r8_1(glval<int>) = VariableAddress[x] : 
 #  733|     mu8_2(int)       = Store              : &:r8_1, r8_0
-#  733|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 14
 
 #  735|   Block 9
@@ -3898,219 +3756,203 @@ ir.cpp:
 #  811|     r0_79(Base *)              = ConvertToBase[Middle : Base]           : r0_78
 #  811|     r0_80(glval<Base *>)       = VariableAddress[pb]                    : 
 #  811|     mu0_81(Base *)             = Store                                  : &:r0_80, r0_79
-#  811|     r0_82(glval<Base *>)       = CopyValue                              : r0_80
-#  812|     r0_83(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  812|     r0_84(Middle *)            = Load                                   : &:r0_83, ~mu0_2
-#  812|     r0_85(Base *)              = ConvertToBase[Middle : Base]           : r0_84
-#  812|     r0_86(glval<Base *>)       = VariableAddress[pb]                    : 
-#  812|     mu0_87(Base *)             = Store                                  : &:r0_86, r0_85
-#  812|     r0_88(glval<Base *>)       = CopyValue                              : r0_86
-#  813|     r0_89(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  813|     r0_90(Middle *)            = Load                                   : &:r0_89, ~mu0_2
-#  813|     r0_91(Base *)              = ConvertToBase[Middle : Base]           : r0_90
-#  813|     r0_92(glval<Base *>)       = VariableAddress[pb]                    : 
-#  813|     mu0_93(Base *)             = Store                                  : &:r0_92, r0_91
-#  813|     r0_94(glval<Base *>)       = CopyValue                              : r0_92
-#  814|     r0_95(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  814|     r0_96(Middle *)            = Load                                   : &:r0_95, ~mu0_2
-#  814|     r0_97(Base *)              = Convert                                : r0_96
-#  814|     r0_98(glval<Base *>)       = VariableAddress[pb]                    : 
-#  814|     mu0_99(Base *)             = Store                                  : &:r0_98, r0_97
-#  814|     r0_100(glval<Base *>)      = CopyValue                              : r0_98
-#  816|     r0_101(glval<Middle>)      = VariableAddress[m]                     : 
-#  816|     r0_102(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  816|     r0_103(glval<Base>)        = VariableAddress[b]                     : 
-#  816|     r0_104(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_103
-#  816|     r0_105(glval<Middle>)      = Convert                                : r0_104
-#  816|     r0_106(Middle &)           = CopyValue                              : r0_105
-#  816|     r0_107(Middle &)           = Call                                   : func:r0_102, this:r0_101, 0:r0_106
-#  816|     mu0_108(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  816|     v0_109(void)               = ^IndirectReadSideEffect[-1]            : &:r0_101, ~mu0_2
-#  816|     v0_110(void)               = ^IndirectReadSideEffect[0]             : &:r0_106, ~mu0_2
-#  816|     mu0_111(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_101
-#  816|     mu0_112(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_106
-#  816|     r0_113(glval<Middle>)      = CopyValue                              : r0_107
-#  817|     r0_114(glval<Middle>)      = VariableAddress[m]                     : 
-#  817|     r0_115(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  817|     r0_116(glval<Base>)        = VariableAddress[b]                     : 
-#  817|     r0_117(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_116
-#  817|     r0_118(glval<Middle>)      = Convert                                : r0_117
-#  817|     r0_119(Middle &)           = CopyValue                              : r0_118
-#  817|     r0_120(Middle &)           = Call                                   : func:r0_115, this:r0_114, 0:r0_119
-#  817|     mu0_121(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  817|     v0_122(void)               = ^IndirectReadSideEffect[-1]            : &:r0_114, ~mu0_2
-#  817|     v0_123(void)               = ^IndirectReadSideEffect[0]             : &:r0_119, ~mu0_2
-#  817|     mu0_124(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_114
-#  817|     mu0_125(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_119
-#  817|     r0_126(glval<Middle>)      = CopyValue                              : r0_120
-#  818|     r0_127(glval<Base *>)      = VariableAddress[pb]                    : 
-#  818|     r0_128(Base *)             = Load                                   : &:r0_127, ~mu0_2
-#  818|     r0_129(Middle *)           = ConvertToDerived[Middle : Base]        : r0_128
-#  818|     r0_130(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  818|     mu0_131(Middle *)          = Store                                  : &:r0_130, r0_129
-#  818|     r0_132(glval<Middle *>)    = CopyValue                              : r0_130
-#  819|     r0_133(glval<Base *>)      = VariableAddress[pb]                    : 
-#  819|     r0_134(Base *)             = Load                                   : &:r0_133, ~mu0_2
-#  819|     r0_135(Middle *)           = ConvertToDerived[Middle : Base]        : r0_134
-#  819|     r0_136(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  819|     mu0_137(Middle *)          = Store                                  : &:r0_136, r0_135
-#  819|     r0_138(glval<Middle *>)    = CopyValue                              : r0_136
-#  820|     r0_139(glval<Base *>)      = VariableAddress[pb]                    : 
-#  820|     r0_140(Base *)             = Load                                   : &:r0_139, ~mu0_2
-#  820|     r0_141(Middle *)           = Convert                                : r0_140
-#  820|     r0_142(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  820|     mu0_143(Middle *)          = Store                                  : &:r0_142, r0_141
-#  820|     r0_144(glval<Middle *>)    = CopyValue                              : r0_142
-#  822|     r0_145(glval<Base>)        = VariableAddress[b]                     : 
-#  822|     r0_146(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  822|     r0_147(glval<Derived>)     = VariableAddress[d]                     : 
-#  822|     r0_148(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_147
-#  822|     r0_149(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_148
-#  822|     r0_150(Base &)             = CopyValue                              : r0_149
-#  822|     r0_151(Base &)             = Call                                   : func:r0_146, this:r0_145, 0:r0_150
-#  822|     mu0_152(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  822|     v0_153(void)               = ^IndirectReadSideEffect[-1]            : &:r0_145, ~mu0_2
-#  822|     v0_154(void)               = ^IndirectReadSideEffect[0]             : &:r0_150, ~mu0_2
-#  822|     mu0_155(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_145
-#  822|     mu0_156(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_150
-#  822|     r0_157(glval<Base>)        = CopyValue                              : r0_151
-#  823|     r0_158(glval<Base>)        = VariableAddress[b]                     : 
-#  823|     r0_159(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  823|     r0_160(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  823|     r0_161(glval<Derived>)     = VariableAddress[d]                     : 
-#  823|     r0_162(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_161
-#  823|     r0_163(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_162
-#  823|     r0_164(Base &)             = CopyValue                              : r0_163
-#  823|     v0_165(void)               = Call                                   : func:r0_160, 0:r0_164
-#  823|     mu0_166(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     v0_167(void)               = ^IndirectReadSideEffect[0]             : &:r0_164, ~mu0_2
-#  823|     mu0_168(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_164
-#  823|     r0_169(glval<Base>)        = Convert                                : v0_165
-#  823|     r0_170(Base &)             = CopyValue                              : r0_169
-#  823|     r0_171(Base &)             = Call                                   : func:r0_159, this:r0_158, 0:r0_170
-#  823|     mu0_172(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     v0_173(void)               = ^IndirectReadSideEffect[-1]            : &:r0_158, ~mu0_2
-#  823|     v0_174(void)               = ^IndirectReadSideEffect[0]             : &:r0_170, ~mu0_2
-#  823|     mu0_175(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_158
-#  823|     mu0_176(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_170
-#  823|     r0_177(glval<Base>)        = CopyValue                              : r0_171
-#  824|     r0_178(glval<Base>)        = VariableAddress[b]                     : 
-#  824|     r0_179(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  824|     r0_180(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  824|     r0_181(glval<Derived>)     = VariableAddress[d]                     : 
-#  824|     r0_182(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_181
-#  824|     r0_183(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_182
-#  824|     r0_184(Base &)             = CopyValue                              : r0_183
-#  824|     v0_185(void)               = Call                                   : func:r0_180, 0:r0_184
-#  824|     mu0_186(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     v0_187(void)               = ^IndirectReadSideEffect[0]             : &:r0_184, ~mu0_2
-#  824|     mu0_188(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_184
-#  824|     r0_189(glval<Base>)        = Convert                                : v0_185
-#  824|     r0_190(Base &)             = CopyValue                              : r0_189
-#  824|     r0_191(Base &)             = Call                                   : func:r0_179, this:r0_178, 0:r0_190
-#  824|     mu0_192(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     v0_193(void)               = ^IndirectReadSideEffect[-1]            : &:r0_178, ~mu0_2
-#  824|     v0_194(void)               = ^IndirectReadSideEffect[0]             : &:r0_190, ~mu0_2
-#  824|     mu0_195(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_178
-#  824|     mu0_196(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_190
-#  824|     r0_197(glval<Base>)        = CopyValue                              : r0_191
-#  825|     r0_198(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  825|     r0_199(Derived *)          = Load                                   : &:r0_198, ~mu0_2
-#  825|     r0_200(Middle *)           = ConvertToBase[Derived : Middle]        : r0_199
-#  825|     r0_201(Base *)             = ConvertToBase[Middle : Base]           : r0_200
-#  825|     r0_202(glval<Base *>)      = VariableAddress[pb]                    : 
-#  825|     mu0_203(Base *)            = Store                                  : &:r0_202, r0_201
-#  825|     r0_204(glval<Base *>)      = CopyValue                              : r0_202
-#  826|     r0_205(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  826|     r0_206(Derived *)          = Load                                   : &:r0_205, ~mu0_2
-#  826|     r0_207(Middle *)           = ConvertToBase[Derived : Middle]        : r0_206
-#  826|     r0_208(Base *)             = ConvertToBase[Middle : Base]           : r0_207
-#  826|     r0_209(glval<Base *>)      = VariableAddress[pb]                    : 
-#  826|     mu0_210(Base *)            = Store                                  : &:r0_209, r0_208
-#  826|     r0_211(glval<Base *>)      = CopyValue                              : r0_209
-#  827|     r0_212(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  827|     r0_213(Derived *)          = Load                                   : &:r0_212, ~mu0_2
-#  827|     r0_214(Middle *)           = ConvertToBase[Derived : Middle]        : r0_213
-#  827|     r0_215(Base *)             = ConvertToBase[Middle : Base]           : r0_214
-#  827|     r0_216(glval<Base *>)      = VariableAddress[pb]                    : 
-#  827|     mu0_217(Base *)            = Store                                  : &:r0_216, r0_215
-#  827|     r0_218(glval<Base *>)      = CopyValue                              : r0_216
-#  828|     r0_219(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  828|     r0_220(Derived *)          = Load                                   : &:r0_219, ~mu0_2
-#  828|     r0_221(Base *)             = Convert                                : r0_220
-#  828|     r0_222(glval<Base *>)      = VariableAddress[pb]                    : 
-#  828|     mu0_223(Base *)            = Store                                  : &:r0_222, r0_221
-#  828|     r0_224(glval<Base *>)      = CopyValue                              : r0_222
-#  830|     r0_225(glval<Derived>)     = VariableAddress[d]                     : 
-#  830|     r0_226(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  830|     r0_227(glval<Base>)        = VariableAddress[b]                     : 
-#  830|     r0_228(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_227
-#  830|     r0_229(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_228
-#  830|     r0_230(glval<Derived>)     = Convert                                : r0_229
-#  830|     r0_231(Derived &)          = CopyValue                              : r0_230
-#  830|     r0_232(Derived &)          = Call                                   : func:r0_226, this:r0_225, 0:r0_231
-#  830|     mu0_233(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  830|     v0_234(void)               = ^IndirectReadSideEffect[-1]            : &:r0_225, ~mu0_2
-#  830|     v0_235(void)               = ^IndirectReadSideEffect[0]             : &:r0_231, ~mu0_2
-#  830|     mu0_236(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_225
-#  830|     mu0_237(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_231
-#  830|     r0_238(glval<Derived>)     = CopyValue                              : r0_232
-#  831|     r0_239(glval<Derived>)     = VariableAddress[d]                     : 
-#  831|     r0_240(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  831|     r0_241(glval<Base>)        = VariableAddress[b]                     : 
-#  831|     r0_242(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_241
-#  831|     r0_243(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_242
-#  831|     r0_244(glval<Derived>)     = Convert                                : r0_243
-#  831|     r0_245(Derived &)          = CopyValue                              : r0_244
-#  831|     r0_246(Derived &)          = Call                                   : func:r0_240, this:r0_239, 0:r0_245
-#  831|     mu0_247(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  831|     v0_248(void)               = ^IndirectReadSideEffect[-1]            : &:r0_239, ~mu0_2
-#  831|     v0_249(void)               = ^IndirectReadSideEffect[0]             : &:r0_245, ~mu0_2
-#  831|     mu0_250(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_239
-#  831|     mu0_251(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_245
-#  831|     r0_252(glval<Derived>)     = CopyValue                              : r0_246
-#  832|     r0_253(glval<Base *>)      = VariableAddress[pb]                    : 
-#  832|     r0_254(Base *)             = Load                                   : &:r0_253, ~mu0_2
-#  832|     r0_255(Middle *)           = ConvertToDerived[Middle : Base]        : r0_254
-#  832|     r0_256(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_255
-#  832|     r0_257(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  832|     mu0_258(Derived *)         = Store                                  : &:r0_257, r0_256
-#  832|     r0_259(glval<Derived *>)   = CopyValue                              : r0_257
-#  833|     r0_260(glval<Base *>)      = VariableAddress[pb]                    : 
-#  833|     r0_261(Base *)             = Load                                   : &:r0_260, ~mu0_2
-#  833|     r0_262(Middle *)           = ConvertToDerived[Middle : Base]        : r0_261
-#  833|     r0_263(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_262
-#  833|     r0_264(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  833|     mu0_265(Derived *)         = Store                                  : &:r0_264, r0_263
-#  833|     r0_266(glval<Derived *>)   = CopyValue                              : r0_264
-#  834|     r0_267(glval<Base *>)      = VariableAddress[pb]                    : 
-#  834|     r0_268(Base *)             = Load                                   : &:r0_267, ~mu0_2
-#  834|     r0_269(Derived *)          = Convert                                : r0_268
-#  834|     r0_270(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  834|     mu0_271(Derived *)         = Store                                  : &:r0_270, r0_269
-#  834|     r0_272(glval<Derived *>)   = CopyValue                              : r0_270
-#  836|     r0_273(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  836|     r0_274(MiddleVB1 *)        = Constant[0]                            : 
-#  836|     mu0_275(MiddleVB1 *)       = Store                                  : &:r0_273, r0_274
-#  837|     r0_276(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  837|     r0_277(DerivedVB *)        = Constant[0]                            : 
-#  837|     mu0_278(DerivedVB *)       = Store                                  : &:r0_276, r0_277
-#  838|     r0_279(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  838|     r0_280(MiddleVB1 *)        = Load                                   : &:r0_279, ~mu0_2
-#  838|     r0_281(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base] : r0_280
-#  838|     r0_282(glval<Base *>)      = VariableAddress[pb]                    : 
-#  838|     mu0_283(Base *)            = Store                                  : &:r0_282, r0_281
-#  838|     r0_284(glval<Base *>)      = CopyValue                              : r0_282
-#  839|     r0_285(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  839|     r0_286(DerivedVB *)        = Load                                   : &:r0_285, ~mu0_2
-#  839|     r0_287(Base *)             = ConvertToVirtualBase[DerivedVB : Base] : r0_286
-#  839|     r0_288(glval<Base *>)      = VariableAddress[pb]                    : 
-#  839|     mu0_289(Base *)            = Store                                  : &:r0_288, r0_287
-#  839|     r0_290(glval<Base *>)      = CopyValue                              : r0_288
-#  840|     v0_291(void)               = NoOp                                   : 
-#  799|     v0_292(void)               = ReturnVoid                             : 
-#  799|     v0_293(void)               = UnmodeledUse                           : mu*
-#  799|     v0_294(void)               = ExitFunction                           : 
+#  812|     r0_82(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  812|     r0_83(Middle *)            = Load                                   : &:r0_82, ~mu0_2
+#  812|     r0_84(Base *)              = ConvertToBase[Middle : Base]           : r0_83
+#  812|     r0_85(glval<Base *>)       = VariableAddress[pb]                    : 
+#  812|     mu0_86(Base *)             = Store                                  : &:r0_85, r0_84
+#  813|     r0_87(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  813|     r0_88(Middle *)            = Load                                   : &:r0_87, ~mu0_2
+#  813|     r0_89(Base *)              = ConvertToBase[Middle : Base]           : r0_88
+#  813|     r0_90(glval<Base *>)       = VariableAddress[pb]                    : 
+#  813|     mu0_91(Base *)             = Store                                  : &:r0_90, r0_89
+#  814|     r0_92(glval<Middle *>)     = VariableAddress[pm]                    : 
+#  814|     r0_93(Middle *)            = Load                                   : &:r0_92, ~mu0_2
+#  814|     r0_94(Base *)              = Convert                                : r0_93
+#  814|     r0_95(glval<Base *>)       = VariableAddress[pb]                    : 
+#  814|     mu0_96(Base *)             = Store                                  : &:r0_95, r0_94
+#  816|     r0_97(glval<Middle>)       = VariableAddress[m]                     : 
+#  816|     r0_98(glval<unknown>)      = FunctionAddress[operator=]             : 
+#  816|     r0_99(glval<Base>)         = VariableAddress[b]                     : 
+#  816|     r0_100(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_99
+#  816|     r0_101(glval<Middle>)      = Convert                                : r0_100
+#  816|     r0_102(Middle &)           = CopyValue                              : r0_101
+#  816|     r0_103(Middle &)           = Call                                   : func:r0_98, this:r0_97, 0:r0_102
+#  816|     mu0_104(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  816|     v0_105(void)               = ^IndirectReadSideEffect[-1]            : &:r0_97, ~mu0_2
+#  816|     v0_106(void)               = ^IndirectReadSideEffect[0]             : &:r0_102, ~mu0_2
+#  816|     mu0_107(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_97
+#  816|     mu0_108(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_102
+#  816|     r0_109(glval<Middle>)      = CopyValue                              : r0_103
+#  817|     r0_110(glval<Middle>)      = VariableAddress[m]                     : 
+#  817|     r0_111(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  817|     r0_112(glval<Base>)        = VariableAddress[b]                     : 
+#  817|     r0_113(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_112
+#  817|     r0_114(glval<Middle>)      = Convert                                : r0_113
+#  817|     r0_115(Middle &)           = CopyValue                              : r0_114
+#  817|     r0_116(Middle &)           = Call                                   : func:r0_111, this:r0_110, 0:r0_115
+#  817|     mu0_117(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  817|     v0_118(void)               = ^IndirectReadSideEffect[-1]            : &:r0_110, ~mu0_2
+#  817|     v0_119(void)               = ^IndirectReadSideEffect[0]             : &:r0_115, ~mu0_2
+#  817|     mu0_120(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_110
+#  817|     mu0_121(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_115
+#  817|     r0_122(glval<Middle>)      = CopyValue                              : r0_116
+#  818|     r0_123(glval<Base *>)      = VariableAddress[pb]                    : 
+#  818|     r0_124(Base *)             = Load                                   : &:r0_123, ~mu0_2
+#  818|     r0_125(Middle *)           = ConvertToDerived[Middle : Base]        : r0_124
+#  818|     r0_126(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  818|     mu0_127(Middle *)          = Store                                  : &:r0_126, r0_125
+#  819|     r0_128(glval<Base *>)      = VariableAddress[pb]                    : 
+#  819|     r0_129(Base *)             = Load                                   : &:r0_128, ~mu0_2
+#  819|     r0_130(Middle *)           = ConvertToDerived[Middle : Base]        : r0_129
+#  819|     r0_131(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  819|     mu0_132(Middle *)          = Store                                  : &:r0_131, r0_130
+#  820|     r0_133(glval<Base *>)      = VariableAddress[pb]                    : 
+#  820|     r0_134(Base *)             = Load                                   : &:r0_133, ~mu0_2
+#  820|     r0_135(Middle *)           = Convert                                : r0_134
+#  820|     r0_136(glval<Middle *>)    = VariableAddress[pm]                    : 
+#  820|     mu0_137(Middle *)          = Store                                  : &:r0_136, r0_135
+#  822|     r0_138(glval<Base>)        = VariableAddress[b]                     : 
+#  822|     r0_139(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  822|     r0_140(glval<Derived>)     = VariableAddress[d]                     : 
+#  822|     r0_141(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_140
+#  822|     r0_142(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_141
+#  822|     r0_143(Base &)             = CopyValue                              : r0_142
+#  822|     r0_144(Base &)             = Call                                   : func:r0_139, this:r0_138, 0:r0_143
+#  822|     mu0_145(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  822|     v0_146(void)               = ^IndirectReadSideEffect[-1]            : &:r0_138, ~mu0_2
+#  822|     v0_147(void)               = ^IndirectReadSideEffect[0]             : &:r0_143, ~mu0_2
+#  822|     mu0_148(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_138
+#  822|     mu0_149(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_143
+#  822|     r0_150(glval<Base>)        = CopyValue                              : r0_144
+#  823|     r0_151(glval<Base>)        = VariableAddress[b]                     : 
+#  823|     r0_152(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  823|     r0_153(glval<unknown>)     = FunctionAddress[Base]                  : 
+#  823|     r0_154(glval<Derived>)     = VariableAddress[d]                     : 
+#  823|     r0_155(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_154
+#  823|     r0_156(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_155
+#  823|     r0_157(Base &)             = CopyValue                              : r0_156
+#  823|     v0_158(void)               = Call                                   : func:r0_153, 0:r0_157
+#  823|     mu0_159(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  823|     v0_160(void)               = ^IndirectReadSideEffect[0]             : &:r0_157, ~mu0_2
+#  823|     mu0_161(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_157
+#  823|     r0_162(glval<Base>)        = Convert                                : v0_158
+#  823|     r0_163(Base &)             = CopyValue                              : r0_162
+#  823|     r0_164(Base &)             = Call                                   : func:r0_152, this:r0_151, 0:r0_163
+#  823|     mu0_165(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  823|     v0_166(void)               = ^IndirectReadSideEffect[-1]            : &:r0_151, ~mu0_2
+#  823|     v0_167(void)               = ^IndirectReadSideEffect[0]             : &:r0_163, ~mu0_2
+#  823|     mu0_168(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_151
+#  823|     mu0_169(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_163
+#  823|     r0_170(glval<Base>)        = CopyValue                              : r0_164
+#  824|     r0_171(glval<Base>)        = VariableAddress[b]                     : 
+#  824|     r0_172(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  824|     r0_173(glval<unknown>)     = FunctionAddress[Base]                  : 
+#  824|     r0_174(glval<Derived>)     = VariableAddress[d]                     : 
+#  824|     r0_175(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_174
+#  824|     r0_176(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_175
+#  824|     r0_177(Base &)             = CopyValue                              : r0_176
+#  824|     v0_178(void)               = Call                                   : func:r0_173, 0:r0_177
+#  824|     mu0_179(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  824|     v0_180(void)               = ^IndirectReadSideEffect[0]             : &:r0_177, ~mu0_2
+#  824|     mu0_181(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_177
+#  824|     r0_182(glval<Base>)        = Convert                                : v0_178
+#  824|     r0_183(Base &)             = CopyValue                              : r0_182
+#  824|     r0_184(Base &)             = Call                                   : func:r0_172, this:r0_171, 0:r0_183
+#  824|     mu0_185(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  824|     v0_186(void)               = ^IndirectReadSideEffect[-1]            : &:r0_171, ~mu0_2
+#  824|     v0_187(void)               = ^IndirectReadSideEffect[0]             : &:r0_183, ~mu0_2
+#  824|     mu0_188(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_171
+#  824|     mu0_189(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_183
+#  824|     r0_190(glval<Base>)        = CopyValue                              : r0_184
+#  825|     r0_191(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  825|     r0_192(Derived *)          = Load                                   : &:r0_191, ~mu0_2
+#  825|     r0_193(Middle *)           = ConvertToBase[Derived : Middle]        : r0_192
+#  825|     r0_194(Base *)             = ConvertToBase[Middle : Base]           : r0_193
+#  825|     r0_195(glval<Base *>)      = VariableAddress[pb]                    : 
+#  825|     mu0_196(Base *)            = Store                                  : &:r0_195, r0_194
+#  826|     r0_197(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  826|     r0_198(Derived *)          = Load                                   : &:r0_197, ~mu0_2
+#  826|     r0_199(Middle *)           = ConvertToBase[Derived : Middle]        : r0_198
+#  826|     r0_200(Base *)             = ConvertToBase[Middle : Base]           : r0_199
+#  826|     r0_201(glval<Base *>)      = VariableAddress[pb]                    : 
+#  826|     mu0_202(Base *)            = Store                                  : &:r0_201, r0_200
+#  827|     r0_203(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  827|     r0_204(Derived *)          = Load                                   : &:r0_203, ~mu0_2
+#  827|     r0_205(Middle *)           = ConvertToBase[Derived : Middle]        : r0_204
+#  827|     r0_206(Base *)             = ConvertToBase[Middle : Base]           : r0_205
+#  827|     r0_207(glval<Base *>)      = VariableAddress[pb]                    : 
+#  827|     mu0_208(Base *)            = Store                                  : &:r0_207, r0_206
+#  828|     r0_209(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  828|     r0_210(Derived *)          = Load                                   : &:r0_209, ~mu0_2
+#  828|     r0_211(Base *)             = Convert                                : r0_210
+#  828|     r0_212(glval<Base *>)      = VariableAddress[pb]                    : 
+#  828|     mu0_213(Base *)            = Store                                  : &:r0_212, r0_211
+#  830|     r0_214(glval<Derived>)     = VariableAddress[d]                     : 
+#  830|     r0_215(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  830|     r0_216(glval<Base>)        = VariableAddress[b]                     : 
+#  830|     r0_217(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_216
+#  830|     r0_218(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_217
+#  830|     r0_219(glval<Derived>)     = Convert                                : r0_218
+#  830|     r0_220(Derived &)          = CopyValue                              : r0_219
+#  830|     r0_221(Derived &)          = Call                                   : func:r0_215, this:r0_214, 0:r0_220
+#  830|     mu0_222(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  830|     v0_223(void)               = ^IndirectReadSideEffect[-1]            : &:r0_214, ~mu0_2
+#  830|     v0_224(void)               = ^IndirectReadSideEffect[0]             : &:r0_220, ~mu0_2
+#  830|     mu0_225(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_214
+#  830|     mu0_226(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_220
+#  830|     r0_227(glval<Derived>)     = CopyValue                              : r0_221
+#  831|     r0_228(glval<Derived>)     = VariableAddress[d]                     : 
+#  831|     r0_229(glval<unknown>)     = FunctionAddress[operator=]             : 
+#  831|     r0_230(glval<Base>)        = VariableAddress[b]                     : 
+#  831|     r0_231(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_230
+#  831|     r0_232(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_231
+#  831|     r0_233(glval<Derived>)     = Convert                                : r0_232
+#  831|     r0_234(Derived &)          = CopyValue                              : r0_233
+#  831|     r0_235(Derived &)          = Call                                   : func:r0_229, this:r0_228, 0:r0_234
+#  831|     mu0_236(unknown)           = ^CallSideEffect                        : ~mu0_2
+#  831|     v0_237(void)               = ^IndirectReadSideEffect[-1]            : &:r0_228, ~mu0_2
+#  831|     v0_238(void)               = ^IndirectReadSideEffect[0]             : &:r0_234, ~mu0_2
+#  831|     mu0_239(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_228
+#  831|     mu0_240(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_234
+#  831|     r0_241(glval<Derived>)     = CopyValue                              : r0_235
+#  832|     r0_242(glval<Base *>)      = VariableAddress[pb]                    : 
+#  832|     r0_243(Base *)             = Load                                   : &:r0_242, ~mu0_2
+#  832|     r0_244(Middle *)           = ConvertToDerived[Middle : Base]        : r0_243
+#  832|     r0_245(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_244
+#  832|     r0_246(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  832|     mu0_247(Derived *)         = Store                                  : &:r0_246, r0_245
+#  833|     r0_248(glval<Base *>)      = VariableAddress[pb]                    : 
+#  833|     r0_249(Base *)             = Load                                   : &:r0_248, ~mu0_2
+#  833|     r0_250(Middle *)           = ConvertToDerived[Middle : Base]        : r0_249
+#  833|     r0_251(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_250
+#  833|     r0_252(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  833|     mu0_253(Derived *)         = Store                                  : &:r0_252, r0_251
+#  834|     r0_254(glval<Base *>)      = VariableAddress[pb]                    : 
+#  834|     r0_255(Base *)             = Load                                   : &:r0_254, ~mu0_2
+#  834|     r0_256(Derived *)          = Convert                                : r0_255
+#  834|     r0_257(glval<Derived *>)   = VariableAddress[pd]                    : 
+#  834|     mu0_258(Derived *)         = Store                                  : &:r0_257, r0_256
+#  836|     r0_259(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
+#  836|     r0_260(MiddleVB1 *)        = Constant[0]                            : 
+#  836|     mu0_261(MiddleVB1 *)       = Store                                  : &:r0_259, r0_260
+#  837|     r0_262(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
+#  837|     r0_263(DerivedVB *)        = Constant[0]                            : 
+#  837|     mu0_264(DerivedVB *)       = Store                                  : &:r0_262, r0_263
+#  838|     r0_265(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
+#  838|     r0_266(MiddleVB1 *)        = Load                                   : &:r0_265, ~mu0_2
+#  838|     r0_267(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base] : r0_266
+#  838|     r0_268(glval<Base *>)      = VariableAddress[pb]                    : 
+#  838|     mu0_269(Base *)            = Store                                  : &:r0_268, r0_267
+#  839|     r0_270(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
+#  839|     r0_271(DerivedVB *)        = Load                                   : &:r0_270, ~mu0_2
+#  839|     r0_272(Base *)             = ConvertToVirtualBase[DerivedVB : Base] : r0_271
+#  839|     r0_273(glval<Base *>)      = VariableAddress[pb]                    : 
+#  839|     mu0_274(Base *)            = Store                                  : &:r0_273, r0_272
+#  840|     v0_275(void)               = NoOp                                   : 
+#  799|     v0_276(void)               = ReturnVoid                             : 
+#  799|     v0_277(void)               = UnmodeledUse                           : mu*
+#  799|     v0_278(void)               = ExitFunction                           : 
 
 #  842| void PolymorphicBase::PolymorphicBase()
 #  842|   Block 0
@@ -4179,37 +4021,35 @@ ir.cpp:
 #  857|     r0_21(PolymorphicBase *)           = CheckedConvertOrNull                : r0_20
 #  857|     r0_22(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
 #  857|     mu0_23(PolymorphicBase *)          = Store                               : &:r0_22, r0_21
-#  857|     r0_24(glval<PolymorphicBase *>)    = CopyValue                           : r0_22
-#  858|     r0_25(glval<PolymorphicBase &>)    = VariableAddress[rb]                 : 
-#  858|     r0_26(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
-#  858|     r0_27(glval<PolymorphicBase>)      = CheckedConvertOrThrow               : r0_26
-#  858|     r0_28(PolymorphicBase &)           = CopyValue                           : r0_27
-#  858|     mu0_29(PolymorphicBase &)          = Store                               : &:r0_25, r0_28
-#  860|     r0_30(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
-#  860|     r0_31(PolymorphicBase *)           = Load                                : &:r0_30, ~mu0_2
-#  860|     r0_32(PolymorphicDerived *)        = CheckedConvertOrNull                : r0_31
-#  860|     r0_33(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  860|     mu0_34(PolymorphicDerived *)       = Store                               : &:r0_33, r0_32
-#  860|     r0_35(glval<PolymorphicDerived *>) = CopyValue                           : r0_33
-#  861|     r0_36(glval<PolymorphicDerived &>) = VariableAddress[rd]                 : 
-#  861|     r0_37(glval<PolymorphicBase>)      = VariableAddress[b]                  : 
-#  861|     r0_38(glval<PolymorphicDerived>)   = CheckedConvertOrThrow               : r0_37
-#  861|     r0_39(PolymorphicDerived &)        = CopyValue                           : r0_38
-#  861|     mu0_40(PolymorphicDerived &)       = Store                               : &:r0_36, r0_39
-#  863|     r0_41(glval<void *>)               = VariableAddress[pv]                 : 
-#  863|     r0_42(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
-#  863|     r0_43(PolymorphicBase *)           = Load                                : &:r0_42, ~mu0_2
-#  863|     r0_44(void *)                      = DynamicCastToVoid                   : r0_43
-#  863|     mu0_45(void *)                     = Store                               : &:r0_41, r0_44
-#  864|     r0_46(glval<void *>)               = VariableAddress[pcv]                : 
-#  864|     r0_47(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
-#  864|     r0_48(PolymorphicDerived *)        = Load                                : &:r0_47, ~mu0_2
-#  864|     r0_49(void *)                      = DynamicCastToVoid                   : r0_48
-#  864|     mu0_50(void *)                     = Store                               : &:r0_46, r0_49
-#  865|     v0_51(void)                        = NoOp                                : 
-#  849|     v0_52(void)                        = ReturnVoid                          : 
-#  849|     v0_53(void)                        = UnmodeledUse                        : mu*
-#  849|     v0_54(void)                        = ExitFunction                        : 
+#  858|     r0_24(glval<PolymorphicBase &>)    = VariableAddress[rb]                 : 
+#  858|     r0_25(glval<PolymorphicDerived>)   = VariableAddress[d]                  : 
+#  858|     r0_26(glval<PolymorphicBase>)      = CheckedConvertOrThrow               : r0_25
+#  858|     r0_27(PolymorphicBase &)           = CopyValue                           : r0_26
+#  858|     mu0_28(PolymorphicBase &)          = Store                               : &:r0_24, r0_27
+#  860|     r0_29(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
+#  860|     r0_30(PolymorphicBase *)           = Load                                : &:r0_29, ~mu0_2
+#  860|     r0_31(PolymorphicDerived *)        = CheckedConvertOrNull                : r0_30
+#  860|     r0_32(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  860|     mu0_33(PolymorphicDerived *)       = Store                               : &:r0_32, r0_31
+#  861|     r0_34(glval<PolymorphicDerived &>) = VariableAddress[rd]                 : 
+#  861|     r0_35(glval<PolymorphicBase>)      = VariableAddress[b]                  : 
+#  861|     r0_36(glval<PolymorphicDerived>)   = CheckedConvertOrThrow               : r0_35
+#  861|     r0_37(PolymorphicDerived &)        = CopyValue                           : r0_36
+#  861|     mu0_38(PolymorphicDerived &)       = Store                               : &:r0_34, r0_37
+#  863|     r0_39(glval<void *>)               = VariableAddress[pv]                 : 
+#  863|     r0_40(glval<PolymorphicBase *>)    = VariableAddress[pb]                 : 
+#  863|     r0_41(PolymorphicBase *)           = Load                                : &:r0_40, ~mu0_2
+#  863|     r0_42(void *)                      = DynamicCastToVoid                   : r0_41
+#  863|     mu0_43(void *)                     = Store                               : &:r0_39, r0_42
+#  864|     r0_44(glval<void *>)               = VariableAddress[pcv]                : 
+#  864|     r0_45(glval<PolymorphicDerived *>) = VariableAddress[pd]                 : 
+#  864|     r0_46(PolymorphicDerived *)        = Load                                : &:r0_45, ~mu0_2
+#  864|     r0_47(void *)                      = DynamicCastToVoid                   : r0_46
+#  864|     mu0_48(void *)                     = Store                               : &:r0_44, r0_47
+#  865|     v0_49(void)                        = NoOp                                : 
+#  849|     v0_50(void)                        = ReturnVoid                          : 
+#  849|     v0_51(void)                        = UnmodeledUse                        : mu*
+#  849|     v0_52(void)                        = ExitFunction                        : 
 
 #  867| void String::String()
 #  867|   Block 0
@@ -4245,46 +4085,42 @@ ir.cpp:
 #  874|     r0_11(char *)            = Convert                : r0_10
 #  874|     r0_12(glval<char *>)     = VariableAddress[p]     : 
 #  874|     mu0_13(char *)           = Store                  : &:r0_12, r0_11
-#  874|     r0_14(glval<char *>)     = CopyValue              : r0_12
-#  875|     r0_15(glval<char[5]>)    = VariableAddress[a]     : 
-#  875|     r0_16(char *)            = Convert                : r0_15
-#  875|     r0_17(int)               = Constant[0]            : 
-#  875|     r0_18(glval<char>)       = PointerAdd[1]          : r0_16, r0_17
-#  875|     r0_19(char *)            = CopyValue              : r0_18
-#  875|     r0_20(char *)            = Convert                : r0_19
-#  875|     r0_21(glval<char *>)     = VariableAddress[p]     : 
-#  875|     mu0_22(char *)           = Store                  : &:r0_21, r0_20
-#  875|     r0_23(glval<char *>)     = CopyValue              : r0_21
-#  876|     r0_24(glval<char[5]>)    = StringConstant["test"] : 
-#  876|     r0_25(char *)            = Convert                : r0_24
-#  876|     r0_26(int)               = Constant[0]            : 
-#  876|     r0_27(glval<char>)       = PointerAdd[1]          : r0_25, r0_26
-#  876|     r0_28(char *)            = CopyValue              : r0_27
-#  876|     r0_29(glval<char *>)     = VariableAddress[p]     : 
-#  876|     mu0_30(char *)           = Store                  : &:r0_29, r0_28
-#  876|     r0_31(glval<char *>)     = CopyValue              : r0_29
-#  877|     r0_32(glval<char(&)[5]>) = VariableAddress[ra]    : 
-#  877|     r0_33(glval<char[5]>)    = VariableAddress[a]     : 
-#  877|     r0_34(char(&)[5])        = CopyValue              : r0_33
-#  877|     mu0_35(char(&)[5])       = Store                  : &:r0_32, r0_34
-#  878|     r0_36(glval<char(&)[5]>) = VariableAddress[rs]    : 
-#  878|     r0_37(glval<char[5]>)    = StringConstant["test"] : 
-#  878|     r0_38(char(&)[5])        = CopyValue              : r0_37
-#  878|     mu0_39(char(&)[5])       = Store                  : &:r0_36, r0_38
-#  879|     r0_40(glval<char(*)[5]>) = VariableAddress[pa]    : 
-#  879|     r0_41(glval<char[5]>)    = VariableAddress[a]     : 
-#  879|     r0_42(char(*)[5])        = CopyValue              : r0_41
-#  879|     r0_43(char(*)[5])        = Convert                : r0_42
-#  879|     mu0_44(char(*)[5])       = Store                  : &:r0_40, r0_43
-#  880|     r0_45(glval<char[5]>)    = StringConstant["test"] : 
-#  880|     r0_46(char(*)[5])        = CopyValue              : r0_45
-#  880|     r0_47(glval<char(*)[5]>) = VariableAddress[pa]    : 
-#  880|     mu0_48(char(*)[5])       = Store                  : &:r0_47, r0_46
-#  880|     r0_49(glval<char(*)[5]>) = CopyValue              : r0_47
-#  881|     v0_50(void)              = NoOp                   : 
-#  871|     v0_51(void)              = ReturnVoid             : 
-#  871|     v0_52(void)              = UnmodeledUse           : mu*
-#  871|     v0_53(void)              = ExitFunction           : 
+#  875|     r0_14(glval<char[5]>)    = VariableAddress[a]     : 
+#  875|     r0_15(char *)            = Convert                : r0_14
+#  875|     r0_16(int)               = Constant[0]            : 
+#  875|     r0_17(glval<char>)       = PointerAdd[1]          : r0_15, r0_16
+#  875|     r0_18(char *)            = CopyValue              : r0_17
+#  875|     r0_19(char *)            = Convert                : r0_18
+#  875|     r0_20(glval<char *>)     = VariableAddress[p]     : 
+#  875|     mu0_21(char *)           = Store                  : &:r0_20, r0_19
+#  876|     r0_22(glval<char[5]>)    = StringConstant["test"] : 
+#  876|     r0_23(char *)            = Convert                : r0_22
+#  876|     r0_24(int)               = Constant[0]            : 
+#  876|     r0_25(glval<char>)       = PointerAdd[1]          : r0_23, r0_24
+#  876|     r0_26(char *)            = CopyValue              : r0_25
+#  876|     r0_27(glval<char *>)     = VariableAddress[p]     : 
+#  876|     mu0_28(char *)           = Store                  : &:r0_27, r0_26
+#  877|     r0_29(glval<char(&)[5]>) = VariableAddress[ra]    : 
+#  877|     r0_30(glval<char[5]>)    = VariableAddress[a]     : 
+#  877|     r0_31(char(&)[5])        = CopyValue              : r0_30
+#  877|     mu0_32(char(&)[5])       = Store                  : &:r0_29, r0_31
+#  878|     r0_33(glval<char(&)[5]>) = VariableAddress[rs]    : 
+#  878|     r0_34(glval<char[5]>)    = StringConstant["test"] : 
+#  878|     r0_35(char(&)[5])        = CopyValue              : r0_34
+#  878|     mu0_36(char(&)[5])       = Store                  : &:r0_33, r0_35
+#  879|     r0_37(glval<char(*)[5]>) = VariableAddress[pa]    : 
+#  879|     r0_38(glval<char[5]>)    = VariableAddress[a]     : 
+#  879|     r0_39(char(*)[5])        = CopyValue              : r0_38
+#  879|     r0_40(char(*)[5])        = Convert                : r0_39
+#  879|     mu0_41(char(*)[5])       = Store                  : &:r0_37, r0_40
+#  880|     r0_42(glval<char[5]>)    = StringConstant["test"] : 
+#  880|     r0_43(char(*)[5])        = CopyValue              : r0_42
+#  880|     r0_44(glval<char(*)[5]>) = VariableAddress[pa]    : 
+#  880|     mu0_45(char(*)[5])       = Store                  : &:r0_44, r0_43
+#  881|     v0_46(void)              = NoOp                   : 
+#  871|     v0_47(void)              = ReturnVoid             : 
+#  871|     v0_48(void)              = UnmodeledUse           : mu*
+#  871|     v0_49(void)              = ExitFunction           : 
 
 #  883| void FuncPtrConversions(int(*)(int), void*)
 #  883|   Block 0
@@ -4300,17 +4136,15 @@ ir.cpp:
 #  884|     r0_9(void *)            = Convert                  : r0_8
 #  884|     r0_10(glval<void *>)    = VariableAddress[p]       : 
 #  884|     mu0_11(void *)          = Store                    : &:r0_10, r0_9
-#  884|     r0_12(glval<void *>)    = CopyValue                : r0_10
-#  885|     r0_13(glval<void *>)    = VariableAddress[p]       : 
-#  885|     r0_14(void *)           = Load                     : &:r0_13, ~mu0_2
-#  885|     r0_15(..(*)(..))        = Convert                  : r0_14
-#  885|     r0_16(glval<..(*)(..)>) = VariableAddress[pfn]     : 
-#  885|     mu0_17(..(*)(..))       = Store                    : &:r0_16, r0_15
-#  885|     r0_18(glval<..(*)(..)>) = CopyValue                : r0_16
-#  886|     v0_19(void)             = NoOp                     : 
-#  883|     v0_20(void)             = ReturnVoid               : 
-#  883|     v0_21(void)             = UnmodeledUse             : mu*
-#  883|     v0_22(void)             = ExitFunction             : 
+#  885|     r0_12(glval<void *>)    = VariableAddress[p]       : 
+#  885|     r0_13(void *)           = Load                     : &:r0_12, ~mu0_2
+#  885|     r0_14(..(*)(..))        = Convert                  : r0_13
+#  885|     r0_15(glval<..(*)(..)>) = VariableAddress[pfn]     : 
+#  885|     mu0_16(..(*)(..))       = Store                    : &:r0_15, r0_14
+#  886|     v0_17(void)             = NoOp                     : 
+#  883|     v0_18(void)             = ReturnVoid               : 
+#  883|     v0_19(void)             = UnmodeledUse             : mu*
+#  883|     v0_20(void)             = ExitFunction             : 
 
 #  888| void VarArgUsage(int)
 #  888|   Block 0
@@ -4619,7 +4453,6 @@ ir.cpp:
 #  968|     r1_0(int)        = Constant[5]        : 
 #  968|     r1_1(glval<int>) = VariableAddress[x] : 
 #  968|     mu1_2(int)       = Store              : &:r1_1, r1_0
-#  968|     r1_3(glval<int>) = CopyValue          : r1_1
 #-----|   Goto -> Block 6
 
 #  970|   Block 2
@@ -4643,7 +4476,6 @@ ir.cpp:
 #  971|     r3_0(int)        = Constant[7]        : 
 #  971|     r3_1(glval<int>) = VariableAddress[y] : 
 #  971|     mu3_2(int)       = Store              : &:r3_1, r3_0
-#  971|     r3_3(glval<int>) = CopyValue          : r3_1
 #-----|   Goto -> Block 6
 
 #  973|   Block 4
@@ -4666,7 +4498,6 @@ ir.cpp:
 #  974|     r5_2(int *)        = Load               : &:r5_1, ~mu0_2
 #  974|     r5_3(glval<int>)   = CopyValue          : r5_2
 #  974|     mu5_4(int)         = Store              : &:r5_3, r5_0
-#  974|     r5_5(glval<int>)   = CopyValue          : r5_3
 #-----|   Goto -> Block 6
 
 #  976|   Block 6
@@ -4804,7 +4635,6 @@ ir.cpp:
 #  995|     r1_1(int)        = Load               : &:r1_0, ~mu0_2
 #  995|     r1_2(glval<int>) = VariableAddress[w] : 
 #  995|     mu1_3(int)       = Store              : &:r1_2, r1_1
-#  995|     r1_4(glval<int>) = CopyValue          : r1_2
 #-----|   Goto -> Block 3
 
 #  997|   Block 2
@@ -4812,7 +4642,6 @@ ir.cpp:
 #  997|     r2_1(int)        = Load               : &:r2_0, ~mu0_2
 #  997|     r2_2(glval<int>) = VariableAddress[w] : 
 #  997|     mu2_3(int)       = Store              : &:r2_2, r2_1
-#  997|     r2_4(glval<int>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  999|   Block 3
@@ -5608,7 +5437,6 @@ ir.cpp:
 # 1130|     r2_2(int)        = Constant[1]        : 
 # 1130|     r2_3(int)        = Add                : r2_1, r2_2
 # 1130|     mu2_4(int)       = Store              : &:r2_0, r2_3
-# 1130|     r2_5(glval<int>) = CopyValue          : r2_0
 #-----|   Goto (back edge) -> Block 1
 
 # 1130|   Block 3
@@ -5674,7 +5502,6 @@ ir.cpp:
 # 1140|     r6_4(int)        = Load                          : &:r6_3, ~mu0_2
 # 1140|     r6_5(glval<int>) = VariableAddress[x]            : 
 # 1140|     mu6_6(int)       = Store                         : &:r6_5, r6_4
-# 1140|     r6_7(glval<int>) = CopyValue                     : r6_5
 #-----|   Goto -> Block 8
 
 # 1140|   Block 7
@@ -5693,7 +5520,6 @@ ir.cpp:
 # 1142|     r8_0(int)        = Constant[7]        : 
 # 1142|     r8_1(glval<int>) = VariableAddress[x] : 
 # 1142|     mu8_2(int)       = Store              : &:r8_1, r8_0
-# 1142|     r8_3(glval<int>) = CopyValue          : r8_1
 #-----|   Goto -> Block 13
 
 # 1144|   Block 9
@@ -5770,30 +5596,28 @@ ir.cpp:
 # 1156|     r0_34(int)                                         = Load                             : &:r0_33, ~mu0_2
 # 1156|     r0_35(glval<int>)                                  = PointerAdd[4]                    : r0_32, r0_34
 # 1156|     mu0_36(int)                                        = Store                            : &:r0_35, r0_31
-# 1156|     r0_37(glval<int>)                                  = CopyValue                        : r0_35
-# 1157|     r0_38(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4_shuffle]     : 
-# 1157|     r0_39(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
-# 1157|     r0_40(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_39, ~mu0_2
-# 1157|     r0_41(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
-# 1157|     r0_42(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_41, ~mu0_2
-#-----|     r0_43(int)                                         = Constant[3]                      : 
-# 1157|     r0_44(int)                                         = Constant[2]                      : 
-# 1157|     r0_45(int)                                         = Constant[1]                      : 
-# 1157|     r0_46(int)                                         = Constant[0]                      : 
-# 1157|     r0_47(__attribute((vector_size(16))) int)          = BuiltIn[__builtin_shufflevector] : 0:r0_40, 1:r0_42, 2:r0_43, 3:r0_44, 4:r0_45, 5:r0_46
-# 1157|     mu0_48(__attribute((vector_size(16UL))) int)       = Store                            : &:r0_38, r0_47
-# 1158|     r0_49(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
-# 1158|     r0_50(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_49, ~mu0_2
-# 1158|     r0_51(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4_shuffle]     : 
-# 1158|     r0_52(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_51, ~mu0_2
-# 1158|     r0_53(__attribute((vector_size(16UL))) int)        = Add                              : r0_50, r0_52
-# 1158|     r0_54(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
-# 1158|     mu0_55(__attribute((vector_size(16UL))) int)       = Store                            : &:r0_54, r0_53
-# 1158|     r0_56(glval<__attribute((vector_size(16UL))) int>) = CopyValue                        : r0_54
-# 1159|     v0_57(void)                                        = NoOp                             : 
-# 1153|     v0_58(void)                                        = ReturnVoid                       : 
-# 1153|     v0_59(void)                                        = UnmodeledUse                     : mu*
-# 1153|     v0_60(void)                                        = ExitFunction                     : 
+# 1157|     r0_37(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4_shuffle]     : 
+# 1157|     r0_38(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
+# 1157|     r0_39(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_38, ~mu0_2
+# 1157|     r0_40(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
+# 1157|     r0_41(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_40, ~mu0_2
+#-----|     r0_42(int)                                         = Constant[3]                      : 
+# 1157|     r0_43(int)                                         = Constant[2]                      : 
+# 1157|     r0_44(int)                                         = Constant[1]                      : 
+# 1157|     r0_45(int)                                         = Constant[0]                      : 
+# 1157|     r0_46(__attribute((vector_size(16))) int)          = BuiltIn[__builtin_shufflevector] : 0:r0_39, 1:r0_41, 2:r0_42, 3:r0_43, 4:r0_44, 5:r0_45
+# 1157|     mu0_47(__attribute((vector_size(16UL))) int)       = Store                            : &:r0_37, r0_46
+# 1158|     r0_48(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
+# 1158|     r0_49(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_48, ~mu0_2
+# 1158|     r0_50(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4_shuffle]     : 
+# 1158|     r0_51(__attribute((vector_size(16UL))) int)        = Load                             : &:r0_50, ~mu0_2
+# 1158|     r0_52(__attribute((vector_size(16UL))) int)        = Add                              : r0_49, r0_51
+# 1158|     r0_53(glval<__attribute((vector_size(16UL))) int>) = VariableAddress[vi4]             : 
+# 1158|     mu0_54(__attribute((vector_size(16UL))) int)       = Store                            : &:r0_53, r0_52
+# 1159|     v0_55(void)                                        = NoOp                             : 
+# 1153|     v0_56(void)                                        = ReturnVoid                       : 
+# 1153|     v0_57(void)                                        = UnmodeledUse                     : mu*
+# 1153|     v0_58(void)                                        = ExitFunction                     : 
 
 # 1163| int ModeledCallTarget(int)
 # 1163|   Block 0
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 9f13acbb1ff..ff8c2b30a05 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -214,7 +214,6 @@ ssa.cpp:
 #   70|     r1_6(glval<char>)   = CopyValue          : r1_2
 #   70|     m1_7(char)          = Store              : &:r1_6, r1_0
 #   70|     m1_8(unknown)       = Chi                : total:m3_0, partial:m1_7
-#   70|     r1_9(glval<char>)   = CopyValue          : r1_6
 #-----|   Goto (back edge) -> Block 3
 
 #   71|   Block 2
@@ -264,23 +263,20 @@ ssa.cpp:
 #   80|     r1_0(int)        = Constant[3]        : 
 #   80|     r1_1(glval<int>) = VariableAddress[x] : 
 #   80|     m1_2(int)        = Store              : &:r1_1, r1_0
-#   80|     r1_3(glval<int>) = CopyValue          : r1_1
-#   81|     r1_4(int)        = Constant[4]        : 
-#   81|     r1_5(glval<int>) = VariableAddress[y] : 
-#   81|     m1_6(int)        = Store              : &:r1_5, r1_4
-#   81|     r1_7(glval<int>) = CopyValue          : r1_5
+#   81|     r1_3(int)        = Constant[4]        : 
+#   81|     r1_4(glval<int>) = VariableAddress[y] : 
+#   81|     m1_5(int)        = Store              : &:r1_4, r1_3
 #-----|   Goto -> Block 3
 
 #   84|   Block 2
 #   84|     r2_0(int)        = Constant[5]        : 
 #   84|     r2_1(glval<int>) = VariableAddress[x] : 
 #   84|     m2_2(int)        = Store              : &:r2_1, r2_0
-#   84|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #   86|   Block 3
 #   86|     m3_0(int)         = Phi                      : from 1:m1_2, from 2:m2_2
-#   86|     m3_1(int)         = Phi                      : from 1:m1_6, from 2:m0_10
+#   86|     m3_1(int)         = Phi                      : from 1:m1_5, from 2:m0_10
 #   86|     r3_2(glval<int>)  = VariableAddress[x_merge] : 
 #   86|     r3_3(glval<int>)  = VariableAddress[x]       : 
 #   86|     r3_4(int)         = Load                     : &:r3_3, m3_0
@@ -501,7 +497,6 @@ ssa.cpp:
 #  125|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  125|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  125|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
-#  125|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  128|   Block 2
@@ -511,7 +506,6 @@ ssa.cpp:
 #  128|     r2_3(glval<int>)   = FieldAddress[x]     : r2_2
 #  128|     m2_4(int)          = Store               : &:r2_3, r2_1
 #  128|     m2_5(Point)        = Chi                 : total:m0_18, partial:m2_4
-#  128|     r2_6(glval<int>)   = CopyValue           : r2_3
 #-----|   Goto -> Block 3
 
 #  130|   Block 3
@@ -565,7 +559,6 @@ ssa.cpp:
 #  137|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  137|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  137|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
-#  137|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  140|   Block 2
@@ -573,7 +566,6 @@ ssa.cpp:
 #  140|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  140|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  140|     m2_3(Point)        = Store              : &:r2_2, r2_1
-#  140|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  142|   Block 3
@@ -623,7 +615,6 @@ ssa.cpp:
 #  148|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  148|     m1_4(int)          = Store               : &:r1_3, r1_1
 #  148|     m1_5(Point)        = Chi                 : total:m0_18, partial:m1_4
-#  148|     r1_6(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  151|   Block 2
@@ -631,7 +622,6 @@ ssa.cpp:
 #  151|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  151|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  151|     m2_3(Point)        = Store              : &:r2_2, r2_1
-#  151|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  153|   Block 3
@@ -680,7 +670,6 @@ ssa.cpp:
 #  159|     r1_4(glval<int>)   = FieldAddress[x]       : r1_3
 #  159|     m1_5(int)          = Store                 : &:r1_4, r1_1
 #  159|     m1_6(Rect)         = Chi                   : total:m0_18, partial:m1_5
-#  159|     r1_7(glval<int>)   = CopyValue             : r1_4
 #-----|   Goto -> Block 3
 
 #  162|   Block 2
@@ -688,7 +677,6 @@ ssa.cpp:
 #  162|     r2_1(Rect)        = Load               : &:r2_0, m0_6
 #  162|     r2_2(glval<Rect>) = VariableAddress[a] : 
 #  162|     m2_3(Rect)        = Store              : &:r2_2, r2_1
-#  162|     r2_4(glval<Rect>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  164|   Block 3
@@ -723,22 +711,19 @@ ssa.cpp:
 #  174|     r0_15(glval<Wrapper>) = VariableAddress[w]     : 
 #  174|     r0_16(glval<int>)     = FieldAddress[f]        : r0_15
 #  174|     m0_17(int)            = Store                  : &:r0_16, r0_14
-#  174|     r0_18(glval<int>)     = CopyValue              : r0_16
-#  175|     r0_19(glval<Wrapper>) = VariableAddress[w]     : 
-#  175|     r0_20(glval<int>)     = FieldAddress[f]        : r0_19
-#  175|     r0_21(int)            = Load                   : &:r0_20, m0_17
-#  175|     r0_22(glval<int>)     = VariableAddress[a]     : 
-#  175|     m0_23(int)            = Store                  : &:r0_22, r0_21
-#  175|     r0_24(glval<int>)     = CopyValue              : r0_22
-#  176|     r0_25(glval<Wrapper>) = VariableAddress[w]     : 
-#  176|     r0_26(Wrapper)        = Load                   : &:r0_25, ~m0_17
-#  176|     r0_27(glval<Wrapper>) = VariableAddress[x]     : 
-#  176|     m0_28(Wrapper)        = Store                  : &:r0_27, r0_26
-#  176|     r0_29(glval<Wrapper>) = CopyValue              : r0_27
-#  177|     v0_30(void)           = NoOp                   : 
-#  171|     v0_31(void)           = ReturnVoid             : 
-#  171|     v0_32(void)           = UnmodeledUse           : mu*
-#  171|     v0_33(void)           = ExitFunction           : 
+#  175|     r0_18(glval<Wrapper>) = VariableAddress[w]     : 
+#  175|     r0_19(glval<int>)     = FieldAddress[f]        : r0_18
+#  175|     r0_20(int)            = Load                   : &:r0_19, m0_17
+#  175|     r0_21(glval<int>)     = VariableAddress[a]     : 
+#  175|     m0_22(int)            = Store                  : &:r0_21, r0_20
+#  176|     r0_23(glval<Wrapper>) = VariableAddress[w]     : 
+#  176|     r0_24(Wrapper)        = Load                   : &:r0_23, ~m0_17
+#  176|     r0_25(glval<Wrapper>) = VariableAddress[x]     : 
+#  176|     m0_26(Wrapper)        = Store                  : &:r0_25, r0_24
+#  177|     v0_27(void)           = NoOp                   : 
+#  171|     v0_28(void)           = ReturnVoid             : 
+#  171|     v0_29(void)           = UnmodeledUse           : mu*
+#  171|     v0_30(void)           = ExitFunction           : 
 
 #  179| int AsmStmt(int*)
 #  179|   Block 0
@@ -819,24 +804,22 @@ ssa.cpp:
 #  200|     r0_27(int)            = Load                      : &:r0_26, m0_19
 #  200|     r0_28(int)            = Add                       : r0_27, r0_24
 #  200|     m0_29(int)            = Store                     : &:r0_26, r0_28
-#  200|     r0_30(glval<int>)     = CopyValue                 : r0_26
-#  201|     r0_31(glval<unknown>) = FunctionAddress[abs]      : 
-#  201|     r0_32(glval<int>)     = VariableAddress[x]        : 
-#  201|     r0_33(int)            = Load                      : &:r0_32, m0_8
-#  201|     r0_34(int)            = Call                      : func:r0_31, 0:r0_33
-#  201|     r0_35(glval<int>)     = VariableAddress[ret]      : 
-#  201|     r0_36(int)            = Load                      : &:r0_35, m0_29
-#  201|     r0_37(int)            = Add                       : r0_36, r0_34
-#  201|     m0_38(int)            = Store                     : &:r0_35, r0_37
-#  201|     r0_39(glval<int>)     = CopyValue                 : r0_35
-#  202|     r0_40(glval<int>)     = VariableAddress[#return]  : 
-#  202|     r0_41(glval<int>)     = VariableAddress[ret]      : 
-#  202|     r0_42(int)            = Load                      : &:r0_41, m0_38
-#  202|     m0_43(int)            = Store                     : &:r0_40, r0_42
-#  198|     r0_44(glval<int>)     = VariableAddress[#return]  : 
-#  198|     v0_45(void)           = ReturnValue               : &:r0_44, m0_43
-#  198|     v0_46(void)           = UnmodeledUse              : mu*
-#  198|     v0_47(void)           = ExitFunction              : 
+#  201|     r0_30(glval<unknown>) = FunctionAddress[abs]      : 
+#  201|     r0_31(glval<int>)     = VariableAddress[x]        : 
+#  201|     r0_32(int)            = Load                      : &:r0_31, m0_8
+#  201|     r0_33(int)            = Call                      : func:r0_30, 0:r0_32
+#  201|     r0_34(glval<int>)     = VariableAddress[ret]      : 
+#  201|     r0_35(int)            = Load                      : &:r0_34, m0_29
+#  201|     r0_36(int)            = Add                       : r0_35, r0_33
+#  201|     m0_37(int)            = Store                     : &:r0_34, r0_36
+#  202|     r0_38(glval<int>)     = VariableAddress[#return]  : 
+#  202|     r0_39(glval<int>)     = VariableAddress[ret]      : 
+#  202|     r0_40(int)            = Load                      : &:r0_39, m0_37
+#  202|     m0_41(int)            = Store                     : &:r0_38, r0_40
+#  198|     r0_42(glval<int>)     = VariableAddress[#return]  : 
+#  198|     v0_43(void)           = ReturnValue               : &:r0_42, m0_41
+#  198|     v0_44(void)           = UnmodeledUse              : mu*
+#  198|     v0_45(void)           = ExitFunction              : 
 
 #  207| int ModeledCallTarget(int)
 #  207|   Block 0
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index fd21c3f2d71..8204cdad960 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -216,7 +216,6 @@ ssa.cpp:
 #   70|     m1_5(char *)        = Store              : &:r1_1, r1_4
 #   70|     r1_6(glval<char>)   = CopyValue          : r1_2
 #   70|     mu1_7(char)         = Store              : &:r1_6, r1_0
-#   70|     r1_8(glval<char>)   = CopyValue          : r1_6
 #-----|   Goto (back edge) -> Block 3
 
 #   71|   Block 2
@@ -265,23 +264,20 @@ ssa.cpp:
 #   80|     r1_0(int)        = Constant[3]        : 
 #   80|     r1_1(glval<int>) = VariableAddress[x] : 
 #   80|     m1_2(int)        = Store              : &:r1_1, r1_0
-#   80|     r1_3(glval<int>) = CopyValue          : r1_1
-#   81|     r1_4(int)        = Constant[4]        : 
-#   81|     r1_5(glval<int>) = VariableAddress[y] : 
-#   81|     m1_6(int)        = Store              : &:r1_5, r1_4
-#   81|     r1_7(glval<int>) = CopyValue          : r1_5
+#   81|     r1_3(int)        = Constant[4]        : 
+#   81|     r1_4(glval<int>) = VariableAddress[y] : 
+#   81|     m1_5(int)        = Store              : &:r1_4, r1_3
 #-----|   Goto -> Block 3
 
 #   84|   Block 2
 #   84|     r2_0(int)        = Constant[5]        : 
 #   84|     r2_1(glval<int>) = VariableAddress[x] : 
 #   84|     m2_2(int)        = Store              : &:r2_1, r2_0
-#   84|     r2_3(glval<int>) = CopyValue          : r2_1
 #-----|   Goto -> Block 3
 
 #   86|   Block 3
 #   86|     m3_0(int)         = Phi                      : from 1:m1_2, from 2:m2_2
-#   86|     m3_1(int)         = Phi                      : from 1:m1_6, from 2:m0_10
+#   86|     m3_1(int)         = Phi                      : from 1:m1_5, from 2:m0_10
 #   86|     r3_2(glval<int>)  = VariableAddress[x_merge] : 
 #   86|     r3_3(glval<int>)  = VariableAddress[x]       : 
 #   86|     r3_4(int)         = Load                     : &:r3_3, m3_0
@@ -486,7 +482,6 @@ ssa.cpp:
 #  125|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  125|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  125|     mu1_4(int)         = Store               : &:r1_3, r1_1
-#  125|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  128|   Block 2
@@ -495,7 +490,6 @@ ssa.cpp:
 #  128|     r2_2(glval<Point>) = VariableAddress[a]  : 
 #  128|     r2_3(glval<int>)   = FieldAddress[x]     : r2_2
 #  128|     mu2_4(int)         = Store               : &:r2_3, r2_1
-#  128|     r2_5(glval<int>)   = CopyValue           : r2_3
 #-----|   Goto -> Block 3
 
 #  130|   Block 3
@@ -544,7 +538,6 @@ ssa.cpp:
 #  137|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  137|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  137|     mu1_4(int)         = Store               : &:r1_3, r1_1
-#  137|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  140|   Block 2
@@ -552,7 +545,6 @@ ssa.cpp:
 #  140|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  140|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  140|     mu2_3(Point)       = Store              : &:r2_2, r2_1
-#  140|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  142|   Block 3
@@ -597,7 +589,6 @@ ssa.cpp:
 #  148|     r1_2(glval<Point>) = VariableAddress[a]  : 
 #  148|     r1_3(glval<int>)   = FieldAddress[x]     : r1_2
 #  148|     mu1_4(int)         = Store               : &:r1_3, r1_1
-#  148|     r1_5(glval<int>)   = CopyValue           : r1_3
 #-----|   Goto -> Block 3
 
 #  151|   Block 2
@@ -605,7 +596,6 @@ ssa.cpp:
 #  151|     r2_1(Point)        = Load               : &:r2_0, m0_6
 #  151|     r2_2(glval<Point>) = VariableAddress[a] : 
 #  151|     mu2_3(Point)       = Store              : &:r2_2, r2_1
-#  151|     r2_4(glval<Point>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  153|   Block 3
@@ -650,7 +640,6 @@ ssa.cpp:
 #  159|     r1_3(glval<Point>) = FieldAddress[topLeft] : r1_2
 #  159|     r1_4(glval<int>)   = FieldAddress[x]       : r1_3
 #  159|     mu1_5(int)         = Store                 : &:r1_4, r1_1
-#  159|     r1_6(glval<int>)   = CopyValue             : r1_4
 #-----|   Goto -> Block 3
 
 #  162|   Block 2
@@ -658,7 +647,6 @@ ssa.cpp:
 #  162|     r2_1(Rect)        = Load               : &:r2_0, m0_6
 #  162|     r2_2(glval<Rect>) = VariableAddress[a] : 
 #  162|     mu2_3(Rect)       = Store              : &:r2_2, r2_1
-#  162|     r2_4(glval<Rect>) = CopyValue          : r2_2
 #-----|   Goto -> Block 3
 
 #  164|   Block 3
@@ -692,22 +680,19 @@ ssa.cpp:
 #  174|     r0_15(glval<Wrapper>) = VariableAddress[w]     : 
 #  174|     r0_16(glval<int>)     = FieldAddress[f]        : r0_15
 #  174|     mu0_17(int)           = Store                  : &:r0_16, r0_14
-#  174|     r0_18(glval<int>)     = CopyValue              : r0_16
-#  175|     r0_19(glval<Wrapper>) = VariableAddress[w]     : 
-#  175|     r0_20(glval<int>)     = FieldAddress[f]        : r0_19
-#  175|     r0_21(int)            = Load                   : &:r0_20, ~mu0_2
-#  175|     r0_22(glval<int>)     = VariableAddress[a]     : 
-#  175|     m0_23(int)            = Store                  : &:r0_22, r0_21
-#  175|     r0_24(glval<int>)     = CopyValue              : r0_22
-#  176|     r0_25(glval<Wrapper>) = VariableAddress[w]     : 
-#  176|     r0_26(Wrapper)        = Load                   : &:r0_25, ~mu0_2
-#  176|     r0_27(glval<Wrapper>) = VariableAddress[x]     : 
-#  176|     m0_28(Wrapper)        = Store                  : &:r0_27, r0_26
-#  176|     r0_29(glval<Wrapper>) = CopyValue              : r0_27
-#  177|     v0_30(void)           = NoOp                   : 
-#  171|     v0_31(void)           = ReturnVoid             : 
-#  171|     v0_32(void)           = UnmodeledUse           : mu*
-#  171|     v0_33(void)           = ExitFunction           : 
+#  175|     r0_18(glval<Wrapper>) = VariableAddress[w]     : 
+#  175|     r0_19(glval<int>)     = FieldAddress[f]        : r0_18
+#  175|     r0_20(int)            = Load                   : &:r0_19, ~mu0_2
+#  175|     r0_21(glval<int>)     = VariableAddress[a]     : 
+#  175|     m0_22(int)            = Store                  : &:r0_21, r0_20
+#  176|     r0_23(glval<Wrapper>) = VariableAddress[w]     : 
+#  176|     r0_24(Wrapper)        = Load                   : &:r0_23, ~mu0_2
+#  176|     r0_25(glval<Wrapper>) = VariableAddress[x]     : 
+#  176|     m0_26(Wrapper)        = Store                  : &:r0_25, r0_24
+#  177|     v0_27(void)           = NoOp                   : 
+#  171|     v0_28(void)           = ReturnVoid             : 
+#  171|     v0_29(void)           = UnmodeledUse           : mu*
+#  171|     v0_30(void)           = ExitFunction           : 
 
 #  179| int AsmStmt(int*)
 #  179|   Block 0
@@ -782,24 +767,22 @@ ssa.cpp:
 #  200|     r0_27(int)            = Load                      : &:r0_26, m0_19
 #  200|     r0_28(int)            = Add                       : r0_27, r0_24
 #  200|     m0_29(int)            = Store                     : &:r0_26, r0_28
-#  200|     r0_30(glval<int>)     = CopyValue                 : r0_26
-#  201|     r0_31(glval<unknown>) = FunctionAddress[abs]      : 
-#  201|     r0_32(glval<int>)     = VariableAddress[x]        : 
-#  201|     r0_33(int)            = Load                      : &:r0_32, m0_8
-#  201|     r0_34(int)            = Call                      : func:r0_31, 0:r0_33
-#  201|     r0_35(glval<int>)     = VariableAddress[ret]      : 
-#  201|     r0_36(int)            = Load                      : &:r0_35, m0_29
-#  201|     r0_37(int)            = Add                       : r0_36, r0_34
-#  201|     m0_38(int)            = Store                     : &:r0_35, r0_37
-#  201|     r0_39(glval<int>)     = CopyValue                 : r0_35
-#  202|     r0_40(glval<int>)     = VariableAddress[#return]  : 
-#  202|     r0_41(glval<int>)     = VariableAddress[ret]      : 
-#  202|     r0_42(int)            = Load                      : &:r0_41, m0_38
-#  202|     m0_43(int)            = Store                     : &:r0_40, r0_42
-#  198|     r0_44(glval<int>)     = VariableAddress[#return]  : 
-#  198|     v0_45(void)           = ReturnValue               : &:r0_44, m0_43
-#  198|     v0_46(void)           = UnmodeledUse              : mu*
-#  198|     v0_47(void)           = ExitFunction              : 
+#  201|     r0_30(glval<unknown>) = FunctionAddress[abs]      : 
+#  201|     r0_31(glval<int>)     = VariableAddress[x]        : 
+#  201|     r0_32(int)            = Load                      : &:r0_31, m0_8
+#  201|     r0_33(int)            = Call                      : func:r0_30, 0:r0_32
+#  201|     r0_34(glval<int>)     = VariableAddress[ret]      : 
+#  201|     r0_35(int)            = Load                      : &:r0_34, m0_29
+#  201|     r0_36(int)            = Add                       : r0_35, r0_33
+#  201|     m0_37(int)            = Store                     : &:r0_34, r0_36
+#  202|     r0_38(glval<int>)     = VariableAddress[#return]  : 
+#  202|     r0_39(glval<int>)     = VariableAddress[ret]      : 
+#  202|     r0_40(int)            = Load                      : &:r0_39, m0_37
+#  202|     m0_41(int)            = Store                     : &:r0_38, r0_40
+#  198|     r0_42(glval<int>)     = VariableAddress[#return]  : 
+#  198|     v0_43(void)           = ReturnValue               : &:r0_42, m0_41
+#  198|     v0_44(void)           = UnmodeledUse              : mu*
+#  198|     v0_45(void)           = ExitFunction              : 
 
 #  207| int ModeledCallTarget(int)
 #  207|   Block 0
diff --git a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
index 589678d9f77..9e8588507ff 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
@@ -26,7 +26,7 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:28:12:28:15 | Chi: call to C |
 | ms_try_mix.cpp:48:10:48:13 | Chi: call to C |
 | pointer_to_member.cpp:36:11:36:30 | FieldAddress: {...} |
-| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
 | vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
 ambiguousSuccessors
diff --git a/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
index bb312fa7691..1bcffed0736 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
@@ -4,7 +4,6 @@ missingOperand
 | condition_decls.cpp:41:9:41:23 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:40:6:40:20 | IR: while_decl_bind | void while_decl_bind(int) |
 | condition_decls.cpp:48:39:48:53 | CopyValue: (condition decl) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | condition_decls.cpp:47:6:47:18 | IR: for_decl_bind | void for_decl_bind(int) |
 | misc.c:125:5:125:11 | CopyValue: (statement expression) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:97:6:97:10 | IR: misc3 | void misc3() |
-| misc.c:220:3:223:3 | CopyValue: ... = ... | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:3:223:3 | Store: ... = ... | Instruction 'Store' is missing an expected operand with tag 'StoreValue' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:9:223:3 | FieldAddress: {...} | Instruction 'FieldAddress' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
 | misc.c:220:9:223:3 | FieldAddress: {...} | Instruction 'FieldAddress' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
@@ -49,13 +48,13 @@ instructionWithoutSuccessor
 | misc.c:222:10:222:10 | Store: 2 |
 | ms_assume.cpp:20:12:20:12 | Constant: (bool)... |
 | ms_try_except.cpp:3:9:3:9 | Uninitialized: definition of x |
-| ms_try_except.cpp:7:13:7:17 | CopyValue: ... = ... |
+| ms_try_except.cpp:7:13:7:17 | Store: ... = ... |
 | ms_try_except.cpp:9:19:9:19 | Load: j |
-| ms_try_except.cpp:10:13:10:17 | CopyValue: ... = ... |
-| ms_try_except.cpp:14:13:14:17 | CopyValue: ... = ... |
-| ms_try_except.cpp:17:13:17:17 | CopyValue: ... = ... |
+| ms_try_except.cpp:10:13:10:17 | Store: ... = ... |
+| ms_try_except.cpp:14:13:14:17 | Store: ... = ... |
+| ms_try_except.cpp:17:13:17:17 | Store: ... = ... |
 | ms_try_except.cpp:19:17:19:21 | Sub: ... - ... |
-| ms_try_except.cpp:20:9:20:13 | CopyValue: ... = ... |
+| ms_try_except.cpp:20:9:20:13 | Store: ... = ... |
 | ms_try_mix.cpp:11:12:11:15 | CallSideEffect: call to C |
 | ms_try_mix.cpp:16:13:16:19 | ThrowValue: throw ... |
 | ms_try_mix.cpp:18:16:18:19 | CallSideEffect: call to C |
@@ -77,7 +76,7 @@ instructionWithoutSuccessor
 | static_init_templates.cpp:97:27:97:36 | Convert: (void *)... |
 | static_init_templates.cpp:105:27:105:27 | Constant: (void *)... |
 | static_init_templates.cpp:105:27:105:27 | Constant: (void *)... |
-| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
 | stmt_expr.cpp:29:11:32:11 | CopyValue: (statement expression) |
 | stmt_in_type.cpp:5:53:5:53 | Constant: 1 |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
index 0f8088f9a25..d064a1264ec 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
@@ -35,7 +35,7 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:28:12:28:15 | CallSideEffect: call to C |
 | ms_try_mix.cpp:48:10:48:13 | CallSideEffect: call to C |
 | pointer_to_member.cpp:36:11:36:30 | FieldAddress: {...} |
-| stmt_expr.cpp:27:5:27:15 | CopyValue: ... = ... |
+| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix |
 | vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
 ambiguousSuccessors

From 11da4a53285b6fc93afc6e9c8c88bdc6644118d4 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Thu, 24 Oct 2019 15:17:16 +0200
Subject: [PATCH 047/232] C++: Accept test results for GVN and sign analysis

---
 .../signanalysis/SignAnalysis.expected        |  28 ---
 .../GlobalValueNumbering/ir_gvn.expected      | 234 ++++++++----------
 2 files changed, 101 insertions(+), 161 deletions(-)

diff --git a/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected b/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
index 4dc280b6ca9..0c8f9c1cff1 100644
--- a/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
@@ -13,7 +13,6 @@
 | bounded_bounds.c:16:12:16:12 | Load: x | negative strictlyNegative |
 | bounded_bounds.c:16:12:16:12 | Store: x | negative strictlyNegative |
 | inline_assembly.c:9:23:9:23 | Uninitialized: definition of y | positive |
-| inline_assembly.c:10:3:10:7 | CopyValue: ... = ... | positive strictlyPositive |
 | inline_assembly.c:10:3:10:7 | Store: ... = ... | positive strictlyPositive |
 | inline_assembly.c:10:7:10:7 | Constant: (unsigned int)... | positive strictlyPositive |
 | inline_assembly.c:12:32:12:32 | Load: y | positive strictlyPositive |
@@ -28,10 +27,8 @@
 | minmax.c:18:37:18:37 | Load: x | positive strictlyPositive |
 | minmax.c:18:40:18:40 | Load: y | positive strictlyPositive |
 | minmax.c:18:43:18:43 | Load: z | positive strictlyPositive |
-| minmax.c:20:2:24:3 | CopyValue: ... = ... | positive |
 | minmax.c:20:2:24:3 | Store: ... = ... | positive |
 | minmax.c:20:6:24:3 | CopyValue: (statement expression) | positive |
-| minmax.c:22:18:22:22 | CopyValue: ... = ... | positive strictlyPositive |
 | minmax.c:22:18:22:22 | Store: ... = ... | positive strictlyPositive |
 | minmax.c:22:22:22:22 | Load: x | positive strictlyPositive |
 | minmax.c:23:3:23:3 | Load: t | positive |
@@ -40,7 +37,6 @@
 | minmax.c:26:40:26:40 | Load: y | positive strictlyPositive |
 | minmax.c:26:43:26:43 | Load: z | positive |
 | test.c:7:10:7:10 | Phi: p | positive |
-| test.c:8:5:8:19 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:8:5:8:19 | Store: ... = ... | positive strictlyPositive |
 | test.c:8:13:8:17 | Load: count | positive |
 | test.c:8:13:8:19 | Add: ... + ... | positive strictlyPositive |
@@ -48,7 +44,6 @@
 | test.c:10:10:10:14 | Load: count | positive |
 | test.c:10:10:10:14 | Store: count | positive |
 | test.c:15:10:15:10 | Phi: p | positive |
-| test.c:16:5:16:26 | CopyValue: ... = ... | positive |
 | test.c:16:5:16:26 | Store: ... = ... | positive |
 | test.c:16:13:16:26 | Rem: ... % ... | positive |
 | test.c:16:14:16:18 | Load: count | positive |
@@ -62,7 +57,6 @@
 | test.c:24:5:24:11 | Constant: ... ++ | positive strictlyPositive |
 | test.c:24:5:24:11 | Load: ... ++ | positive |
 | test.c:24:5:24:11 | Store: ... ++ | positive strictlyPositive |
-| test.c:25:5:25:22 | CopyValue: ... = ... | positive |
 | test.c:25:5:25:22 | Store: ... = ... | positive |
 | test.c:25:13:25:17 | Load: count | positive strictlyPositive |
 | test.c:25:13:25:22 | Rem: ... % ... | positive |
@@ -73,7 +67,6 @@
 | test.c:33:15:33:15 | Phi: i | positive |
 | test.c:33:15:33:15 | Phi: i | positive |
 | test.c:33:19:33:19 | Constant: 2 | positive strictlyPositive |
-| test.c:33:22:33:28 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:33:22:33:28 | Store: ... = ... | positive strictlyPositive |
 | test.c:33:26:33:26 | Load: i | positive |
 | test.c:33:26:33:28 | Add: ... + ... | positive strictlyPositive |
@@ -108,7 +101,6 @@
 | test.c:51:15:51:17 | Add: ... + ... | positive strictlyPositive |
 | test.c:51:17:51:17 | Constant: 2 | positive strictlyPositive |
 | test.c:51:21:51:21 | Constant: 4 | positive strictlyPositive |
-| test.c:51:24:51:30 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:51:24:51:30 | Store: ... = ... | positive strictlyPositive |
 | test.c:51:28:51:28 | Load: i | positive |
 | test.c:51:28:51:30 | Add: ... + ... | positive strictlyPositive |
@@ -467,7 +459,6 @@
 | test.c:343:5:343:7 | Constant: ... ++ | positive strictlyPositive |
 | test.c:343:5:343:7 | Load: ... ++ | positive |
 | test.c:343:5:343:7 | Store: ... ++ | positive strictlyPositive |
-| test.c:345:3:345:7 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:345:3:345:7 | Store: ... = ... | positive strictlyPositive |
 | test.c:345:7:345:7 | Load: i | positive strictlyPositive |
 | test.c:346:7:346:7 | Load: x | positive |
@@ -483,7 +474,6 @@
 | test.c:356:36:356:37 | Uninitialized: definition of y6 | positive |
 | test.c:356:40:356:41 | Uninitialized: definition of y7 | positive |
 | test.c:356:44:356:45 | Uninitialized: definition of y8 | positive |
-| test.c:357:3:357:23 | CopyValue: ... = ... | positive |
 | test.c:357:3:357:23 | Store: ... = ... | positive |
 | test.c:357:8:357:8 | Load: x | positive |
 | test.c:357:8:357:23 | Load: ... ? ... : ... | positive |
@@ -493,7 +483,6 @@
 | test.c:357:12:357:14 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:357:18:357:18 | Load: x | positive |
 | test.c:357:22:357:23 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:358:3:358:24 | CopyValue: ... = ... | positive |
 | test.c:358:3:358:24 | Store: ... = ... | positive |
 | test.c:358:8:358:8 | Load: x | positive |
 | test.c:358:8:358:24 | Load: ... ? ... : ... | positive |
@@ -505,7 +494,6 @@
 | test.c:358:24:358:24 | Load: x | positive |
 | test.c:365:7:365:7 | Load: x | positive |
 | test.c:365:11:365:13 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:366:5:366:15 | CopyValue: ... = ... | positive |
 | test.c:366:5:366:15 | Store: ... = ... | positive |
 | test.c:366:10:366:10 | Load: x | positive |
 | test.c:366:10:366:15 | Load: ... ? ... : ... | positive |
@@ -513,7 +501,6 @@
 | test.c:366:10:366:15 | Store: ... ? ... : ... | positive |
 | test.c:366:10:366:15 | Store: ... ? ... : ... | positive strictlyPositive |
 | test.c:366:15:366:15 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:367:5:367:17 | CopyValue: ... = ... | positive |
 | test.c:367:5:367:17 | Store: ... = ... | positive |
 | test.c:367:10:367:10 | Load: x | positive |
 | test.c:367:10:367:17 | Load: ... ? ... : ... | positive |
@@ -521,7 +508,6 @@
 | test.c:367:10:367:17 | Store: ... ? ... : ... | positive |
 | test.c:367:10:367:17 | Store: ... ? ... : ... | positive strictlyPositive |
 | test.c:367:15:367:17 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:368:5:368:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:368:5:368:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:368:10:368:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:368:10:368:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -529,7 +515,6 @@
 | test.c:368:11:368:13 | Add: ... + ... | positive strictlyPositive |
 | test.c:368:13:368:13 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:368:19:368:21 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:369:5:369:36 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:369:5:369:36 | Store: ... = ... | positive strictlyPositive |
 | test.c:369:10:369:36 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:369:10:369:36 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -539,7 +524,6 @@
 | test.c:369:27:369:29 | Add: ... + ... | positive strictlyPositive |
 | test.c:369:29:369:29 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:369:36:369:36 | Constant: 5 | positive strictlyPositive |
-| test.c:370:5:370:38 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:370:5:370:38 | Store: ... = ... | positive strictlyPositive |
 | test.c:370:10:370:38 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:370:10:370:38 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -549,7 +533,6 @@
 | test.c:370:27:370:29 | Add: ... + ... | positive strictlyPositive |
 | test.c:370:29:370:29 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:370:36:370:38 | Constant: 500 | positive strictlyPositive |
-| test.c:371:5:371:39 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:371:5:371:39 | Store: ... = ... | positive strictlyPositive |
 | test.c:371:10:371:39 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:371:10:371:39 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -587,7 +570,6 @@
 | test.c:378:24:378:25 | Uninitialized: definition of y3 | positive |
 | test.c:378:28:378:29 | Uninitialized: definition of y4 | positive |
 | test.c:378:32:378:33 | Uninitialized: definition of y5 | positive |
-| test.c:379:3:379:24 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:379:3:379:24 | Store: ... = ... | positive strictlyPositive |
 | test.c:379:8:379:8 | Load: x | positive |
 | test.c:379:8:379:24 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -597,7 +579,6 @@
 | test.c:379:12:379:14 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:379:18:379:18 | Load: x | positive strictlyPositive |
 | test.c:379:22:379:24 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:380:3:380:25 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:380:3:380:25 | Store: ... = ... | positive strictlyPositive |
 | test.c:380:8:380:8 | Load: x | positive |
 | test.c:380:8:380:25 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -607,18 +588,14 @@
 | test.c:380:13:380:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:380:19:380:21 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:380:25:380:25 | Load: x | positive strictlyPositive |
-| test.c:381:3:381:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:381:3:381:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:381:8:381:11 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:382:3:382:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:382:3:382:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:382:8:382:11 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:383:3:383:11 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:383:3:383:11 | Store: ... = ... | positive strictlyPositive |
 | test.c:383:8:383:11 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:384:7:384:7 | Load: x | positive |
 | test.c:384:12:384:14 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:385:5:385:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:385:5:385:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:385:10:385:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:385:10:385:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -626,7 +603,6 @@
 | test.c:385:11:385:15 | Sub: ... - ... | positive |
 | test.c:385:13:385:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:385:21:385:21 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:386:5:386:21 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:386:5:386:21 | Store: ... = ... | positive strictlyPositive |
 | test.c:386:10:386:21 | Load: ... ? ... : ... | positive strictlyPositive |
 | test.c:386:10:386:21 | Store: ... ? ... : ... | positive strictlyPositive |
@@ -634,7 +610,6 @@
 | test.c:386:11:386:15 | Sub: ... - ... | positive |
 | test.c:386:13:386:15 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:386:21:386:21 | Constant: (unsigned int)... | positive strictlyPositive |
-| test.c:387:5:387:38 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:387:5:387:38 | Store: ... = ... | positive strictlyPositive |
 | test.c:387:10:387:38 | Convert: (unsigned int)... | positive strictlyPositive |
 | test.c:387:10:387:38 | Load: ... ? ... : ... | positive strictlyPositive |
@@ -669,7 +644,6 @@
 | test.c:394:34:394:36 | Constant: (unsigned int)... | positive strictlyPositive |
 | test.c:395:16:395:17 | Uninitialized: definition of y1 | positive |
 | test.c:396:16:396:17 | Uninitialized: definition of y2 | positive |
-| test.c:397:3:397:15 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:397:3:397:15 | Store: ... = ... | positive strictlyPositive |
 | test.c:397:9:397:11 | Add: ++ ... | positive strictlyPositive |
 | test.c:397:9:397:11 | Constant: ++ ... | positive strictlyPositive |
@@ -677,13 +651,11 @@
 | test.c:397:9:397:11 | Store: ++ ... | positive strictlyPositive |
 | test.c:397:9:397:14 | CopyValue: ... , ... | positive strictlyPositive |
 | test.c:397:14:397:14 | Load: y | positive strictlyPositive |
-| test.c:398:3:398:23 | CopyValue: ... = ... | positive strictlyPositive |
 | test.c:398:3:398:23 | Store: ... = ... | positive strictlyPositive |
 | test.c:398:9:398:11 | Add: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Constant: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Load: ... ++ | positive strictlyPositive |
 | test.c:398:9:398:11 | Store: ... ++ | positive strictlyPositive |
-| test.c:398:9:398:19 | CopyValue: ... , ... | positive strictlyPositive |
 | test.c:398:9:398:22 | CopyValue: ... , ... | positive strictlyPositive |
 | test.c:398:14:398:19 | Add: ... += ... | positive strictlyPositive |
 | test.c:398:14:398:19 | Load: ... += ... | positive strictlyPositive |
diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
index 4bc9f90cc60..ec6f300a957 100644
--- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
+++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
@@ -40,40 +40,34 @@ test.cpp:
 #    5|         valnum = r0_7
 #    5|     m0_19(int)                  = Store                    : &:r0_18, r0_17
 #    5|         valnum = r0_17
-#    5|     r0_20(glval<int>)           = CopyValue                : r0_18
-#    5|         valnum = r0_7
-#    6|     r0_21(glval<int>)           = VariableAddress[p0]      : 
+#    6|     r0_20(glval<int>)           = VariableAddress[p0]      : 
 #    6|         valnum = r0_3
-#    6|     r0_22(int)                  = Load                     : &:r0_21, m0_4
+#    6|     r0_21(int)                  = Load                     : &:r0_20, m0_4
 #    6|         valnum = m0_4
-#    6|     r0_23(glval<int>)           = VariableAddress[p1]      : 
+#    6|     r0_22(glval<int>)           = VariableAddress[p1]      : 
 #    6|         valnum = r0_5
-#    6|     r0_24(int)                  = Load                     : &:r0_23, m0_6
+#    6|     r0_23(int)                  = Load                     : &:r0_22, m0_6
 #    6|         valnum = m0_6
-#    6|     r0_25(int)                  = Add                      : r0_22, r0_24
+#    6|     r0_24(int)                  = Add                      : r0_21, r0_23
 #    6|         valnum = r0_17
-#    6|     r0_26(glval<int>)           = VariableAddress[x]       : 
+#    6|     r0_25(glval<int>)           = VariableAddress[x]       : 
 #    6|         valnum = r0_7
-#    6|     m0_27(int)                  = Store                    : &:r0_26, r0_25
+#    6|     m0_26(int)                  = Store                    : &:r0_25, r0_24
 #    6|         valnum = r0_17
-#    6|     r0_28(glval<int>)           = CopyValue                : r0_26
-#    6|         valnum = r0_7
-#    7|     r0_29(glval<int>)           = VariableAddress[x]       : 
+#    7|     r0_27(glval<int>)           = VariableAddress[x]       : 
 #    7|         valnum = r0_7
-#    7|     r0_30(int)                  = Load                     : &:r0_29, m0_27
+#    7|     r0_28(int)                  = Load                     : &:r0_27, m0_26
 #    7|         valnum = r0_17
-#    7|     r0_31(glval<int>)           = VariableAddress[y]       : 
+#    7|     r0_29(glval<int>)           = VariableAddress[y]       : 
 #    7|         valnum = r0_9
-#    7|     m0_32(int)                  = Store                    : &:r0_31, r0_30
+#    7|     m0_30(int)                  = Store                    : &:r0_29, r0_28
 #    7|         valnum = r0_17
-#    7|     r0_33(glval<int>)           = CopyValue                : r0_31
-#    7|         valnum = r0_9
-#    8|     v0_34(void)                 = NoOp                     : 
-#    1|     r0_35(glval<int>)           = VariableAddress[#return] : 
+#    8|     v0_31(void)                 = NoOp                     : 
+#    1|     r0_32(glval<int>)           = VariableAddress[#return] : 
 #    1|         valnum = unique
-#    1|     v0_36(void)                 = ReturnValue              : &:r0_35
-#    1|     v0_37(void)                 = UnmodeledUse             : mu*
-#    1|     v0_38(void)                 = ExitFunction             : 
+#    1|     v0_33(void)                 = ReturnValue              : &:r0_32
+#    1|     v0_34(void)                 = UnmodeledUse             : mu*
+#    1|     v0_35(void)                 = ExitFunction             : 
 
 #   12| int test01(int, int)
 #   12|   Block 0
@@ -122,46 +116,40 @@ test.cpp:
 #   16|         valnum = r0_7
 #   16|     m0_22(int)                  = Store                     : &:r0_21, r0_20
 #   16|         valnum = r0_20
-#   16|     r0_23(glval<int>)           = CopyValue                 : r0_21
-#   16|         valnum = r0_7
-#   17|     r0_24(glval<int>)           = VariableAddress[p0]       : 
+#   17|     r0_23(glval<int>)           = VariableAddress[p0]       : 
 #   17|         valnum = r0_3
-#   17|     r0_25(int)                  = Load                      : &:r0_24, m0_4
+#   17|     r0_24(int)                  = Load                      : &:r0_23, m0_4
 #   17|         valnum = m0_4
-#   17|     r0_26(glval<int>)           = VariableAddress[p1]       : 
+#   17|     r0_25(glval<int>)           = VariableAddress[p1]       : 
 #   17|         valnum = r0_5
-#   17|     r0_27(int)                  = Load                      : &:r0_26, m0_6
+#   17|     r0_26(int)                  = Load                      : &:r0_25, m0_6
 #   17|         valnum = m0_6
-#   17|     r0_28(int)                  = Add                       : r0_25, r0_27
+#   17|     r0_27(int)                  = Add                       : r0_24, r0_26
 #   17|         valnum = r0_17
-#   17|     r0_29(glval<int>)           = VariableAddress[global01] : 
+#   17|     r0_28(glval<int>)           = VariableAddress[global01] : 
 #   17|         valnum = r0_18
-#   17|     r0_30(int)                  = Load                      : &:r0_29, ~m0_1
+#   17|     r0_29(int)                  = Load                      : &:r0_28, ~m0_1
 #   17|         valnum = unique
-#   17|     r0_31(int)                  = Add                       : r0_28, r0_30
-#   17|         valnum = r0_31
-#   17|     r0_32(glval<int>)           = VariableAddress[x]        : 
+#   17|     r0_30(int)                  = Add                       : r0_27, r0_29
+#   17|         valnum = r0_30
+#   17|     r0_31(glval<int>)           = VariableAddress[x]        : 
 #   17|         valnum = r0_7
-#   17|     m0_33(int)                  = Store                     : &:r0_32, r0_31
-#   17|         valnum = r0_31
-#   17|     r0_34(glval<int>)           = CopyValue                 : r0_32
-#   17|         valnum = r0_7
-#   18|     r0_35(glval<int>)           = VariableAddress[x]        : 
+#   17|     m0_32(int)                  = Store                     : &:r0_31, r0_30
+#   17|         valnum = r0_30
+#   18|     r0_33(glval<int>)           = VariableAddress[x]        : 
 #   18|         valnum = r0_7
-#   18|     r0_36(int)                  = Load                      : &:r0_35, m0_33
-#   18|         valnum = r0_31
-#   18|     r0_37(glval<int>)           = VariableAddress[y]        : 
+#   18|     r0_34(int)                  = Load                      : &:r0_33, m0_32
+#   18|         valnum = r0_30
+#   18|     r0_35(glval<int>)           = VariableAddress[y]        : 
 #   18|         valnum = r0_9
-#   18|     m0_38(int)                  = Store                     : &:r0_37, r0_36
-#   18|         valnum = r0_31
-#   18|     r0_39(glval<int>)           = CopyValue                 : r0_37
-#   18|         valnum = r0_9
-#   19|     v0_40(void)                 = NoOp                      : 
-#   12|     r0_41(glval<int>)           = VariableAddress[#return]  : 
+#   18|     m0_36(int)                  = Store                     : &:r0_35, r0_34
+#   18|         valnum = r0_30
+#   19|     v0_37(void)                 = NoOp                      : 
+#   12|     r0_38(glval<int>)           = VariableAddress[#return]  : 
 #   12|         valnum = unique
-#   12|     v0_42(void)                 = ReturnValue               : &:r0_41
-#   12|     v0_43(void)                 = UnmodeledUse              : mu*
-#   12|     v0_44(void)                 = ExitFunction              : 
+#   12|     v0_39(void)                 = ReturnValue               : &:r0_38
+#   12|     v0_40(void)                 = UnmodeledUse              : mu*
+#   12|     v0_41(void)                 = ExitFunction              : 
 
 #   25| int test02(int, int)
 #   25|   Block 0
@@ -210,53 +198,47 @@ test.cpp:
 #   29|         valnum = r0_7
 #   29|     m0_22(int)                  = Store                            : &:r0_21, r0_20
 #   29|         valnum = r0_20
-#   29|     r0_23(glval<int>)           = CopyValue                        : r0_21
-#   29|         valnum = r0_7
-#   30|     r0_24(glval<unknown>)       = FunctionAddress[change_global02] : 
+#   30|     r0_23(glval<unknown>)       = FunctionAddress[change_global02] : 
 #   30|         valnum = unique
-#   30|     v0_25(void)                 = Call                             : func:r0_24
-#   30|     m0_26(unknown)              = ^CallSideEffect                  : ~m0_1
+#   30|     v0_24(void)                 = Call                             : func:r0_23
+#   30|     m0_25(unknown)              = ^CallSideEffect                  : ~m0_1
 #   30|         valnum = unique
-#   30|     m0_27(unknown)              = Chi                              : total:m0_1, partial:m0_26
+#   30|     m0_26(unknown)              = Chi                              : total:m0_1, partial:m0_25
 #   30|         valnum = unique
-#   31|     r0_28(glval<int>)           = VariableAddress[p0]              : 
+#   31|     r0_27(glval<int>)           = VariableAddress[p0]              : 
 #   31|         valnum = r0_3
-#   31|     r0_29(int)                  = Load                             : &:r0_28, m0_4
+#   31|     r0_28(int)                  = Load                             : &:r0_27, m0_4
 #   31|         valnum = m0_4
-#   31|     r0_30(glval<int>)           = VariableAddress[p1]              : 
+#   31|     r0_29(glval<int>)           = VariableAddress[p1]              : 
 #   31|         valnum = r0_5
-#   31|     r0_31(int)                  = Load                             : &:r0_30, m0_6
+#   31|     r0_30(int)                  = Load                             : &:r0_29, m0_6
 #   31|         valnum = m0_6
-#   31|     r0_32(int)                  = Add                              : r0_29, r0_31
+#   31|     r0_31(int)                  = Add                              : r0_28, r0_30
 #   31|         valnum = r0_17
-#   31|     r0_33(glval<int>)           = VariableAddress[global02]        : 
+#   31|     r0_32(glval<int>)           = VariableAddress[global02]        : 
 #   31|         valnum = r0_18
-#   31|     r0_34(int)                  = Load                             : &:r0_33, ~m0_27
+#   31|     r0_33(int)                  = Load                             : &:r0_32, ~m0_26
 #   31|         valnum = unique
-#   31|     r0_35(int)                  = Add                              : r0_32, r0_34
-#   31|         valnum = r0_35
-#   31|     r0_36(glval<int>)           = VariableAddress[x]               : 
+#   31|     r0_34(int)                  = Add                              : r0_31, r0_33
+#   31|         valnum = r0_34
+#   31|     r0_35(glval<int>)           = VariableAddress[x]               : 
 #   31|         valnum = r0_7
-#   31|     m0_37(int)                  = Store                            : &:r0_36, r0_35
-#   31|         valnum = r0_35
-#   31|     r0_38(glval<int>)           = CopyValue                        : r0_36
-#   31|         valnum = r0_7
-#   32|     r0_39(glval<int>)           = VariableAddress[x]               : 
+#   31|     m0_36(int)                  = Store                            : &:r0_35, r0_34
+#   31|         valnum = r0_34
+#   32|     r0_37(glval<int>)           = VariableAddress[x]               : 
 #   32|         valnum = r0_7
-#   32|     r0_40(int)                  = Load                             : &:r0_39, m0_37
-#   32|         valnum = r0_35
-#   32|     r0_41(glval<int>)           = VariableAddress[y]               : 
+#   32|     r0_38(int)                  = Load                             : &:r0_37, m0_36
+#   32|         valnum = r0_34
+#   32|     r0_39(glval<int>)           = VariableAddress[y]               : 
 #   32|         valnum = r0_9
-#   32|     m0_42(int)                  = Store                            : &:r0_41, r0_40
-#   32|         valnum = r0_35
-#   32|     r0_43(glval<int>)           = CopyValue                        : r0_41
-#   32|         valnum = r0_9
-#   33|     v0_44(void)                 = NoOp                             : 
-#   25|     r0_45(glval<int>)           = VariableAddress[#return]         : 
+#   32|     m0_40(int)                  = Store                            : &:r0_39, r0_38
+#   32|         valnum = r0_34
+#   33|     v0_41(void)                 = NoOp                             : 
+#   25|     r0_42(glval<int>)           = VariableAddress[#return]         : 
 #   25|         valnum = unique
-#   25|     v0_46(void)                 = ReturnValue                      : &:r0_45
-#   25|     v0_47(void)                 = UnmodeledUse                     : mu*
-#   25|     v0_48(void)                 = ExitFunction                     : 
+#   25|     v0_43(void)                 = ReturnValue                      : &:r0_42
+#   25|     v0_44(void)                 = UnmodeledUse                     : mu*
+#   25|     v0_45(void)                 = ExitFunction                     : 
 
 #   39| int test03(int, int, int*)
 #   39|   Block 0
@@ -309,60 +291,52 @@ test.cpp:
 #   43|         valnum = r0_9
 #   43|     m0_24(int)                  = Store                     : &:r0_23, r0_22
 #   43|         valnum = r0_22
-#   43|     r0_25(glval<int>)           = CopyValue                 : r0_23
-#   43|         valnum = r0_9
-#   44|     r0_26(int)                  = Constant[0]               : 
-#   44|         valnum = r0_26
-#   44|     r0_27(glval<int *>)         = VariableAddress[p2]       : 
+#   44|     r0_25(int)                  = Constant[0]               : 
+#   44|         valnum = r0_25
+#   44|     r0_26(glval<int *>)         = VariableAddress[p2]       : 
 #   44|         valnum = r0_7
-#   44|     r0_28(int *)                = Load                      : &:r0_27, m0_8
+#   44|     r0_27(int *)                = Load                      : &:r0_26, m0_8
 #   44|         valnum = m0_8
-#   44|     r0_29(glval<int>)           = CopyValue                 : r0_28
+#   44|     r0_28(glval<int>)           = CopyValue                 : r0_27
 #   44|         valnum = m0_8
-#   44|     m0_30(int)                  = Store                     : &:r0_29, r0_26
-#   44|         valnum = r0_26
-#   44|     m0_31(unknown)              = Chi                       : total:m0_1, partial:m0_30
+#   44|     m0_29(int)                  = Store                     : &:r0_28, r0_25
+#   44|         valnum = r0_25
+#   44|     m0_30(unknown)              = Chi                       : total:m0_1, partial:m0_29
 #   44|         valnum = unique
-#   44|     r0_32(glval<int>)           = CopyValue                 : r0_29
-#   44|         valnum = m0_8
-#   45|     r0_33(glval<int>)           = VariableAddress[p0]       : 
+#   45|     r0_31(glval<int>)           = VariableAddress[p0]       : 
 #   45|         valnum = r0_3
-#   45|     r0_34(int)                  = Load                      : &:r0_33, m0_4
+#   45|     r0_32(int)                  = Load                      : &:r0_31, m0_4
 #   45|         valnum = m0_4
-#   45|     r0_35(glval<int>)           = VariableAddress[p1]       : 
+#   45|     r0_33(glval<int>)           = VariableAddress[p1]       : 
 #   45|         valnum = r0_5
-#   45|     r0_36(int)                  = Load                      : &:r0_35, m0_6
+#   45|     r0_34(int)                  = Load                      : &:r0_33, m0_6
 #   45|         valnum = m0_6
-#   45|     r0_37(int)                  = Add                       : r0_34, r0_36
+#   45|     r0_35(int)                  = Add                       : r0_32, r0_34
 #   45|         valnum = r0_19
-#   45|     r0_38(glval<int>)           = VariableAddress[global03] : 
+#   45|     r0_36(glval<int>)           = VariableAddress[global03] : 
 #   45|         valnum = r0_20
-#   45|     r0_39(int)                  = Load                      : &:r0_38, ~m0_31
+#   45|     r0_37(int)                  = Load                      : &:r0_36, ~m0_30
 #   45|         valnum = unique
-#   45|     r0_40(int)                  = Add                       : r0_37, r0_39
-#   45|         valnum = r0_40
-#   45|     r0_41(glval<int>)           = VariableAddress[x]        : 
+#   45|     r0_38(int)                  = Add                       : r0_35, r0_37
+#   45|         valnum = r0_38
+#   45|     r0_39(glval<int>)           = VariableAddress[x]        : 
 #   45|         valnum = r0_9
-#   45|     m0_42(int)                  = Store                     : &:r0_41, r0_40
-#   45|         valnum = r0_40
-#   45|     r0_43(glval<int>)           = CopyValue                 : r0_41
-#   45|         valnum = r0_9
-#   46|     r0_44(glval<int>)           = VariableAddress[x]        : 
+#   45|     m0_40(int)                  = Store                     : &:r0_39, r0_38
+#   45|         valnum = r0_38
+#   46|     r0_41(glval<int>)           = VariableAddress[x]        : 
 #   46|         valnum = r0_9
-#   46|     r0_45(int)                  = Load                      : &:r0_44, m0_42
-#   46|         valnum = r0_40
-#   46|     r0_46(glval<int>)           = VariableAddress[y]        : 
+#   46|     r0_42(int)                  = Load                      : &:r0_41, m0_40
+#   46|         valnum = r0_38
+#   46|     r0_43(glval<int>)           = VariableAddress[y]        : 
 #   46|         valnum = r0_11
-#   46|     m0_47(int)                  = Store                     : &:r0_46, r0_45
-#   46|         valnum = r0_40
-#   46|     r0_48(glval<int>)           = CopyValue                 : r0_46
-#   46|         valnum = r0_11
-#   47|     v0_49(void)                 = NoOp                      : 
-#   39|     r0_50(glval<int>)           = VariableAddress[#return]  : 
+#   46|     m0_44(int)                  = Store                     : &:r0_43, r0_42
+#   46|         valnum = r0_38
+#   47|     v0_45(void)                 = NoOp                      : 
+#   39|     r0_46(glval<int>)           = VariableAddress[#return]  : 
 #   39|         valnum = unique
-#   39|     v0_51(void)                 = ReturnValue               : &:r0_50
-#   39|     v0_52(void)                 = UnmodeledUse              : mu*
-#   39|     v0_53(void)                 = ExitFunction              : 
+#   39|     v0_47(void)                 = ReturnValue               : &:r0_46
+#   39|     v0_48(void)                 = UnmodeledUse              : mu*
+#   39|     v0_49(void)                 = ExitFunction              : 
 
 #   49| unsigned int my_strspn(char const*, char const*)
 #   49|   Block 0
@@ -419,8 +393,6 @@ test.cpp:
 #   55|         valnum = r0_7
 #   55|     m2_3(char *)        = Store                  : &:r2_2, r2_1
 #   55|         valnum = m0_6
-#   55|     r2_4(glval<char *>) = CopyValue              : r2_2
-#   55|         valnum = r0_7
 #-----|   Goto -> Block 3
 
 #   56|   Block 3
@@ -602,8 +574,6 @@ test.cpp:
 #   80|         valnum = r0_5
 #   80|     m1_6(signed short)        = Store                      : &:r1_5, r1_4
 #   80|         valnum = r1_4
-#   80|     r1_7(glval<signed short>) = CopyValue                  : r1_5
-#   80|         valnum = r0_5
 #-----|   Goto -> Block 2
 
 #   82|   Block 2
@@ -680,12 +650,10 @@ test.cpp:
 #   88|         valnum = r0_9
 #   88|     m3_4(int)        = Store                      : &:r3_3, r3_2
 #   88|         valnum = m3_0
-#   88|     r3_5(glval<int>) = CopyValue                  : r3_3
-#   88|         valnum = r0_9
-#   89|     v3_6(void)       = NoOp                       : 
-#   84|     v3_7(void)       = ReturnVoid                 : 
-#   84|     v3_8(void)       = UnmodeledUse               : mu*
-#   84|     v3_9(void)       = ExitFunction               : 
+#   89|     v3_5(void)       = NoOp                       : 
+#   84|     v3_6(void)       = ReturnVoid                 : 
+#   84|     v3_7(void)       = UnmodeledUse               : mu*
+#   84|     v3_8(void)       = ExitFunction               : 
 
 #   91| int regression_test00()
 #   91|   Block 0

From 5c07750286a2bfa2c4bdffc35f4267e488d1f7f6 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 24 Oct 2019 11:28:42 +0200
Subject: [PATCH 048/232] simplify the heuristic for Deferred promises

---
 .../ql/src/semmle/javascript/Promises.qll     | 48 ++++---------------
 1 file changed, 8 insertions(+), 40 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index 13eb1e8114e..ae8554c1a0a 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -36,35 +36,9 @@ module Bluebird {
  * Provides classes for working with various Deferred implementations
  */
 module Deferred {
-  class DeferredClass extends DataFlow::SourceNode {
-    DeferredClass() {
-      exists(Variable var |
-        var.getName() = "Deferred" and
-        (
-          var.getADeclaration() instanceof LocalNamespaceDecl or
-          var.getScope() instanceof GlobalScope
-        ) and
-        this = DataFlow::valueNode(var.getADefinition())
-      )
-      or
-      this.(DataFlow::ParameterNode).getName() = "Deferred"
-      or
-      exists(Function f |
-        f.getName() = "Deferred" and
-        this = DataFlow::valueNode(f)
-      )
-      or
-      exists(ClassDefinition c |
-        c.getName() = "Deferred" and
-        this = DataFlow::valueNode(c)
-      )
-    }
-  }
-
   class DeferredInstance extends DataFlow::NewNode {
-    DeferredClass deferredClass;
-
-    DeferredInstance() { this = deferredClass.getAnInstantiation() }
+  	// Describes both `new Deferred()`, `new $.Deferred` and other variants. 
+    DeferredInstance() { this.getCalleeName() = "Deferred" }
 
     private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
       t.start() and
@@ -72,23 +46,17 @@ module Deferred {
       or
       exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
     }
-
-    DeferredClass getDeferredClass() { result = deferredClass }
-
-    DataFlow::CallNode getPromiseMemberCall(string methodName) {
-      result = ref(DataFlow::TypeTracker::end()).getAMemberCall(methodName)
-    }
+    
+    DataFlow::SourceNode ref() { result = ref(DataFlow::TypeTracker::end()) }
   }
 
   /**
    * A promise object created by a Deferred constructor
    */
   private class DeferredPromiseDefinition extends PromiseDefinition, DeferredInstance {
-    DeferredPromiseDefinition() { 
-      this = any(DeferredClass c |
-        exists(any(DeferredInstance i | i.getDeferredClass() = c).getPromiseMemberCall("resolve")) and
-        exists(any(DeferredInstance i | i.getDeferredClass() = c).getPromiseMemberCall("reject"))
-      ).getAnInstantiation() 
+    DeferredPromiseDefinition() {
+      // hardening of the "Deferred" heuristic: a method call to `resolve`. 
+      exists(ref().getAMethodCall("resolve"))
     }
 
     override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
@@ -99,7 +67,7 @@ module Deferred {
    */
   class ResolvedDeferredPromiseDefinition extends ResolvedPromiseDefinition {
     ResolvedDeferredPromiseDefinition() {
-      this = any(DeferredPromiseDefinition def).getPromiseMemberCall("resolve")
+      this = any(DeferredPromiseDefinition def).ref().getAMethodCall("resolve")
     }
 
     override DataFlow::Node getValue() { result = getArgument(0) }

From 5489a80372ab2fdbf1c30f7d3a5c0625a4ed9bf1 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 10 Oct 2019 16:20:27 +0200
Subject: [PATCH 049/232] add query for detecting ignored calls to
 Array.prototype.concat

---
 change-notes/1.23/analysis-javascript.md      |  1 +
 .../src/Statements/IgnoreConcatReturn.qhelp   | 44 +++++++++++++++++++
 .../ql/src/Statements/IgnoreConcatReturn.ql   | 42 ++++++++++++++++++
 .../src/Statements/examples/IgnoreConcat.js   |  5 +++
 .../Statements/examples/IgnoreConcatFixed.js  |  5 +++
 .../IgnoreConcatReturn.expected               |  2 +
 .../IgnoreConcatReturn.qlref                  |  1 +
 .../Statements/IgnoreConcatReturn/tst.js      | 13 ++++++
 8 files changed, 113 insertions(+)
 create mode 100644 javascript/ql/src/Statements/IgnoreConcatReturn.qhelp
 create mode 100644 javascript/ql/src/Statements/IgnoreConcatReturn.ql
 create mode 100644 javascript/ql/src/Statements/examples/IgnoreConcat.js
 create mode 100644 javascript/ql/src/Statements/examples/IgnoreConcatFixed.js
 create mode 100644 javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected
 create mode 100644 javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref
 create mode 100644 javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 73bbf1247f7..90f46403f26 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -23,6 +23,7 @@
 | Use of returnless function (`js/use-of-returnless-function`)              | maintainability, correctness                                      | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
 | Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
 | Unreachable method overloads (`js/unreachable-method-overloads`)          | correctness, typescript                                           | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
+| Ignoring return from concat (`js/ignore-return-from-concat`)              | maintainability, correctness                                      | Highlights calls to the concat method on array where the return value is ignored. Results are shown on LGTM by default. |
 
 ## Changes to existing queries
 
diff --git a/javascript/ql/src/Statements/IgnoreConcatReturn.qhelp b/javascript/ql/src/Statements/IgnoreConcatReturn.qhelp
new file mode 100644
index 00000000000..1b69a61b3a9
--- /dev/null
+++ b/javascript/ql/src/Statements/IgnoreConcatReturn.qhelp
@@ -0,0 +1,44 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>
+The <code>concat</code> method on is pure and does not modify any of the input 
+arrays. It is therefore generally an error to ignore the return value from a 
+call to  <code>concat</code>. 
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Use the returned value from the call to <code>concat</code>. 
+</p>
+
+</recommendation>
+<example>
+
+<p>
+In the following example a function <code>extend</code> is defined. The 
+function uses the <code>concat</code> method to add elements to the 
+<code>arr</code> array. However, the <code>extend</code> function has no 
+effect as the return value from <code>concat</code> is ignored.
+</p>
+
+<sample src="examples/IgnoreConcat.js" />
+
+<p>
+Assigning the returned value from the call to <code>concat</code> to the 
+<code>arr</code> variable fixes the error.
+</p>
+
+<sample src="examples/IgnoreConcatFixed.js" />
+
+</example>
+<references>
+
+<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/concat">Array concat</a>.</li>
+
+</references>
+</qhelp>
diff --git a/javascript/ql/src/Statements/IgnoreConcatReturn.ql b/javascript/ql/src/Statements/IgnoreConcatReturn.ql
new file mode 100644
index 00000000000..65c379b3437
--- /dev/null
+++ b/javascript/ql/src/Statements/IgnoreConcatReturn.ql
@@ -0,0 +1,42 @@
+/**
+ * @name Ignoring return from concat
+ * @description The concat method does not modify an array, ignoring the result of a call to concat is therefore generally an error.
+ * @kind problem
+ * @problem.severity warning
+ * @id js/ignore-result-from-concat
+ * @tags maintainability,
+ *       correctness
+ * @precision high
+ */
+
+import javascript
+import Expressions.ExprHasNoEffect
+
+DataFlow::SourceNode array(DataFlow::TypeTracker t) {
+  t.start() and
+  result instanceof DataFlow::ArrayCreationNode
+  or
+  exists (DataFlow::TypeTracker t2 |
+    result = array(t2).track(t2, t)
+  )
+}
+
+DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
+
+predicate isArrayMethod(DataFlow::MethodCallNode call) {
+  call.getReceiver().getALocalSource() = array()
+}
+
+predicate isIncomplete(DataFlow::Node node) {
+  any(DataFlow::Incompleteness cause | node.analyze().getAValue().isIndefinite(cause)) != "global"
+}
+
+from DataFlow::CallNode call
+where 
+  isArrayMethod(call) and
+  call.getCalleeName() = "concat" and
+  call.getNumArgument() = 1 and 
+  (call.getArgument(0).getALocalSource() = array() or isIncomplete(call.getArgument(0))) and 
+  not call.getArgument(0).asExpr().(ArrayExpr).getSize() = 0 and 
+  inVoidContext(call.asExpr())
+select call, "Return value from call to concat ignored."
diff --git a/javascript/ql/src/Statements/examples/IgnoreConcat.js b/javascript/ql/src/Statements/examples/IgnoreConcat.js
new file mode 100644
index 00000000000..7137d5261a6
--- /dev/null
+++ b/javascript/ql/src/Statements/examples/IgnoreConcat.js
@@ -0,0 +1,5 @@
+var arr = [1,2,3];
+
+function extend(others) {
+	arr.concat(others);
+}
\ No newline at end of file
diff --git a/javascript/ql/src/Statements/examples/IgnoreConcatFixed.js b/javascript/ql/src/Statements/examples/IgnoreConcatFixed.js
new file mode 100644
index 00000000000..1c7977e9ef0
--- /dev/null
+++ b/javascript/ql/src/Statements/examples/IgnoreConcatFixed.js
@@ -0,0 +1,5 @@
+var arr = [1,2,3];
+
+function extend(others) {
+	arr = arr.concat(others);
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected
new file mode 100644
index 00000000000..1ae8b59226a
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected
@@ -0,0 +1,2 @@
+| tst.js:3:1:3:19 | arr.concat([1,2,3]) | Return value from call to concat ignored. |
+| tst.js:5:1:5:15 | arr.concat(arr) | Return value from call to concat ignored. |
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref
new file mode 100644
index 00000000000..485692fff07
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref
@@ -0,0 +1 @@
+Statements/IgnoreConcatReturn.ql
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js
new file mode 100644
index 00000000000..f2c5f34cc60
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js
@@ -0,0 +1,13 @@
+var arr = [1,2,3];
+
+arr.concat([1,2,3]); // NOT OK!
+
+arr.concat(arr); // NOT OK!
+
+console.log(arr.concat([1,2,3]));
+
+arr.concat(null);
+arr.concat();
+arr.concat([]);
+
+({concat: Array.prototype.concat}.concat(arr));
\ No newline at end of file

From 5b26d03f1ca2dba1a91e86f363dd855e09529230 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 25 Oct 2019 15:45:35 +0200
Subject: [PATCH 050/232] introduce backtracking, and also marking join/slice
 calls

---
 ...atReturn.qhelp => IgnoreArrayResult.qhelp} | 16 ++++---
 .../ql/src/Statements/IgnoreArrayResult.ql    | 45 +++++++++++++++++++
 .../ql/src/Statements/IgnoreConcatReturn.ql   | 42 -----------------
 .../{IgnoreConcat.js => IgnoreArrayResult.js} |  0
 ...ncatFixed.js => IgnoreArrayResultFixed.js} |  0
 .../IgnoreArrayResult.expected}               |  0
 .../IgnoreArrayResult.qlref}                  |  0
 .../tst.js                                    |  0
 8 files changed, 55 insertions(+), 48 deletions(-)
 rename javascript/ql/src/Statements/{IgnoreConcatReturn.qhelp => IgnoreArrayResult.qhelp} (50%)
 create mode 100644 javascript/ql/src/Statements/IgnoreArrayResult.ql
 delete mode 100644 javascript/ql/src/Statements/IgnoreConcatReturn.ql
 rename javascript/ql/src/Statements/examples/{IgnoreConcat.js => IgnoreArrayResult.js} (100%)
 rename javascript/ql/src/Statements/examples/{IgnoreConcatFixed.js => IgnoreArrayResultFixed.js} (100%)
 rename javascript/ql/test/query-tests/Statements/{IgnoreConcatReturn/IgnoreConcatReturn.expected => IgnoreArrayResult/IgnoreArrayResult.expected} (100%)
 rename javascript/ql/test/query-tests/Statements/{IgnoreConcatReturn/IgnoreConcatReturn.qlref => IgnoreArrayResult/IgnoreArrayResult.qlref} (100%)
 rename javascript/ql/test/query-tests/Statements/{IgnoreConcatReturn => IgnoreArrayResult}/tst.js (100%)

diff --git a/javascript/ql/src/Statements/IgnoreConcatReturn.qhelp b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
similarity index 50%
rename from javascript/ql/src/Statements/IgnoreConcatReturn.qhelp
rename to javascript/ql/src/Statements/IgnoreArrayResult.qhelp
index 1b69a61b3a9..b70ff1f1b32 100644
--- a/javascript/ql/src/Statements/IgnoreConcatReturn.qhelp
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
@@ -4,16 +4,18 @@
 <qhelp>
 <overview>
 <p>
-The <code>concat</code> method on is pure and does not modify any of the input 
-arrays. It is therefore generally an error to ignore the return value from a 
-call to  <code>concat</code>. 
+The <code>concat</code>, <code>join</code> and <code>slice</code> methods are
+pure and does not modify any of the inputs or the array the method was called 
+on. It is therefore generally an error to ignore the return value from a call
+to one of these methods. 
 </p>
 
 </overview>
 <recommendation>
 
 <p>
-Use the returned value from the call to <code>concat</code>. 
+Use the returned value from the calls to <code>concat</code>, <code>join</code> 
+or <code>slice</code>. 
 </p>
 
 </recommendation>
@@ -26,19 +28,21 @@ function uses the <code>concat</code> method to add elements to the
 effect as the return value from <code>concat</code> is ignored.
 </p>
 
-<sample src="examples/IgnoreConcat.js" />
+<sample src="examples/IgnoreArrayResult.js" />
 
 <p>
 Assigning the returned value from the call to <code>concat</code> to the 
 <code>arr</code> variable fixes the error.
 </p>
 
-<sample src="examples/IgnoreConcatFixed.js" />
+<sample src="examples/IgnoreArrayResultFixed.js" />
 
 </example>
 <references>
 
 <li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/concat">Array concat</a>.</li>
+<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/slice">Array slice</a>.</li>
+<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/join">Array join</a>.</li>
 
 </references>
 </qhelp>
diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.ql b/javascript/ql/src/Statements/IgnoreArrayResult.ql
new file mode 100644
index 00000000000..b3703c6992d
--- /dev/null
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.ql
@@ -0,0 +1,45 @@
+/**
+ * @name Ignoring result from pure array method
+ * @description The array methods do not modify the array, ignoring the result of such a call is therefore generally an error.
+ * @kind problem
+ * @problem.severity warning
+ * @id js/ignore-array-result
+ * @tags maintainability,
+ *       correctness
+ * @precision high
+ */
+
+import javascript
+import Expressions.ExprHasNoEffect
+
+DataFlow::SourceNode callsArray(DataFlow::TypeBackTracker t, DataFlow::MethodCallNode call) {
+  isIgnoredPureArrayCall(call) and
+  (
+    t.start() and
+    result = call.getReceiver()
+    or
+    exists(DataFlow::TypeBackTracker t2 | result = callsArray(t2, call).backtrack(t2, t))
+  )
+}
+
+DataFlow::SourceNode callsArray(DataFlow::MethodCallNode call) {
+  result = callsArray(DataFlow::TypeBackTracker::end(), call)
+}
+
+predicate isIgnoredPureArrayCall(DataFlow::MethodCallNode call) {
+  inVoidContext(call.asExpr()) and
+  (
+    call.getMethodName() = "concat" and
+    call.getNumArgument() = 1
+    or
+    call.getMethodName() = "join" and
+    call.getNumArgument() < 2
+    or
+    call.getMethodName() = "slice" and
+    call.getNumArgument() < 3
+  )
+}
+
+from DataFlow::MethodCallNode call
+where callsArray(call) instanceof DataFlow::ArrayCreationNode
+select call, "Result from call to " + call.getMethodName() + " ignored."
diff --git a/javascript/ql/src/Statements/IgnoreConcatReturn.ql b/javascript/ql/src/Statements/IgnoreConcatReturn.ql
deleted file mode 100644
index 65c379b3437..00000000000
--- a/javascript/ql/src/Statements/IgnoreConcatReturn.ql
+++ /dev/null
@@ -1,42 +0,0 @@
-/**
- * @name Ignoring return from concat
- * @description The concat method does not modify an array, ignoring the result of a call to concat is therefore generally an error.
- * @kind problem
- * @problem.severity warning
- * @id js/ignore-result-from-concat
- * @tags maintainability,
- *       correctness
- * @precision high
- */
-
-import javascript
-import Expressions.ExprHasNoEffect
-
-DataFlow::SourceNode array(DataFlow::TypeTracker t) {
-  t.start() and
-  result instanceof DataFlow::ArrayCreationNode
-  or
-  exists (DataFlow::TypeTracker t2 |
-    result = array(t2).track(t2, t)
-  )
-}
-
-DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
-
-predicate isArrayMethod(DataFlow::MethodCallNode call) {
-  call.getReceiver().getALocalSource() = array()
-}
-
-predicate isIncomplete(DataFlow::Node node) {
-  any(DataFlow::Incompleteness cause | node.analyze().getAValue().isIndefinite(cause)) != "global"
-}
-
-from DataFlow::CallNode call
-where 
-  isArrayMethod(call) and
-  call.getCalleeName() = "concat" and
-  call.getNumArgument() = 1 and 
-  (call.getArgument(0).getALocalSource() = array() or isIncomplete(call.getArgument(0))) and 
-  not call.getArgument(0).asExpr().(ArrayExpr).getSize() = 0 and 
-  inVoidContext(call.asExpr())
-select call, "Return value from call to concat ignored."
diff --git a/javascript/ql/src/Statements/examples/IgnoreConcat.js b/javascript/ql/src/Statements/examples/IgnoreArrayResult.js
similarity index 100%
rename from javascript/ql/src/Statements/examples/IgnoreConcat.js
rename to javascript/ql/src/Statements/examples/IgnoreArrayResult.js
diff --git a/javascript/ql/src/Statements/examples/IgnoreConcatFixed.js b/javascript/ql/src/Statements/examples/IgnoreArrayResultFixed.js
similarity index 100%
rename from javascript/ql/src/Statements/examples/IgnoreConcatFixed.js
rename to javascript/ql/src/Statements/examples/IgnoreArrayResultFixed.js
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected
similarity index 100%
rename from javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.expected
rename to javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref
similarity index 100%
rename from javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/IgnoreConcatReturn.qlref
rename to javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
similarity index 100%
rename from javascript/ql/test/query-tests/Statements/IgnoreConcatReturn/tst.js
rename to javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js

From 841dac1abad86183a0c590fbe45eb486efd81039 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 25 Oct 2019 17:46:55 +0200
Subject: [PATCH 051/232] address review feedback

---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 2fc3f01a560..c01c6b5e3eb 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -127,8 +127,10 @@ DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
  */
 predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
   hasNonVoidCallbackMethod(call.getCalleeName()) and
-  func = call.getAnArgument().getALocalSource().asExpr() and
-  1 = count(DataFlow::Node arg | arg = call.getAnArgument() and arg.getALocalSource().asExpr() instanceof Function) and
+  exists(int index | 
+    index = min(int i | exists(call.getCallback(i))) and 
+    func = call.getCallback(index).getFunction()
+  ) and
   returnsVoid(func) and
   not isStub(func) and
   not alwaysThrows(func) and

From 1d052a8e6256aaa7aca937e77bc25a399e160f7f Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 25 Oct 2019 13:07:54 -0700
Subject: [PATCH 052/232] [CPP-434] Address comments re change notes.

---
 change-notes/1.23/analysis-cpp.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index 24fa06e9bbf..b3e16dcc29a 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -9,7 +9,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
 | Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail.  This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
-| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | This query checks for when two signed values are added together to test for overflow (`a + b < a`), which is undefined behavior. |
+| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | Finds overflow checks that rely on signed integer addition to overflow, which is undefined behavior. Example: `a + b < a`. |
 
 ## Changes to existing queries
 

From f964fe8b0ee99ebc568fad54ea4c59038ab2ba23 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 25 Oct 2019 14:08:30 -0700
Subject: [PATCH 053/232] [CPP-434] Address comments regarding .ql and .qhelp.

---
 .../Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp | 12 ++++++------
 .../Likely Bugs/Arithmetic/SignedOverflowCheck.ql    | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 9b9d358dea2..df48af7056d 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -4,16 +4,16 @@
 <qhelp>
 <overview>
 <p>
-Testing for <code>signed</code> integer overflow by adding a
-value to a variable and then comparing the result to that variable
-is not defined by the C or C++ standards.  The comparison may
-produce an unintended result, or may be deleted by the compiler
-entirely.
+Testing for signed integer overflow by adding a
+two signed values together and then comparing the result to one
+of the values is ill-formed since the overflow check is undefined.
+The comparison may produce an unintended result, or may be deleted
+by the compiler entirely.
 </p>
 </overview>
 <recommendation>
 <p>
-Make sure that the comparison in question uses <i>unsigned</i> values.
+When checking for overflow, make sure that <code>unsigned</code> values are used.
 </p>
 </recommendation>
 <example>
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index f1b65dd4a96..7ea5df5da64 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -2,7 +2,7 @@
  * @name Undefined result of signed test for overflow
  * @description Testing for overflow by adding a value to a variable
  *              to see if it "wraps around" works only for
- *              `unsigned` integer values.
+ *              unsigned integer values.
  * @kind problem
  * @problem.severity warning
  * @precision high
@@ -15,12 +15,12 @@ import cpp
 private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 private import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
-from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
+from RelationalOperation ro, AddExpr add, Expr expr1, Expr expr2
 where
   ro.getAnOperand() = add and
-  add.getAnOperand() = va1 and
-  ro.getAnOperand() = va2 and
-  globalValueNumber(va1) = globalValueNumber(va2) and
-  add.getType().getUnspecifiedType().(IntegralType).isSigned() and
+  add.getAnOperand() = expr1 and
+  ro.getAnOperand() = expr2 and
+  globalValueNumber(expr1) = globalValueNumber(expr2) and
+  add.getUnspecifiedType().(IntegralType).isSigned() and
   exprMightOverflowPositively(add)
 select ro, "Testing for signed overflow may produce undefined results."

From 7204e137467f25d317194eab9805a846b320f3de Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 25 Oct 2019 14:37:28 -0700
Subject: [PATCH 054/232] [CPP-434] Address comments re .cpp test cases.

---
 .../SignedOverflowCheck.cpp                      | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index 72767c54aab..273c84ae73b 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -29,10 +29,10 @@ bool cannotHoldAnotherUInt(int n1, unsigned int delta) {
 }
 
 bool shortShort1(unsigned short n1, unsigned short delta) {
-    // clang 8.0.0 -O2: deleted
-    // gcc 9.2 -O2: deleted
-    // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // GOOD: always false, but will never overflow
+
+    // BAD [BadAdditionOverflowCheck.ql]
+    // GOOD [SigneOverflowCheck.ql]: Test always fails, but will never overflow.
+	return n1 + delta < n1;
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
@@ -107,10 +107,10 @@ bool multipleCasts(char x) {
 }
 
 bool multipleCasts2(char x) {
-    // clang 9.0.0 -O2: not deleted
-    // gcc 9.2 -O2: not deleted
-    // msvc 19.22 /O2: not deleted
-    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // GOOD: cannot overflow
+
+    // BAD [BadAdditionOverflowCheck.ql]
+    // GOOD [SigneOverflowCheck.ql]: Test always fails, but will never overflow.
+    return (int)(unsigned short)(x + '1') < (int)(unsigned short)x;
 }
 
 int does_it_overflow(int n1, unsigned short delta) {

From 6ee3d7d788fe5e990b27309b2dcf4dd79f3d9d80 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 25 Oct 2019 15:50:00 -0700
Subject: [PATCH 055/232] [CPP-434] Address more comments re .cpp test cases.

---
 .../BadAdditionOverflowCheck/SignedOverflowCheck.cpp | 12 ++++++------
 .../SignedOverflowCheck.expected                     |  1 +
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index 273c84ae73b..bbfb1c3fad8 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -44,7 +44,7 @@ bool shortShort2(unsigned short n1, unsigned short delta) {
 
 /* Distinguish `varname` from `ptr->varname` and `obj.varname` */
 struct N {
-	unsigned short n1;
+	int n1;
 } n, *np;
 
 bool shortStruct1(unsigned short n1, unsigned short delta) {
@@ -60,7 +60,7 @@ bool shortStruct2(unsigned short n1, unsigned short delta) {
 }
 
 struct se {
-        short xPos;
+        int xPos;
         short yPos;
         short xSize;
         short ySize;
@@ -70,7 +70,7 @@ extern se *getSo(void);
 
 bool func1(se *so) {
 	se *o = getSo();
-	if (so->xPos + so->xSize < o->xPos // GOOD
+	if (so->xPos + so->xSize < so->xPos // BAD
 	    || so->xPos > o->xPos + o->xSize) { // GOOD
     	// clang 8.0.0 -O2: not deleted
     	// gcc 9.2 -O2: not deleted
@@ -100,9 +100,9 @@ int overflow12(int n) {
 }
 
 bool multipleCasts(char x) {
-    // clang 9.0.0 -O2: deleted
-    // gcc 9.2 -O2: deleted
-    // msvc 19.22 /O2: deleted
+
+    // BAD [UNDETECTED - BadAdditionOverflowCheck.ql]
+    // GOOD [SigneOverflowCheck.ql]: Test always fails, but will never overflow.
     return (int)(unsigned short)x + 2 < (int)(unsigned short)x; // GOOD: cannot overflow
 }
 
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
index eaf6a7ac1e4..414bc74f99e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected	
@@ -1,4 +1,5 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:73:6:73:36 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:122:10:122:42 | ... <= ... | Testing for signed overflow may produce undefined results. |

From da23898ebae5e0701ba1aa40783401e232619c16 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Sat, 26 Oct 2019 23:26:45 +0200
Subject: [PATCH 056/232] update tests

---
 .../Statements/IgnoreArrayResult/IgnoreArrayResult.expected   | 4 ++--
 .../Statements/IgnoreArrayResult/IgnoreArrayResult.qlref      | 2 +-
 .../ql/test/query-tests/Statements/IgnoreArrayResult/tst.js   | 4 ----
 3 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected
index 1ae8b59226a..9f5c5a0b082 100644
--- a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected
+++ b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.expected
@@ -1,2 +1,2 @@
-| tst.js:3:1:3:19 | arr.concat([1,2,3]) | Return value from call to concat ignored. |
-| tst.js:5:1:5:15 | arr.concat(arr) | Return value from call to concat ignored. |
+| tst.js:3:1:3:19 | arr.concat([1,2,3]) | Result from call to concat ignored. |
+| tst.js:5:1:5:15 | arr.concat(arr) | Result from call to concat ignored. |
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref
index 485692fff07..2cbc7e722a5 100644
--- a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref
+++ b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/IgnoreArrayResult.qlref
@@ -1 +1 @@
-Statements/IgnoreConcatReturn.ql
\ No newline at end of file
+Statements/IgnoreArrayResult.ql
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
index f2c5f34cc60..fc00470c8e1 100644
--- a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
+++ b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
@@ -6,8 +6,4 @@ arr.concat(arr); // NOT OK!
 
 console.log(arr.concat([1,2,3]));
 
-arr.concat(null);
-arr.concat();
-arr.concat([]);
-
 ({concat: Array.prototype.concat}.concat(arr));
\ No newline at end of file

From c6f53199d400c11c4ad71f75e44484bef81a6e18 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Sun, 27 Oct 2019 00:24:38 +0200
Subject: [PATCH 057/232] ignore when the reciever is the empty array

---
 javascript/ql/src/Statements/IgnoreArrayResult.ql | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.ql b/javascript/ql/src/Statements/IgnoreArrayResult.ql
index b3703c6992d..b6137e664d7 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.ql
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.ql
@@ -41,5 +41,7 @@ predicate isIgnoredPureArrayCall(DataFlow::MethodCallNode call) {
 }
 
 from DataFlow::MethodCallNode call
-where callsArray(call) instanceof DataFlow::ArrayCreationNode
+where 
+  callsArray(call) instanceof DataFlow::ArrayCreationNode and
+  not call.getReceiver().asExpr().(ArrayExpr).getSize() = 0
 select call, "Result from call to " + call.getMethodName() + " ignored."

From 92cebea235d6906a18e818c5234696fae2e58965 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Sun, 27 Oct 2019 00:25:59 +0200
Subject: [PATCH 058/232] update tests to include empty reciever case

---
 .../ql/test/query-tests/Statements/IgnoreArrayResult/tst.js   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
index fc00470c8e1..47efe8c1cb6 100644
--- a/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
+++ b/javascript/ql/test/query-tests/Statements/IgnoreArrayResult/tst.js
@@ -6,4 +6,6 @@ arr.concat(arr); // NOT OK!
 
 console.log(arr.concat([1,2,3]));
 
-({concat: Array.prototype.concat}.concat(arr));
\ No newline at end of file
+({concat: Array.prototype.concat}.concat(arr));
+
+[].concat([1,2,3]);
\ No newline at end of file

From b2c31701f3cf6dfdfb900fdaeba38b5e0ced2444 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Sun, 27 Oct 2019 09:07:45 +0100
Subject: [PATCH 059/232] add documentation to two predicates

---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index c01c6b5e3eb..77ec29ba9ee 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -89,6 +89,9 @@ predicate lastStatementHasNoEffect(Function f) {
   hasNoEffect(f.getExit().getAPredecessor())
 }
 
+/**
+ * Holds if `func` is a callee of `call`, and all possible callees of `call` never return a value.
+ */
 predicate callToVoidFunction(DataFlow::CallNode call, Function func) {
   not call.isIncomplete() and 
   func = call.getACallee() and
@@ -97,6 +100,11 @@ predicate callToVoidFunction(DataFlow::CallNode call, Function func) {
   )
 }
 
+/**
+ * Holds if `name` is the name of a method from `Array.prototype` or Lodash,
+ * where that method takes a callback as parameter,
+ * and the callback is expected to return a value.
+ */
 predicate hasNonVoidCallbackMethod(string name) {
   name = "every" or
   name = "filter" or

From 1500148c765438be0170777a7c6bcd79e71b0872 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Sun, 27 Oct 2019 11:23:54 -0700
Subject: [PATCH 060/232] [CPP-434] Clarify Qhelp.

---
 .../Arithmetic/SignedOverflowCheck-good1.cpp  |  2 +-
 .../Arithmetic/SignedOverflowCheck-good2.cpp  |  4 +-
 .../Arithmetic/SignedOverflowCheck.qhelp      | 48 +++++++++++--------
 3 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp
index d79d3ccbe93..2209b8bff71 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp	
@@ -1,3 +1,3 @@
 bool baf(unsigned short n1, unsigned short delta) {
-    return n1 + (unsigned)delta < n1; // GOOD
+    return (unsigned short)(n1 + delta) < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp
index 2670a4371f6..cccc66b71f8 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp	
@@ -1,3 +1,3 @@
-bool baz(int n1, unsigned int delta) {
-    return n1 + delta < n1; // GOOD
+bool baz(int n1, int delta) {
+    return (unsigned)n1 + delta < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index df48af7056d..ae4dae55016 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -4,16 +4,22 @@
 <qhelp>
 <overview>
 <p>
-Testing for signed integer overflow by adding a
-two signed values together and then comparing the result to one
-of the values is ill-formed since the overflow check is undefined.
-The comparison may produce an unintended result, or may be deleted
-by the compiler entirely.
+When checking for integer overflow, one often writes tests like
+<code>a + b &lt; a</code>.  This works fine if <code>a</code> or
+<code>b</code> are unsigned integers, since any overflow in the addition
+will cause the value to simply "wrap around".  However, using
+<i>signed</i> integers is problematic because signed overflows have undefined
+behavior according to the C and C++ standards.  If the addition overflows
+and has an undefined result, the comparison will likewise be undefined;
+it may produce an unintended result, or may be deleted entirely by an
+optimizing compiler.
 </p>
 </overview>
 <recommendation>
 <p>
-When checking for overflow, make sure that <code>unsigned</code> values are used.
+When checking for overflow by adding two values, first make sure that <code>a</code>
+or <code>b</code> are (converted into) unsigned values, unless it is
+certain that the signed addition cannot overflow.
 </p>
 </recommendation>
 <example>
@@ -21,9 +27,10 @@ When checking for overflow, make sure that <code>unsigned</code> values are used
 In the following example, even though <code>delta</code> has been declared
 <code>unsigned short</code>, C/C++ type promotion rules require that its
 type is promoted to the larger type used in the addition and comparison,
-namely a <code>signed int</code>.  As a result, the entire expression is
-evaluated using <code>signed</code> integers and may overflow, and hence
-is undefined.
+namely a <code>signed int</code>.  Addition is performed on 
+signed integers, and may have undefined behavior if an overflow occurs.
+As a result, the entire (comparison) expression may also have an undefined
+result.
 </p>
 <sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
@@ -39,21 +46,20 @@ hold true, which likely is not what the programmer intended. (see also the
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
 The following example builds upon the previous one.  Again, we have two
-<code>unsigned short</code> values getting promoted to a wider type.  However,
-since <code>delta</code> is explicitly cast to an <code>unsigned</code> type,
-<code>n1</code> (on both sides of the comparison) is promoted to
-<code>unsigned int</code> as well.  Since we are now operating on
-<code>unsigned</code> values, the overflow check is defined and supported by
-standard C/C++.
+<code>unsigned short</code> values getting promoted to a wider type, resulting
+in a comparison that always succeeds (since there is no overflow).  To
+test whether we have an <code>unsigned short</code> overflow, we cast the
+left-hand side to it, causing the right-hand side to remain an <code>unsigned
+short</code> as well.
 </p>
 <sample src="SignedOverflowCheck-good1.cpp" />
 <p>
-In the next example, a value of type <code>signed int</code> is
-added to a value of type <code>unsigned int</code>.  Because
-the types are of the same size, C/C++ conversion rules dictate that
-<code>unsigned int</code> is chosen as the overall type of the addition
-operation. The entire expression is evaluated using <code>unsigned</code>
-values, which is allowed and defined behavior per the C/C++ standard.
+In the next example, we have two <code>signed int</code> values that we
+wish to add together.  Adding them "as-is" opens the possibility of
+a signed integer overflow, the results of which are undefined.
+By casting one of the operands to <code>unsigned</code>, the entire 
+expression is evaluated using <code>unsigned</code>
+values, which is defined behavior per the C/C++ standard.
 </p>
 <sample src="SignedOverflowCheck-good2.cpp" />
 </example>

From b0cf7cb39a9f04648fc98f796ee2c9a444d63d74 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 28 Oct 2019 13:38:53 +0100
Subject: [PATCH 061/232] C#: Move `UnsafeDeserialization.qll`

---
 .../ql/src/Security Features/CWE-502/UnsafeDeserialization.ql   | 2 +-
 .../CWE-502/UnsafeDeserializationUntrustedInput.ql              | 2 +-
 .../code/csharp/security/dataflow}/UnsafeDeserialization.qll    | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename csharp/ql/src/{Security Features/CWE-502 => semmle/code/csharp/security/dataflow}/UnsafeDeserialization.qll (100%)

diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql
index edd0e15c247..d0ab23560a1 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql	
@@ -14,7 +14,7 @@
  */
 
 import csharp
-import UnsafeDeserialization::UnsafeDeserialization
+import semmle.code.csharp.security.dataflow.UnsafeDeserialization::UnsafeDeserialization
 
 from Call deserializeCall, Sink sink
 where deserializeCall.getAnArgument() = sink.asExpr()
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
index b0b659857ab..fb4011ec846 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql	
@@ -14,7 +14,7 @@
  */
 
 import csharp
-import UnsafeDeserialization::UnsafeDeserialization
+import semmle.code.csharp.security.dataflow.UnsafeDeserialization::UnsafeDeserialization
 import DataFlow::PathGraph
 
 from TaintTrackingConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll
similarity index 100%
rename from csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qll
rename to csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll

From eb990525d740a3744dcb2781d5466ed00140c2c3 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 28 Oct 2019 14:19:40 +0100
Subject: [PATCH 062/232] C#: Add precision tags to
 `UnsafeDeserialization[UntrustedInput].ql`

---
 .../CWE-502/UnsafeDeserialization.ql          |  5 +--
 .../UnsafeDeserializationUntrustedInput.ql    |  5 +--
 .../dataflow/UnsafeDeserialization.qll        |  1 -
 .../UnsafeDeserialization/ExtractorOptions.cs |  2 +-
 .../UnsafeDeserialization/SystemWebStub.cs    | 34 --------------
 .../ExtractorOptions.cs                       |  2 +-
 .../SystemWebStub.cs                          | 45 -------------------
 csharp/ql/test/resources/stubs/System.Web.cs  | 22 +++++++++
 8 files changed, 26 insertions(+), 90 deletions(-)
 delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/SystemWebStub.cs
 delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/SystemWebStub.cs

diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql
index d0ab23560a1..40022d40573 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql	
@@ -5,14 +5,11 @@
  * @kind problem
  * @id cs/unsafe-deserialization
  * @problem.severity warning
+ * @precision low
  * @tags security
  *       external/cwe/cwe-502
  */
 
-/*
- * consider: @precision low
- */
-
 import csharp
 import semmle.code.csharp.security.dataflow.UnsafeDeserialization::UnsafeDeserialization
 
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
index fb4011ec846..80a3762a8bc 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql	
@@ -5,14 +5,11 @@
  * @kind path-problem
  * @id cs/unsafe-deserialization-untrusted-input
  * @problem.severity error
+ * @precision high
  * @tags security
  *       external/cwe/cwe-502
  */
 
-/*
- * consider: @precision high
- */
-
 import csharp
 import semmle.code.csharp.security.dataflow.UnsafeDeserialization::UnsafeDeserialization
 import DataFlow::PathGraph
diff --git a/csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll b/csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll
index 4e401eb4804..57b3a78485b 100644
--- a/csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll
+++ b/csharp/ql/src/semmle/code/csharp/security/dataflow/UnsafeDeserialization.qll
@@ -6,7 +6,6 @@
 import csharp
 
 module UnsafeDeserialization {
-  private import semmle.code.csharp.dataflow.flowsources.Remote
   private import semmle.code.csharp.dataflow.flowsources.Remote
   private import semmle.code.csharp.serialization.Deserializers
 
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ExtractorOptions.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ExtractorOptions.cs
index 11f05a14a00..bd796aa9f51 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ExtractorOptions.cs	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ExtractorOptions.cs	
@@ -1 +1 @@
-// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll
+// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll /r:System.Collections.Specialized.dll ${testdir}/../../../../resources/stubs/System.Web.cs
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/SystemWebStub.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/SystemWebStub.cs
deleted file mode 100644
index 48c74335f6f..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/SystemWebStub.cs	
+++ /dev/null
@@ -1,34 +0,0 @@
-// This file contains auto-generated code.
-// original-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll
-
-namespace System
-{
-    namespace Web
-    {
-        namespace Script
-        {
-            namespace Serialization
-            {
-                // Generated from `System.Web.Script.Serialization.JavaScriptSerializer` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                public class JavaScriptSerializer
-                {
-                    public JavaScriptSerializer() => throw null;
-                    public JavaScriptSerializer(System.Web.Script.Serialization.JavaScriptTypeResolver resolver) => throw null;
-                    public object DeserializeObject(string input) => throw null;
-                }
-
-                // Generated from `System.Web.Script.Serialization.JavaScriptTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                abstract public class JavaScriptTypeResolver
-                {
-                }
-
-                // Generated from `System.Web.Script.Serialization.SimpleTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                public class SimpleTypeResolver : System.Web.Script.Serialization.JavaScriptTypeResolver
-                {
-                    public SimpleTypeResolver() => throw null;
-                }
-
-            }
-        }
-    }
-}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ExtractorOptions.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ExtractorOptions.cs
index 11f05a14a00..bd796aa9f51 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ExtractorOptions.cs	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ExtractorOptions.cs	
@@ -1 +1 @@
-// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll
+// semmle-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll /r:System.Collections.Specialized.dll ${testdir}/../../../../resources/stubs/System.Web.cs
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/SystemWebStub.cs b/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/SystemWebStub.cs
deleted file mode 100644
index 293c0cdf355..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/SystemWebStub.cs	
+++ /dev/null
@@ -1,45 +0,0 @@
-// This file contains auto-generated code.
-// original-extractor-options: /r:System.Runtime.Extensions.dll /r:System.IO.FileSystem.dll
-
-namespace System
-{
-    namespace Web
-    {
-        namespace UI
-        {
-            namespace WebControls
-            {
-                public class TextBox
-                {
-                    public string Text { get; set; }
-                }
-            }
-        }
-
-        namespace Script
-        {
-            namespace Serialization
-            {
-                // Generated from `System.Web.Script.Serialization.JavaScriptSerializer` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                public class JavaScriptSerializer
-                {
-                    public JavaScriptSerializer() => throw null;
-                    public JavaScriptSerializer(System.Web.Script.Serialization.JavaScriptTypeResolver resolver) => throw null;
-                    public object DeserializeObject(string input) => throw null;
-                }
-
-                // Generated from `System.Web.Script.Serialization.JavaScriptTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                abstract public class JavaScriptTypeResolver
-                {
-                }
-
-                // Generated from `System.Web.Script.Serialization.SimpleTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
-                public class SimpleTypeResolver : System.Web.Script.Serialization.JavaScriptTypeResolver
-                {
-                    public SimpleTypeResolver() => throw null;
-                }
-
-            }
-        }
-    }
-}
diff --git a/csharp/ql/test/resources/stubs/System.Web.cs b/csharp/ql/test/resources/stubs/System.Web.cs
index eb08326b794..13ebaf316d7 100644
--- a/csharp/ql/test/resources/stubs/System.Web.cs
+++ b/csharp/ql/test/resources/stubs/System.Web.cs
@@ -346,3 +346,25 @@ namespace System.Web.Helpers
         public static void Validate() { }
     }
 }
+
+namespace System.Web.Script.Serialization
+{
+    // Generated from `System.Web.Script.Serialization.JavaScriptSerializer` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
+    public class JavaScriptSerializer
+    {
+        public JavaScriptSerializer() => throw null;
+        public JavaScriptSerializer(System.Web.Script.Serialization.JavaScriptTypeResolver resolver) => throw null;
+        public object DeserializeObject(string input) => throw null;
+    }
+
+    // Generated from `System.Web.Script.Serialization.JavaScriptTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
+    abstract public class JavaScriptTypeResolver
+    {
+    }
+
+    // Generated from `System.Web.Script.Serialization.SimpleTypeResolver` in `System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`
+    public class SimpleTypeResolver : System.Web.Script.Serialization.JavaScriptTypeResolver
+    {
+        public SimpleTypeResolver() => throw null;
+    }
+}

From 3f5ee5138b99d52ae2146e8ceddc96b628d9e331 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 28 Oct 2019 14:22:59 +0100
Subject: [PATCH 063/232] C#: Add change notes

---
 change-notes/1.23/analysis-csharp.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/change-notes/1.23/analysis-csharp.md b/change-notes/1.23/analysis-csharp.md
index 7ec412a0eb2..786c35ffbae 100644
--- a/change-notes/1.23/analysis-csharp.md
+++ b/change-notes/1.23/analysis-csharp.md
@@ -8,7 +8,9 @@ The following changes in version 1.23 affect C# analysis in all applications.
 
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
+| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security | Finds flow of untrusted input to calls to unsafe deserializers. |
 | Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
+| Unsafe deserializer (`cs/unsafe-deserialization`) | security | Finds calls to unsafe deserializers. |
 | Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
 
 ## Changes to existing queries

From d693eb8c20a147a927ae2e5dda179d9233cde6b9 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 28 Oct 2019 17:39:45 +0000
Subject: [PATCH 064/232] CPP: Correct the ConditionallyUninitializedVariable
 examples.

---
 .../CWE/CWE-457/ConditionallyUninitializedVariableBad.c     | 6 +++---
 .../CWE/CWE-457/ConditionallyUninitializedVariableGood.c    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableBad.c b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableBad.c
index 1f281f3cfd9..73a01c2d900 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableBad.c
+++ b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableBad.c
@@ -19,7 +19,7 @@ int notify(int deviceNumber) {
   DeviceConfig config;
   initDeviceConfig(&config, deviceNumber);
   // BAD: Using config without checking the status code that is returned
-  if (config->isEnabled) {
-    notifyChannel(config->channel);
+  if (config.isEnabled) {
+    notifyChannel(config.channel);
   }
-}
\ No newline at end of file
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableGood.c b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableGood.c
index a9dcc06c9a5..ced43a66cfc 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableGood.c
+++ b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariableGood.c
@@ -20,8 +20,8 @@ void notify(int deviceNumber) {
   int statusCode = initDeviceConfig(&config, deviceNumber);
   if (statusCode == 0) {
     // GOOD: Status code returned by initialization function is checked, so this is safe
-    if (config->isEnabled) {
-      notifyChannel(config->channel);
+    if (config.isEnabled) {
+      notifyChannel(config.channel);
     }
   }
-}
\ No newline at end of file
+}

From c40c88ec4bfd2ddd5e79ed48fb1c955e23bf2a7b Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 28 Oct 2019 18:43:00 +0000
Subject: [PATCH 065/232] CPP: Add test cases for
 ConditionallyUninitializedVariables.ql.

---
 ...onditionallyUninitializedVariable.expected |  3 +
 .../ConditionallyUninitializedVariable.qlref  |  1 +
 .../examples.cpp                              | 43 +++++++++
 .../test.cpp                                  | 96 +++++++++++++++++++
 4 files changed, 143 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.expected
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.expected
new file mode 100644
index 00000000000..60964c8f178
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.expected
@@ -0,0 +1,3 @@
+| examples.cpp:38:3:38:18 | call to initDeviceConfig | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | examples.cpp:13:5:13:20 | initDeviceConfig | initDeviceConfig | examples.cpp:37:16:37:21 | config | config |
+| test.cpp:22:2:22:17 | call to maybeInitialize1 | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | test.cpp:4:5:4:20 | maybeInitialize1 | maybeInitialize1 | test.cpp:19:6:19:6 | a | a |
+| test.cpp:68:2:68:17 | call to maybeInitialize2 | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | test.cpp:51:6:51:21 | maybeInitialize2 | maybeInitialize2 | test.cpp:66:6:66:6 | a | a |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref
new file mode 100644
index 00000000000..5150d627257
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp
new file mode 100644
index 00000000000..ccb15904d02
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp
@@ -0,0 +1,43 @@
+// based on the qhelp
+
+int getMaxDevices();
+bool fetchIsDeviceEnabled(int deviceNumber);
+int fetchDeviceChannel(int deviceNumber);
+void notifyChannel(int channel);
+
+struct DeviceConfig {
+  bool isEnabled;
+  int channel;
+};
+
+int initDeviceConfig(DeviceConfig *ref, int deviceNumber) {
+  if (deviceNumber >= getMaxDevices()) {
+    // No device with that number, return -1 to indicate failure
+    return -1;
+  }
+  // Device with that number, fetch parameters and initialize struct
+  ref->isEnabled = fetchIsDeviceEnabled(deviceNumber);
+  ref->channel = fetchDeviceChannel(deviceNumber);
+  // Return 0 to indicate success
+  return 0;
+}
+
+void notifyGood(int deviceNumber) {
+  DeviceConfig config;
+  int statusCode = initDeviceConfig(&config, deviceNumber);
+  if (statusCode == 0) {
+    // GOOD: Status code returned by initialization function is checked, so this is safe
+    if (config.isEnabled) {
+      notifyChannel(config.channel);
+    }
+  }
+}
+
+int notifyBad(int deviceNumber) {
+  DeviceConfig config;
+  initDeviceConfig(&config, deviceNumber);
+  // BAD: Using config without checking the status code that is returned
+  if (config.isEnabled) {
+    notifyChannel(config.channel);
+  }
+}
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
new file mode 100644
index 00000000000..a3c9b0a24aa
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
@@ -0,0 +1,96 @@
+
+void use(int i);
+
+int maybeInitialize1(int *v)
+{
+	static int resources = 100;
+
+	if (resources == 0)
+	{
+		return 0; // FAIL
+	}
+
+	*v = resources--;
+	return 1; // SUCCESS
+}
+
+void test1()
+{
+	int a, b, c, d, e, f;
+	int result1, result2;
+
+	maybeInitialize1(&a); // BAD (initialization not checked)
+	use(a);
+	
+	if (maybeInitialize1(&b) == 1) // GOOD
+	{
+		use(b);
+	}
+	
+	if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED]
+	{
+		use(c);
+	}
+
+	result1 = maybeInitialize1(&d); // BAD (initialization stored but not checked) [NOT DETECTED]
+	use(d);
+
+	result2 = maybeInitialize1(&e); // GOOD
+	if (result2 == 1)
+	{
+		use(e);
+	}
+
+	if (maybeInitialize1(&f) == 0) // GOOD
+	{
+		return;
+	}
+	use(f);
+}
+
+bool maybeInitialize2(int *v)
+{
+	static int resources = 100;
+
+	if (resources > 0)
+	{
+		*v = resources--;
+		return true; // SUCCESS
+	}
+
+	return false; // FAIL
+}
+
+void test2()
+{
+	int a, b;
+
+	maybeInitialize2(&a); // BAD (initialization not checked)
+	use(a);
+	
+	if (maybeInitialize2(&b)) // GOOD
+	{
+		use(b);
+	}
+}
+
+int alwaysInitialize(int *v)
+{
+	static int resources = 0;
+
+	*v = resources++;
+	return 1; // SUCCESS
+}
+
+void test3()
+{
+	int a, b;
+
+	alwaysInitialize(&a); // GOOD (initialization never fails)
+	use(a);
+	
+	if (alwaysInitialize(&b) == 1) // GOOD
+	{
+		use(b);
+	}
+}

From 2d64fedeb021db7fa0a919bad6f189ae4805907f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 25 Oct 2019 11:19:31 +0100
Subject: [PATCH 066/232] CPP: Speed up VirtualDispatch.qll's getAViableTarget.

---
 .../code/cpp/dispatch/VirtualDispatch.qll     | 28 +++++++++++--------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll b/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
index 2fa9322843e..1113fc430e7 100644
--- a/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
+++ b/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
@@ -28,6 +28,19 @@ module VirtualDispatch {
     not result.hasName("IUnknown")
   }
 
+  /**
+   * Helper predicate for `getAViableTarget`, which computes the viable targets for
+   * virtual calls based on the qualifier type.
+   */
+  private Function getAViableVirtualCallTarget(Class qualifierType, MemberFunction staticTarget) {
+    exists(Class qualifierSubType |
+      result = getAPossibleImplementation(staticTarget) and
+      qualifierType = qualifierSubType.getABaseClass*() and
+      mayInherit(qualifierSubType, result) and
+      not cannotInherit(qualifierSubType, result)
+    )
+  }
+
   /**
    * Gets a viable target for the given function call.
    *
@@ -42,18 +55,9 @@ module VirtualDispatch {
    * If `c` is not a virtual call, the result will be `c.getTarget()`.
    */
   Function getAViableTarget(Call c) {
-    exists(Function staticTarget | staticTarget = c.getTarget() |
-      if c.(FunctionCall).isVirtual() and staticTarget instanceof MemberFunction
-      then
-        exists(Class qualifierType, Class qualifierSubType |
-          result = getAPossibleImplementation(staticTarget) and
-          qualifierType = getCallQualifierType(c) and
-          qualifierType = qualifierSubType.getABaseClass*() and
-          mayInherit(qualifierSubType, result) and
-          not cannotInherit(qualifierSubType, result)
-        )
-      else result = staticTarget
-    )
+    if c.(FunctionCall).isVirtual() and c.getTarget() instanceof MemberFunction
+    then result = getAViableVirtualCallTarget(getCallQualifierType(c), c.getTarget())
+    else result = c.getTarget()
   }
 
   /** Holds if `f` is declared in `c` or a transitive base class of `c`. */

From 3584c0b2e5ae646b0e4c53d4d80810e84ed5c780 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 25 Oct 2019 11:22:42 +0100
Subject: [PATCH 067/232] CPP: Speed up InitializationFunctions.qll's
 getTarget.

---
 .../CWE/CWE-457/InitializationFunctions.qll   | 51 +++++++++++--------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 240bd7aa25e..720cf11950b 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -618,6 +618,33 @@ Function getAPossibleDefinition(Function undefinedFunction) {
   ) and
   result.isDefined()
 }
+ 
+private Function getTarget1(Call c) {
+  /*
+   * If there is at least one defined target after performing some simple virtual dispatch
+   * resolution, then the result is all the defined targets.
+   */
+
+  result = VirtualDispatch::getAViableTarget(c) and
+  result.isDefined()
+}
+
+private Function getTarget2(Call c) {
+  /*
+   * If we can use the heuristic matching of functions to find definitions for some of the viable
+   * targets, return those.
+   */
+
+  not exists(getTarget1(c)) and
+  result = getAPossibleDefinition(VirtualDispatch::getAViableTarget(c))
+}
+
+private Function getTarget3(Call c) {
+  not exists(getTarget1(c)) and
+  not exists(getTarget2(c)) and
+  // Otherwise, the result is the undefined `Function` instances.
+  result = VirtualDispatch::getAViableTarget(c)
+}
 
 /**
  * Gets a possible target for the Call, using the name and parameter matching if we did not associate
@@ -625,27 +652,9 @@ Function getAPossibleDefinition(Function undefinedFunction) {
  * dispatch resolution.
  */
 Function getTarget(Call c) {
-  if VirtualDispatch::getAViableTarget(c).isDefined()
-  then
-    /*
-     * If there is at least one defined target after performing some simple virtual dispatch
-     * resolution, then the result is all the defined targets.
-     */
-
-    result = VirtualDispatch::getAViableTarget(c) and
-    result.isDefined()
-  else
-    if exists(getAPossibleDefinition(VirtualDispatch::getAViableTarget(c)))
-    then
-      /*
-       * If we can use the heuristic matching of functions to find definitions for some of the viable
-       * targets, return those.
-       */
-
-      result = getAPossibleDefinition(VirtualDispatch::getAViableTarget(c))
-    else
-      // Otherwise, the result is the undefined `Function` instances
-      result = VirtualDispatch::getAViableTarget(c)
+  result = getTarget1(c) or
+  result = getTarget2(c) or
+  result = getTarget3(c)
 }
 
 /**

From 563f32193cfbb747c19c0b28884be70264a6296c Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 29 Oct 2019 12:10:12 +0100
Subject: [PATCH 068/232] suggestions from @max-schaefer

Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
---
 javascript/ql/src/Statements/IgnoreArrayResult.qhelp | 2 +-
 javascript/ql/src/Statements/IgnoreArrayResult.ql    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
index b70ff1f1b32..2232784d881 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
@@ -5,7 +5,7 @@
 <overview>
 <p>
 The <code>concat</code>, <code>join</code> and <code>slice</code> methods are
-pure and does not modify any of the inputs or the array the method was called 
+pure and do not modify any of the inputs or the array the method was called 
 on. It is therefore generally an error to ignore the return value from a call
 to one of these methods. 
 </p>
diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.ql b/javascript/ql/src/Statements/IgnoreArrayResult.ql
index b6137e664d7..5ab778ed95b 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.ql
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.ql
@@ -1,10 +1,10 @@
 /**
  * @name Ignoring result from pure array method
- * @description The array methods do not modify the array, ignoring the result of such a call is therefore generally an error.
+ * @description Ignoring the result of an array method that does not modify its receiver is generally an error.
  * @kind problem
  * @problem.severity warning
  * @id js/ignore-array-result
- * @tags maintainability,
+ * @tags maintainability
  *       correctness
  * @precision high
  */
@@ -16,7 +16,7 @@ DataFlow::SourceNode callsArray(DataFlow::TypeBackTracker t, DataFlow::MethodCal
   isIgnoredPureArrayCall(call) and
   (
     t.start() and
-    result = call.getReceiver()
+    result = call.getReceiver().getALocalSource()
     or
     exists(DataFlow::TypeBackTracker t2 | result = callsArray(t2, call).backtrack(t2, t))
   )

From 2d01e7c5ed97392e55db948755d445dc8337a68a Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 29 Oct 2019 12:13:01 +0100
Subject: [PATCH 069/232] simplify the callsArray predicate

---
 javascript/ql/src/Statements/IgnoreArrayResult.ql | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.ql b/javascript/ql/src/Statements/IgnoreArrayResult.ql
index 5ab778ed95b..6f6698797f1 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.ql
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.ql
@@ -13,13 +13,11 @@ import javascript
 import Expressions.ExprHasNoEffect
 
 DataFlow::SourceNode callsArray(DataFlow::TypeBackTracker t, DataFlow::MethodCallNode call) {
-  isIgnoredPureArrayCall(call) and
-  (
-    t.start() and
-    result = call.getReceiver().getALocalSource()
-    or
-    exists(DataFlow::TypeBackTracker t2 | result = callsArray(t2, call).backtrack(t2, t))
-  )
+  isIgnoredPureArrayCall(call) and 
+  t.start() and
+  result = call.getReceiver().getALocalSource()
+  or
+  exists(DataFlow::TypeBackTracker t2 | result = callsArray(t2, call).backtrack(t2, t))
 }
 
 DataFlow::SourceNode callsArray(DataFlow::MethodCallNode call) {

From 49dd2216a65e55824bb0371d8d476eebae1c241b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Thu, 10 Oct 2019 16:14:12 +0200
Subject: [PATCH 070/232] Python: Refactor django library

Use General.qll for routing, like in other web libraries
---
 .../src/semmle/python/web/django/General.qll  | 28 +++++++++++++
 .../src/semmle/python/web/django/Request.qll  | 41 ++++---------------
 2 files changed, 35 insertions(+), 34 deletions(-)
 create mode 100644 python/ql/src/semmle/python/web/django/General.qll

diff --git a/python/ql/src/semmle/python/web/django/General.qll b/python/ql/src/semmle/python/web/django/General.qll
new file mode 100644
index 00000000000..954df1892e8
--- /dev/null
+++ b/python/ql/src/semmle/python/web/django/General.qll
@@ -0,0 +1,28 @@
+import python
+import semmle.python.regex
+import semmle.python.web.Http
+
+predicate django_route(CallNode call, ControlFlowNode regex, FunctionValue view) {
+    exists(FunctionValue url |
+        Value::named("django.conf.urls.url") = url and
+        url.getArgumentForCall(call, 0) = regex and
+        url.getArgumentForCall(call, 1).pointsTo(view)
+    )
+}
+
+class DjangoRouteRegex extends RegexString {
+    DjangoRouteRegex() { django_route(_, this.getAFlowNode(), _) }
+}
+
+class DjangoRoute extends CallNode {
+    DjangoRoute() { django_route(this, _, _) }
+
+    FunctionValue getViewFunction() { django_route(this, _, result) }
+
+    string getNamedArgument() {
+        exists(DjangoRouteRegex regex |
+            django_route(this, regex.getAFlowNode(), _) and
+            regex.getGroupName(_, _) = result
+        )
+    }
+}
diff --git a/python/ql/src/semmle/python/web/django/Request.qll b/python/ql/src/semmle/python/web/django/Request.qll
index d2ad2ff30d3..71da78f9b43 100644
--- a/python/ql/src/semmle/python/web/django/Request.qll
+++ b/python/ql/src/semmle/python/web/django/Request.qll
@@ -1,7 +1,7 @@
 import python
-import semmle.python.regex
 import semmle.python.security.TaintTracking
 import semmle.python.web.Http
+import semmle.python.web.django.General
 
 /** A django.request.HttpRequest object */
 class DjangoRequest extends TaintKind {
@@ -52,7 +52,7 @@ abstract class DjangoRequestSource extends HttpRequestTaintSource {
 private class DjangoFunctionBasedViewRequestArgument extends DjangoRequestSource {
     DjangoFunctionBasedViewRequestArgument() {
         exists(FunctionValue view |
-            url_dispatch(_, _, view) and
+            django_route(_, _, view) and
             this = view.getScope().getArg(0).asName().getAFlowNode()
         )
     }
@@ -76,41 +76,14 @@ class DjangoClassBasedViewRequestArgument extends DjangoRequestSource {
     }
 }
 
-/* ***********  Routing  ********* */
-/* Function based views */
-predicate url_dispatch(CallNode call, ControlFlowNode regex, FunctionValue view) {
-    exists(FunctionValue url |
-        Value::named("django.conf.urls.url") = url and
-        url.getArgumentForCall(call, 0) = regex and
-        url.getArgumentForCall(call, 1).pointsTo(view)
-    )
-}
-
-class UrlRegex extends RegexString {
-    UrlRegex() { url_dispatch(_, this.getAFlowNode(), _) }
-}
-
-class UrlRouting extends CallNode {
-    UrlRouting() { url_dispatch(this, _, _) }
-
-    FunctionValue getViewFunction() { url_dispatch(this, _, result) }
-
-    string getNamedArgument() {
-        exists(UrlRegex regex |
-            url_dispatch(this, regex.getAFlowNode(), _) and
-            regex.getGroupName(_, _) = result
-        )
-    }
-}
-
 /** An argument specified in a url routing table */
-class HttpRequestParameter extends HttpRequestTaintSource {
-    HttpRequestParameter() {
-        exists(UrlRouting url |
-            this.(ControlFlowNode).getNode() = url
+class DjangoRequestParameter extends HttpRequestTaintSource {
+    DjangoRequestParameter() {
+        exists(DjangoRoute route |
+            this.(ControlFlowNode).getNode() = route
                         .getViewFunction()
                         .getScope()
-                        .getArgByName(url.getNamedArgument())
+                        .getArgByName(route.getNamedArgument())
         )
     }
 

From afe7a0536cc0ad3cc93b396c0d3ed40bb1c5502c Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Thu, 10 Oct 2019 17:25:09 +0200
Subject: [PATCH 071/232] Python: Support positional arguments in Django routes

---
 change-notes/1.23/analysis-python.md          |  5 +++
 .../src/semmle/python/web/django/General.qll  | 12 +++++++
 .../src/semmle/python/web/django/Request.qll  | 14 +++++---
 .../library-tests/web/django/Sinks.expected   |  4 +++
 .../library-tests/web/django/Sources.expected |  9 +++++
 .../ql/test/library-tests/web/django/test.py  | 33 ++++++++++++++++++-
 6 files changed, 71 insertions(+), 6 deletions(-)

diff --git a/change-notes/1.23/analysis-python.md b/change-notes/1.23/analysis-python.md
index 00fab13e098..6cea1745284 100644
--- a/change-notes/1.23/analysis-python.md
+++ b/change-notes/1.23/analysis-python.md
@@ -20,3 +20,8 @@
 |----------------------------|------------------------|------------|
 | Unreachable code | Fewer false positives | Analysis now accounts for uses of `contextlib.suppress` to suppress exceptions. |
 | `__iter__` method returns a non-iterator | Better alert message | Alert now highlights which class is expected to be an iterator. |
+
+
+## Changes to QL libraries
+
+* Django library now recognizes positional arguments from a `django.conf.urls.url` regex (Django version 1.x)
diff --git a/python/ql/src/semmle/python/web/django/General.qll b/python/ql/src/semmle/python/web/django/General.qll
index 954df1892e8..423d853cdad 100644
--- a/python/ql/src/semmle/python/web/django/General.qll
+++ b/python/ql/src/semmle/python/web/django/General.qll
@@ -25,4 +25,16 @@ class DjangoRoute extends CallNode {
             regex.getGroupName(_, _) = result
         )
     }
+
+    /**
+      * Get the number of positional arguments that will be passed to the view.
+      * Will only return a result if there are no named arguments.
+      */
+    int getNumPositionalArguments() {
+        exists(DjangoRouteRegex regex |
+            django_route(this, regex.getAFlowNode(), _) and
+            not exists(string s | s = regex.getGroupName(_, _)) and
+            result = count(regex.getGroupNumber(_, _))
+        )
+    }
 }
diff --git a/python/ql/src/semmle/python/web/django/Request.qll b/python/ql/src/semmle/python/web/django/Request.qll
index 71da78f9b43..15ea032e6d7 100644
--- a/python/ql/src/semmle/python/web/django/Request.qll
+++ b/python/ql/src/semmle/python/web/django/Request.qll
@@ -79,11 +79,15 @@ class DjangoClassBasedViewRequestArgument extends DjangoRequestSource {
 /** An argument specified in a url routing table */
 class DjangoRequestParameter extends HttpRequestTaintSource {
     DjangoRequestParameter() {
-        exists(DjangoRoute route |
-            this.(ControlFlowNode).getNode() = route
-                        .getViewFunction()
-                        .getScope()
-                        .getArgByName(route.getNamedArgument())
+        exists(DjangoRoute route, Function f |
+            f = route.getViewFunction().getScope() |
+            this.(ControlFlowNode).getNode() = f.getArgByName(route.getNamedArgument())
+            or
+            exists(int i | i >= 0 |
+                i < route.getNumPositionalArguments() and
+                // +1 because first argument is always the request
+                this.(ControlFlowNode).getNode() = f.getArg(i+1)
+            )
         )
     }
 
diff --git a/python/ql/test/library-tests/web/django/Sinks.expected b/python/ql/test/library-tests/web/django/Sinks.expected
index 82d1b71e53a..7201a7a20a9 100644
--- a/python/ql/test/library-tests/web/django/Sinks.expected
+++ b/python/ql/test/library-tests/web/django/Sinks.expected
@@ -4,3 +4,7 @@
 | test.py:25 | BinaryExpr | externally controlled string |
 | test.py:26 | BinaryExpr | externally controlled string |
 | test.py:34 | BinaryExpr | externally controlled string |
+| test.py:46 | Attribute() | externally controlled string |
+| test.py:57 | Attribute() | externally controlled string |
+| test.py:60 | Attribute() | externally controlled string |
+| test.py:63 | Attribute() | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/Sources.expected b/python/ql/test/library-tests/web/django/Sources.expected
index 8f421a2d169..7482f21cdda 100644
--- a/python/ql/test/library-tests/web/django/Sources.expected
+++ b/python/ql/test/library-tests/web/django/Sources.expected
@@ -1,2 +1,11 @@
 | test.py:11 | request | django.request.HttpRequest |
 | test.py:31 | request | django.request.HttpRequest |
+| test.py:56 | arg0 | externally controlled string |
+| test.py:56 | request | django.request.HttpRequest |
+| test.py:59 | arg0 | externally controlled string |
+| test.py:59 | arg1 | externally controlled string |
+| test.py:59 | arg2 | externally controlled string |
+| test.py:59 | request | django.request.HttpRequest |
+| test.py:62 | arg0 | externally controlled string |
+| test.py:62 | arg1 | externally controlled string |
+| test.py:62 | request | django.request.HttpRequest |
diff --git a/python/ql/test/library-tests/web/django/test.py b/python/ql/test/library-tests/web/django/test.py
index e6c39c30a32..3cabac0e5c5 100644
--- a/python/ql/test/library-tests/web/django/test.py
+++ b/python/ql/test/library-tests/web/django/test.py
@@ -34,7 +34,38 @@ def maybe_xss(request):
     resp.write("first name is " + first_name)
     return resp
 
-urlpatterns2 = [
+urlpatterns = [
     # Route to code_execution
     url(r'^maybe_xss$', maybe_xss, name='maybe_xss')
 ]
+
+
+# Non capturing group (we correctly identify page_number as a request parameter)
+
+def show_articles(request, page_number=1):
+    return HttpResponse('articles page: {}'.format(page_number))
+
+urlpatterns = [
+    # one pattern to support `articles/page-<n>` and ensuring that articles/ goes to page-1
+    url(r'articles/^(?:page-(?P<page_number>\d+)/)?$', show_articles),
+]
+
+
+# Positional arguments
+
+def xxs_positional_arg1(request, arg0):
+    return HttpResponse('xxs_positional_arg1: {}'.format(arg0))
+
+def xxs_positional_arg2(request, arg0, arg1, arg2):
+    return HttpResponse('xxs_positional_arg2: {} {} {}'.format(arg0, arg1, arg2))
+
+def xxs_positional_arg3(request, arg0, arg1):
+    return HttpResponse('xxs_positional_arg3: {} {}'.format(arg0, arg1))
+
+urlpatterns = [
+    # passing as positional argument is not the recommended way of doing things,
+    # but it is certainly possible
+    url(r'^(.+)$', xxs_positional_arg1, name='xxs_positional_arg1'),
+    url(r'^([^/]+)/([^/]+)/([^/]+)$', xxs_positional_arg2, name='xxs_positional_arg2'),
+    url(r'^([^/]+)/(?:foo|bar)/([^/]+)$', xxs_positional_arg3, name='xxs_positional_arg3'),
+]

From 471318369b4fee5c66239a5f33c91d9410df8f76 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Mon, 14 Oct 2019 16:51:50 +0200
Subject: [PATCH 072/232] Python: Don't quote %s in django example

This is vulnerable to SQL injection because of the quotes around %s -- added
some code that highlights this in test.py

Since our examples did this in the safe query, I ended up rewriting them
completely, causing a lot of trouble for myself :D
---
 .../src/Security/CWE-089/SqlInjection.qhelp   | 17 +++++--
 .../CWE-089/examples/sql_injection.py         | 28 +++++-----
 .../library-tests/web/django/Sinks.expected   | 21 ++++----
 .../library-tests/web/django/Sources.expected | 26 ++++++----
 .../ql/test/library-tests/web/django/test.py  | 51 ++++++++++++-------
 .../Security/CWE-089/SqlInjection.expected    | 27 +++++-----
 .../Security/CWE-089/sql_injection.py         | 48 ++++++++++-------
 7 files changed, 128 insertions(+), 90 deletions(-)

diff --git a/python/ql/src/Security/CWE-089/SqlInjection.qhelp b/python/ql/src/Security/CWE-089/SqlInjection.qhelp
index e976401a6b5..286b71a6047 100644
--- a/python/ql/src/Security/CWE-089/SqlInjection.qhelp
+++ b/python/ql/src/Security/CWE-089/SqlInjection.qhelp
@@ -21,20 +21,29 @@ or prepared statements.
 
 <example>
 <p>
-In the following snippet, from an example django app, 
-a name is stored in the database using two different queries.
+In the following snippet, a user is fetched from the database using three
+different queries.
 </p>
 
 <p>
 In the first case, the query string is built by
-directly using string formatting from a user-supplied request attribute.
+directly using string formatting from a user-supplied request parameter.
 The parameter may include quote characters, so this
 code is vulnerable to a SQL injection attack.
 </p>
 
 <p>
 In the second case, the user-supplied request attribute is passed
-to the database using query parameters.
+to the database using query parameters. The database connector library will
+take care of escaping and inserting quotes as needed.
+</p>
+
+<p>
+In the third case, the placeholder in the SQL string has been manually quoted. Since most
+databaseconnector libraries will insert their own quotes, doing so yourself will make the code
+vulnerable to SQL injection attacks. In this example, if <code>username</code> was
+<code>; DROP ALL TABLES -- </code>, the final SQL query would be
+<code>SELECT * FROM users WHERE username = ''; DROP ALL TABLES -- ''</code>
 </p>
 
 <sample src="examples/sql_injection.py" />
diff --git a/python/ql/src/Security/CWE-089/examples/sql_injection.py b/python/ql/src/Security/CWE-089/examples/sql_injection.py
index 541c580f712..fe6dbc50c01 100644
--- a/python/ql/src/Security/CWE-089/examples/sql_injection.py
+++ b/python/ql/src/Security/CWE-089/examples/sql_injection.py
@@ -1,21 +1,19 @@
-
-from django.conf.urls import patterns, url
+from django.conf.urls import url
 from django.db import connection
 
 
-def save_name(request):
+def show_user(request, username):
+    with connection.cursor() as cursor:
+        # BAD -- Using string formatting
+        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
+        user = cursor.fetchone()
 
-    if request.method == 'POST':
-        name = request.POST.get('name')
-        curs = connection.cursor()
-        #BAD -- Using string formatting
-        curs.execute(
-            "insert into names_file ('name') values ('%s')" % name)
-        #GOOD -- Using parameters
-        curs.execute(
-            "insert into names_file ('name') values ('%s')", name)
+        # GOOD -- Using parameters
+        cursor.execute("SELECT * FROM users WHERE username = %s", username)
+        user = cursor.fetchone()
 
+        # BAD -- Manually quoting placeholder (%s)
+        cursor.execute("SELECT * FROM users WHERE username = '%s'", username)
+        user = cursor.fetchone()
 
-urlpatterns = patterns(url(r'^save_name/$',
-                           upload, name='save_name'))
-
+urlpatterns = [url(r'^users/(?P<username>[^/]+)$', show_user)]
diff --git a/python/ql/test/library-tests/web/django/Sinks.expected b/python/ql/test/library-tests/web/django/Sinks.expected
index 7201a7a20a9..31a42364762 100644
--- a/python/ql/test/library-tests/web/django/Sinks.expected
+++ b/python/ql/test/library-tests/web/django/Sinks.expected
@@ -1,10 +1,13 @@
-| test.py:18 | Str | externally controlled string |
+| test.py:14 | Str | externally controlled string |
+| test.py:15 | Str | externally controlled string |
+| test.py:18 | BinaryExpr | externally controlled string |
 | test.py:21 | BinaryExpr | externally controlled string |
-| test.py:24 | BinaryExpr | externally controlled string |
-| test.py:25 | BinaryExpr | externally controlled string |
-| test.py:26 | BinaryExpr | externally controlled string |
-| test.py:34 | BinaryExpr | externally controlled string |
-| test.py:46 | Attribute() | externally controlled string |
-| test.py:57 | Attribute() | externally controlled string |
-| test.py:60 | Attribute() | externally controlled string |
-| test.py:63 | Attribute() | externally controlled string |
+| test.py:22 | BinaryExpr | externally controlled string |
+| test.py:23 | BinaryExpr | externally controlled string |
+| test.py:37 | Str | externally controlled string |
+| test.py:44 | BinaryExpr | externally controlled string |
+| test.py:48 | Attribute() | externally controlled string |
+| test.py:59 | Attribute() | externally controlled string |
+| test.py:70 | Attribute() | externally controlled string |
+| test.py:73 | Attribute() | externally controlled string |
+| test.py:76 | Attribute() | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/Sources.expected b/python/ql/test/library-tests/web/django/Sources.expected
index 7482f21cdda..371b1e7cb6f 100644
--- a/python/ql/test/library-tests/web/django/Sources.expected
+++ b/python/ql/test/library-tests/web/django/Sources.expected
@@ -1,11 +1,17 @@
 | test.py:11 | request | django.request.HttpRequest |
-| test.py:31 | request | django.request.HttpRequest |
-| test.py:56 | arg0 | externally controlled string |
-| test.py:56 | request | django.request.HttpRequest |
-| test.py:59 | arg0 | externally controlled string |
-| test.py:59 | arg1 | externally controlled string |
-| test.py:59 | arg2 | externally controlled string |
-| test.py:59 | request | django.request.HttpRequest |
-| test.py:62 | arg0 | externally controlled string |
-| test.py:62 | arg1 | externally controlled string |
-| test.py:62 | request | django.request.HttpRequest |
+| test.py:11 | username | externally controlled string |
+| test.py:41 | request | django.request.HttpRequest |
+| test.py:47 | bar | externally controlled string |
+| test.py:47 | foo | externally controlled string |
+| test.py:47 | request | django.request.HttpRequest |
+| test.py:58 | page_number | externally controlled string |
+| test.py:58 | request | django.request.HttpRequest |
+| test.py:69 | arg0 | externally controlled string |
+| test.py:69 | request | django.request.HttpRequest |
+| test.py:72 | arg0 | externally controlled string |
+| test.py:72 | arg1 | externally controlled string |
+| test.py:72 | arg2 | externally controlled string |
+| test.py:72 | request | django.request.HttpRequest |
+| test.py:75 | arg0 | externally controlled string |
+| test.py:75 | arg1 | externally controlled string |
+| test.py:75 | request | django.request.HttpRequest |
diff --git a/python/ql/test/library-tests/web/django/test.py b/python/ql/test/library-tests/web/django/test.py
index 3cabac0e5c5..1240b9ae5a1 100644
--- a/python/ql/test/library-tests/web/django/test.py
+++ b/python/ql/test/library-tests/web/django/test.py
@@ -5,28 +5,38 @@ from django.db.models.expressions import RawSQL
 from django.http.response import HttpResponse
 import base64
 
-class Name(models.Model):
+class User(models.Model):
     pass
 
-def save_name(request):
+def show_user(request, username):
+    with connection.cursor() as cursor:
+        # GOOD -- Using parameters
+        cursor.execute("SELECT * FROM users WHERE username = %s", username)
+        User.objects.raw("SELECT * FROM users WHERE username = %s", (username,))
 
-    if request.method == 'POST':
-        name = request.POST.get('name')
-        curs = connection.cursor()
-        #GOOD -- Using parameters
-        curs.execute(
-            "insert into names_file ('name') values ('%s')", name)
-        #BAD -- Using string formatting
-        curs.execute(
-            "insert into names_file ('name') values ('%s')" % name)
+        # BAD -- Using string formatting
+        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
 
-        #BAD -- other ways of executing raw SQL code with string interpolation
-        Name.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % name))
-        Name.objects.raw("insert into names_file ('name') values ('%s')" % name)
-        Name.objects.extra("insert into names_file ('name') values ('%s')" % name)
+        # BAD -- other ways of executing raw SQL code with string interpolation
+        User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username))
+        User.objects.raw("insert into names_file ('name') values ('%s')" % username)
+        User.objects.extra("insert into names_file ('name') values ('%s')" % username)
 
-urlpatterns1 = patterns(url(r'^save_name/$',
-                           save_name, name='save_name'))
+        # BAD (but currently no custom query to find this)
+        #
+        # It is exposed to SQL injection (https://docs.djangoproject.com/en/2.2/ref/models/querysets/#extra)
+        # For example, using name = "; DROP ALL TABLES -- "
+        # will result in SQL: SELECT * FROM name WHERE name = ''; DROP ALL TABLES -- ''
+        #
+        # This shouldn't be very widespread, since using a normal string will result in invalid SQL
+        # Using name = "example", will result in SQL: SELECT * FROM name WHERE name = ''example''
+        # which in MySQL will give a syntax error
+        #
+        # When testing this out locally, none of the queries worked against SQLite3, but I could use
+        # the SQL injection against MySQL.
+        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
+
+urlpatterns = patterns(url(r'^users/(?P<username>[^/]+)$', show_user))
 
 def maybe_xss(request):
     first_name = request.POST.get('first_name', '')
@@ -34,9 +44,12 @@ def maybe_xss(request):
     resp.write("first name is " + first_name)
     return resp
 
+def xss_kwargs(request, foo, bar, baz=None):
+    return HttpResponse('xss_kwargs: {} {}'.format(foo, bar))
+
 urlpatterns = [
-    # Route to code_execution
-    url(r'^maybe_xss$', maybe_xss, name='maybe_xss')
+    url(r'^maybe_xss$', maybe_xss, name='maybe_xss'),
+    url(r'^bar/(?P<bar>[^/]+)/foo/(?P<foo>[^/]+)', xss_kwargs, name='xss_kwargs'),
 ]
 
 
diff --git a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected b/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
index 9c00ffdb2db..461d42fccf1 100644
--- a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
@@ -1,17 +1,14 @@
 edges
-| sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:12:16:12:22 | django.request.HttpRequest |
-| sql_injection.py:12:16:12:22 | django.request.HttpRequest | sql_injection.py:12:16:12:27 | django.http.request.QueryDict |
-| sql_injection.py:12:16:12:27 | django.http.request.QueryDict | sql_injection.py:12:16:12:39 | externally controlled string |
-| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:19:63:19:66 | externally controlled string |
-| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:22:88:22:91 | externally controlled string |
-| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:23:76:23:79 | externally controlled string |
-| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:24:78:24:81 | externally controlled string |
-| sql_injection.py:19:63:19:66 | externally controlled string | sql_injection.py:19:13:19:66 | externally controlled string |
-| sql_injection.py:22:88:22:91 | externally controlled string | sql_injection.py:22:38:22:91 | externally controlled string |
-| sql_injection.py:23:76:23:79 | externally controlled string | sql_injection.py:23:26:23:79 | externally controlled string |
-| sql_injection.py:24:78:24:81 | externally controlled string | sql_injection.py:24:28:24:81 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:70:19:77 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:88:22:95 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:76:23:83 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:78:24:85 | externally controlled string |
+| sql_injection.py:19:70:19:77 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string |
+| sql_injection.py:22:88:22:95 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string |
+| sql_injection.py:23:76:23:83 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string |
+| sql_injection.py:24:78:24:85 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string |
 #select
-| sql_injection.py:19:13:19:66 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:19:13:19:66 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
-| sql_injection.py:22:38:22:91 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:22:38:22:91 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
-| sql_injection.py:23:26:23:79 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:23:26:23:79 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
-| sql_injection.py:24:28:24:81 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:24:28:24:81 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
+| sql_injection.py:19:24:19:77 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
+| sql_injection.py:22:38:22:95 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
+| sql_injection.py:23:26:23:83 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
+| sql_injection.py:24:28:24:85 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-089/sql_injection.py b/python/ql/test/query-tests/Security/CWE-089/sql_injection.py
index b312241b809..9ccca7503bd 100644
--- a/python/ql/test/query-tests/Security/CWE-089/sql_injection.py
+++ b/python/ql/test/query-tests/Security/CWE-089/sql_injection.py
@@ -1,28 +1,40 @@
+"""This is copied from ql/python/ql/test/library-tests/web/django/test.py
+and a only a slight extension of ql/python/ql/src/Security/CWE-089/examples/sql_injection.py
+"""
 
-from django.conf.urls import patterns, url
+from django.conf.urls import url
 from django.db import connection, models
 from django.db.models.expressions import RawSQL
 
-class Name(models.Model):
+class User(models.Model):
     pass
 
-def save_name(request):
+def show_user(request, username):
+    with connection.cursor() as cursor:
+        # GOOD -- Using parameters
+        cursor.execute("SELECT * FROM users WHERE username = %s", username)
+        User.objects.raw("SELECT * FROM users WHERE username = %s", (username,))
 
-    if request.method == 'POST':
-        name = request.POST.get('name')
-        curs = connection.cursor()
-        #GOOD -- Using parameters
-        curs.execute(
-            "insert into names_file ('name') values ('%s')", name)
-        #BAD -- Using string formatting
-        curs.execute(
-            "insert into names_file ('name') values ('%s')" % name)
+        # BAD -- Using string formatting
+        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
 
-        #BAD -- other ways of executing raw SQL code with string interpolation
-        Name.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % name))
-        Name.objects.raw("insert into names_file ('name') values ('%s')" % name)
-        Name.objects.extra("insert into names_file ('name') values ('%s')" % name)
+        # BAD -- other ways of executing raw SQL code with string interpolation
+        User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username))
+        User.objects.raw("insert into names_file ('name') values ('%s')" % username)
+        User.objects.extra("insert into names_file ('name') values ('%s')" % username)
 
-urlpatterns = patterns(url(r'^save_name/$',
-                           save_name, name='save_name'))
+        # BAD (but currently no custom query to find this)
+        #
+        # It is exposed to SQL injection (https://docs.djangoproject.com/en/2.2/ref/models/querysets/#extra)
+        # For example, using name = "; DROP ALL TABLES -- "
+        # will result in SQL: SELECT * FROM name WHERE name = ''; DROP ALL TABLES -- ''
+        #
+        # This shouldn't be very widespread, since using a normal string will result in invalid SQL
+        # Using name = "example", will result in SQL: SELECT * FROM name WHERE name = ''example''
+        # which in MySQL will give a syntax error
+        #
+        # When testing this out locally, none of the queries worked against SQLite3, but I could use
+        # the SQL injection against MySQL.
+        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
 
+urlpatterns = [url(r'^users/(?P<username>[^/]+)$', show_user)]

From 91f269ed7b873cc7fc329f562a99552297467a0e Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Tue, 15 Oct 2019 16:44:26 +0200
Subject: [PATCH 073/232] Python: Remove unused django sinks

This would find instances of `thing = MyThing.objects.get(field=userinput)`, and
what seems to be a query that wants to match on `thing = MyThing();
thing.field=userinput`. Both are not vulnerable to user-input, due to the
build-in escaping by django.

The DjangoModelFieldWrite actually matches on `MyThing.field=userinput` and not
`thing.field=userinput`. I suspect this to be a mistake.

Matching on `thing.field=userinput`, would require this CodeQL:

attr.getObject(_).pointsTo().getClass() = model
---
 .../ql/src/semmle/python/web/django/Model.qll | 27 -------------------
 1 file changed, 27 deletions(-)

diff --git a/python/ql/src/semmle/python/web/django/Model.qll b/python/ql/src/semmle/python/web/django/Model.qll
index 34cf5856802..b8f47b64bdf 100644
--- a/python/ql/src/semmle/python/web/django/Model.qll
+++ b/python/ql/src/semmle/python/web/django/Model.qll
@@ -54,33 +54,6 @@ class DjangoModelObjects extends TaintSource {
     override string toString() { result = "django.db.models.Model.objects" }
 }
 
-/** A write to a field of a django model, which is a vulnerable to external data. */
-class DjangoModelFieldWrite extends SqlInjectionSink {
-    DjangoModelFieldWrite() {
-        exists(AttrNode attr, DjangoModel model |
-            this = attr and attr.isStore() and attr.getObject(_).pointsTo(model)
-        )
-    }
-
-    override predicate sinks(TaintKind kind) { kind instanceof ExternalStringKind }
-
-    override string toString() { result = "django model field write" }
-}
-
-/** A direct reference to a django model object, which is vulnerable to external data. */
-class DjangoModelDirectObjectReference extends TaintSink {
-    DjangoModelDirectObjectReference() {
-        exists(CallNode objects_get_call, ControlFlowNode objects | this = objects_get_call.getAnArg() |
-            objects_get_call.getFunction().(AttrNode).getObject("get") = objects and
-            any(DjangoDbTableObjects objs).taints(objects)
-        )
-    }
-
-    override predicate sinks(TaintKind kind) { kind instanceof ExternalStringKind }
-
-    override string toString() { result = "django model object reference" }
-}
-
 /**
  * A call to the `raw` method on a django model. This allows a raw SQL query
  * to be sent to the database, which is a security risk.

From fb864b7262ec63ed695edf8fd084f6eb1b124da1 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Mon, 21 Oct 2019 16:39:55 +0200
Subject: [PATCH 074/232] Python: Consolidate tests for django

The tests in 3/ was not Python 3 specific anymore
---
 .../3/library-tests/web/django/Sinks.expected |  6 --
 .../test/3/library-tests/web/django/Sinks.ql  | 13 ---
 .../library-tests/web/django/Sources.expected |  8 --
 .../3/library-tests/web/django/Sources.ql     | 12 ---
 .../3/library-tests/web/django/Taint.expected | 24 ------
 .../test/3/library-tests/web/django/Taint.ql  | 14 ---
 .../web/django/django/__init__.py             |  1 -
 .../web/django/django/conf/__init__.py        |  1 -
 .../web/django/django/conf/urls.py            |  3 -
 .../web/django/django/db/__init__.py          |  1 -
 .../web/django/django/db/models/__init__.py   |  2 -
 .../django/django/db/models/expressions.py    |  2 -
 .../web/django/django/http/__init__.py        |  2 -
 .../web/django/django/http/response.py        |  5 --
 .../test/3/library-tests/web/django/models.py | 10 ---
 .../test/3/library-tests/web/django/rawsql.py | 23 -----
 .../test/3/library-tests/web/django/urls.py   |  9 --
 .../test/3/library-tests/web/django/views.py  | 19 ----
 python/ql/test/3/library-tests/web/options    |  1 -
 .../library-tests/web/django/Sinks.expected   | 28 +++---
 .../library-tests/web/django/Sources.expected | 32 +++----
 .../ql/test/library-tests/web/django/sql.py   | 53 ++++++++++++
 .../ql/test/library-tests/web/django/test.py  | 86 +++----------------
 .../ql/test/library-tests/web/django/views.py | 65 ++++++++++++++
 .../Security/lib/django/conf/urls.py          |  5 +-
 25 files changed, 161 insertions(+), 264 deletions(-)
 delete mode 100644 python/ql/test/3/library-tests/web/django/Sinks.expected
 delete mode 100644 python/ql/test/3/library-tests/web/django/Sinks.ql
 delete mode 100644 python/ql/test/3/library-tests/web/django/Sources.expected
 delete mode 100644 python/ql/test/3/library-tests/web/django/Sources.ql
 delete mode 100644 python/ql/test/3/library-tests/web/django/Taint.expected
 delete mode 100644 python/ql/test/3/library-tests/web/django/Taint.ql
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/__init__.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/conf/__init__.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/conf/urls.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/db/__init__.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/db/models/__init__.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/db/models/expressions.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/http/__init__.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/django/http/response.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/models.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/rawsql.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/urls.py
 delete mode 100644 python/ql/test/3/library-tests/web/django/views.py
 delete mode 100644 python/ql/test/3/library-tests/web/options
 create mode 100644 python/ql/test/library-tests/web/django/sql.py
 create mode 100644 python/ql/test/library-tests/web/django/views.py

diff --git a/python/ql/test/3/library-tests/web/django/Sinks.expected b/python/ql/test/3/library-tests/web/django/Sinks.expected
deleted file mode 100644
index b4142a2d82a..00000000000
--- a/python/ql/test/3/library-tests/web/django/Sinks.expected
+++ /dev/null
@@ -1,6 +0,0 @@
-| models.py:9 | key | externally controlled string |
-| rawsql.py:4 | BinaryExpr | externally controlled string |
-| rawsql.py:13 | BinaryExpr | externally controlled string |
-| rawsql.py:18 | BinaryExpr | externally controlled string |
-| rawsql.py:22 | BinaryExpr | externally controlled string |
-| views.py:8 | Attribute() | externally controlled string |
diff --git a/python/ql/test/3/library-tests/web/django/Sinks.ql b/python/ql/test/3/library-tests/web/django/Sinks.ql
deleted file mode 100644
index db9b6a89b93..00000000000
--- a/python/ql/test/3/library-tests/web/django/Sinks.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-
-import python
-
-
-import semmle.python.web.django.Request
-import semmle.python.web.django.Model
-import semmle.python.web.django.Db
-import semmle.python.web.django.Response
-import semmle.python.security.strings.Untrusted
-
-from TaintSink sink, TaintKind kind
-where sink.sinks(kind)
-select sink.getLocation().toString(), sink.(ControlFlowNode).getNode().toString(), kind.toString()
diff --git a/python/ql/test/3/library-tests/web/django/Sources.expected b/python/ql/test/3/library-tests/web/django/Sources.expected
deleted file mode 100644
index 965142343dc..00000000000
--- a/python/ql/test/3/library-tests/web/django/Sources.expected
+++ /dev/null
@@ -1,8 +0,0 @@
-| models.py:9 | Attribute | django.db.models.Model.objects |
-| rawsql.py:13 | Attribute | django.db.models.Model.objects |
-| rawsql.py:16 | Attribute | django.db.models.Model.objects |
-| rawsql.py:21 | Attribute | django.db.models.Model.objects |
-| views.py:6 | request | django.request.HttpRequest |
-| views.py:8 | HttpResponse() | django.response.HttpResponse |
-| views.py:11 | path | externally controlled string |
-| views.py:11 | request | django.request.HttpRequest |
diff --git a/python/ql/test/3/library-tests/web/django/Sources.ql b/python/ql/test/3/library-tests/web/django/Sources.ql
deleted file mode 100644
index 60d42cb2ac1..00000000000
--- a/python/ql/test/3/library-tests/web/django/Sources.ql
+++ /dev/null
@@ -1,12 +0,0 @@
-
-import python
-
-
-import semmle.python.web.django.Request
-import semmle.python.web.django.Model
-import semmle.python.web.django.Response
-import semmle.python.security.strings.Untrusted
-
-from TaintSource src, TaintKind kind
-where src.isSourceOf(kind)
-select src.getLocation().toString(), src.(ControlFlowNode).getNode().toString(), kind.toString()
diff --git a/python/ql/test/3/library-tests/web/django/Taint.expected b/python/ql/test/3/library-tests/web/django/Taint.expected
deleted file mode 100644
index 3f40979c8a2..00000000000
--- a/python/ql/test/3/library-tests/web/django/Taint.expected
+++ /dev/null
@@ -1,24 +0,0 @@
-| models.py:9 | Attribute | django.db.models.Model.objects |
-| rawsql.py:13 | Attribute | django.db.models.Model.objects |
-| rawsql.py:13 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:16 | Attribute | django.db.models.Model.objects |
-| rawsql.py:16 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:17 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:17 | m | django.db.models.Model.objects |
-| rawsql.py:18 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:18 | m | django.db.models.Model.objects |
-| rawsql.py:21 | Attribute | django.db.models.Model.objects |
-| rawsql.py:21 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:22 | Attribute() | django.db.models.Model.objects |
-| rawsql.py:22 | m | django.db.models.Model.objects |
-| views.py:6 | request | django.request.HttpRequest |
-| views.py:8 | Attribute | django.http.request.QueryDict |
-| views.py:8 | Attribute() | externally controlled string |
-| views.py:8 | HttpResponse() | django.response.HttpResponse |
-| views.py:8 | request | django.request.HttpRequest |
-| views.py:11 | path | externally controlled string |
-| views.py:11 | request | django.request.HttpRequest |
-| views.py:12 | Dict | {externally controlled string} |
-| views.py:12 | path | externally controlled string |
-| views.py:13 | env | {externally controlled string} |
-| views.py:13 | request | django.request.HttpRequest |
diff --git a/python/ql/test/3/library-tests/web/django/Taint.ql b/python/ql/test/3/library-tests/web/django/Taint.ql
deleted file mode 100644
index b12a6560125..00000000000
--- a/python/ql/test/3/library-tests/web/django/Taint.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-
-import python
-
-
-import semmle.python.web.django.Request
-import semmle.python.web.django.Model
-import semmle.python.web.django.Response
-import semmle.python.security.strings.Untrusted
-
-
-from TaintedNode node
-
-select node.getLocation().toString(), node.getAstNode().toString(), node.getTaintKind().toString()
-
diff --git a/python/ql/test/3/library-tests/web/django/django/__init__.py b/python/ql/test/3/library-tests/web/django/django/__init__.py
deleted file mode 100644
index fc8d5b8c09b..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-#Fake django package
\ No newline at end of file
diff --git a/python/ql/test/3/library-tests/web/django/django/conf/__init__.py b/python/ql/test/3/library-tests/web/django/django/conf/__init__.py
deleted file mode 100644
index fc8d5b8c09b..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/conf/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-#Fake django package
\ No newline at end of file
diff --git a/python/ql/test/3/library-tests/web/django/django/conf/urls.py b/python/ql/test/3/library-tests/web/django/django/conf/urls.py
deleted file mode 100644
index 580cc063d99..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/conf/urls.py
+++ /dev/null
@@ -1,3 +0,0 @@
-
-def url(regex, view):
-    pass
\ No newline at end of file
diff --git a/python/ql/test/3/library-tests/web/django/django/db/__init__.py b/python/ql/test/3/library-tests/web/django/django/db/__init__.py
deleted file mode 100644
index fc8d5b8c09b..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/db/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-#Fake django package
\ No newline at end of file
diff --git a/python/ql/test/3/library-tests/web/django/django/db/models/__init__.py b/python/ql/test/3/library-tests/web/django/django/db/models/__init__.py
deleted file mode 100644
index eb9c72adc45..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/db/models/__init__.py
+++ /dev/null
@@ -1,2 +0,0 @@
-class Model:
-    pass
diff --git a/python/ql/test/3/library-tests/web/django/django/db/models/expressions.py b/python/ql/test/3/library-tests/web/django/django/db/models/expressions.py
deleted file mode 100644
index d7e0d1c27b6..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/db/models/expressions.py
+++ /dev/null
@@ -1,2 +0,0 @@
-class RawSQL:
-    pass
diff --git a/python/ql/test/3/library-tests/web/django/django/http/__init__.py b/python/ql/test/3/library-tests/web/django/django/http/__init__.py
deleted file mode 100644
index e1a02f873cb..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/http/__init__.py
+++ /dev/null
@@ -1,2 +0,0 @@
-
-from .response import HttpResponse
diff --git a/python/ql/test/3/library-tests/web/django/django/http/response.py b/python/ql/test/3/library-tests/web/django/django/http/response.py
deleted file mode 100644
index f3dd53d15b0..00000000000
--- a/python/ql/test/3/library-tests/web/django/django/http/response.py
+++ /dev/null
@@ -1,5 +0,0 @@
-
-class HttpResponse:
-
-    def __init__(self, *args):
-        pass
diff --git a/python/ql/test/3/library-tests/web/django/models.py b/python/ql/test/3/library-tests/web/django/models.py
deleted file mode 100644
index 571c594d055..00000000000
--- a/python/ql/test/3/library-tests/web/django/models.py
+++ /dev/null
@@ -1,10 +0,0 @@
-
-from django.db import models
-
-class MyModel(models.Model):
-    title = models.CharField(max_length=500)
-    summary = models.TextField(blank=True)
-
-def update_my_model(key, title):
-    item = MyModel.objects.get(pk=key)
-    item.title = title
diff --git a/python/ql/test/3/library-tests/web/django/rawsql.py b/python/ql/test/3/library-tests/web/django/rawsql.py
deleted file mode 100644
index c6c82909c2d..00000000000
--- a/python/ql/test/3/library-tests/web/django/rawsql.py
+++ /dev/null
@@ -1,23 +0,0 @@
-from django.db.models.expressions import RawSQL
-
-def raw1(arg):
-    return RawSQL("select foo from bar where baz = %s" % arg, "")
-
-
-from django.db import models
-
-class MyModel(models.Model):
-    pass
-
-def raw2(arg):
-    MyModel.objects.raw("select foo from bar where baz = %s" % arg)
-
-def raw3(arg):
-    m = MyModel.objects.filter('foo')
-    m = m.filter('bar')
-    m.raw("select foo from bar where baz = %s" % arg)
-
-def raw4(arg):
-    m = MyModel.objects.filter('foo')
-    m.extra("select foo from bar where baz = %s" % arg)
-
diff --git a/python/ql/test/3/library-tests/web/django/urls.py b/python/ql/test/3/library-tests/web/django/urls.py
deleted file mode 100644
index d5a941ae519..00000000000
--- a/python/ql/test/3/library-tests/web/django/urls.py
+++ /dev/null
@@ -1,9 +0,0 @@
-from django.conf.urls import url
-import views
-
-urlpatterns = [
-
-    url(r'^route1$', views.view_func1),
-    url(r'^(?P<path>.*)$', views.view_func2),
-    url(r'^route2$', views.ClassView.as_view())
-]
diff --git a/python/ql/test/3/library-tests/web/django/views.py b/python/ql/test/3/library-tests/web/django/views.py
deleted file mode 100644
index f7de60a23f6..00000000000
--- a/python/ql/test/3/library-tests/web/django/views.py
+++ /dev/null
@@ -1,19 +0,0 @@
-
-from django.http import HttpResponse
-from django.shortcuts import redirect, render
-from django.views.generic import View
-
-def view_func1(request):
-    # Whether this is safe depends on template.html -- annoyingly
-    return HttpResponse(request.GET.get("untrusted"))
-
-
-def view_func2(request, path='default'):
-    env = {'path': path}
-    return render(request, 'vulnerable-path.html', env)
-
-
-class ClassView(View):
-
-    def get(self, request):
-        pass
diff --git a/python/ql/test/3/library-tests/web/options b/python/ql/test/3/library-tests/web/options
deleted file mode 100644
index f2d60a4bc3c..00000000000
--- a/python/ql/test/3/library-tests/web/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: --max-import-depth=3 --lang=3
diff --git a/python/ql/test/library-tests/web/django/Sinks.expected b/python/ql/test/library-tests/web/django/Sinks.expected
index 31a42364762..86e05bca6dc 100644
--- a/python/ql/test/library-tests/web/django/Sinks.expected
+++ b/python/ql/test/library-tests/web/django/Sinks.expected
@@ -1,13 +1,15 @@
-| test.py:14 | Str | externally controlled string |
-| test.py:15 | Str | externally controlled string |
-| test.py:18 | BinaryExpr | externally controlled string |
-| test.py:21 | BinaryExpr | externally controlled string |
-| test.py:22 | BinaryExpr | externally controlled string |
-| test.py:23 | BinaryExpr | externally controlled string |
-| test.py:37 | Str | externally controlled string |
-| test.py:44 | BinaryExpr | externally controlled string |
-| test.py:48 | Attribute() | externally controlled string |
-| test.py:59 | Attribute() | externally controlled string |
-| test.py:70 | Attribute() | externally controlled string |
-| test.py:73 | Attribute() | externally controlled string |
-| test.py:76 | Attribute() | externally controlled string |
+| sql.py:13 | Str | externally controlled string |
+| sql.py:14 | Str | externally controlled string |
+| sql.py:17 | BinaryExpr | externally controlled string |
+| sql.py:20 | BinaryExpr | externally controlled string |
+| sql.py:21 | BinaryExpr | externally controlled string |
+| sql.py:22 | BinaryExpr | externally controlled string |
+| sql.py:36 | Str | externally controlled string |
+| sql.py:42 | BinaryExpr | externally controlled string |
+| sql.py:47 | BinaryExpr | externally controlled string |
+| views.py:7 | Attribute() | externally controlled string |
+| views.py:11 | Attribute() | externally controlled string |
+| views.py:15 | Attribute() | externally controlled string |
+| views.py:22 | Attribute() | externally controlled string |
+| views.py:27 | Attribute() | externally controlled string |
+| views.py:31 | Attribute() | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/Sources.expected b/python/ql/test/library-tests/web/django/Sources.expected
index 371b1e7cb6f..a0c253b27c5 100644
--- a/python/ql/test/library-tests/web/django/Sources.expected
+++ b/python/ql/test/library-tests/web/django/Sources.expected
@@ -1,17 +1,17 @@
+| test.py:5 | path | externally controlled string |
+| test.py:5 | request | django.request.HttpRequest |
+| test.py:11 | path | externally controlled string |
 | test.py:11 | request | django.request.HttpRequest |
-| test.py:11 | username | externally controlled string |
-| test.py:41 | request | django.request.HttpRequest |
-| test.py:47 | bar | externally controlled string |
-| test.py:47 | foo | externally controlled string |
-| test.py:47 | request | django.request.HttpRequest |
-| test.py:58 | page_number | externally controlled string |
-| test.py:58 | request | django.request.HttpRequest |
-| test.py:69 | arg0 | externally controlled string |
-| test.py:69 | request | django.request.HttpRequest |
-| test.py:72 | arg0 | externally controlled string |
-| test.py:72 | arg1 | externally controlled string |
-| test.py:72 | arg2 | externally controlled string |
-| test.py:72 | request | django.request.HttpRequest |
-| test.py:75 | arg0 | externally controlled string |
-| test.py:75 | arg1 | externally controlled string |
-| test.py:75 | request | django.request.HttpRequest |
+| views.py:6 | bar | externally controlled string |
+| views.py:6 | foo | externally controlled string |
+| views.py:6 | request | django.request.HttpRequest |
+| views.py:10 | request | django.request.HttpRequest |
+| views.py:14 | request | django.request.HttpRequest |
+| views.py:25 | page_number | externally controlled string |
+| views.py:25 | request | django.request.HttpRequest |
+| views.py:30 | arg0 | externally controlled string |
+| views.py:30 | arg1 | externally controlled string |
+| views.py:30 | request | django.request.HttpRequest |
+| views.py:50 | request | django.request.HttpRequest |
+| views.py:50 | username | externally controlled string |
+| views.py:59 | request | django.request.HttpRequest |
diff --git a/python/ql/test/library-tests/web/django/sql.py b/python/ql/test/library-tests/web/django/sql.py
new file mode 100644
index 00000000000..7809c24edc1
--- /dev/null
+++ b/python/ql/test/library-tests/web/django/sql.py
@@ -0,0 +1,53 @@
+from django.db import connection, models
+from django.db.models.expressions import RawSQL
+
+
+class User(models.Model):
+    username = models.CharField(max_length=100)
+    description = models.TextField(blank=True)
+
+
+def show_user(username):
+    with connection.cursor() as cursor:
+        # GOOD -- Using parameters
+        cursor.execute("SELECT * FROM users WHERE username = %s", username)
+        User.objects.raw("SELECT * FROM users WHERE username = %s", (username,))
+
+        # BAD -- Using string formatting
+        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
+
+        # BAD -- other ways of executing raw SQL code with string interpolation
+        User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username))
+        User.objects.raw("insert into names_file ('name') values ('%s')" % username)
+        User.objects.extra("insert into names_file ('name') values ('%s')" % username)
+
+        # BAD (but currently no custom query to find this)
+        #
+        # It is exposed to SQL injection (https://docs.djangoproject.com/en/2.2/ref/models/querysets/#extra)
+        # For example, using name = "; DROP ALL TABLES -- "
+        # will result in SQL: SELECT * FROM name WHERE name = ''; DROP ALL TABLES -- ''
+        #
+        # This shouldn't be very widespread, since using a normal string will result in invalid SQL
+        # Using name = "example", will result in SQL: SELECT * FROM name WHERE name = ''example''
+        # which in MySQL will give a syntax error
+        #
+        # When testing this out locally, none of the queries worked against SQLite3, but I could use
+        # the SQL injection against MySQL.
+        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
+
+
+def raw3(arg):
+    m = User.objects.filter('foo')
+    m = m.filter('bar')
+    m.raw("select foo from bar where baz = %s" % arg)
+
+
+def raw4(arg):
+    m = User.objects.filter('foo')
+    m.extra("select foo from bar where baz = %s" % arg)
+
+
+def update_user(key, description1):
+    # Neither of these are exposed to sql-injections
+    user = User.objects.get(pk=key)
+    item.description = description
diff --git a/python/ql/test/library-tests/web/django/test.py b/python/ql/test/library-tests/web/django/test.py
index 1240b9ae5a1..5664647c3a7 100644
--- a/python/ql/test/library-tests/web/django/test.py
+++ b/python/ql/test/library-tests/web/django/test.py
@@ -1,84 +1,18 @@
+from django.conf.urls import url
+from django.shortcuts import redirect, render
 
-from django.conf.urls import patterns, url
-from django.db import connection, models
-from django.db.models.expressions import RawSQL
-from django.http.response import HttpResponse
-import base64
 
-class User(models.Model):
-    pass
+def with_template(request, path='default'):
+    env = {'path': path}
+    # We would need to understand django templates to know if this is safe or not
+    return render(request, 'possibly-vulnerable-template.html', env)
 
-def show_user(request, username):
-    with connection.cursor() as cursor:
-        # GOOD -- Using parameters
-        cursor.execute("SELECT * FROM users WHERE username = %s", username)
-        User.objects.raw("SELECT * FROM users WHERE username = %s", (username,))
 
-        # BAD -- Using string formatting
-        cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
+def vuln_redirect(request, path):
+    return redirect(path)
 
-        # BAD -- other ways of executing raw SQL code with string interpolation
-        User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username))
-        User.objects.raw("insert into names_file ('name') values ('%s')" % username)
-        User.objects.extra("insert into names_file ('name') values ('%s')" % username)
-
-        # BAD (but currently no custom query to find this)
-        #
-        # It is exposed to SQL injection (https://docs.djangoproject.com/en/2.2/ref/models/querysets/#extra)
-        # For example, using name = "; DROP ALL TABLES -- "
-        # will result in SQL: SELECT * FROM name WHERE name = ''; DROP ALL TABLES -- ''
-        #
-        # This shouldn't be very widespread, since using a normal string will result in invalid SQL
-        # Using name = "example", will result in SQL: SELECT * FROM name WHERE name = ''example''
-        # which in MySQL will give a syntax error
-        #
-        # When testing this out locally, none of the queries worked against SQLite3, but I could use
-        # the SQL injection against MySQL.
-        User.objects.raw("SELECT * FROM users WHERE username = '%s'", (username,))
-
-urlpatterns = patterns(url(r'^users/(?P<username>[^/]+)$', show_user))
-
-def maybe_xss(request):
-    first_name = request.POST.get('first_name', '')
-    resp = HttpResponse()
-    resp.write("first name is " + first_name)
-    return resp
-
-def xss_kwargs(request, foo, bar, baz=None):
-    return HttpResponse('xss_kwargs: {} {}'.format(foo, bar))
 
 urlpatterns = [
-    url(r'^maybe_xss$', maybe_xss, name='maybe_xss'),
-    url(r'^bar/(?P<bar>[^/]+)/foo/(?P<foo>[^/]+)', xss_kwargs, name='xss_kwargs'),
-]
-
-
-# Non capturing group (we correctly identify page_number as a request parameter)
-
-def show_articles(request, page_number=1):
-    return HttpResponse('articles page: {}'.format(page_number))
-
-urlpatterns = [
-    # one pattern to support `articles/page-<n>` and ensuring that articles/ goes to page-1
-    url(r'articles/^(?:page-(?P<page_number>\d+)/)?$', show_articles),
-]
-
-
-# Positional arguments
-
-def xxs_positional_arg1(request, arg0):
-    return HttpResponse('xxs_positional_arg1: {}'.format(arg0))
-
-def xxs_positional_arg2(request, arg0, arg1, arg2):
-    return HttpResponse('xxs_positional_arg2: {} {} {}'.format(arg0, arg1, arg2))
-
-def xxs_positional_arg3(request, arg0, arg1):
-    return HttpResponse('xxs_positional_arg3: {} {}'.format(arg0, arg1))
-
-urlpatterns = [
-    # passing as positional argument is not the recommended way of doing things,
-    # but it is certainly possible
-    url(r'^(.+)$', xxs_positional_arg1, name='xxs_positional_arg1'),
-    url(r'^([^/]+)/([^/]+)/([^/]+)$', xxs_positional_arg2, name='xxs_positional_arg2'),
-    url(r'^([^/]+)/(?:foo|bar)/([^/]+)$', xxs_positional_arg3, name='xxs_positional_arg3'),
+    url(r'^(?P<path>.*)$', with_template),
+    url(r'^redirect/(?P<path>.*)$', vuln_redirect),
 ]
diff --git a/python/ql/test/library-tests/web/django/views.py b/python/ql/test/library-tests/web/django/views.py
new file mode 100644
index 00000000000..ffa49118785
--- /dev/null
+++ b/python/ql/test/library-tests/web/django/views.py
@@ -0,0 +1,65 @@
+from django.conf.urls import patterns, url
+from django.http.response import HttpResponse
+from django.views.generic import View
+
+
+def url_match_xss(request, foo, bar, no_taint=None):
+    return HttpResponse('url_match_xss: {} {}'.format(foo, bar))
+
+
+def get_params_xss(request):
+    return HttpResponse(request.GET.get("untrusted"))
+
+
+def post_params_xss(request):
+    return HttpResponse(request.POST.get("untrusted"))
+
+
+class ClassView(View):
+
+    # TODO: Currently we don't flag `untrusted` as a DjangoRequestParameter
+    def get(self, request, untrusted):
+        return HttpResponse('ClassView: {}'.format(untrusted))
+
+
+def show_articles(request, page_number=1):
+    page_number = int(page_number)
+    return HttpResponse('articles page: {}'.format(page_number))
+
+
+def xxs_positional_arg(request, arg0, arg1, no_taint=None):
+    return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))
+
+
+urlpatterns = [
+    url(r'^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)$', url_match_xss),
+    url(r'^get_params$', get_params_xss),
+    url(r'^post_params$', post_params_xss),
+    url(r'^class_view/(?P<untrusted>.+)$', ClassView.as_view()),
+
+    # one pattern to support `articles/page-<n>` and ensuring that articles/ goes to page-1
+    url(r'articles/^(?:page-(?P<page_number>\d+)/)?$', show_articles),
+    # passing as positional argument is not the recommended way of doing things, but it is certainly
+    # possible
+    url(r'^([^/]+)/(?:foo|bar)/([^/]+)$', xxs_positional_arg, name='xxs_positional_arg'),
+]
+
+
+# Using patterns() for routing
+
+def show_user(request, username):
+    pass
+
+
+urlpatterns = patterns(url(r'^users/(?P<username>[^/]+)$', show_user))
+
+
+# Show we understand the keyword arguments to django.conf.urls.url
+
+def we_understand_url_kwargs(request):
+    pass
+
+
+urlpatterns = [
+    url(view=we_understand_url_kwargs, regex=r'^specifying-as-kwargs-is-not-a-problem$')
+]
diff --git a/python/ql/test/query-tests/Security/lib/django/conf/urls.py b/python/ql/test/query-tests/Security/lib/django/conf/urls.py
index cf65525e893..6c1a83baf0b 100644
--- a/python/ql/test/query-tests/Security/lib/django/conf/urls.py
+++ b/python/ql/test/query-tests/Security/lib/django/conf/urls.py
@@ -1,7 +1,6 @@
-
-def url(pattern, *args):
+# https://docs.djangoproject.com/en/1.11/_modules/django/conf/urls/#url
+def url(regex, view, kwargs=None, name=None):
     pass
 
 def patterns(*urls):
     pass
-

From fc851b46c3d41cda88ecfecd8c35821d96ac7222 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Mon, 21 Oct 2019 16:44:35 +0200
Subject: [PATCH 075/232] Python: Fix Django class-based views

---
 .../src/semmle/python/web/django/Request.qll   |  2 +-
 .../library-tests/web/django/Sinks.expected    |  7 ++++---
 .../library-tests/web/django/Sources.expected  | 18 ++++++++++--------
 .../ql/test/library-tests/web/django/views.py  | 11 +++++++++--
 .../Security/lib/django/views/__init__.py      |  0
 .../Security/lib/django/views/generic.py       |  2 ++
 6 files changed, 26 insertions(+), 14 deletions(-)
 create mode 100644 python/ql/test/query-tests/Security/lib/django/views/__init__.py
 create mode 100644 python/ql/test/query-tests/Security/lib/django/views/generic.py

diff --git a/python/ql/src/semmle/python/web/django/Request.qll b/python/ql/src/semmle/python/web/django/Request.qll
index 15ea032e6d7..24a29ea4542 100644
--- a/python/ql/src/semmle/python/web/django/Request.qll
+++ b/python/ql/src/semmle/python/web/django/Request.qll
@@ -67,7 +67,7 @@ private class DjangoView extends ClassValue {
 }
 
 private FunctionValue djangoViewHttpMethod() {
-    exists(DjangoView view | view.attr(httpVerbLower()) = result)
+    exists(DjangoView view | view.lookup(httpVerbLower()) = result)
 }
 
 class DjangoClassBasedViewRequestArgument extends DjangoRequestSource {
diff --git a/python/ql/test/library-tests/web/django/Sinks.expected b/python/ql/test/library-tests/web/django/Sinks.expected
index 86e05bca6dc..e3d233c9990 100644
--- a/python/ql/test/library-tests/web/django/Sinks.expected
+++ b/python/ql/test/library-tests/web/django/Sinks.expected
@@ -10,6 +10,7 @@
 | views.py:7 | Attribute() | externally controlled string |
 | views.py:11 | Attribute() | externally controlled string |
 | views.py:15 | Attribute() | externally controlled string |
-| views.py:22 | Attribute() | externally controlled string |
-| views.py:27 | Attribute() | externally controlled string |
-| views.py:31 | Attribute() | externally controlled string |
+| views.py:23 | Attribute() | externally controlled string |
+| views.py:29 | Attribute() | externally controlled string |
+| views.py:34 | Attribute() | externally controlled string |
+| views.py:38 | Attribute() | externally controlled string |
diff --git a/python/ql/test/library-tests/web/django/Sources.expected b/python/ql/test/library-tests/web/django/Sources.expected
index a0c253b27c5..35e0d3d8ced 100644
--- a/python/ql/test/library-tests/web/django/Sources.expected
+++ b/python/ql/test/library-tests/web/django/Sources.expected
@@ -7,11 +7,13 @@
 | views.py:6 | request | django.request.HttpRequest |
 | views.py:10 | request | django.request.HttpRequest |
 | views.py:14 | request | django.request.HttpRequest |
-| views.py:25 | page_number | externally controlled string |
-| views.py:25 | request | django.request.HttpRequest |
-| views.py:30 | arg0 | externally controlled string |
-| views.py:30 | arg1 | externally controlled string |
-| views.py:30 | request | django.request.HttpRequest |
-| views.py:50 | request | django.request.HttpRequest |
-| views.py:50 | username | externally controlled string |
-| views.py:59 | request | django.request.HttpRequest |
+| views.py:22 | request | django.request.HttpRequest |
+| views.py:28 | request | django.request.HttpRequest |
+| views.py:32 | page_number | externally controlled string |
+| views.py:32 | request | django.request.HttpRequest |
+| views.py:37 | arg0 | externally controlled string |
+| views.py:37 | arg1 | externally controlled string |
+| views.py:37 | request | django.request.HttpRequest |
+| views.py:57 | request | django.request.HttpRequest |
+| views.py:57 | username | externally controlled string |
+| views.py:66 | request | django.request.HttpRequest |
diff --git a/python/ql/test/library-tests/web/django/views.py b/python/ql/test/library-tests/web/django/views.py
index ffa49118785..57d1ea5460c 100644
--- a/python/ql/test/library-tests/web/django/views.py
+++ b/python/ql/test/library-tests/web/django/views.py
@@ -15,11 +15,18 @@ def post_params_xss(request):
     return HttpResponse(request.POST.get("untrusted"))
 
 
-class ClassView(View):
+class Foo(object):
+    # Note: since Foo is used as the super type in a class view, it will be able to handle requests.
 
+    # TODO: Currently we don't flag `untrusted` as a DjangoRequestParameter
+    def post(self, request, untrusted):
+        return HttpResponse('Foo post: {}'.format(untrusted))
+
+
+class ClassView(View, Foo):
     # TODO: Currently we don't flag `untrusted` as a DjangoRequestParameter
     def get(self, request, untrusted):
-        return HttpResponse('ClassView: {}'.format(untrusted))
+        return HttpResponse('ClassView get: {}'.format(untrusted))
 
 
 def show_articles(request, page_number=1):
diff --git a/python/ql/test/query-tests/Security/lib/django/views/__init__.py b/python/ql/test/query-tests/Security/lib/django/views/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/query-tests/Security/lib/django/views/generic.py b/python/ql/test/query-tests/Security/lib/django/views/generic.py
new file mode 100644
index 00000000000..d924b03d062
--- /dev/null
+++ b/python/ql/test/query-tests/Security/lib/django/views/generic.py
@@ -0,0 +1,2 @@
+class View:
+    pass

From 63f24476e96771b0d557d3b7c2c01c547068d511 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 08:29:10 +0000
Subject: [PATCH 076/232] JavaScript: Refactor `DoubleEscaping.ql`.

---
 .../ql/src/Security/CWE-116/DoubleEscaping.ql | 62 ++++++++++++-------
 1 file changed, 41 insertions(+), 21 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index a150a2d7a7a..124dcf304aa 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -62,30 +62,23 @@ predicate escapingScheme(string metachar, string regex) {
 }
 
 /**
- * A call to `String.prototype.replace` that replaces all instances of a pattern.
+ * A method call that performs string replacement.
  */
-class Replacement extends DataFlow::Node {
-  RegExpLiteral pattern;
-
-  Replacement() {
-    exists(DataFlow::MethodCallNode mcn | this = mcn |
-      mcn.getMethodName() = "replace" and
-      pattern.flow().(DataFlow::SourceNode).flowsTo(mcn.getArgument(0)) and
-      mcn.getNumArgument() = 2 and
-      pattern.isGlobal()
-    )
-  }
-
+abstract class Replacement extends DataFlow::Node {
   /**
    * Holds if this replacement replaces the string `input` with `output`.
    */
-  predicate replaces(string input, string output) {
-    exists(DataFlow::MethodCallNode mcn |
-      mcn = this and
-      input = getStringValue(pattern) and
-      output = mcn.getArgument(1).getStringValue()
-    )
-  }
+  abstract predicate replaces(string input, string output);
+
+  /**
+   * Gets the input of this replacement.
+   */
+  abstract DataFlow::Node getInput();
+
+  /**
+   * Gets the output of this replacement.
+   */
+  abstract DataFlow::SourceNode getOutput();
 
   /**
    * Holds if this replacement escapes `char` using `metachar`.
@@ -119,7 +112,7 @@ class Replacement extends DataFlow::Node {
    * Gets the previous replacement in this chain of replacements.
    */
   Replacement getPreviousReplacement() {
-    result = getASimplePredecessor*(this.(DataFlow::MethodCallNode).getReceiver())
+    result.getOutput() = getASimplePredecessor*(getInput())
   }
 
   /**
@@ -147,6 +140,33 @@ class Replacement extends DataFlow::Node {
   }
 }
 
+/**
+ * A call to `String.prototype.replace` that replaces all instances of a pattern.
+ */
+class GlobalStringReplacement extends Replacement, DataFlow::MethodCallNode {
+  RegExpLiteral pattern;
+
+  GlobalStringReplacement() {
+    this.getMethodName() = "replace" and
+    pattern.flow().(DataFlow::SourceNode).flowsTo(this.getArgument(0)) and
+    this.getNumArgument() = 2 and
+    pattern.isGlobal()
+  }
+
+  override predicate replaces(string input, string output) {
+    input = getStringValue(pattern) and
+    output = this.getArgument(1).getStringValue()
+  }
+
+  override DataFlow::Node getInput() {
+    result = this.getReceiver()
+  }
+
+  override DataFlow::SourceNode getOutput() {
+    result = this
+  }
+}
+
 from Replacement primary, Replacement supplementary, string message, string metachar
 where
   primary.escapes(metachar, _) and

From bd1c99d8a428770a12c90450ce3518854427b352 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 09:35:49 +0000
Subject: [PATCH 077/232] JavaScript: Recognise `JSON.stringify` and
 `JSON.parse` as escaper/unescaper.

---
 .../ql/src/Security/CWE-116/DoubleEscaping.ql | 46 +++++++++++++++++++
 .../DoubleEscaping/DoubleEscaping.expected    |  2 +
 .../Security/CWE-116/DoubleEscaping/tst.js    | 20 ++++++++
 3 files changed, 68 insertions(+)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 124dcf304aa..589a935d5fe 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -167,6 +167,52 @@ class GlobalStringReplacement extends Replacement, DataFlow::MethodCallNode {
   }
 }
 
+/**
+ * A call to `JSON.stringify`, viewed as a string replacement.
+ */
+class JsonStringifyReplacement extends Replacement, DataFlow::CallNode {
+  JsonStringifyReplacement() {
+    this = DataFlow::globalVarRef("JSON").getAMemberCall("stringify")
+  }
+
+  override predicate replaces(string input, string output) {
+    input = "\\" and output = "\\\\"
+    // the other replacements are not relevant for this query
+  }
+
+  override DataFlow::Node getInput() {
+    result = this.getArgument(0)
+  }
+
+  override DataFlow::SourceNode getOutput() {
+    result = this
+  }
+}
+
+/**
+ * A call to `JSON.parse`, viewed as a string replacement.
+ */
+class JsonParseReplacement extends Replacement {
+  JsonParserCall self;
+
+  JsonParseReplacement() {
+    this = self
+  }
+
+  override predicate replaces(string input, string output) {
+    input = "\\\\" and output = "\\"
+    // the other replacements are not relevant for this query
+  }
+
+  override DataFlow::Node getInput() {
+    result = self.getInput()
+  }
+
+  override DataFlow::SourceNode getOutput() {
+    result = self.getOutput()
+  }
+}
+
 from Replacement primary, Replacement supplementary, string message, string metachar
 where
   primary.escapes(metachar, _) and
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
index d4930ad07cf..e3d5a9a4252 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
@@ -5,3 +5,5 @@
 | tst.js:53:10:53:33 | s.repla ... , '\\\\') | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:53:10:54:33 | s.repla ... , '\\'') | here |
 | tst.js:60:7:60:28 | s.repla ...  '%25') | This replacement may double-escape '%' characters from $@. | tst.js:59:7:59:28 | s.repla ...  '%26') | here |
 | tst.js:68:10:70:38 | s.repla ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:68:10:69:39 | s.repla ... apos;") | here |
+| tst.js:74:10:77:10 | JSON.st ...       ) | This replacement may double-escape '\\' characters from $@. | tst.js:75:12:76:37 | s.repla ... u003E") | here |
+| tst.js:86:10:86:22 | JSON.parse(s) | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:86:10:86:47 | JSON.pa ... g, "<") | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index 19ab94d2691..ee9cd930b6f 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -69,3 +69,23 @@ function badEncode(s) {
           .replace(indirect2, "&apos;")
           .replace(indirect3, "&amp;");
 }
+
+function badEscape1(s) {
+  return JSON.stringify(
+           s.replace(/</g, "\\u003C")
+            .replace(/>/g, "\\u003E")
+         );
+}
+
+function goodEscape1(s) {
+  return JSON.stringify(s)
+             .replace(/</g, "\\u003C").replace(/>/g, "\\u003E");
+}
+
+function badUnescape2(s) {
+  return JSON.parse(s).replace(/\\u003C/g, "<").replace(/\\u003E/g, ">");
+}
+
+function goodUnescape2(s) {
+  return JSON.parse(s.replace(/\\u003C/g, "<").replace(/\\u003E/g, ">"));
+}

From aaeca325193deedc7ac8ea163cbe574514d44b94 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 09:55:28 +0000
Subject: [PATCH 078/232] JavaScript: Recognize string escaping using
 `.replace` with a callback.

---
 javascript/ql/src/Security/CWE-116/DoubleEscaping.ql     | 8 ++++++++
 .../CWE-116/DoubleEscaping/DoubleEscaping.expected       | 1 +
 .../query-tests/Security/CWE-116/DoubleEscaping/tst.js   | 9 +++++++++
 3 files changed, 18 insertions(+)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 589a935d5fe..4e6969e54c3 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -156,6 +156,14 @@ class GlobalStringReplacement extends Replacement, DataFlow::MethodCallNode {
   override predicate replaces(string input, string output) {
     input = getStringValue(pattern) and
     output = this.getArgument(1).getStringValue()
+    or
+    exists(DataFlow::FunctionNode replacer, DataFlow::PropRead pr, DataFlow::ObjectLiteralNode map |
+      replacer = getCallback(1) and
+      replacer.getParameter(0).flowsToExpr(pr.getPropertyNameExpr()) and
+      pr = map.getAPropertyRead() and
+      pr.flowsTo(replacer.getAReturn()) and
+      map.asExpr().(ObjectExpr).getPropertyByName(input).getInit().getStringValue() = output
+    )
   }
 
   override DataFlow::Node getInput() {
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
index e3d5a9a4252..d7e2b558a06 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
@@ -7,3 +7,4 @@
 | tst.js:68:10:70:38 | s.repla ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:68:10:69:39 | s.repla ... apos;") | here |
 | tst.js:74:10:77:10 | JSON.st ...       ) | This replacement may double-escape '\\' characters from $@. | tst.js:75:12:76:37 | s.repla ... u003E") | here |
 | tst.js:86:10:86:22 | JSON.parse(s) | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:86:10:86:47 | JSON.pa ... g, "<") | here |
+| tst.js:99:10:99:66 | s.repla ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:99:10:99:43 | s.repla ... epl[c]) | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index ee9cd930b6f..78c73ce9584 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -89,3 +89,12 @@ function badUnescape2(s) {
 function goodUnescape2(s) {
   return JSON.parse(s.replace(/\\u003C/g, "<").replace(/\\u003E/g, ">"));
 }
+
+function badEncodeWithReplacer(s) {
+  var repl = {
+    '"': "&quot;",
+    "'": "&apos;",
+    "&": "&amp;"
+  };
+  return s.replace(/["']/g, (c) => repl[c]).replace(/&/g, "&amp;");
+}

From 02d16b1dc99ddbcb3b2c8148b0cb53731214b039 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 10:59:04 +0000
Subject: [PATCH 079/232] JavaScript: Recognise wrapped string replacement
 functions.

---
 .../ql/src/Security/CWE-116/DoubleEscaping.ql | 28 +++++++++++++++++++
 .../DoubleEscaping/DoubleEscaping.expected    |  1 +
 .../Security/CWE-116/DoubleEscaping/tst.js    |  8 ++++++
 3 files changed, 37 insertions(+)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 4e6969e54c3..733afad0b06 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -221,6 +221,34 @@ class JsonParseReplacement extends Replacement {
   }
 }
 
+/**
+ * A string replacement wrapped in a utility function.
+ */
+class WrappedReplacement extends Replacement, DataFlow::CallNode {
+  int i;
+
+  Replacement inner;
+
+  WrappedReplacement() {
+    exists(DataFlow::FunctionNode wrapped | wrapped.getFunction() = getACallee() |
+      wrapped.getParameter(i).flowsTo(inner.getInput()) and
+      inner.getOutput().flowsTo(wrapped.getAReturn())
+    )
+  }
+
+  override predicate replaces(string input, string output) {
+    inner.replaces(input, output)
+  }
+
+  override DataFlow::Node getInput() {
+    result = getArgument(i)
+  }
+
+  override DataFlow::SourceNode getOutput() {
+    result = this
+  }
+}
+
 from Replacement primary, Replacement supplementary, string message, string metachar
 where
   primary.escapes(metachar, _) and
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
index d7e2b558a06..d0747087d12 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
@@ -8,3 +8,4 @@
 | tst.js:74:10:77:10 | JSON.st ...       ) | This replacement may double-escape '\\' characters from $@. | tst.js:75:12:76:37 | s.repla ... u003E") | here |
 | tst.js:86:10:86:22 | JSON.parse(s) | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:86:10:86:47 | JSON.pa ... g, "<") | here |
 | tst.js:99:10:99:66 | s.repla ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:99:10:99:43 | s.repla ... epl[c]) | here |
+| tst.js:107:10:107:53 | encodeD ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:107:10:107:30 | encodeD ... otes(s) | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index 78c73ce9584..d88422e74a4 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -98,3 +98,11 @@ function badEncodeWithReplacer(s) {
   };
   return s.replace(/["']/g, (c) => repl[c]).replace(/&/g, "&amp;");
 }
+
+function encodeDoubleQuotes(s) {
+  return s.replace(/"/g, "&quot;");
+}
+
+function badWrappedEncode(s) {
+  return encodeDoubleQuotes(s).replace(/&/g, "&amp;");
+}

From 5349e0f88142ae4e7a63038fa3238b5001e0972d Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 13:02:59 +0000
Subject: [PATCH 080/232] JavaScript: Recognise wrapped chains of replacements.

---
 javascript/ql/src/Security/CWE-116/DoubleEscaping.ql  | 11 +++++++++--
 .../CWE-116/DoubleEscaping/DoubleEscaping.expected    |  1 +
 .../Security/CWE-116/DoubleEscaping/tst.js            |  8 ++++++++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 733afad0b06..2fc91a9854d 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -115,6 +115,13 @@ abstract class Replacement extends DataFlow::Node {
     result.getOutput() = getASimplePredecessor*(getInput())
   }
 
+  /**
+   * Gets the next replacement in this chain of replacements.
+   */
+  Replacement getNextReplacement() {
+    this = result.getPreviousReplacement()
+  }
+
   /**
    * Gets an earlier replacement in this chain of replacements that
    * performs an escaping.
@@ -231,8 +238,8 @@ class WrappedReplacement extends Replacement, DataFlow::CallNode {
 
   WrappedReplacement() {
     exists(DataFlow::FunctionNode wrapped | wrapped.getFunction() = getACallee() |
-      wrapped.getParameter(i).flowsTo(inner.getInput()) and
-      inner.getOutput().flowsTo(wrapped.getAReturn())
+      wrapped.getParameter(i).flowsTo(inner.getPreviousReplacement*().getInput()) and
+      inner.getNextReplacement*().getOutput().flowsTo(wrapped.getAReturn())
     )
   }
 
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
index d0747087d12..23e5a4a6b05 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/DoubleEscaping.expected
@@ -9,3 +9,4 @@
 | tst.js:86:10:86:22 | JSON.parse(s) | This replacement may produce '\\' characters that are double-unescaped $@. | tst.js:86:10:86:47 | JSON.pa ... g, "<") | here |
 | tst.js:99:10:99:66 | s.repla ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:99:10:99:43 | s.repla ... epl[c]) | here |
 | tst.js:107:10:107:53 | encodeD ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:107:10:107:30 | encodeD ... otes(s) | here |
+| tst.js:115:10:115:47 | encodeQ ... &amp;") | This replacement may double-escape '&' characters from $@. | tst.js:115:10:115:24 | encodeQuotes(s) | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index d88422e74a4..628166ed04a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -106,3 +106,11 @@ function encodeDoubleQuotes(s) {
 function badWrappedEncode(s) {
   return encodeDoubleQuotes(s).replace(/&/g, "&amp;");
 }
+
+function encodeQuotes(s) {
+  return s.replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+
+function badWrappedEncode2(s) {
+  return encodeQuotes(s).replace(/&/g, "&amp;");
+}

From a8214ce7ee070ad082430a6ea0140548ea1b0799 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 14:15:59 +0000
Subject: [PATCH 081/232] JavaScript: Fix regexes for escaping schemes.

---
 javascript/ql/src/Security/CWE-116/DoubleEscaping.ql     | 6 +++---
 .../query-tests/Security/CWE-116/DoubleEscaping/tst.js   | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 2fc91a9854d..5d5157bafb3 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -54,11 +54,11 @@ DataFlow::Node getASimplePredecessor(DataFlow::Node nd) {
  * into a form described by regular expression `regex`.
  */
 predicate escapingScheme(string metachar, string regex) {
-  metachar = "&" and regex = "&.*;"
+  metachar = "&" and regex = "&.+;"
   or
-  metachar = "%" and regex = "%.*"
+  metachar = "%" and regex = "%.+"
   or
-  metachar = "\\" and regex = "\\\\.*"
+  metachar = "\\" and regex = "\\\\.+"
 }
 
 /**
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index 628166ed04a..e05779eeb7a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -114,3 +114,12 @@ function encodeQuotes(s) {
 function badWrappedEncode2(s) {
   return encodeQuotes(s).replace(/&/g, "&amp;");
 }
+
+function roundtrip(s) {
+  return JSON.parse(JSON.stringify(s));
+}
+
+// dubious, but out of scope for this query
+function badRoundtrip(s) {
+  return s.replace(/\\\\/g, "\\").replace(/\\/g, "\\\\");
+}

From 8c133ff61d873b574ff0fef778f5248f8c4b11d9 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 14:46:50 +0000
Subject: [PATCH 082/232] JavaScript: Deal with (un-)escaping on captured
 variables.

---
 javascript/ql/src/Security/CWE-116/DoubleEscaping.ql       | 7 ++++++-
 .../query-tests/Security/CWE-116/DoubleEscaping/tst.js     | 7 +++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index 5d5157bafb3..b6d76956630 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -46,7 +46,12 @@ string getStringValue(RegExpLiteral rl) {
  */
 DataFlow::Node getASimplePredecessor(DataFlow::Node nd) {
   result = nd.getAPredecessor() and
-  not nd.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition() instanceof SsaPhiNode
+  not exists(SsaDefinition ssa |
+    ssa = nd.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition()
+  |
+    ssa instanceof SsaPhiNode or
+    ssa instanceof SsaVariableCapture
+  )
 }
 
 /**
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index e05779eeb7a..7b840e2be08 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -123,3 +123,10 @@ function roundtrip(s) {
 function badRoundtrip(s) {
   return s.replace(/\\\\/g, "\\").replace(/\\/g, "\\\\");
 }
+
+function testWithCapturedVar(x) {
+  var captured = x;
+  (function() {
+    captured = captured.replace(/\\/g, "\\\\");
+  })();
+}

From bb0771b36c3065c60dd4aa3f04a481b241ff9c86 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 14:49:01 +0000
Subject: [PATCH 083/232] JavaScript: Deal with escape-unescape-escape (and
 similar) chains.

---
 javascript/ql/src/Security/CWE-116/DoubleEscaping.ql      | 8 ++++++--
 .../query-tests/Security/CWE-116/DoubleEscaping/tst.js    | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index b6d76956630..db8624458b7 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -135,7 +135,9 @@ abstract class Replacement extends DataFlow::Node {
     exists(Replacement pred | pred = this.getPreviousReplacement() |
       if pred.escapes(_, metachar)
       then result = pred
-      else result = pred.getAnEarlierEscaping(metachar)
+      else (
+        not pred.unescapes(metachar, _) and result = pred.getAnEarlierEscaping(metachar)
+      )
     )
   }
 
@@ -147,7 +149,9 @@ abstract class Replacement extends DataFlow::Node {
     exists(Replacement succ | this = succ.getPreviousReplacement() |
       if succ.unescapes(metachar, _)
       then result = succ
-      else result = succ.getALaterUnescaping(metachar)
+      else (
+        not succ.escapes(_, metachar) and result = succ.getALaterUnescaping(metachar)
+      )
     )
   }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
index 7b840e2be08..9c69c837f6b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/DoubleEscaping/tst.js
@@ -130,3 +130,7 @@ function testWithCapturedVar(x) {
     captured = captured.replace(/\\/g, "\\\\");
   })();
 }
+
+function cloneAndStringify(s) {
+  return JSON.stringify(JSON.parse(JSON.stringify(s)));
+}

From 3bbded57d3c45c1adc1056d23c3c74f0ffb38568 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 30 Oct 2019 14:49:18 +0000
Subject: [PATCH 084/232] JavaScript: Autoformat.

---
 .../ql/src/Security/CWE-116/DoubleEscaping.ql | 52 +++++--------------
 1 file changed, 13 insertions(+), 39 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
index db8624458b7..6340a2fcedc 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.ql
@@ -116,16 +116,12 @@ abstract class Replacement extends DataFlow::Node {
   /**
    * Gets the previous replacement in this chain of replacements.
    */
-  Replacement getPreviousReplacement() {
-    result.getOutput() = getASimplePredecessor*(getInput())
-  }
+  Replacement getPreviousReplacement() { result.getOutput() = getASimplePredecessor*(getInput()) }
 
   /**
    * Gets the next replacement in this chain of replacements.
    */
-  Replacement getNextReplacement() {
-    this = result.getPreviousReplacement()
-  }
+  Replacement getNextReplacement() { this = result.getPreviousReplacement() }
 
   /**
    * Gets an earlier replacement in this chain of replacements that
@@ -182,35 +178,25 @@ class GlobalStringReplacement extends Replacement, DataFlow::MethodCallNode {
     )
   }
 
-  override DataFlow::Node getInput() {
-    result = this.getReceiver()
-  }
+  override DataFlow::Node getInput() { result = this.getReceiver() }
 
-  override DataFlow::SourceNode getOutput() {
-    result = this
-  }
+  override DataFlow::SourceNode getOutput() { result = this }
 }
 
 /**
  * A call to `JSON.stringify`, viewed as a string replacement.
  */
 class JsonStringifyReplacement extends Replacement, DataFlow::CallNode {
-  JsonStringifyReplacement() {
-    this = DataFlow::globalVarRef("JSON").getAMemberCall("stringify")
-  }
+  JsonStringifyReplacement() { this = DataFlow::globalVarRef("JSON").getAMemberCall("stringify") }
 
   override predicate replaces(string input, string output) {
     input = "\\" and output = "\\\\"
     // the other replacements are not relevant for this query
   }
 
-  override DataFlow::Node getInput() {
-    result = this.getArgument(0)
-  }
+  override DataFlow::Node getInput() { result = this.getArgument(0) }
 
-  override DataFlow::SourceNode getOutput() {
-    result = this
-  }
+  override DataFlow::SourceNode getOutput() { result = this }
 }
 
 /**
@@ -219,22 +205,16 @@ class JsonStringifyReplacement extends Replacement, DataFlow::CallNode {
 class JsonParseReplacement extends Replacement {
   JsonParserCall self;
 
-  JsonParseReplacement() {
-    this = self
-  }
+  JsonParseReplacement() { this = self }
 
   override predicate replaces(string input, string output) {
     input = "\\\\" and output = "\\"
     // the other replacements are not relevant for this query
   }
 
-  override DataFlow::Node getInput() {
-    result = self.getInput()
-  }
+  override DataFlow::Node getInput() { result = self.getInput() }
 
-  override DataFlow::SourceNode getOutput() {
-    result = self.getOutput()
-  }
+  override DataFlow::SourceNode getOutput() { result = self.getOutput() }
 }
 
 /**
@@ -252,17 +232,11 @@ class WrappedReplacement extends Replacement, DataFlow::CallNode {
     )
   }
 
-  override predicate replaces(string input, string output) {
-    inner.replaces(input, output)
-  }
+  override predicate replaces(string input, string output) { inner.replaces(input, output) }
 
-  override DataFlow::Node getInput() {
-    result = getArgument(i)
-  }
+  override DataFlow::Node getInput() { result = getArgument(i) }
 
-  override DataFlow::SourceNode getOutput() {
-    result = this
-  }
+  override DataFlow::SourceNode getOutput() { result = this }
 }
 
 from Replacement primary, Replacement supplementary, string message, string metachar

From 8620b0513efa171a2713c08f8fdde5576b73078a Mon Sep 17 00:00:00 2001
From: yh-semmle <yh@semmle.com>
Date: Wed, 30 Oct 2019 11:18:36 -0400
Subject: [PATCH 085/232] Java: move `UnsafeDeserialization.qll` to standard
 library location

---
 java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql       | 2 +-
 .../code/java/security}/UnsafeDeserialization.qll               | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename java/ql/src/{Security/CWE/CWE-502 => semmle/code/java/security}/UnsafeDeserialization.qll (100%)

diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
index 18cf624375f..bb4df03cd4f 100644
--- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
+++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
@@ -12,7 +12,7 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
-import UnsafeDeserialization
+import semmle.code.java.security.UnsafeDeserialization
 import DataFlow::PathGraph
 
 class UnsafeDeserializationConfig extends TaintTracking::Configuration {
diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qll b/java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
similarity index 100%
rename from java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qll
rename to java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll

From 27d0b51c6b4eabc891c71eb8952874c07932c7e3 Mon Sep 17 00:00:00 2001
From: alistair <alistair@semmle.com>
Date: Wed, 30 Oct 2019 16:10:03 +0000
Subject: [PATCH 086/232] CPP & C#: Review of qhelp

PR #2151 got merged without a review of the qhelp
by a technical writer.
The current PR makes changes I would have suggested on that PR.
---
 .../NtohlArrayNoBoundOpenSource.qhelp         |  2 +-
 .../ConditionallyUninitializedVariable.qhelp  |  2 +-
 .../ConditionallyUninitializedVariable.ql     |  2 +-
 .../CWE-091/XMLInjection.qhelp                |  4 ++--
 .../CWE-114/AssemblyPathInjection.qhelp       |  6 ++---
 .../CWE-321/HardcodedEncryptionKey.ql         |  4 ++--
 .../CWE-327/InsecureSQLConnection.qhelp       | 22 +++++++++----------
 .../CWE-327/InsecureSQLConnection.ql          |  2 +-
 8 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.qhelp
index 522d6cde74c..fc8f309f73a 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.qhelp	
@@ -14,7 +14,7 @@ byte order function, such as <code>ntohl</code>.
 The use of a network-to-host byte order function is therefore a good indicator that the returned
 value is unvalidated data retrieved from the network, and should not be used without further
 validation. In particular, the returned value should not be used as an array index or array length
-value without validation, which may result in a buffer overflow vulnerability.
+value without validation, as this could result in a buffer overflow vulnerability.
 </p>
 </overview>
 
diff --git a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
index b9118edc736..8e6a8903483 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
@@ -37,7 +37,7 @@ which is then subsequently accessed to fetch properties of the device. However,
 check the return value from the function call to <code>initDeviceConfig</code>. If the
 device number passed to the <code>notify</code> function was invalid, the
 <code>initDeviceConfig</code> function will leave the <code>config</code> variable uninitialized,
-which would result in the <code>notify</code> function accessing uninitialized memory.</p>
+which will result in the <code>notify</code> function accessing uninitialized memory.</p>
 
 <sample src="ConditionallyUninitializedVariableBad.c" />
 
diff --git a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
index eb00fb9ea10..f9eb2fe5400 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
+++ b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
@@ -2,7 +2,7 @@
  * @name Conditionally uninitialized variable
  * @description When an initialization function is used to initialize a local variable, but the
  *              returned status code is not checked, the variable may be left in an uninitialized
- *              state, and reading the variable may result in undefined behaviour.
+ *              state, and reading the variable may result in undefined behavior.
  * @kind problem
  * @problem.severity warning
  * @opaque-id SM02313
diff --git a/csharp/ql/src/Security Features/CWE-091/XMLInjection.qhelp b/csharp/ql/src/Security Features/CWE-091/XMLInjection.qhelp
index 4e70b06531a..3aff9901bfc 100644
--- a/csharp/ql/src/Security Features/CWE-091/XMLInjection.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-091/XMLInjection.qhelp	
@@ -36,10 +36,10 @@ which ensures the content is appropriately escaped.</p>
 
 <references>
   <li>
-    <a href="http://projects.webappsec.org/w/page/13247004/XML%20Injection">XML Injection</a> (The Web Application Security Consortium).
+    Web Application Security Consortium: <a href="http://projects.webappsec.org/w/page/13247004/XML%20Injection">XML Injection</a>.
   </li>
   <li>
-    <a href="https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmlwriter.writeraw?view=netframework-4.8">WriteRaw</a> (Microsoft documentation).
+    Microsoft Docs: <a href="https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmlwriter.writeraw?view=netframework-4.8">WriteRaw</a>.
   </li>
 </references>
 </qhelp>
diff --git a/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.qhelp b/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.qhelp
index 5f95181c092..e1dbe9c1bd0 100644
--- a/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.qhelp	
@@ -14,7 +14,7 @@ was not intended to be loaded, and executing arbitrary code.
 <p>
 Avoid loading assemblies based on user provided input. If this is not possible, ensure that the path
 is validated before being used with <code>Assembly</code>. For example, compare the provided input
-against a whitelist of known safe assemblies, or confirm that path is restricted to a single
+against a whitelist of known safe assemblies, or confirm that the path is restricted to a single
 directory which only contains safe assemblies.
 </p>
 </recommendation>
@@ -30,8 +30,8 @@ is only loaded if the user input matches one of those options.</p>
 </example>
 
 <references>
-  <li>
-    <a href="https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=netframework-4.8">System.Reflection.Assembly</a> (Microsoft documentation).
+  <li>Microsoft: 
+    <a href="https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=netframework-4.8">System.Reflection.Assembly</a>.
   </li>
 </references>
 </qhelp>
diff --git a/csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql b/csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql
index c09a67d756c..cce122ffa62 100644
--- a/csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql	
+++ b/csharp/ql/src/Security Features/CWE-321/HardcodedEncryptionKey.ql	
@@ -1,6 +1,6 @@
 /**
- * @name Do not use hard-coded encryption keys.
- * @description The .Key property or rgbKey parameter of a SymmetricAlgorithm should never be a hardcoded value.
+ * @name Hard-coded encryption key
+ * @description The .Key property or rgbKey parameter of a SymmetricAlgorithm should never be a hard-coded value.
  * @kind problem
  * @id cs/hardcoded-key
  * @problem.severity error
diff --git a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.qhelp b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.qhelp
index ae69402eb7e..c59feeed61c 100644
--- a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.qhelp	
@@ -3,7 +3,6 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>Finds uses of insecure SQL Connections string by not enabling the <code>Encrypt</code> option.</p>
 
   <p>
     SQL Server connections where the client is not enforcing the encryption in transit are susceptible to multiple attacks, including a man-in-the-middle, that would potentially compromise the user credentials and/or the TDS session.
@@ -29,18 +28,17 @@
 
 </example>
 <references>
-
-  <li>
-    <a href="https://blogs.msdn.microsoft.com/sql_protocols/2009/10/19/selectively-using-secure-connection-to-sql-server/">Selectively using secure connection to SQL Server</a>
+  <li>Microsoft, SQL Protocols blog: 
+    <a href="https://blogs.msdn.microsoft.com/sql_protocols/2009/10/19/selectively-using-secure-connection-to-sql-server/">Selectively using secure connection to SQL Server</a>.
   </li>
-  <li>
-    <a href="https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlconnection.connectionstring(v=vs.110).aspx">Net SqlClient (ADO .Net)</a>
+  <li>Microsoft:
+    <a href="https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlconnection.connectionstring(v=vs.110).aspx">SqlConnection.ConnectionString Property</a>.
+  </li>
+  <li>Microsoft: 
+    <a href="https://msdn.microsoft.com/en-us/library/ms130822.aspx">Using Connection String Keywords with SQL Server Native Client</a>.
+  </li>
+  <li>Microsoft: 
+    <a href="https://msdn.microsoft.com/en-us/library/ms378988(v=sql.110).aspx">Setting the connection properties</a>.
   </li>
-  <li><a href="https://msdn.microsoft.com/en-us/library/ms130822.aspx">SQL native driver (SNAC)</a>
-</li>
-  <li>
-    <a href="https://msdn.microsoft.com/en-us/library/ms378988(v=sql.110).aspx">JDBC driver</a>
-</li>
-  
 </references>
 </qhelp>
diff --git a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
index 0f855150aa9..78bcc1c19e5 100644
--- a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql	
+++ b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql	
@@ -1,6 +1,6 @@
 /**
  * @name Insecure SQL connection
- * @description TODO.
+ * @description Using an SQL Server connection without enforcing encryption is a security vulnerability.
  * @kind path-problem
  * @id cs/insecure-sql-connection
  * @problem.severity error

From 03c9a40ba35db5be5e635703db8b2ab82beca909 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 22 Oct 2019 09:32:51 +0100
Subject: [PATCH 087/232] JavaScript: Add libraries for forward and backward
 data-flow exploration.

---
 .../dataflow/BackwardExploration.qll          | 44 +++++++++++++++++++
 .../dataflow/ForwardExploration.qll           | 42 ++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 javascript/ql/src/semmle/javascript/dataflow/BackwardExploration.qll
 create mode 100644 javascript/ql/src/semmle/javascript/dataflow/ForwardExploration.qll

diff --git a/javascript/ql/src/semmle/javascript/dataflow/BackwardExploration.qll b/javascript/ql/src/semmle/javascript/dataflow/BackwardExploration.qll
new file mode 100644
index 00000000000..caf67e6db7f
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/dataflow/BackwardExploration.qll
@@ -0,0 +1,44 @@
+/**
+ * Provides machinery for performing backward data-flow exploration.
+ *
+ * Importing this module effectively makes all data-flow and taint-tracking configurations
+ * ignore their `isSource` predicate. Instead, flow is tracked from any _initial node_ (that is,
+ * a node without incoming flow) to a sink node. All initial nodes are then treated as source
+ * nodes.
+ *
+ * Data-flow exploration cannot be used with configurations depending on other configurations.
+ *
+ * NOTE: This library should only be used for debugging, not in production code. Backward
+ * exploration in particular does not scale on non-trivial code bases and hence is of limited
+ * usefulness as it stands.
+ */
+
+import javascript
+
+private class BackwardExploringConfiguration extends DataFlow::Configuration {
+  DataFlow::Configuration cfg;
+
+  BackwardExploringConfiguration() {
+    this = cfg
+  }
+
+  override predicate isSource(DataFlow::Node node) { any() }
+
+  override predicate isSource(DataFlow::Node node, DataFlow::FlowLabel lbl) { any() }
+
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(DataFlow::PathNode src, DataFlow::PathNode snk | hasFlowPath(src, snk) |
+      source = src.getNode() and
+      sink = snk.getNode()
+    )
+  }
+
+  override predicate hasFlowPath(DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink) {
+    exists(DataFlow::MidPathNode first |
+      source.getConfiguration() = this and
+      source.getASuccessor() = first and
+      not exists(DataFlow::MidPathNode mid | mid.getASuccessor() = first) and
+      first.getASuccessor*() = sink
+    )
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/dataflow/ForwardExploration.qll b/javascript/ql/src/semmle/javascript/dataflow/ForwardExploration.qll
new file mode 100644
index 00000000000..0e3a7ae91c2
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/dataflow/ForwardExploration.qll
@@ -0,0 +1,42 @@
+/**
+ * Provides machinery for performing forward data-flow exploration.
+ *
+ * Importing this module effectively makes all data-flow and taint-tracking configurations
+ * ignore their `isSink` predicate. Instead, flow is tracked from source nodes as far as
+ * possible, until a _terminal node_ (that is, a node without any outgoing flow) is reached.
+ * All terminal nodes are then treated as sink nodes.
+ *
+ * Data-flow exploration cannot be used with configurations depending on other configurations.
+ *
+ * NOTE: This library should only be used for debugging, not in production code.
+ */
+
+import javascript
+
+private class ForwardExploringConfiguration extends DataFlow::Configuration {
+  DataFlow::Configuration cfg;
+
+  ForwardExploringConfiguration() {
+    this = cfg
+  }
+
+  override predicate isSink(DataFlow::Node node) { any() }
+
+  override predicate isSink(DataFlow::Node node, DataFlow::FlowLabel lbl) { any() }
+
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(DataFlow::PathNode src, DataFlow::PathNode snk | hasFlowPath(src, snk) |
+      source = src.getNode() and
+      sink = snk.getNode()
+    )
+  }
+
+  override predicate hasFlowPath(DataFlow::SourcePathNode source, DataFlow::SinkPathNode sink) {
+    exists(DataFlow::MidPathNode last |
+      source.getConfiguration() = this and
+      source.getASuccessor*() = last and
+      not last.getASuccessor() instanceof DataFlow::MidPathNode and
+      last.getASuccessor() = sink
+    )
+  }
+}

From 3e1fd4a737549a47d322a47a3bf28720989ffceb Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Thu, 31 Oct 2019 18:03:34 -0700
Subject: [PATCH 088/232] [CPP-434] Add table of constructs to Qhelp.  Rewrite
 examples section.

---
 change-notes/1.23/analysis-cpp.md             |   2 +-
 .../Arithmetic/SignedOverflowCheck-bad2.cpp   |   2 +-
 .../Arithmetic/SignedOverflowCheck-good1.cpp  |   5 +-
 .../Arithmetic/SignedOverflowCheck-good2.cpp  |   4 +-
 .../Arithmetic/SignedOverflowCheck.qhelp      | 124 +++++++++++++++---
 5 files changed, 110 insertions(+), 27 deletions(-)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index b3e16dcc29a..f98e3c7fef1 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -9,7 +9,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
 | Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail.  This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
-| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | Finds overflow checks that rely on signed integer addition to overflow, which is undefined behavior. Example: `a + b < a`. |
+| Signed overflow check (`cpp/signed-overflow-check`) | correctness, reliability | Finds overflow checks that rely on signed integer addition to overflow, which has undefined behavior. Example: `a + b < a`. |
 
 ## Changes to existing queries
 
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp
index d4d9cd75393..7f69e374ed1 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp	
@@ -1,4 +1,4 @@
 bool bar(unsigned short n1, unsigned short delta) {
     // NB: Comparison is always false
-    return n1 + delta < n1; // GOOD
+    return n1 + delta < n1; // GOOD (but misleading)
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp
index 2209b8bff71..424684ee2ec 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good1.cpp	
@@ -1,3 +1,4 @@
-bool baf(unsigned short n1, unsigned short delta) {
-    return (unsigned short)(n1 + delta) < n1; // GOOD
+#include <limits.h>
+bool foo(int n1, unsigned short delta) {
+    return n1 > INT_MAX - delta; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp
index cccc66b71f8..de8de2b9847 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-good2.cpp	
@@ -1,3 +1,3 @@
-bool baz(int n1, int delta) {
-    return (unsigned)n1 + delta < n1; // GOOD
+bool bar(unsigned short n1, unsigned short delta) {
+    return (unsigned short)(n1 + delta) < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index ae4dae55016..da7f86f021b 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -4,11 +4,11 @@
 <qhelp>
 <overview>
 <p>
-When checking for integer overflow, one often writes tests like
+When checking for integer overflow, you may often write tests like
 <code>a + b &lt; a</code>.  This works fine if <code>a</code> or
 <code>b</code> are unsigned integers, since any overflow in the addition
-will cause the value to simply "wrap around".  However, using
-<i>signed</i> integers is problematic because signed overflows have undefined
+will cause the value to simply "wrap around."  However, using
+<i>signed</i> integers is problematic because signed overflow has undefined
 behavior according to the C and C++ standards.  If the addition overflows
 and has an undefined result, the comparison will likewise be undefined;
 it may produce an unintended result, or may be deleted entirely by an
@@ -17,10 +17,89 @@ optimizing compiler.
 </overview>
 <recommendation>
 <p>
-When checking for overflow by adding two values, first make sure that <code>a</code>
-or <code>b</code> are (converted into) unsigned values, unless it is
-certain that the signed addition cannot overflow.
+Solutions to this problem can be thought of as falling into one of two
+categories: (1) rewrite the signed expression so that overflow cannot occur
+but the signedness remains, or (2) rewrite (or cast) the signed expression
+into unsigned form.
+
+The table below lists various expressions where signed overflow may
+occur, along with proposed rewritings.  It should not be
+considered as exhaustive.
 </p>
+<table>
+  <tr>
+    <th>Original Construct</th>
+    <th>Alternate Construct(s)</th>
+    <th>Notes</th>
+  </tr>
+  <tr>
+    <td><tt><table>
+      <tr>
+        <td>unsigned short i, delta;</td>
+      </tr><tr>
+        <td>i + delta &lt; i</td>
+      </tr>
+    </table></tt></td>
+    <td><tt><table>
+      <tr>
+        <td>unsigned short i, delta;</td>
+      </tr><tr>
+        <td>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</td>
+      </tr>
+    </table></tt></td>
+    <td><tt>i + delta</tt>does not actually overflow due to <tt>int</tt> promotion</td>
+  </tr>
+  <tr>
+    <td>&nbsp;</td>
+    <td><tt><table>
+      <tr>
+        <td>unsigned short i, delta;</td>
+      </tr><tr>
+        <td>i > USHORT_MAX - delta</td>
+      </tr>
+    </table></tt></td>
+    <td>Must include <tt>limits.h</tt> or <tt>climits</tt></td>
+  </tr>
+  <tr>
+    <td><tt><table>
+      <tr>
+        <td>int i, delta;</td>
+      </tr><tr>
+        <td>i + delta &lt; i</td>
+      </tr>
+    </table></tt></td>
+    <td><tt><table>
+      <tr>
+        <td>int i, delta;</td>
+      </tr><tr>
+        <td>i &gt; INT_MAX - delta</td>
+      </tr>
+    </table></tt></td>
+    <td>Must include <tt>limits.h</tt> or <tt>climits</tt></td>
+  </tr>
+  <tr>
+    <td>&nbsp;</td>
+    <td><tt><table>
+      <tr>
+        <td>int i, delta;</td>
+      </tr><tr>
+        <td>(unsigned)i + delta &lt; i</td>
+      </tr>
+    </table></tt></td>
+    <td>Change in program semantics</td>
+  </tr>
+  <tr>
+    <td>&nbsp;</td>
+    <td><tt><table>
+      <tr>
+        <td>unsigned int i, delta;</td>
+      </tr><tr>
+        <td>i + delta &lt; i</td>
+      </tr>
+    </table></tt></td>
+    <td>Change in program semantics</td>
+  </tr>
+</table>
 </recommendation>
 <example>
 <p>
@@ -34,6 +113,17 @@ result.
 </p>
 <sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
+The following example builds upon the previous one.  Instead of
+performing an addition (which could overflow), we have re-framed the
+solution so that a subtraction is used instead.  Since <code>delta</code>
+is promoted to a <code>signed int</code> and <code>INT_MAX</code> denotes
+the largest possible positive value for an <code>signed int</code>,
+the expression <code>INT_MAX - delta</code> can never be less than zero
+or more than <code>INT_MAX</code>.  Hence, any overflow and underflow
+are avoided.
+</p>
+<sample src="SignedOverflowCheck-good1.cpp" />
+<p>
 In the following example, even though both <code>n</code> and <code>delta</code>
 have been declared <code>unsigned short</code>, both are promoted to 
 <code>signed int</code> prior to addition.  Because we started out with the
@@ -45,26 +135,18 @@ hold true, which likely is not what the programmer intended. (see also the
 </p>
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
-The following example builds upon the previous one.  Again, we have two
-<code>unsigned short</code> values getting promoted to a wider type, resulting
-in a comparison that always succeeds (since there is no overflow).  To
-test whether we have an <code>unsigned short</code> overflow, we cast the
-left-hand side to it, causing the right-hand side to remain an <code>unsigned
-short</code> as well.
-</p>
-<sample src="SignedOverflowCheck-good1.cpp" />
-<p>
-In the next example, we have two <code>signed int</code> values that we
-wish to add together.  Adding them "as-is" opens the possibility of
-a signed integer overflow, the results of which are undefined.
-By casting one of the operands to <code>unsigned</code>, the entire 
-expression is evaluated using <code>unsigned</code>
-values, which is defined behavior per the C/C++ standard.
+The next example provides a solution to the previous one.  Even though
+<code>i + delta</code> does not overflow, casting it to an
+<code>unsigned short</code> truncates the addition modulo 2^16,
+so that <code>unsigned short</code> "wrap around" may now be observed.
+Furthermore, since the left-hand side is now of type <code>unsigned short</code>,
+the right-hand side does not need to be promoted to a <code>signed int</code>.
 </p>
 <sample src="SignedOverflowCheck-good2.cpp" />
 </example>
 <references>
 <li><a href="http://c-faq.com/expr/preservingrules.html">comp.lang.c FAQ list · Question 3.19 (Preserving rules)</a></li>
 <li><a href="https://wiki.sei.cmu.edu/confluence/display/c/INT31-C.+Ensure+that+integer+conversions+do+not+result+in+lost+or+misinterpreted+data">INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data</a></li>
+<li>W. Dietz,∗ P. Li, J. Regehr, V. Adve. <a href="http://www.cs.utah.edu/~regehr/papers/overflow12.pdf">Understanding Integer Overflow in C/C++</a></li>
 </references>
 </qhelp>

From 02bb142e7c6b3d8df058b60139504c1ead6b39e7 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Fri, 1 Nov 2019 12:05:13 +0000
Subject: [PATCH 089/232] Update repository artifacts for name change

---
 CONTRIBUTING.md | 14 +++++++-------
 README.md       | 12 ++++++------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6c0714571fc..e074b1c2079 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-# Contributing to QL
+# Contributing to CodeQL
 
 We welcome contributions to our standard library and standard checks. Got an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request!
 
@@ -9,13 +9,13 @@ Before we accept your pull request, we require that you have agreed to our Contr
 If you have an idea for a query that you would like to share with other Semmle users, please open a pull request to add it to this repository. 
 Follow the steps below to help other users understand what your query does, and to ensure that your query is consistent with the other Semmle queries.
 
-1. **Consult the QL documentation for query writers**
+1. **Consult the documentation for query writers**
 
-   There is lots of useful documentation to help you write QL, ranging from information about query file structure to language-specific tutorials. For more information on the documentation available, see [Writing QL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
+   There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [Writing CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
 
-2. **Format your QL correctly**
+2. **Format your code correctly**
 
-   All of Semmle's standard QL queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all QL contributions follow the same formatting guidelines. If you use QL for Eclipse, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html). For more information, see the [QL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md).
+   All of Semmle's standard queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all contributions follow the same formatting guidelines. If you use QL for Eclipse, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html). For more information, see the [CodeQL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md).
 
 3. **Make sure your query has the correct metadata**
 
@@ -29,7 +29,7 @@ Follow the steps below to help other users understand what your query does, and
    The `select` statement of your query must be compatible with the query type (determined by the `@kind` metadata property) for alert or path results to be displayed correctly in LGTM and QL for Eclipse.
    For more information on `select` statement format, see [Introduction to query files](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
 
-5. **Save your query in a `.ql` file in correct language directory in this repository**
+5. **Save your query in a `.ql` file in the correct language directory in this repository**
 
    There are five language-specific directories in this repository:
    
@@ -54,7 +54,7 @@ repositories, which might be made public. We might also use this information
 to contact you in relation to your contributions, as well as in the
 normal course of software development. We also store records of your
 CLA agreements. Under GDPR legislation, we do this
-on the basis of our legitimate interest in creating the QL product.
+on the basis of our legitimate interest in creating the CodeQL product.
 
 Please do get in touch (privacy@semmle.com) if you have any questions about
 this or our data protection policies.
diff --git a/README.md b/README.md
index b483d29cae2..a6aa5e38f1a 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,16 @@
-# Semmle QL
+# CodeQL
 
-This open source repository contains the standard QL libraries and queries that power [LGTM](https://lgtm.com), and the other products that [Semmle](https://semmle.com) makes available to its customers worldwide.
+This open source repository contains the standard CodeQL libraries and queries that power [LGTM](https://lgtm.com), and the other products that [Semmle](https://semmle.com) makes available to its customers worldwide.
 
-## How do I learn QL and run queries?
+## How do I learn CodeQL and run queries?
 
-There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing QL.
+There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
 You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open-source project that's currently being analyzed.
 
 ## Contributing
 
-We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/Semmle/ql/tree/master/docs) to learn how to format your QL for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
+We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/Semmle/ql/tree/master/docs) to learn how to format your code for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
 
 ## License
 
-The QL queries in this repository are licensed under [Apache License 2.0](LICENSE) by [Semmle](https://semmle.com).
+The code in this repository is licensed under [Apache License 2.0](LICENSE) by [Semmle](https://semmle.com).

From 570e55190dda6e94d8080760f0987f6f6271becb Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Fri, 1 Nov 2019 12:20:45 +0000
Subject: [PATCH 090/232] Update style guides for name change

---
 docs/ql-style-guide.md             | 4 ++--
 docs/query-metadata-style-guide.md | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/docs/ql-style-guide.md b/docs/ql-style-guide.md
index 7b6ee9caf94..9e926c0b07e 100644
--- a/docs/ql-style-guide.md
+++ b/docs/ql-style-guide.md
@@ -1,8 +1,8 @@
-# QL Style Guide
+# CodeQL style guide
 
 ## Introduction
 
-This document describes how to format the QL code you contribute to this repository. It covers aspects such as layout, white-space, naming, and documentation. Adhering to consistent standards makes code easier to read and maintain. Of course, these are only guidelines, and can be overridden as the need arises on a case-by-case basis. Where existing code deviates from these guidelines, prefer consistency with the surrounding code.
+This document describes how to format the code you contribute to this repository. It covers aspects such as layout, white-space, naming, and documentation. Adhering to consistent standards makes code easier to read and maintain. Of course, these are only guidelines, and can be overridden as the need arises on a case-by-case basis. Where existing code deviates from these guidelines, prefer consistency with the surrounding code.
 Note, if you use QL for Eclipse, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html).
 
 Words in *italic* are defined in the [Glossary](#glossary).
diff --git a/docs/query-metadata-style-guide.md b/docs/query-metadata-style-guide.md
index 979594eb925..aab4365c445 100644
--- a/docs/query-metadata-style-guide.md
+++ b/docs/query-metadata-style-guide.md
@@ -1,6 +1,5 @@
 # Query file metadata and alert message style guide
 
-
 ## Introduction
 
 This document outlines the structure of Semmle query files. You should adopt this structure when contributing custom queries to this repository, in order to ensure that new queries are consistent with the standard Semmle queries.
@@ -11,13 +10,13 @@ Query files have the extension `.ql`. Each file has two distinct areas:
 
 *   Metadata area–displayed at the top of the file, contains the metadata that defines how results for the query are interpreted and gives a brief description of the purpose of the query.
 *   Query definition–defined using QL. The query includes a select statement, which defines the content and format of the results. For further information about writing QL, see the following topics:
-    *   [Learning QL](https://help.semmle.com/QL/learn-ql/index.html)
+    *   [Learning CodeQL](https://help.semmle.com/QL/learn-ql/index.html)
     *   [QL language handbook](https://help.semmle.com/QL/ql-handbook/index.html)
     *   [QL language specification](https://help.semmle.com/QL/ql-spec/language.html)
     *   [QL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md) 
 
 
-For examples of query files for the languages supported by Semmle, visit the following links: 
+For examples of query files for the languages supported by CodeQL, visit the following links: 
 
 *   [C/C++ queries](https://help.semmle.com/wiki/display/CCPPOBJ/)
 *   [C# queries](https://help.semmle.com/wiki/display/CSHARP/)
@@ -178,4 +177,4 @@ For examples of select clauses and alert messages, see the query source files at
 *   [JavaScript queries](https://help.semmle.com/wiki/display/JS/)
 *   [Python queries](https://help.semmle.com/wiki/display/PYTHON/)
 
-For further information on query writing, see  [Writing QL queries](https://help.semmle.com/QL/learn-ql/ql/writing-queries/writing-queries.html). For more information on learning QL, see [Learning QL](https://help.semmle.com/QL/learn-ql/index.html).
+For further information on query writing, see  [Writing CodeQL queries](https://help.semmle.com/QL/learn-ql/ql/writing-queries/writing-queries.html). For more information on learning CodeQL, see [Learning CodeQL](https://help.semmle.com/QL/learn-ql/index.html).

From 236e1f7955a66a94562aa003253dd8d43093e7fd Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Fri, 1 Nov 2019 12:27:43 +0000
Subject: [PATCH 091/232] Update change notes for name change

---
 change-notes/1.23/analysis-cpp.md        | 2 +-
 change-notes/1.23/analysis-csharp.md     | 2 +-
 change-notes/1.23/analysis-java.md       | 2 +-
 change-notes/1.23/analysis-javascript.md | 2 +-
 change-notes/support/README.md           | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index 64e9b98fcfb..a24559dc5d0 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -24,7 +24,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
 | Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
 
-## Changes to QL libraries
+## Changes to libraries
 
 * The data-flow library has been extended with a new feature to aid debugging.
   Instead of specifying `isSink(Node n) { any() }` on a configuration to
diff --git a/change-notes/1.23/analysis-csharp.md b/change-notes/1.23/analysis-csharp.md
index 7ec412a0eb2..1b9b70f9172 100644
--- a/change-notes/1.23/analysis-csharp.md
+++ b/change-notes/1.23/analysis-csharp.md
@@ -24,7 +24,7 @@ The following changes in version 1.23 affect C# analysis in all applications.
 
 * `nameof` expressions are now extracted correctly when the name is a namespace.
 
-## Changes to QL libraries
+## Changes to libraries
 
 * The new class `NamespaceAccess` models accesses to namespaces, for example in `nameof` expressions.
 * The data-flow library now makes it easier to specify barriers/sanitizers
diff --git a/change-notes/1.23/analysis-java.md b/change-notes/1.23/analysis-java.md
index b81b681aac5..8c38f57e9d2 100644
--- a/change-notes/1.23/analysis-java.md
+++ b/change-notes/1.23/analysis-java.md
@@ -19,7 +19,7 @@ The following changes in version 1.23 affect Java analysis in all applications.
 | Query built without neutralizing special characters (`java/concatenated-sql-query`) | More results | The query now identifies arguments to `Statement.executeLargeUpdate` and `Connection.prepareCall` as SQL expressions sinks. |
 | Useless comparison test (`java/constant-comparison`) | Fewer false positives | Additional overflow check patterns are now recognized and no longer reported. |
 
-## Changes to QL libraries
+## Changes to libraries
 
 * The data-flow library has been extended with a new feature to aid debugging.
   Instead of specifying `isSink(Node n) { any() }` on a configuration to
diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 20f9ad1df87..cc349113468 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -46,7 +46,7 @@
 | Uncontrolled data used in path expression (`js/path-injection`) | Fewer false-positive results | This query now recognizes calls to Express `sendFile` as safe in some cases. |
 | Unknown directive (`js/unknown-directive`) | Fewer false positive results | This query no longer flags uses of ":", which is sometimes used like a directive. |
 
-## Changes to QL libraries
+## Changes to libraries
 
 * `Expr.getDocumentation()` now handles chain assignments.
 
diff --git a/change-notes/support/README.md b/change-notes/support/README.md
index 7813c69523d..f111a437183 100644
--- a/change-notes/support/README.md
+++ b/change-notes/support/README.md
@@ -1,6 +1,6 @@
 # Files moved to ``docs`` directory
 
-Now that all of the QL documentation is in this repository,
+Now that all of the CodeQL documentation is in this repository,
 notes on the languages, compilers, and frameworks supported have moved.
 They're now stored as part of the Sphinx ``support`` project with the other documentation:
 ``docs/language/support``.

From 692e977a7148da6c6dc13a38c258b9034ae84bf7 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicitymay@github.com>
Date: Fri, 1 Nov 2019 13:44:23 +0000
Subject: [PATCH 092/232] Update docs/query-metadata-style-guide.md

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
---
 docs/query-metadata-style-guide.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/query-metadata-style-guide.md b/docs/query-metadata-style-guide.md
index aab4365c445..d5f5606002c 100644
--- a/docs/query-metadata-style-guide.md
+++ b/docs/query-metadata-style-guide.md
@@ -13,7 +13,7 @@ Query files have the extension `.ql`. Each file has two distinct areas:
     *   [Learning CodeQL](https://help.semmle.com/QL/learn-ql/index.html)
     *   [QL language handbook](https://help.semmle.com/QL/ql-handbook/index.html)
     *   [QL language specification](https://help.semmle.com/QL/ql-spec/language.html)
-    *   [QL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md) 
+    *   [CodeQL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md) 
 
 
 For examples of query files for the languages supported by CodeQL, visit the following links: 

From 458108f66b7fc5848ff3cffb7477efd4817e7fca Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Fri, 1 Nov 2019 14:08:50 +0000
Subject: [PATCH 093/232] Make 'open source' consistent on the page and with
 other docs

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a6aa5e38f1a..3c73253b6df 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ This open source repository contains the standard CodeQL libraries and queries t
 ## How do I learn CodeQL and run queries?
 
 There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
-You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open-source project that's currently being analyzed.
+You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [QL for Eclipse](https://lgtm.com/help/lgtm/running-queries-ide) plugin to try out your queries on any open source project that's currently being analyzed.
 
 ## Contributing
 

From e2b0ec5696111ab5183d291de61dbd5b81b5ce3e Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 31 Oct 2019 16:17:17 +0000
Subject: [PATCH 094/232] JS: Handle multiple and/or operators in
 SanitizerFunction

---
 .../javascript/dataflow/TaintTracking.qll     | 24 +++++++++++--
 .../TaintTracking/BasicTaintTracking.expected |  2 ++
 .../TaintTracking/DataFlowTracking.expected   |  5 +++
 .../TaintTracking/sanitizer-function.js       | 35 +++++++++++++++++++
 4 files changed, 64 insertions(+), 2 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/TaintTracking/sanitizer-function.js

diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
index 06a0d904261..41afdb653f7 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -846,6 +846,26 @@ module TaintTracking {
     override predicate appliesTo(Configuration cfg) { any() }
   }
 
+  /**
+   * Gets an operand of the given `&&` operator.
+   *
+   * We use this to construct the transitive closure over a relation
+   * that does not include all of `BinaryExpr.getAnOperand`.
+   */
+  private Expr getALogicalAndOperand(LogAndExpr e) {
+    result = e.getAnOperand()
+  }
+
+  /**
+   * Gets an operand of the given `||` operator.
+   *
+   * We use this to construct the transitive closure over a relation
+   * that does not include all of `BinaryExpr.getAnOperand`.
+   */
+  private Expr getALogicalOrOperand(LogOrExpr e) {
+    result = e.getAnOperand()
+  }
+
   /**
    * A function that returns the result of a sanitizer check.
    */
@@ -860,10 +880,10 @@ module TaintTracking {
           returnExpr = sanitizer.asExpr()
           or
           // ad hoc support for conjunctions:
-          returnExpr.(LogAndExpr).getAnOperand() = sanitizer.asExpr() and sanitizerOutcome = true
+          getALogicalAndOperand+(returnExpr) = sanitizer.asExpr() and sanitizerOutcome = true
           or
           // ad hoc support for disjunctions:
-          returnExpr.(LogOrExpr).getAnOperand() = sanitizer.asExpr() and sanitizerOutcome = false
+          getALogicalOrOperand+(returnExpr) = sanitizer.asExpr() and sanitizerOutcome = false
         |
           exists(SsaExplicitDefinition ssa |
             ssa.getDef().getSource() = returnExpr and
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index 2722f67d6fd..df1d6306feb 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -69,6 +69,8 @@ typeInferenceMismatch
 | promise.js:5:25:5:32 | source() | promise.js:5:8:5:33 | bluebir ... urce()) |
 | promise.js:10:24:10:31 | source() | promise.js:10:8:10:32 | Promise ... urce()) |
 | promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:14:10:14:14 | taint |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:33:14:33:18 | taint |
 | sanitizer-guards.js:2:11:2:18 | source() | sanitizer-guards.js:4:8:4:8 | x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
index 6a589e3e0d9..f3023ad44da 100644
--- a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
@@ -41,6 +41,11 @@
 | partialCalls.js:4:17:4:24 | source() | partialCalls.js:30:14:30:20 | x.value |
 | partialCalls.js:4:17:4:24 | source() | partialCalls.js:41:10:41:18 | id(taint) |
 | partialCalls.js:4:17:4:24 | source() | partialCalls.js:51:14:51:14 | x |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:14:10:14:14 | taint |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:17:14:17:18 | taint |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:21:14:21:18 | taint |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:25:14:25:18 | taint |
+| sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:33:14:33:18 | taint |
 | sanitizer-guards.js:2:11:2:18 | source() | sanitizer-guards.js:4:8:4:8 | x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/sanitizer-function.js b/javascript/ql/test/library-tests/TaintTracking/sanitizer-function.js
new file mode 100644
index 00000000000..6df74cf29ee
--- /dev/null
+++ b/javascript/ql/test/library-tests/TaintTracking/sanitizer-function.js
@@ -0,0 +1,35 @@
+function test() {
+    function myCheck1(x) {
+        return x === "a" && something() && somethingElse();
+    }
+    function myCheck2(x) {
+        return something() && x === "a" && somethingElse();
+    }
+    function myCheck3(x) {
+        return something() && somethingElse() && x === "a";
+    }
+
+    let taint = source();
+
+    sink(taint); // NOT OK
+
+    if (myCheck1(taint)) {
+        sink(taint); // OK
+    }
+
+    if (myCheck2(taint)) {
+        sink(taint); // OK
+    }
+
+    if (myCheck3(taint)) {
+        sink(taint); // OK
+    }
+
+    function badCheck(x) {
+        return something && x + isSafe(x) != null;
+    }
+
+    if (badCheck(taint)) {
+        sink(taint); // NOT OK
+    }
+}

From d6158427c5cdecea8569441c71c59bb892304380 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 31 Oct 2019 22:33:36 +0000
Subject: [PATCH 095/232] JS: Generalize SanitizerFunction to data flow configs
 and flow labels

---
 .../javascript/dataflow/Configuration.qll     | 169 +++++++++++++++---
 .../javascript/dataflow/TaintTracking.qll     |  89 +--------
 2 files changed, 145 insertions(+), 113 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
index 568c1c92eab..68771406006 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -147,7 +147,7 @@ abstract class Configuration extends string {
    */
   predicate isBarrier(DataFlow::Node node) {
     exists(BarrierGuardNode guard |
-      isBarrierGuard(guard) and
+      isBarrierGuardInternal(guard) and
       guard.internalBlocks(node, "")
     )
   }
@@ -181,7 +181,7 @@ abstract class Configuration extends string {
    */
   predicate isLabeledBarrier(DataFlow::Node node, FlowLabel lbl) {
     exists(BarrierGuardNode guard |
-      isBarrierGuard(guard) and
+      isBarrierGuardInternal(guard) and
       guard.internalBlocks(node, lbl)
     )
     or
@@ -198,6 +198,12 @@ abstract class Configuration extends string {
    */
   predicate isBarrierGuard(BarrierGuardNode guard) { none() }
 
+  private predicate isBarrierGuardInternal(BarrierGuardNode guard) {
+    isBarrierGuard(guard)
+    or
+    guard.(AdditionalBarrierGuardNode).appliesTo(this)
+  }
+
   /**
    * Holds if data may flow from `source` to `sink` for this configuration.
    */
@@ -304,7 +310,7 @@ abstract class BarrierGuardNode extends DataFlow::Node {
       forex(SsaVariable input | input = ref.getAnInput() |
         asExpr() = ref.getGuard().getTest() and
         outcome = ref.getGuard().(ConditionGuardNode).getOutcome() and
-        internalBlocksExpr(outcome, input.getAUse(), label)
+        barrierGuardBlocksExpr(this, outcome, input.getAUse(), label)
       )
     )
     or
@@ -313,33 +319,11 @@ abstract class BarrierGuardNode extends DataFlow::Node {
       nd = DataFlow::valueNode(p.getAnInstanceIn(bb)) and
       asExpr() = cond.getTest() and
       outcome = cond.getOutcome() and
-      internalBlocksAccessPath(outcome, p, label) and
+      barrierGuardBlocksAccessPath(this, outcome, p, label) and
       cond.dominates(bb)
     )
   }
 
-  /**
-   * Holds if data flow node `nd` acts as a barrier for data flow.
-   *
-   * `label` is bound to the blocked label, or the empty string if all labels should be blocked.
-   */
-  private predicate internalBlocksExpr(boolean outcome, Expr test, string label) {
-    blocks(outcome, test) and label = ""
-    or
-    blocks(outcome, test, label)
-  }
-
-  /**
-   * Holds if data flow node `nd` acts as a barrier for data flow due to aliasing through
-   * an access path.
-   *
-   * `label` is bound to the blocked label, or the empty string if all labels should be blocked.
-   */
-  pragma[noinline]
-  private predicate internalBlocksAccessPath(boolean outcome, AccessPath ap, string label) {
-    internalBlocksExpr(outcome, ap.getAnInstance(), label)
-  }
-
   /**
    * Holds if this node blocks expression `e` provided it evaluates to `outcome`.
    *
@@ -353,6 +337,32 @@ abstract class BarrierGuardNode extends DataFlow::Node {
   predicate blocks(boolean outcome, Expr e, FlowLabel label) { none() }
 }
 
+/**
+  * Holds if data flow node `nd` acts as a barrier for data flow.
+  *
+  * `label` is bound to the blocked label, or the empty string if all labels should be blocked.
+  */
+private predicate barrierGuardBlocksExpr(BarrierGuardNode guard, boolean outcome, Expr test, string label) {
+  guard.blocks(outcome, test) and label = ""
+  or
+  guard.blocks(outcome, test, label)
+  or
+  // Handle labelled barrier guard functions specially, to avoid negative recursion
+  // through the non-abstract 3-argument version of blocks().
+  guard.(AdditionalBarrierGuardCall).internalBlocksLabel(outcome, test, label)
+}
+
+/**
+  * Holds if data flow node `nd` acts as a barrier for data flow due to aliasing through
+  * an access path.
+  *
+  * `label` is bound to the blocked label, or the empty string if all labels should be blocked.
+  */
+pragma[noinline]
+private predicate barrierGuardBlocksAccessPath(BarrierGuardNode guard, boolean outcome, AccessPath ap, string label) {
+  barrierGuardBlocksExpr(guard, outcome, ap.getAnInstance(), label)
+}
+
 /**
  * A guard node that only blocks specific labels.
  */
@@ -1186,3 +1196,110 @@ module PathGraph {
     not pred = finalMidNode(succ)
   }
 }
+
+
+
+/**
+  * Gets an operand of the given `&&` operator.
+  *
+  * We use this to construct the transitive closure over a relation
+  * that does not include all of `BinaryExpr.getAnOperand`.
+  */
+private Expr getALogicalAndOperand(LogAndExpr e) {
+  result = e.getAnOperand()
+}
+
+/**
+  * Gets an operand of the given `||` operator.
+  *
+  * We use this to construct the transitive closure over a relation
+  * that does not include all of `BinaryExpr.getAnOperand`.
+  */
+private Expr getALogicalOrOperand(LogOrExpr e) {
+  result = e.getAnOperand()
+}
+
+/**
+ * A `BarrierGuardNode` that controls which data flow
+ * configurations it is used in.
+ *
+ * Note: For performance reasons, all subclasses of this class should be part
+ * of the standard library. Override `Configuration::isBarrierGuard`
+ * for analysis-specific barrier guards.
+ */
+abstract class AdditionalBarrierGuardNode extends BarrierGuardNode {
+  abstract predicate appliesTo(Configuration cfg);
+}
+
+/**
+  * A function that returns the result of a barrier guard.
+  */
+private class BarrierGuardFunction extends Function {
+  DataFlow::ParameterNode sanitizedParameter;
+  BarrierGuardNode guard;
+  boolean guardOutcome;
+  string label;
+
+  BarrierGuardFunction() {
+    exists(Expr e |
+      exists(Expr returnExpr |
+        returnExpr = guard.asExpr()
+        or
+        // ad hoc support for conjunctions:
+        getALogicalAndOperand+(returnExpr) = guard.asExpr() and guardOutcome = true
+        or
+        // ad hoc support for disjunctions:
+        getALogicalOrOperand+(returnExpr) = guard.asExpr() and guardOutcome = false
+      |
+        exists(SsaExplicitDefinition ssa |
+          ssa.getDef().getSource() = returnExpr and
+          ssa.getVariable().getAUse() = getAReturnedExpr()
+        )
+        or
+        returnExpr = getAReturnedExpr()
+      ) and
+      sanitizedParameter.flowsToExpr(e) and
+      barrierGuardBlocksExpr(guard, guardOutcome, e, label)
+    ) and
+    getNumParameter() = 1 and
+    sanitizedParameter.getParameter() = getParameter(0)
+  }
+
+  /**
+    * Holds if this function sanitizes argument `e` of call `call`, provided the call evaluates to `outcome`.
+    */
+  predicate isBarrierCall(DataFlow::CallNode call, Expr e, boolean outcome, string lbl) {
+    exists(DataFlow::Node arg |
+      arg.asExpr() = e and
+      arg = call.getArgument(0) and
+      call.getNumArgument() = 1 and
+      argumentPassing(call, arg, this, sanitizedParameter) and
+      outcome = guardOutcome and
+      lbl = label
+    )
+  }
+
+  /**
+    * Holds if this function applies to the flow in `cfg`.
+    */
+  predicate appliesTo(Configuration cfg) { cfg.isBarrierGuard(guard) }
+}
+
+/**
+  * A call that sanitizes an argument.
+  */
+private class AdditionalBarrierGuardCall extends AdditionalBarrierGuardNode, DataFlow::CallNode {
+  BarrierGuardFunction f;
+
+  AdditionalBarrierGuardCall() { f.isBarrierCall(this, _, _, _) }
+
+  override predicate blocks(boolean outcome, Expr e) {
+    f.isBarrierCall(this, e, outcome, "")
+  }
+
+  predicate internalBlocksLabel(boolean outcome, Expr e, DataFlow::FlowLabel label) {
+    f.isBarrierCall(this, e, outcome, label)
+  }
+
+  override predicate appliesTo(Configuration cfg) { f.appliesTo(cfg) }
+}
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
index 41afdb653f7..43a04c55363 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -133,8 +133,8 @@ module TaintTracking {
    * configurations it is used in.
    *
    * Note: For performance reasons, all subclasses of this class should be part
-   * of the standard library. Override `Configuration::isSanitizer`
-   * for analysis-specific taint steps.
+   * of the standard library. Override `Configuration::isSanitizerGuard`
+   * for analysis-specific taint sanitizer guards.
    */
   abstract class AdditionalSanitizerGuardNode extends SanitizerGuardNode {
     /**
@@ -846,91 +846,6 @@ module TaintTracking {
     override predicate appliesTo(Configuration cfg) { any() }
   }
 
-  /**
-   * Gets an operand of the given `&&` operator.
-   *
-   * We use this to construct the transitive closure over a relation
-   * that does not include all of `BinaryExpr.getAnOperand`.
-   */
-  private Expr getALogicalAndOperand(LogAndExpr e) {
-    result = e.getAnOperand()
-  }
-
-  /**
-   * Gets an operand of the given `||` operator.
-   *
-   * We use this to construct the transitive closure over a relation
-   * that does not include all of `BinaryExpr.getAnOperand`.
-   */
-  private Expr getALogicalOrOperand(LogOrExpr e) {
-    result = e.getAnOperand()
-  }
-
-  /**
-   * A function that returns the result of a sanitizer check.
-   */
-  private class SanitizingFunction extends Function {
-    DataFlow::ParameterNode sanitizedParameter;
-    SanitizerGuardNode sanitizer;
-    boolean sanitizerOutcome;
-
-    SanitizingFunction() {
-      exists(Expr e |
-        exists(Expr returnExpr |
-          returnExpr = sanitizer.asExpr()
-          or
-          // ad hoc support for conjunctions:
-          getALogicalAndOperand+(returnExpr) = sanitizer.asExpr() and sanitizerOutcome = true
-          or
-          // ad hoc support for disjunctions:
-          getALogicalOrOperand+(returnExpr) = sanitizer.asExpr() and sanitizerOutcome = false
-        |
-          exists(SsaExplicitDefinition ssa |
-            ssa.getDef().getSource() = returnExpr and
-            ssa.getVariable().getAUse() = getAReturnedExpr()
-          )
-          or
-          returnExpr = getAReturnedExpr()
-        ) and
-        sanitizedParameter.flowsToExpr(e) and
-        sanitizer.sanitizes(sanitizerOutcome, e)
-      ) and
-      getNumParameter() = 1 and
-      sanitizedParameter.getParameter() = getParameter(0)
-    }
-
-    /**
-     * Holds if this function sanitizes argument `e` of call `call`, provided the call evaluates to `outcome`.
-     */
-    predicate isSanitizingCall(DataFlow::CallNode call, Expr e, boolean outcome) {
-      exists(DataFlow::Node arg |
-        arg.asExpr() = e and
-        arg = call.getArgument(0) and
-        call.getNumArgument() = 1 and
-        FlowSteps::argumentPassing(call, arg, this, sanitizedParameter) and
-        outcome = sanitizerOutcome
-      )
-    }
-
-    /**
-     * Holds if this function applies to the flow in `cfg`.
-     */
-    predicate appliesTo(Configuration cfg) { cfg.isBarrierGuard(sanitizer) }
-  }
-
-  /**
-   * A call that sanitizes an argument.
-   */
-  private class AdditionalSanitizingCall extends AdditionalSanitizerGuardNode, DataFlow::CallNode {
-    SanitizingFunction f;
-
-    AdditionalSanitizingCall() { f.isSanitizingCall(this, _, _) }
-
-    override predicate sanitizes(boolean outcome, Expr e) { f.isSanitizingCall(this, e, outcome) }
-
-    override predicate appliesTo(Configuration cfg) { f.appliesTo(cfg) }
-  }
-
   /**
    * An equality test on `e.origin` or `e.source` where `e` is a `postMessage` event object,
    * considered as a sanitizer for `e`.

From f48d16fcb7450579e4e36e6eaa1a1d8547eed4ef Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 1 Nov 2019 15:22:03 +0000
Subject: [PATCH 096/232] JS: Support barrier guards that are reflective calls

---
 .../semmle/javascript/dataflow/Configuration.qll   | 11 +++++++++--
 .../ql/src/semmle/javascript/dataflow/DataFlow.qll |  9 +++++++++
 .../TaintTracking/BasicTaintTracking.expected      |  2 ++
 .../TaintTracking/BasicTaintTracking.ql            |  6 +++++-
 .../TaintTracking/DataFlowTracking.expected        |  3 +++
 .../TaintTracking/sanitizer-guards.js              | 14 ++++++++++++++
 6 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
index 68771406006..11cfb24376e 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -308,7 +308,7 @@ abstract class BarrierGuardNode extends DataFlow::Node {
     exists(SsaRefinementNode ref, boolean outcome |
       nd = DataFlow::ssaDefinitionNode(ref) and
       forex(SsaVariable input | input = ref.getAnInput() |
-        asExpr() = ref.getGuard().getTest() and
+        getExpr() = ref.getGuard().getTest() and
         outcome = ref.getGuard().(ConditionGuardNode).getOutcome() and
         barrierGuardBlocksExpr(this, outcome, input.getAUse(), label)
       )
@@ -317,13 +317,20 @@ abstract class BarrierGuardNode extends DataFlow::Node {
     // 2) `nd` is an instance of an access path `p`, and dominated by a barrier for `p`
     exists(AccessPath p, BasicBlock bb, ConditionGuardNode cond, boolean outcome |
       nd = DataFlow::valueNode(p.getAnInstanceIn(bb)) and
-      asExpr() = cond.getTest() and
+      getExpr() = cond.getTest() and
       outcome = cond.getOutcome() and
       barrierGuardBlocksAccessPath(this, outcome, p, label) and
       cond.dominates(bb)
     )
   }
 
+  /** Gets the corresponding expression, including that of reflective calls. */
+  private Expr getExpr() {
+    result = asExpr()
+    or
+    this = DataFlow::reflectiveCallNode(result)
+  }
+
   /**
    * Holds if this node blocks expression `e` provided it evaluates to `outcome`.
    *
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 8798df6cc37..0faecc01109 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -932,6 +932,15 @@ module DataFlow {
    */
   DataFlow::Node globalAccessPathRootPseudoNode() { result instanceof TGlobalAccessPathRoot }
 
+  /**
+   * Gets a data flow node representing the underlying call performed by the given
+   * call to `Function.prototype.call` or `Function.prototype.apply`.
+   *
+   * For example, for an expression `fn.call(x, y)`, this gets a call node with `fn` as the
+   * callee, `x` as the receiver, and `y` as the first argument.
+   */
+  DataFlow::InvokeNode reflectiveCallNode(InvokeExpr expr) { result = TReflectiveCallNode(expr, _) }
+
   /**
    * Provides classes representing various kinds of calls.
    *
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index df1d6306feb..93dc5e6e200 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -75,6 +75,8 @@ typeInferenceMismatch
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:26:9:26:14 | this.x |
+| sanitizer-guards.js:43:11:43:18 | source() | sanitizer-guards.js:45:8:45:8 | x |
+| sanitizer-guards.js:43:11:43:18 | source() | sanitizer-guards.js:48:10:48:10 | x |
 | spread.js:2:15:2:22 | source() | spread.js:4:8:4:19 | { ...taint } |
 | spread.js:2:15:2:22 | source() | spread.js:5:8:5:43 | { f: 'h ... orld' } |
 | spread.js:2:15:2:22 | source() | spread.js:7:8:7:19 | [ ...taint ] |
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.ql b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.ql
index 0b1d5d9da84..26c66a1b4fe 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.ql
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.ql
@@ -1,7 +1,11 @@
 import javascript
 import semmle.javascript.dataflow.InferredTypes
 
-DataFlow::CallNode getACall(string name) { result.getCalleeName() = name }
+DataFlow::CallNode getACall(string name) {
+  result.getCalleeName() = name
+  or
+  result.getCalleeNode().getALocalSource() = DataFlow::globalVarRef(name)
+}
 
 class Sink extends DataFlow::Node {
   Sink() { this = getACall("sink").getAnArgument() }
diff --git a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
index f3023ad44da..f2799d763fd 100644
--- a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
@@ -50,6 +50,9 @@
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:26:9:26:14 | this.x |
+| sanitizer-guards.js:43:11:43:18 | source() | sanitizer-guards.js:45:8:45:8 | x |
+| sanitizer-guards.js:43:11:43:18 | source() | sanitizer-guards.js:48:10:48:10 | x |
+| sanitizer-guards.js:43:11:43:18 | source() | sanitizer-guards.js:52:10:52:10 | x |
 | thisAssignments.js:4:17:4:24 | source() | thisAssignments.js:5:10:5:18 | obj.field |
 | thisAssignments.js:7:19:7:26 | source() | thisAssignments.js:8:10:8:20 | this.field2 |
 | tst.js:2:13:2:20 | source() | tst.js:4:10:4:10 | x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/sanitizer-guards.js b/javascript/ql/test/library-tests/TaintTracking/sanitizer-guards.js
index 494e828460d..03d6a9aedd7 100644
--- a/javascript/ql/test/library-tests/TaintTracking/sanitizer-guards.js
+++ b/javascript/ql/test/library-tests/TaintTracking/sanitizer-guards.js
@@ -38,3 +38,17 @@ class C {
 	});
   }
 }
+
+function reflective() {
+  let x = source();
+
+  sink(x); // NOT OK
+
+  if (isSafe.call(x)) {
+    sink(x); // NOT OK - `isSafe` does not sanitize the receiver
+  }
+
+  if (isSafe.call(null, x)) {
+    sink(x); // OK
+  }
+}

From fa203254ce09661d52db689e4f5a388f0acf69b7 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 17:09:42 +0000
Subject: [PATCH 097/232] CPP: Add test cases.

---
 .../TlsSettingsMisconfiguration.expected      | 11 ++++
 .../Likely Bugs/Protocols/boostorg/test2.cpp  | 55 +++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/test2.cpp

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.expected b/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.expected
index 8a3acb1aeb5..c6883e156d1 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.expected	
@@ -1,3 +1,14 @@
+| test2.cpp:15:32:15:33 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:15:32:15:33 | call to context | boost::asio::ssl::context::context | test2.cpp:14:40:14:72 | sslv23 | sslv23 | test2.cpp:15:32:15:33 | call to context | no_sslv3 has not been set |
+| test2.cpp:23:32:23:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:23:32:23:65 | call to context | boost::asio::ssl::context::context | test2.cpp:23:32:23:64 | sslv23 | sslv23 | test2.cpp:23:32:23:65 | call to context | no_sslv3 has not been set |
+| test2.cpp:23:32:23:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:23:32:23:65 | call to context | boost::asio::ssl::context::context | test2.cpp:23:32:23:64 | sslv23 | sslv23 | test2.cpp:23:32:23:65 | call to context | no_tlsv1 has not been set |
+| test2.cpp:23:32:23:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:23:32:23:65 | call to context | boost::asio::ssl::context::context | test2.cpp:23:32:23:64 | sslv23 | sslv23 | test2.cpp:23:32:23:65 | call to context | no_tlsv1_1 has not been set |
+| test2.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test2.cpp:31:32:31:64 | sslv23 | sslv23 | test2.cpp:31:32:31:65 | call to context | no_sslv3 has not been set |
+| test2.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test2.cpp:31:32:31:64 | sslv23 | sslv23 | test2.cpp:31:32:31:65 | call to context | no_tlsv1 has not been set |
+| test2.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test2.cpp:31:32:31:64 | sslv23 | sslv23 | test2.cpp:31:32:31:65 | call to context | no_tlsv1_1 has not been set |
+| test2.cpp:45:35:45:98 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:45:35:45:98 | call to context | boost::asio::ssl::context::context | test2.cpp:45:65:45:97 | sslv23 | sslv23 | test2.cpp:45:35:45:98 | call to context | no_sslv3 has not been set |
+| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_sslv3 has not been set |
+| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_tlsv1 has not been set |
+| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_tlsv1_1 has not been set |
 | test.cpp:25:32:25:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:25:32:25:65 | call to context | boost::asio::ssl::context::context | test.cpp:25:32:25:64 | sslv23 | sslv23 | test.cpp:25:32:25:65 | call to context | no_sslv3 has not been set |
 | test.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test.cpp:31:32:31:64 | sslv23 | sslv23 | test.cpp:31:32:31:65 | call to context | no_sslv3 has not been set |
 | test.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test.cpp:31:32:31:64 | sslv23 | sslv23 | test.cpp:31:32:31:65 | call to context | no_tlsv1 has not been set |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/test2.cpp b/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/test2.cpp
new file mode 100644
index 00000000000..5679cee8b0f
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/boostorg/test2.cpp	
@@ -0,0 +1,55 @@
+#include "asio/boost_simulation.hpp"
+
+void good1()
+{
+	// GOOD
+	boost::asio::ssl::context::method m = boost::asio::ssl::context::sslv23;
+	boost::asio::ssl::context ctx(m);
+	ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1 | boost::asio::ssl::context::no_sslv3);
+}
+
+void bad1()
+{
+	// BAD: missing disable SSLv3
+	boost::asio::ssl::context::method m = boost::asio::ssl::context::sslv23;
+	boost::asio::ssl::context ctx(m);
+	ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1);
+}
+
+void good2()
+{
+	// GOOD [FALSE POSITIVE x 3]
+	boost::asio::ssl::context::options opts = boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1 | boost::asio::ssl::context::no_sslv3;
+	boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23);
+	ctx.set_options(opts);
+}
+
+void bad2()
+{
+	// BAD: missing disable SSLv3 [WITH FALSE POSITIVE x 2]
+	boost::asio::ssl::context::options opts = boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1;
+	boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23);
+	ctx.set_options(opts);
+}
+
+void good3()
+{
+	// GOOD
+	boost::asio::ssl::context *ctx = new boost::asio::ssl::context(boost::asio::ssl::context::sslv23);
+	ctx->set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1 | boost::asio::ssl::context::no_sslv3);
+}
+
+void bad3()
+{
+	// BAD: missing disable SSLv3
+	boost::asio::ssl::context *ctx = new boost::asio::ssl::context(boost::asio::ssl::context::sslv23);
+	ctx->set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1);
+}
+
+void bad4()
+{
+	// BAD: missing disable SSLv3
+	boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23);
+}
+
+

From 6a865ed580c3dfdfedb0236f9067206421b37d4c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 15:03:10 +0000
Subject: [PATCH 098/232] CPP: De-duplicate TlsSettingsMisconfiguration.ql.

---
 .../boostorg/TlsSettingsMisconfiguration.ql   | 25 ++-----------------
 1 file changed, 2 insertions(+), 23 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 83ed90bafab..0089221799c 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -46,29 +46,8 @@ predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
 
 bindingset[flag]
 predicate isOptionNotSet(ConstructorCall cc, int flag) {
-  not exists(
-    BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
-    Expr optionsSink
-  |
-    config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
-    exists(VariableAccess contextSetOptions |
-      testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
-      exists(FunctionCall fcSetOptions, BoostorgAsio::SslSetOptionsFunction f |
-        f.getACallToThisFunction() = fcSetOptions
-      |
-        contextSetOptions = fcSetOptions.getQualifier() and
-        forall(
-          Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
-          Expr optionArgumentSource
-        |
-          optionArgument = fcSetOptions.getArgument(0) and
-          optionArgConfig
-              .hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
-        |
-          optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
-        )
-      )
-    )
+  not exists(FunctionCall fcSetOptions |
+    isOptionSet(cc, flag, fcSetOptions)
   )
 }
 

From c08493670b56d1ac019161e676f766c930942df7 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 15:09:25 +0000
Subject: [PATCH 099/232] CPP: Speed up ExistsAnyFlowConfig.

---
 .../Protocols/boostorg/TlsSettingsMisconfiguration.ql     | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 0089221799c..1a5dbfb74fc 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -13,7 +13,9 @@ import semmle.code.cpp.security.boostorg.asio.protocols
 class ExistsAnyFlowConfig extends DataFlow::Configuration {
   ExistsAnyFlowConfig() { this = "ExistsAnyFlowConfig" }
 
-  override predicate isSource(DataFlow::Node source) { any() }
+  override predicate isSource(DataFlow::Node source) {
+  	source.asExpr() instanceof ConstructorCall
+  }
 
   override predicate isSink(DataFlow::Node sink) { any() }
 }
@@ -21,12 +23,12 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
 bindingset[flag]
 predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
   exists(
-    BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
+    BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig anyFlowConfig,
     Expr optionsSink
   |
     config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
     exists(VariableAccess contextSetOptions |
-      testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
+      anyFlowConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
       exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
         contextSetOptions = fcSetOptions.getQualifier() and
         forall(

From 98b9afd83f772e45f9c3c44cdb8211eef0d01446 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 15:19:36 +0000
Subject: [PATCH 100/232] CPP: Remove apparently irrelevant parts of the query.

This is not strictly behaviour preserving, but I believe the parts I've removed or simplified weren't intended to do what they were doing.
---
 .../boostorg/TlsSettingsMisconfiguration.ql      | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 1a5dbfb74fc..369dbf77973 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -22,11 +22,9 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
 
 bindingset[flag]
 predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
-  exists(
-    BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig anyFlowConfig,
-    Expr optionsSink
+  exists(BoostorgAsio::SslContextClass c, ExistsAnyFlowConfig anyFlowConfig
   |
-    config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
+    c.getAContructorCall() = cc and
     exists(VariableAccess contextSetOptions |
       anyFlowConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
       exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
@@ -55,15 +53,14 @@ predicate isOptionNotSet(ConstructorCall cc, int flag) {
 
 from
   BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
-  BoostorgAsio::SslContextFlowsToSetOptionConfig config, Expr protocolSource, Expr protocolSink,
-  ConstructorCall cc, Expr e, string msg
+  Expr protocolSource, Expr protocolSink,
+  BoostorgAsio::SslContextClass c, ConstructorCall cc, Expr e, string msg
 where
   configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
   cc.getArgument(0) = protocolSink and
   (
     BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
-    not exists(Expr optionsSink |
-      config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
+    not (
       isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3(), _) and
       isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
       isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
@@ -72,8 +69,7 @@ where
     or
     BoostorgAsio::isExprTlsBoostProtocol(protocolSource) and
     not BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
-    not exists(Expr optionsSink |
-      config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
+    not (
       isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
       isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
       isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())

From 08293d00095c4f01b8b1fe067b3716291c5a08a1 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 17:56:22 +0000
Subject: [PATCH 101/232] CPP: Simplify.

---
 .../boostorg/TlsSettingsMisconfiguration.ql   | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 369dbf77973..6c2026c83d6 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -14,7 +14,9 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
   ExistsAnyFlowConfig() { this = "ExistsAnyFlowConfig" }
 
   override predicate isSource(DataFlow::Node source) {
-  	source.asExpr() instanceof ConstructorCall
+  	exists(BoostorgAsio::SslContextClass c |
+  	  c.getAContructorCall() = source.asExpr()
+ 	)
   }
 
   override predicate isSink(DataFlow::Node sink) { any() }
@@ -22,23 +24,19 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
 
 bindingset[flag]
 predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
-  exists(BoostorgAsio::SslContextClass c, ExistsAnyFlowConfig anyFlowConfig
-  |
-    c.getAContructorCall() = cc and
-    exists(VariableAccess contextSetOptions |
-      anyFlowConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
-      exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
-        contextSetOptions = fcSetOptions.getQualifier() and
-        forall(
-          Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
-          Expr optionArgumentSource
-        |
-          optionArgument = fcSetOptions.getArgument(0) and
-          optionArgConfig
-              .hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
-        |
-          optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
-        )
+  exists(ExistsAnyFlowConfig anyFlowConfig, VariableAccess contextSetOptions |
+    anyFlowConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
+    exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
+      contextSetOptions = fcSetOptions.getQualifier() and
+      forall(
+        Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
+        Expr optionArgumentSource
+      |
+        optionArgument = fcSetOptions.getArgument(0) and
+        optionArgConfig
+            .hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
+      |
+        optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
       )
     )
   )
@@ -54,7 +52,7 @@ predicate isOptionNotSet(ConstructorCall cc, int flag) {
 from
   BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
   Expr protocolSource, Expr protocolSink,
-  BoostorgAsio::SslContextClass c, ConstructorCall cc, Expr e, string msg
+  ConstructorCall cc, Expr e, string msg
 where
   configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
   cc.getArgument(0) = protocolSink and

From c2812197a96059247677c7bfd3f62aab9b675bf0 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 1 Nov 2019 18:16:12 +0000
Subject: [PATCH 102/232] CPP: Further speedup.

---
 .../Protocols/boostorg/TlsSettingsMisconfiguration.ql      | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 6c2026c83d6..85f4ca1a860 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -19,7 +19,12 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
  	)
   }
 
-  override predicate isSink(DataFlow::Node sink) { any() }
+  override predicate isSink(DataFlow::Node sink) {
+  	exists(BoostorgAsio::SslSetOptionsFunction f, FunctionCall fcSetOptions |
+  	  f.getACallToThisFunction() = fcSetOptions and
+  	  fcSetOptions.getQualifier() = sink.asExpr()
+  	)
+  }
 }
 
 bindingset[flag]

From 2bad9394b7d909186bb8977ce147982c36d00041 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Fri, 1 Nov 2019 15:24:22 -0700
Subject: [PATCH 103/232] [CPP-434] Squelch alerts for expressions inside
 macros; try to make Qhelp Jenkins-friendly.

---
 .../Arithmetic/SignedOverflowCheck.qhelp      | 46 +++++++++----------
 .../Arithmetic/SignedOverflowCheck.ql         |  1 +
 .../SignedOverflowCheck.cpp                   |  7 +++
 3 files changed, 31 insertions(+), 23 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index da7f86f021b..302fbd4ed23 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -24,81 +24,81 @@ into unsigned form.
 
 The table below lists various expressions where signed overflow may
 occur, along with proposed rewritings.  It should not be
-considered as exhaustive.
+considered exhaustive.
 </p>
 <table>
-  <tr>
+  <thead><tr>
     <th>Original Construct</th>
     <th>Alternate Construct(s)</th>
     <th>Notes</th>
-  </tr>
-  <tr>
+  </tr></thead>
+  <tbody><tr>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>unsigned short i, delta;</td>
       </tr><tr>
         <td>i + delta &lt; i</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>unsigned short i, delta;</td>
       </tr><tr>
         <td>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
     <td><tt>i + delta</tt>does not actually overflow due to <tt>int</tt> promotion</td>
   </tr>
   <tr>
     <td>&nbsp;</td>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>unsigned short i, delta;</td>
       </tr><tr>
         <td>i > USHORT_MAX - delta</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
-    <td>Must include <tt>limits.h</tt> or <tt>climits</tt></td>
+    <td>Must include <tt>limits.h</tt> or <tt>climits</tt>; <tt>delta &gt; 0</tt></td>
   </tr>
   <tr>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>int i, delta;</td>
       </tr><tr>
         <td>i + delta &lt; i</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>int i, delta;</td>
       </tr><tr>
         <td>i &gt; INT_MAX - delta</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
-    <td>Must include <tt>limits.h</tt> or <tt>climits</tt></td>
+    <td>Must include <tt>limits.h</tt> or <tt>climits</tt>; <tt>delta &gt; 0</tt></td>
   </tr>
   <tr>
     <td>&nbsp;</td>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>int i, delta;</td>
       </tr><tr>
         <td>(unsigned)i + delta &lt; i</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
     <td>Change in program semantics</td>
   </tr>
   <tr>
     <td>&nbsp;</td>
     <td><tt><table>
-      <tr>
+      <tbody><tr>
         <td>unsigned int i, delta;</td>
       </tr><tr>
         <td>i + delta &lt; i</td>
-      </tr>
+      </tr></tbody>
     </table></tt></td>
     <td>Change in program semantics</td>
-  </tr>
+  </tr></tbody>
 </table>
 </recommendation>
 <example>
@@ -131,7 +131,7 @@ narrower <code>short</code> type, the addition is guaranteed not to overflow
 and is therefore defined.  But the fact that <code>n1 + delta</code> never 
 overflows means that the condition <code>n1 + delta &lt; n1</code> will never
 hold true, which likely is not what the programmer intended. (see also the
-<code>BadArithmeticOverflow.Check.ql</code> query).
+<code>cpp/bad-addition-overflow-check</code> query).
 </p>
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
@@ -147,6 +147,6 @@ the right-hand side does not need to be promoted to a <code>signed int</code>.
 <references>
 <li><a href="http://c-faq.com/expr/preservingrules.html">comp.lang.c FAQ list · Question 3.19 (Preserving rules)</a></li>
 <li><a href="https://wiki.sei.cmu.edu/confluence/display/c/INT31-C.+Ensure+that+integer+conversions+do+not+result+in+lost+or+misinterpreted+data">INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data</a></li>
-<li>W. Dietz,∗ P. Li, J. Regehr, V. Adve. <a href="http://www.cs.utah.edu/~regehr/papers/overflow12.pdf">Understanding Integer Overflow in C/C++</a></li>
+<li>W. Dietz, P. Li, J. Regehr, V. Adve. <a href="https://www.cs.utah.edu/~regehr/papers/overflow12.pdf">Understanding Integer Overflow in C/C++</a></li>
 </references>
 </qhelp>
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index 7ea5df5da64..bd79a114172 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -22,5 +22,6 @@ where
   ro.getAnOperand() = expr2 and
   globalValueNumber(expr1) = globalValueNumber(expr2) and
   add.getUnspecifiedType().(IntegralType).isSigned() and
+  not exists(MacroInvocation mi | mi.getAnAffectedElement() = add) and
   exprMightOverflowPositively(add)
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
index bbfb1c3fad8..e359fb098eb 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp	
@@ -121,3 +121,10 @@ int overflow12b(int n) {
     // not deleted by gcc or clang
 	return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // BAD: n + 32 may overflow
 }
+
+#define MACRO(E1, E2) (E1) <= (E2)? -1: 1
+
+int overflow12_macro(int n) {
+	return MACRO((unsigned)(n + 32), (unsigned)n); // GOOD: inside a macro expansion
+}
+

From fb4dac597c819df53d29ecf6b9c19553e0a0d1a4 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@knef.dk>
Date: Sun, 3 Nov 2019 16:21:21 +0100
Subject: [PATCH 104/232] C++: Minimal caching of the IR type system

This was the minimal amount of predicates I could easily cache without
introducing extra cached stages. The predicates that are not cached
here, like `CppType::getTypeSize` and `getCanonicalLanguageType`, appear
to be cheap.

I've tested that this avoids recomputation of the IR type system by
running

    grep -c 'Starting to evaluate predicate CppType::CppType::getIRType_dispred'

on the evaluator log for `IRSanity.ql`. It drops from 4 to 1. The
pretty-printed DIL drops from 79,175 lines to 76,326 lines.
---
 cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll | 1 +
 cpp/ql/src/semmle/code/cpp/ir/internal/CppType.qll      | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
index 0abfa14023d..5534ed20914 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
@@ -4,6 +4,7 @@
 
 private import internal.IRTypeInternal
 
+cached
 private newtype TIRType =
   TIRVoidType() or
   TIRUnknownType() or
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/CppType.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/CppType.qll
index 88184d90345..e967dc9920c 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/internal/CppType.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/CppType.qll
@@ -175,6 +175,7 @@ private IRType getIRTypeForPRValue(Type type) {
   )
 }
 
+cached
 private newtype TCppType =
   TPRValueType(Type type) { exists(getIRTypeForPRValue(type)) } or
   TFunctionGLValueType() or
@@ -203,6 +204,7 @@ class CppType extends TCppType {
    * Gets the `IRType` that represents this `CppType`. Many different `CppType`s can map to a single
    * `IRType`.
    */
+  cached
   IRType getIRType() { none() }
 
   /**

From 508b09f565fa9338b8f77e73cbe2bb19ab31ce55 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <tom@semmle.com>
Date: Mon, 4 Nov 2019 13:43:39 +0100
Subject: [PATCH 105/232] C#: Address review comments

---
 change-notes/1.23/analysis-csharp.md                          | 4 ++--
 .../src/Security Features/CWE-502/UnsafeDeserialization.qhelp | 2 +-
 .../CWE-502/UnsafeDeserializationUntrustedInput.qhelp         | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/change-notes/1.23/analysis-csharp.md b/change-notes/1.23/analysis-csharp.md
index f81007a2fc9..c60c32ba029 100644
--- a/change-notes/1.23/analysis-csharp.md
+++ b/change-notes/1.23/analysis-csharp.md
@@ -9,9 +9,9 @@ The following changes in version 1.23 affect C# analysis in all applications.
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
 | Deserialized delegate (`cs/deserialized-delegate`) | security, external/cwe/cwe-502 | Finds unsafe deserialization of delegate types. |
-| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security | Finds flow of untrusted input to calls to unsafe deserializers. |
+| Deserialization of untrusted data (`cs/unsafe-deserialization-untrusted-input`) | security, external/cwe/cwe-502 | Finds flow of untrusted input to calls to unsafe deserializers. |
 | Unsafe year argument for 'DateTime' constructor (`cs/unsafe-year-construction`) | reliability, date-time | Finds incorrect manipulation of `DateTime` values, which could lead to invalid dates. |
-| Unsafe deserializer (`cs/unsafe-deserialization`) | security | Finds calls to unsafe deserializers. |
+| Unsafe deserializer (`cs/unsafe-deserialization`) | security, external/cwe/cwe-502 | Finds calls to unsafe deserializers. |
 | Mishandling the Japanese era start date (`cs/mishandling-japanese-era`) | reliability, date-time | Finds hard-coded Japanese era start dates that could be invalid. |
 
 ## Changes to existing queries
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp
index 7acfd20fe3a..3c68b74a1d9 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp	
@@ -5,7 +5,7 @@
 <overview>
 
 <p>Deserializing an object from untrusted input may result in security problems, such
-as denial-of-service or remote code execution.</p>
+as denial of service or remote code execution.</p>
 
 </overview>
 <recommendation>
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp
index ef946f40136..3ba934ba391 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp	
@@ -5,7 +5,7 @@
 <overview>
 
 <p>Deserializing an object from untrusted input may result in security problems, such
-as denial-of-service or remote code execution.</p>
+as denial of service or remote code execution.</p>
 
 </overview>
 <recommendation>

From 016808b92ea17a62abe3a29688cf6be02a97ec68 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Mon, 4 Nov 2019 17:00:12 +0000
Subject: [PATCH 106/232] JavaScript: Address review comments.

---
 change-notes/1.23/analysis-javascript.md                | 1 +
 javascript/ql/src/Security/CWE-116/DoubleEscaping.qhelp | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index aa9d2086d14..c87e16ce569 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -31,6 +31,7 @@
 
 | **Query**                      | **Expected impact**          | **Change**                                                                |
 |--------------------------------|------------------------------|---------------------------------------------------------------------------|
+| Double escaping or unescaping (`js/double-escaping`) | More results | This rule now detects additional escaping and unescaping functions. |
 | Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false-positive results | This rule now recognizes additional ways delimiters can be stripped away. |
 | Client-side cross-site scripting (`js/xss`) | More results, fewer false-positive results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected. |
 | Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized. |
diff --git a/javascript/ql/src/Security/CWE-116/DoubleEscaping.qhelp b/javascript/ql/src/Security/CWE-116/DoubleEscaping.qhelp
index 02cce7c5911..6c36fde4b28 100644
--- a/javascript/ql/src/Security/CWE-116/DoubleEscaping.qhelp
+++ b/javascript/ql/src/Security/CWE-116/DoubleEscaping.qhelp
@@ -10,8 +10,8 @@ attacks such as cross-site scripting. One particular example of this is HTML ent
 where HTML special characters are replaced by HTML character entities to prevent them from being
 interpreted as HTML markup. For example, the less-than character is encoded as <code>&amp;lt;</code>
 and the double-quote character as <code>&amp;quot;</code>.
-Other examples include backslash-escaping for including untrusted data in string literals and
-percent-encoding for URI components.
+Other examples include backslash escaping or JSON encoding for including untrusted data in string
+literals, and percent-encoding for URI components.
 </p>
 <p>
 The reverse process of replacing escape sequences with the characters they represent is known as

From 6cac9619d3faeaa47b1db702425731058517dcec Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 4 Nov 2019 18:44:13 +0100
Subject: [PATCH 107/232] add missing not

Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 77ec29ba9ee..59d88bc51a0 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -131,7 +131,7 @@ DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
 /**
  * Holds if `call` is an Array or Lodash method accepting a callback `func`,
  * where the `call` expects a callback that returns an expression, 
- * but `func` does return a value. 
+ * but `func` does not return a value. 
  */
 predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
   hasNonVoidCallbackMethod(call.getCalleeName()) and

From 8ebfe15f0d286139b370a0cc2f3016459c9b1520 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 4 Nov 2019 18:54:43 +0100
Subject: [PATCH 108/232] apply doc feedback from mchammer01

Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
---
 javascript/ql/src/Statements/IgnoreArrayResult.qhelp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
index 2232784d881..048ca6680fc 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
@@ -22,17 +22,17 @@ or <code>slice</code>.
 <example>
 
 <p>
-In the following example a function <code>extend</code> is defined. The 
+A function <code>extend</code> is defined in the following example. The 
 function uses the <code>concat</code> method to add elements to the 
 <code>arr</code> array. However, the <code>extend</code> function has no 
-effect as the return value from <code>concat</code> is ignored.
+effect as the return value from <code>concat</code> is ignored:
 </p>
 
 <sample src="examples/IgnoreArrayResult.js" />
 
 <p>
 Assigning the returned value from the call to <code>concat</code> to the 
-<code>arr</code> variable fixes the error.
+<code>arr</code> variable fixes the error:
 </p>
 
 <sample src="examples/IgnoreArrayResultFixed.js" />

From aa47e3f6d2ff7d45dac3d7b3a5c00b83d4da3931 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 4 Nov 2019 18:52:29 +0100
Subject: [PATCH 109/232] update change-note to reflect changed query

---
 change-notes/1.23/analysis-javascript.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 90f46403f26..e3421a3de45 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -23,7 +23,7 @@
 | Use of returnless function (`js/use-of-returnless-function`)              | maintainability, correctness                                      | Highlights calls where the return value is used, but the callee never returns a value. Results are shown on LGTM by default. |
 | Useless regular expression character escape (`js/useless-regexp-character-escape`) | correctness, security, external/cwe/cwe-20 | Highlights regular expression strings with useless character escapes, indicating a possible violation of [CWE-20](https://cwe.mitre.org/data/definitions/20.html). Results are shown on LGTM by default. |
 | Unreachable method overloads (`js/unreachable-method-overloads`)          | correctness, typescript                                           | Highlights method overloads that are impossible to use from client code. Results are shown on LGTM by default. |
-| Ignoring return from concat (`js/ignore-return-from-concat`)              | maintainability, correctness                                      | Highlights calls to the concat method on array where the return value is ignored. Results are shown on LGTM by default. |
+| Ignoring result from pure array method (`js/ignore-array-result`)         | maintainability, correctness                                      | Highlights calls to array methods without side effects where the return value is ignored. Results are shown on LGTM by default. |
 
 ## Changes to existing queries
 

From bdb81c268c22a92758c60cdea795459fab268f07 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 4 Nov 2019 18:56:03 +0100
Subject: [PATCH 110/232] change tense

---
 javascript/ql/src/Statements/IgnoreArrayResult.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
index 048ca6680fc..70e3cb4e5cc 100644
--- a/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
+++ b/javascript/ql/src/Statements/IgnoreArrayResult.qhelp
@@ -5,7 +5,7 @@
 <overview>
 <p>
 The <code>concat</code>, <code>join</code> and <code>slice</code> methods are
-pure and do not modify any of the inputs or the array the method was called 
+pure and do not modify any of the inputs or the array the method is called 
 on. It is therefore generally an error to ignore the return value from a call
 to one of these methods. 
 </p>

From ce8ba86f2d35df8e302dc7240d3f8e9e771a64eb Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Mon, 4 Nov 2019 12:30:52 -0800
Subject: [PATCH 111/232] [CPP-434] Use a bullet list instead of a table in
 order to placate Jenkins.

---
 .../Arithmetic/SignedOverflowCheck.qhelp      | 102 +++++-------------
 1 file changed, 27 insertions(+), 75 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 302fbd4ed23..a6f8f4dc373 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -22,85 +22,36 @@ categories: (1) rewrite the signed expression so that overflow cannot occur
 but the signedness remains, or (2) rewrite (or cast) the signed expression
 into unsigned form.
 
-The table below lists various expressions where signed overflow may
+The bullet list below lists various expressions where signed overflow may
 occur, along with proposed rewritings.  It should not be
 considered exhaustive.
 </p>
-<table>
-  <thead><tr>
-    <th>Original Construct</th>
-    <th>Alternate Construct(s)</th>
-    <th>Notes</th>
-  </tr></thead>
-  <tbody><tr>
-    <td><tt><table>
-      <tbody><tr>
-        <td>unsigned short i, delta;</td>
-      </tr><tr>
-        <td>i + delta &lt; i</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td><tt><table>
-      <tbody><tr>
-        <td>unsigned short i, delta;</td>
-      </tr><tr>
-        <td>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td><tt>i + delta</tt>does not actually overflow due to <tt>int</tt> promotion</td>
-  </tr>
-  <tr>
-    <td>&nbsp;</td>
-    <td><tt><table>
-      <tbody><tr>
-        <td>unsigned short i, delta;</td>
-      </tr><tr>
-        <td>i > USHORT_MAX - delta</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td>Must include <tt>limits.h</tt> or <tt>climits</tt>; <tt>delta &gt; 0</tt></td>
-  </tr>
-  <tr>
-    <td><tt><table>
-      <tbody><tr>
-        <td>int i, delta;</td>
-      </tr><tr>
-        <td>i + delta &lt; i</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td><tt><table>
-      <tbody><tr>
-        <td>int i, delta;</td>
-      </tr><tr>
-        <td>i &gt; INT_MAX - delta</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td>Must include <tt>limits.h</tt> or <tt>climits</tt>; <tt>delta &gt; 0</tt></td>
-  </tr>
-  <tr>
-    <td>&nbsp;</td>
-    <td><tt><table>
-      <tbody><tr>
-        <td>int i, delta;</td>
-      </tr><tr>
-        <td>(unsigned)i + delta &lt; i</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td>Change in program semantics</td>
-  </tr>
-  <tr>
-    <td>&nbsp;</td>
-    <td><tt><table>
-      <tbody><tr>
-        <td>unsigned int i, delta;</td>
-      </tr><tr>
-        <td>i + delta &lt; i</td>
-      </tr></tbody>
-    </table></tt></td>
-    <td>Change in program semantics</td>
-  </tr></tbody>
-</table>
+
+<li>Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>, 
+it is possible to rewrite it as <code>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</code>.
+Note that <code>i + delta</code>does not actually overflow, due to <code>int</code> promotion</li>
+
+<li>Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
+it is also possible to rewrite it as <code>USHORT_MAX - delta</code>. It must be true
+that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
+header has been included.</li>
+
+<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+it is possible to rewrite it as <code>INT_MAX - delta</code>. It must be true
+that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
+header has been included.</li>
+
+<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+it is also possible to rewrite it as <code>(unsigned)i + delta &lt; i</code>.
+Note that program semantics are affected by this change.</li>
+
+<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+it is also possible to rewrite it as <code>unsigned int i, delta</code> and
+<code>i + delta &lt; i</code>.  Note that program semantics are 
+affected by this change.</li>
+
 </recommendation>
+
 <example>
 <p>
 In the following example, even though <code>delta</code> has been declared
@@ -142,6 +93,7 @@ so that <code>unsigned short</code> "wrap around" may now be observed.
 Furthermore, since the left-hand side is now of type <code>unsigned short</code>,
 the right-hand side does not need to be promoted to a <code>signed int</code>.
 </p>
+
 <sample src="SignedOverflowCheck-good2.cpp" />
 </example>
 <references>

From 398896a4b21127b2d286d9fc2bd456b2456959bd Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Mon, 4 Nov 2019 16:44:31 -0800
Subject: [PATCH 112/232] [CPP-434] Change list items to ordinary paragraphs in
 the Recommendation section.

---
 .../Arithmetic/SignedOverflowCheck.qhelp      | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index a6f8f4dc373..4d5dfabef14 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -22,34 +22,35 @@ categories: (1) rewrite the signed expression so that overflow cannot occur
 but the signedness remains, or (2) rewrite (or cast) the signed expression
 into unsigned form.
 
-The bullet list below lists various expressions where signed overflow may
-occur, along with proposed rewritings.  It should not be
+Below we list examples of expressions where signed overflow may
+occur, along with proposed solutions.  The list should not be
 considered exhaustive.
 </p>
 
-<li>Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>, 
+<p>
+Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>, 
 it is possible to rewrite it as <code>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</code>.
-Note that <code>i + delta</code>does not actually overflow, due to <code>int</code> promotion</li>
+Note that <code>i + delta</code>does not actually overflow, due to <code>int</code> promotion
 
-<li>Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
+Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>USHORT_MAX - delta</code>. It must be true
 that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
-header has been included.</li>
+header has been included.
 
-<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is possible to rewrite it as <code>INT_MAX - delta</code>. It must be true
 that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
-header has been included.</li>
+header has been included.
 
-<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>(unsigned)i + delta &lt; i</code>.
-Note that program semantics are affected by this change.</li>
+Note that program semantics are affected by this change.
 
-<li>Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
+Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>unsigned int i, delta</code> and
 <code>i + delta &lt; i</code>.  Note that program semantics are 
-affected by this change.</li>
-
+affected by this change.
+</p>
 </recommendation>
 
 <example>

From df3c70e57e1613c6ad1096e3028924634c612196 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 5 Nov 2019 10:40:14 +0100
Subject: [PATCH 113/232] add js/ignore-array-result to correctness-core suite

---
 javascript/config/suites/javascript/correctness-core | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/config/suites/javascript/correctness-core b/javascript/config/suites/javascript/correctness-core
index 6a53405e1c3..d6b91e83a07 100644
--- a/javascript/config/suites/javascript/correctness-core
+++ b/javascript/config/suites/javascript/correctness-core
@@ -37,5 +37,6 @@
 + semmlecode-javascript-queries/RegExp/UnboundBackref.ql: /Correctness/Regular Expressions
 + semmlecode-javascript-queries/RegExp/UnmatchableCaret.ql: /Correctness/Regular Expressions
 + semmlecode-javascript-queries/RegExp/UnmatchableDollar.ql: /Correctness/Regular Expressions
++ semmlecode-javascript-queries/Statements/IgnoreArrayResult.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/InconsistentLoopOrientation.ql: /Correctness/Statements
 + semmlecode-javascript-queries/Statements/UnreachableStatement.ql: /Correctness/Statements

From d8f3a2c55037421e30a5d02cb7273af53e3cf9e7 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 31 Oct 2019 12:58:39 +0000
Subject: [PATCH 114/232] JS: Add lvalue of for..of loop as a PropRead

---
 .../semmle/javascript/dataflow/DataFlow.qll   | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 8798df6cc37..07920cba3c9 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -741,7 +741,8 @@ module DataFlow {
     PropReadAsSourceNode() {
       this = TPropNode(any(PropertyPattern p)) or
       this instanceof RestPatternNode or
-      this instanceof ElementPatternNode
+      this instanceof ElementPatternNode or
+      this = lvalueNode(any(ForOfStmt stmt).getLValue())
     }
   }
 
@@ -826,6 +827,24 @@ module DataFlow {
     override string getPropertyName() { result = astNode.getImportedName() }
   }
 
+  /**
+   * The left-hand side of a `for..of` statement, seen as a property read
+   * on the object being iterated over.
+   */
+  private class ForOfLvalueAsPropRead extends PropRead {
+    ForOfStmt stmt;
+
+    ForOfLvalueAsPropRead() {
+      this = lvalueNode(stmt.getLValue())
+    }
+
+    override Node getBase() { result = stmt.getIterationDomain().flow() }
+
+    override Expr getPropertyNameExpr() { none() }
+
+    override string getPropertyName() { none() }
+  }
+
   /**
    * A data flow node representing an unused parameter.
    *

From d8ac0abb7f26879e59d7f6addd8cbe995aeedf5b Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 5 Nov 2019 10:06:21 +0000
Subject: [PATCH 115/232] JS: Add test

---
 .../ql/test/library-tests/DataFlow/flowStep.expected       | 5 +++++
 .../ql/test/library-tests/DataFlow/incomplete.expected     | 5 +++++
 .../ql/test/library-tests/DataFlow/parameters.expected     | 1 +
 javascript/ql/test/library-tests/DataFlow/sources.expected | 7 +++++++
 javascript/ql/test/library-tests/DataFlow/sources.js       | 5 +++++
 5 files changed, 23 insertions(+)

diff --git a/javascript/ql/test/library-tests/DataFlow/flowStep.expected b/javascript/ql/test/library-tests/DataFlow/flowStep.expected
index a6446732fbe..107dcfb98c7 100644
--- a/javascript/ql/test/library-tests/DataFlow/flowStep.expected
+++ b/javascript/ql/test/library-tests/DataFlow/flowStep.expected
@@ -7,6 +7,11 @@
 | sources.js:3:11:3:11 | x | sources.js:4:10:4:10 | x |
 | sources.js:4:10:4:13 | x+19 | sources.js:3:1:5:6 | (functi ... \\n})(23) |
 | sources.js:5:4:5:5 | 23 | sources.js:3:11:3:11 | x |
+| sources.js:9:14:9:18 | array | sources.js:10:19:10:23 | array |
+| sources.js:9:14:9:18 | array | sources.js:11:23:11:27 | array |
+| sources.js:10:12:10:14 | key | sources.js:10:28:10:30 | key |
+| sources.js:11:12:11:18 | key | sources.js:11:32:11:34 | key |
+| sources.js:11:14:11:16 | key | sources.js:11:12:11:18 | key |
 | tst.js:1:1:1:1 | x | tst.js:28:2:28:1 | x |
 | tst.js:1:1:1:1 | x | tst.js:32:1:32:0 | x |
 | tst.js:1:10:1:11 | fs | tst.js:1:10:1:11 | fs |
diff --git a/javascript/ql/test/library-tests/DataFlow/incomplete.expected b/javascript/ql/test/library-tests/DataFlow/incomplete.expected
index aee8fd44421..35413033fe7 100644
--- a/javascript/ql/test/library-tests/DataFlow/incomplete.expected
+++ b/javascript/ql/test/library-tests/DataFlow/incomplete.expected
@@ -8,6 +8,11 @@
 | sources.js:1:6:1:11 | exceptional return of anonymous function | call |
 | sources.js:3:1:5:6 | exceptional return of (functi ... \\n})(23) | call |
 | sources.js:3:2:5:1 | exceptional return of anonymous function | call |
+| sources.js:9:1:12:1 | exceptional return of function foo | call |
+| sources.js:9:14:9:18 | array | call |
+| sources.js:10:12:10:14 | key | heap |
+| sources.js:11:12:11:18 | key | heap |
+| sources.js:11:14:11:16 | key | heap |
 | tst.js:1:10:1:11 | fs | import |
 | tst.js:16:1:20:9 | exceptional return of (functi ... ("arg") | call |
 | tst.js:16:2:20:1 | exceptional return of function f | call |
diff --git a/javascript/ql/test/library-tests/DataFlow/parameters.expected b/javascript/ql/test/library-tests/DataFlow/parameters.expected
index b7746f41c8a..31bab07c4e2 100644
--- a/javascript/ql/test/library-tests/DataFlow/parameters.expected
+++ b/javascript/ql/test/library-tests/DataFlow/parameters.expected
@@ -1,5 +1,6 @@
 | sources.js:1:6:1:6 | x |
 | sources.js:3:11:3:11 | x |
+| sources.js:9:14:9:18 | array |
 | tst.js:16:13:16:13 | a |
 | tst.js:32:12:32:12 | b |
 | tst.js:87:11:87:24 | { p: x, ...o } |
diff --git a/javascript/ql/test/library-tests/DataFlow/sources.expected b/javascript/ql/test/library-tests/DataFlow/sources.expected
index 185cc89e4ad..37a54027371 100644
--- a/javascript/ql/test/library-tests/DataFlow/sources.expected
+++ b/javascript/ql/test/library-tests/DataFlow/sources.expected
@@ -13,6 +13,12 @@
 | sources.js:3:2:5:1 | functio ... x+19;\\n} |
 | sources.js:3:11:3:11 | x |
 | sources.js:7:1:7:3 | /x/ |
+| sources.js:9:1:9:0 | this |
+| sources.js:9:1:12:1 | functio ... ey; }\\n} |
+| sources.js:9:14:9:18 | array |
+| sources.js:10:12:10:14 | key |
+| sources.js:11:12:11:18 | { key } |
+| sources.js:11:14:11:16 | key |
 | tst.js:1:1:1:0 | this |
 | tst.js:1:1:1:24 | import  ... m 'fs'; |
 | tst.js:1:10:1:11 | fs |
@@ -60,6 +66,7 @@
 | tst.js:72:9:72:9 | p |
 | tst.js:72:9:72:11 | p() |
 | tst.js:75:9:75:21 | import('foo') |
+| tst.js:80:10:80:10 | v |
 | tst.js:83:11:83:28 | [ for (v of o) v ] |
 | tst.js:85:11:85:28 | ( for (v of o) v ) |
 | tst.js:87:1:96:2 | (functi ... r: 0\\n}) |
diff --git a/javascript/ql/test/library-tests/DataFlow/sources.js b/javascript/ql/test/library-tests/DataFlow/sources.js
index 653c5fc129c..7a5bb869efe 100644
--- a/javascript/ql/test/library-tests/DataFlow/sources.js
+++ b/javascript/ql/test/library-tests/DataFlow/sources.js
@@ -5,3 +5,8 @@ new (x => x);
 })(23);
 
 /x/;
+
+function foo(array) {
+  for (let key of array) { key; }
+  for (let { key } of array) { key; }
+}

From c373be0dee9b4c8b4edbfb5980b1b0b3f5586bde Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 5 Nov 2019 10:26:04 +0000
Subject: [PATCH 116/232] JS: Update TaintBarriers test

---
 .../library-tests/TaintBarriers/SanitizingGuard.expected     | 5 -----
 .../ql/test/library-tests/TaintBarriers/TaintedSink.expected | 1 -
 .../ql/test/library-tests/TaintBarriers/isBarrier.expected   | 1 +
 javascript/ql/test/library-tests/TaintBarriers/tst.js        | 2 +-
 4 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected b/javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected
index c58a7c511d1..010375e1ab8 100644
--- a/javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected
+++ b/javascript/ql/test/library-tests/TaintBarriers/SanitizingGuard.expected
@@ -44,14 +44,11 @@
 | tst.js:236:9:236:24 | isWhitelisted(v) | ExampleConfiguration | true | tst.js:236:23:236:23 | v |
 | tst.js:240:9:240:28 | config.allowValue(v) | ExampleConfiguration | true | tst.js:240:27:240:27 | v |
 | tst.js:252:16:252:36 | whiteli ... ains(x) | ExampleConfiguration | true | tst.js:252:35:252:35 | x |
-| tst.js:254:9:254:12 | f(v) | ExampleConfiguration | true | tst.js:254:11:254:11 | v |
 | tst.js:261:25:261:45 | whiteli ... ains(y) | ExampleConfiguration | true | tst.js:261:44:261:44 | y |
-| tst.js:264:9:264:12 | g(v) | ExampleConfiguration | true | tst.js:264:11:264:11 | v |
 | tst.js:271:25:271:45 | whiteli ... ains(z) | ExampleConfiguration | true | tst.js:271:44:271:44 | z |
 | tst.js:281:16:281:25 | x2 != null | ExampleConfiguration | false | tst.js:281:16:281:17 | x2 |
 | tst.js:281:16:281:25 | x2 != null | ExampleConfiguration | false | tst.js:281:22:281:25 | null |
 | tst.js:281:30:281:51 | whiteli ... ins(x2) | ExampleConfiguration | true | tst.js:281:49:281:50 | x2 |
-| tst.js:283:9:283:13 | f2(v) | ExampleConfiguration | true | tst.js:283:12:283:12 | v |
 | tst.js:290:16:290:25 | x3 == null | ExampleConfiguration | true | tst.js:290:16:290:17 | x3 |
 | tst.js:290:16:290:25 | x3 == null | ExampleConfiguration | true | tst.js:290:22:290:25 | null |
 | tst.js:290:30:290:51 | whiteli ... ins(x3) | ExampleConfiguration | true | tst.js:290:49:290:50 | x3 |
@@ -61,7 +58,6 @@
 | tst.js:327:25:327:34 | x7 != null | ExampleConfiguration | false | tst.js:327:25:327:26 | x7 |
 | tst.js:327:25:327:34 | x7 != null | ExampleConfiguration | false | tst.js:327:31:327:34 | null |
 | tst.js:327:39:327:60 | whiteli ... ins(x7) | ExampleConfiguration | true | tst.js:327:58:327:59 | x7 |
-| tst.js:330:9:330:13 | f7(v) | ExampleConfiguration | true | tst.js:330:12:330:12 | v |
 | tst.js:337:25:337:46 | whiteli ... ins(x8) | ExampleConfiguration | true | tst.js:337:44:337:45 | x8 |
 | tst.js:338:16:338:25 | x8 != null | ExampleConfiguration | false | tst.js:338:16:338:17 | x8 |
 | tst.js:338:16:338:25 | x8 != null | ExampleConfiguration | false | tst.js:338:22:338:25 | null |
@@ -70,6 +66,5 @@
 | tst.js:356:16:356:27 | x10 !== null | ExampleConfiguration | false | tst.js:356:24:356:27 | null |
 | tst.js:356:32:356:48 | x10 !== undefined | ExampleConfiguration | false | tst.js:356:32:356:34 | x10 |
 | tst.js:356:32:356:48 | x10 !== undefined | ExampleConfiguration | false | tst.js:356:40:356:48 | undefined |
-| tst.js:358:9:358:14 | f10(v) | ExampleConfiguration | false | tst.js:358:13:358:13 | v |
 | tst.js:370:9:370:29 | o.p ==  ... listed" | ExampleConfiguration | true | tst.js:370:9:370:11 | o.p |
 | tst.js:377:11:377:32 | o[p] == ... listed" | ExampleConfiguration | true | tst.js:377:11:377:14 | o[p] |
diff --git a/javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected b/javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected
index 050f80bc071..54b35166b15 100644
--- a/javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected
+++ b/javascript/ql/test/library-tests/TaintBarriers/TaintedSink.expected
@@ -53,7 +53,6 @@
 | tst.js:333:14:333:14 | v | tst.js:248:13:248:20 | SOURCE() |
 | tst.js:341:14:341:14 | v | tst.js:248:13:248:20 | SOURCE() |
 | tst.js:343:14:343:14 | v | tst.js:248:13:248:20 | SOURCE() |
-| tst.js:350:14:350:14 | v | tst.js:248:13:248:20 | SOURCE() |
 | tst.js:352:14:352:14 | v | tst.js:248:13:248:20 | SOURCE() |
 | tst.js:359:14:359:14 | v | tst.js:248:13:248:20 | SOURCE() |
 | tst.js:368:10:368:12 | o.p | tst.js:367:13:367:20 | SOURCE() |
diff --git a/javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected b/javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected
index 50804043f95..f650c93185c 100644
--- a/javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected
+++ b/javascript/ql/test/library-tests/TaintBarriers/isBarrier.expected
@@ -37,6 +37,7 @@
 | tst.js:265:14:265:14 | v | ExampleConfiguration |
 | tst.js:284:14:284:14 | v | ExampleConfiguration |
 | tst.js:331:14:331:14 | v | ExampleConfiguration |
+| tst.js:350:14:350:14 | v | ExampleConfiguration |
 | tst.js:356:16:356:27 | x10 | ExampleConfiguration |
 | tst.js:356:32:356:34 | x10 | ExampleConfiguration |
 | tst.js:361:14:361:14 | v | ExampleConfiguration |
diff --git a/javascript/ql/test/library-tests/TaintBarriers/tst.js b/javascript/ql/test/library-tests/TaintBarriers/tst.js
index 78986d6af37..a7a05590540 100644
--- a/javascript/ql/test/library-tests/TaintBarriers/tst.js
+++ b/javascript/ql/test/library-tests/TaintBarriers/tst.js
@@ -347,7 +347,7 @@ function IndirectSanitizer () {
         return unknown() && whitelist.contains(x9) && unknown();
     }
     if (f9(v)) {
-        SINK(v); // SANITIZATION OF THIS IS NOT YET SUPPORTED
+        SINK(v);
     } else {
         SINK(v);
     }

From 48c7d1d7c1218ad0b022bab561e69c74905876ce Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 11:20:16 +0100
Subject: [PATCH 117/232] C++: add *_template_parameter_value() tuples

---
 cpp/ql/src/semmlecode.cpp.dbscheme | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/cpp/ql/src/semmlecode.cpp.dbscheme b/cpp/ql/src/semmlecode.cpp.dbscheme
index 98a075d5495..bd182f697bf 100644
--- a/cpp/ql/src/semmlecode.cpp.dbscheme
+++ b/cpp/ql/src/semmlecode.cpp.dbscheme
@@ -731,6 +731,11 @@ class_template_argument(
     int index: int ref,
     int arg_type: @type ref
 );
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
 
 is_proxy_class_for(
     unique int id: @usertype ref,
@@ -755,6 +760,11 @@ function_template_argument(
     int index: int ref,
     int arg_type: @type ref
 );
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
 
 is_variable_template(unique int id: @variable ref);
 variable_instantiation(
@@ -766,6 +776,11 @@ variable_template_argument(
     int index: int ref,
     int arg_type: @type ref
 );
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
 
 /*
   Fixed point types

From df7d21220be83026d76636877c98693fffc08ef0 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 11:20:48 +0100
Subject: [PATCH 118/232] C++: Basic lib support for template param values

---
 cpp/ql/src/semmle/code/cpp/Class.qll       |  9 +++++++++
 cpp/ql/src/semmle/code/cpp/Declaration.qll |  7 +++++++
 cpp/ql/src/semmle/code/cpp/Function.qll    | 10 ++++++++++
 cpp/ql/src/semmle/code/cpp/Variable.qll    |  9 +++++++++
 4 files changed, 35 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/Class.qll b/cpp/ql/src/semmle/code/cpp/Class.qll
index 5ac4f52392e..44e8b4e65ef 100644
--- a/cpp/ql/src/semmle/code/cpp/Class.qll
+++ b/cpp/ql/src/semmle/code/cpp/Class.qll
@@ -614,6 +614,15 @@ class Class extends UserType {
     class_template_argument(underlyingElement(this), i, unresolveElement(result))
   }
 
+  /**
+   * Gets the `i`th template argument value used to instantiate this class from a
+   * class template. When called on a class template, this will return the
+   * `i`th template parameter value.
+   */
+  override Expr getTemplateArgumentValue(int i) {
+    class_template_argument_value(underlyingElement(this), i, unresolveElement(result))
+  }
+
   /**
    * Holds if this class/struct is polymorphic (has a virtual function, or
    * inherits one).
diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index 5d13bf4883a..a3a93aaca96 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -203,6 +203,13 @@ abstract class Declaration extends Locatable, @declaration {
    */
   Type getTemplateArgument(int index) { none() }
 
+  /**
+   * Gets the `i`th template argument value used to instantiate this declaration
+   * from a template. When called on a template, this will return the `i`th template
+   * parameter value if it exists.
+   */
+  Expr getTemplateArgumentValue(int index) { none() }
+
   /** Gets the number of template arguments for this declaration. */
   final int getNumberOfTemplateArguments() {
     result = count(int i | exists(getTemplateArgument(i)))
diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index 94d11d63575..be031f2b915 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -352,6 +352,16 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
     function_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
+  /**
+   * Gets the value of the `i`th template argument used to instantiate this
+   * function from a function template if that argument was a 'non-type'
+   * argument.  When called on a function template, this with return the value
+   * of the `i`th template parameter.
+   */
+  override Expr getTemplateArgumentValue(int index) {
+    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+  }
+
   /**
    * Holds if this function is defined in several files. This is illegal in
    * C (though possible in some C++ compilers), and likely indicates that
diff --git a/cpp/ql/src/semmle/code/cpp/Variable.qll b/cpp/ql/src/semmle/code/cpp/Variable.qll
index 6fd33d9a037..deae1069aab 100644
--- a/cpp/ql/src/semmle/code/cpp/Variable.qll
+++ b/cpp/ql/src/semmle/code/cpp/Variable.qll
@@ -164,6 +164,15 @@ class Variable extends Declaration, @variable {
     variable_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
+  /**
+   * Gets the `i`th template argument value used to instantiate this variable from a
+   * variable template. When called on a variable template, this will return the
+   * `i`th template parameter value.
+   */
+  override Expr getTemplateArgumentValue(int index) {
+    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+  }
+
   /**
    * Holds if this is a compiler-generated variable. For example, a
    * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)

From faf5ba432b2306d09d77965c48a84edc1c245d94 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 11:22:03 +0100
Subject: [PATCH 119/232] C++: Update expected test results

---
 .../library-tests/ir/ir/PrintAST.expected     | 50 +++++++++----------
 .../test/library-tests/ir/ir/raw_ir.expected  | 23 +++++++++
 .../ptr_to_member/segfault/exprs.expected     |  4 ++
 .../templates/CPP-202/template_args.expected  |  4 +-
 .../templates/CPP-204/element.expected        |  6 +++
 5 files changed, 60 insertions(+), 27 deletions(-)

diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index 19a4288a4c4..e61fe2b440f 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -67,31 +67,7 @@ bad_asts.cpp:
 #    5|   params: 
 #-----|     0: [Parameter] p#0
 #-----|         Type = [RValueReferenceType] S &&
-#    9| [MemberFunction] int Bad::S::MemberFunction(int)
-#    9|   params: 
-#    9|     0: [Parameter] y
-#    9|         Type = [IntType] int
-#    9|   body: [Block] { ... }
-#   10|     0: [ReturnStmt] return ...
-#   10|       0: [AddExpr] ... + ...
-#   10|           Type = [IntType] int
-#   10|           ValueCategory = prvalue
-#   10|         0: [AddExpr] ... + ...
-#   10|             Type = [IntType] int
-#   10|             ValueCategory = prvalue
-#   10|           0: [Literal] Unknown literal
-#   10|               Type = [IntType] int
-#   10|               ValueCategory = prvalue
-#   10|           1: [PointerFieldAccess] x
-#   10|               Type = [IntType] int
-#   10|               ValueCategory = prvalue(load)
-#-----|             -1: [ThisExpr] this
-#-----|                 Type = [PointerType] S *
-#-----|                 ValueCategory = prvalue(load)
-#   10|         1: [VariableAccess] y
-#   10|             Type = [IntType] int
-#   10|             ValueCategory = prvalue(load)
-#    9| [TopLevelFunction] int MemberFunction(int)
+#    9| [FunctionTemplateInstantiation,MemberFunction] int Bad::S::MemberFunction<int>(int)
 #    9|   params: 
 #    9|     0: [Parameter] y
 #    9|         Type = [IntType] int
@@ -116,6 +92,30 @@ bad_asts.cpp:
 #   10|         1: [VariableAccess] y
 #   10|             Type = [IntType] int
 #   10|             ValueCategory = prvalue(load)
+#    9| [MemberFunction,TemplateFunction] int Bad::S::MemberFunction<int>(int)
+#    9|   params: 
+#    9|     0: [Parameter] y
+#    9|         Type = [IntType] int
+#    9|   body: [Block] { ... }
+#   10|     0: [ReturnStmt] return ...
+#   10|       0: [AddExpr] ... + ...
+#   10|           Type = [IntType] int
+#   10|           ValueCategory = prvalue
+#   10|         0: [AddExpr] ... + ...
+#   10|             Type = [IntType] int
+#   10|             ValueCategory = prvalue
+#   10|           0: [Literal] Unknown literal
+#   10|               Type = [IntType] int
+#   10|               ValueCategory = prvalue
+#   10|           1: [PointerFieldAccess] x
+#   10|               Type = [IntType] int
+#   10|               ValueCategory = prvalue(load)
+#-----|             -1: [ThisExpr] this
+#-----|                 Type = [PointerType] S *
+#-----|                 ValueCategory = prvalue(load)
+#   10|         1: [VariableAccess] y
+#   10|             Type = [IntType] int
+#   10|             ValueCategory = prvalue(load)
 #   14| [TopLevelFunction] void Bad::CallBadMemberFunction()
 #   14|   params: 
 #   14|   body: [Block] { ... }
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 90c3061114e..f0c96d2bfa0 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -1,4 +1,27 @@
 bad_asts.cpp:
+#    9| int Bad::S::MemberFunction<int>(int)
+#    9|   Block 0
+#    9|     v0_0(void)        = EnterFunction            : 
+#    9|     mu0_1(unknown)    = AliasedDefinition        : 
+#    9|     mu0_2(unknown)    = UnmodeledDefinition      : 
+#    9|     r0_3(glval<S>)    = InitializeThis           : 
+#    9|     r0_4(glval<int>)  = VariableAddress[y]       : 
+#    9|     mu0_5(int)        = InitializeParameter[y]   : &:r0_4
+#   10|     r0_6(glval<int>)  = VariableAddress[#return] : 
+#   10|     r0_7(int)         = Constant[6]              : 
+#-----|     r0_8(S *)         = CopyValue                : r0_3
+#   10|     r0_9(glval<int>)  = FieldAddress[x]          : r0_8
+#   10|     r0_10(int)        = Load                     : &:r0_9, ~mu0_2
+#   10|     r0_11(int)        = Add                      : r0_7, r0_10
+#   10|     r0_12(glval<int>) = VariableAddress[y]       : 
+#   10|     r0_13(int)        = Load                     : &:r0_12, ~mu0_2
+#   10|     r0_14(int)        = Add                      : r0_11, r0_13
+#   10|     mu0_15(int)       = Store                    : &:r0_6, r0_14
+#    9|     r0_16(glval<int>) = VariableAddress[#return] : 
+#    9|     v0_17(void)       = ReturnValue              : &:r0_16, ~mu0_2
+#    9|     v0_18(void)       = UnmodeledUse             : mu*
+#    9|     v0_19(void)       = ExitFunction             : 
+
 #   14| void Bad::CallBadMemberFunction()
 #   14|   Block 0
 #   14|     v0_0(void)           = EnterFunction                   : 
diff --git a/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected b/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
index 7af2f7c8c17..e745ca0142d 100644
--- a/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
+++ b/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
@@ -1,3 +1,7 @@
+| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
 | segfault.cpp:25:46:25:65 | call to S | file://:0:0:0:0 | void |
 | segfault.cpp:25:46:25:65 | call to S | file://:0:0:0:0 | void |
 | segfault.cpp:25:48:25:55 | __second | segfault.cpp:15:7:15:11 | tuple |
diff --git a/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected b/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
index 0f20692d443..ae10f9ddf63 100644
--- a/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
+++ b/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
@@ -1,6 +1,6 @@
 | file://:0:0:0:0 | __va_list_tag | <none> |
-| test.cpp:3:8:3:9 | s1<<expression>> | <none> |
-| test.cpp:3:8:3:9 | s1<<unnamed>> | <none> |
+| test.cpp:3:8:3:9 | s1<<expression>> | bool |
+| test.cpp:3:8:3:9 | s1<<unnamed>> | bool |
 | test.cpp:5:8:5:9 | s2<T> | T |
 | test.cpp:5:8:5:9 | s2<T> | T |
 | test.cpp:7:8:7:9 | s3<T, <unnamed>> | (unnamed) |
diff --git a/cpp/ql/test/library-tests/templates/CPP-204/element.expected b/cpp/ql/test/library-tests/templates/CPP-204/element.expected
index 6cb84a117d5..b1662c2a3b3 100644
--- a/cpp/ql/test/library-tests/templates/CPP-204/element.expected
+++ b/cpp/ql/test/library-tests/templates/CPP-204/element.expected
@@ -1,6 +1,12 @@
 | file://:0:0:0:0 |  |
 | file://:0:0:0:0 | 0 |
 | file://:0:0:0:0 | (global namespace) |
+| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | Unknown literal |
 | file://:0:0:0:0 | __va_list_tag |
 | file://:0:0:0:0 | __va_list_tag & |
 | file://:0:0:0:0 | __va_list_tag && |

From 6334ad92c5de06fa362f51e4727d3da5397f11ba Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 11:25:15 +0100
Subject: [PATCH 120/232] C++: Add DB Upgrade script.

---
 .../old.dbscheme                              | 1918 ++++++++++++++++
 .../semmlecode.cpp.dbscheme                   | 1933 +++++++++++++++++
 .../upgrade.properties                        |    2 +
 3 files changed, 3853 insertions(+)
 create mode 100644 cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/old.dbscheme
 create mode 100644 cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/semmlecode.cpp.dbscheme
 create mode 100644 cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties

diff --git a/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/old.dbscheme b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/old.dbscheme
new file mode 100644
index 00000000000..98a075d5495
--- /dev/null
+++ b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/old.dbscheme
@@ -0,0 +1,1918 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The date of the snapshot.
+ */
+snapshotDate(unique date snapshotDate : date ref);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Data used by the 'duplicate code' detection.
+ */
+duplicateCode(
+    unique int id : @duplication,
+    string relativePath : string ref,
+    int equivClass : int ref
+);
+
+/**
+ * Data used by the 'similar code' detection.
+ */
+similarCode(
+    unique int id : @similarity,
+    string relativePath : string ref,
+    int equivClass : int ref
+);
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+@duplication_or_similarity = @duplication | @similarity
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+#keyset[id, offset]
+tokens(
+    int id : @duplication_or_similarity ref,
+    int offset : int ref,
+    int beginLine : int ref,
+    int beginColumn : int ref,
+    int endLine : int ref,
+    int endColumn : int ref
+);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+    unique int id: @file,
+    string name: string ref,
+    string simple: string ref,
+    string ext: string ref,
+    int fromSource: int ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref,
+    string simple: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+decltypes(
+    unique int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    unique string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the EDG frontend.  See symbol_ref.h there.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+successors(
+    int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+truecond(
+    unique int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+falsecond(
+    unique int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/semmlecode.cpp.dbscheme b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/semmlecode.cpp.dbscheme
new file mode 100644
index 00000000000..bd182f697bf
--- /dev/null
+++ b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/semmlecode.cpp.dbscheme
@@ -0,0 +1,1933 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The date of the snapshot.
+ */
+snapshotDate(unique date snapshotDate : date ref);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Data used by the 'duplicate code' detection.
+ */
+duplicateCode(
+    unique int id : @duplication,
+    string relativePath : string ref,
+    int equivClass : int ref
+);
+
+/**
+ * Data used by the 'similar code' detection.
+ */
+similarCode(
+    unique int id : @similarity,
+    string relativePath : string ref,
+    int equivClass : int ref
+);
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+@duplication_or_similarity = @duplication | @similarity
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+#keyset[id, offset]
+tokens(
+    int id : @duplication_or_similarity ref,
+    int offset : int ref,
+    int beginLine : int ref,
+    int beginColumn : int ref,
+    int endLine : int ref,
+    int endColumn : int ref
+);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+    unique int id: @file,
+    string name: string ref,
+    string simple: string ref,
+    string ext: string ref,
+    int fromSource: int ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref,
+    string simple: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+decltypes(
+    unique int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    unique string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the EDG frontend.  See symbol_ref.h there.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+successors(
+    int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+truecond(
+    unique int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+falsecond(
+    unique int from: @cfgnode ref,
+    int to: @cfgnode ref
+);
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties
new file mode 100644
index 00000000000..3388d1abe28
--- /dev/null
+++ b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add support for value template paramters.
+compatibility: partial

From 4ab87291f35bb831dae94d314f91308bd4c0c2d1 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 15:29:16 +0100
Subject: [PATCH 121/232] C++: Further use of TemplateArgumentValue

---
 cpp/ql/src/semmle/code/cpp/Declaration.qll |  6 ++++++
 cpp/ql/src/semmle/code/cpp/exprs/Call.qll  | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index a3a93aaca96..a10faf0f918 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -197,6 +197,12 @@ abstract class Declaration extends Locatable, @declaration {
    */
   final Type getATemplateArgument() { result = getTemplateArgument(_) }
 
+  /**
+   * Gets a template argument used to instantiate this declaration from a template.
+   * When called on a template, this will return a template parameter value.
+   */
+  final Expr getATemplateArgumentValue() { result = getTemplateArgumentValue(_) }
+
   /**
    * Gets the `i`th template argument used to instantiate this declaration from a
    * template. When called on a template, this will return the `i`th template parameter.
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
index 882918316f6..85807cf0d14 100644
--- a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
@@ -141,15 +141,27 @@ class FunctionCall extends Call, @funbindexpr {
   /** Gets an explicit template argument for this call. */
   Type getAnExplicitTemplateArgument() { result = getExplicitTemplateArgument(_) }
 
+  /** Gets an explicit template argument value for this call. */
+  Expr getAnExplicitTemplateArgumentValue() { result = getExplicitTemplateArgumentValue(_) }
+
   /** Gets a template argument for this call. */
   Type getATemplateArgument() { result = getTarget().getATemplateArgument() }
 
+  /** Gets a template argument value for this call. */
+  Expr getATemplateArgumentValue() { result = getTarget().getATemplateArgumentValue() }
+
   /** Gets the nth explicit template argument for this call. */
   Type getExplicitTemplateArgument(int n) {
     n < getNumberOfExplicitTemplateArguments() and
     result = getTemplateArgument(n)
   }
 
+  /** Gets the nth explicit template argument value for this call. */
+  Expr getExplicitTemplateArgumentValue(int n) {
+    n < getNumberOfExplicitTemplateArguments() and
+    result = getTemplateArgumentValue(n)
+  }
+
   /** Gets the number of explicit template arguments for this call. */
   int getNumberOfExplicitTemplateArguments() {
     if numtemplatearguments(underlyingElement(this), _)
@@ -160,9 +172,15 @@ class FunctionCall extends Call, @funbindexpr {
   /** Gets the number of template arguments for this call. */
   int getNumberOfTemplateArguments() { result = count(int i | exists(getTemplateArgument(i))) }
 
+  /** Gets the number of template argument which are values for this call. */
+  int getNumberOfTemplateArgumentValues() { result = count(int i | exists(getTemplateArgumentValue(i))) }
+
   /** Gets the nth template argument for this call (indexed from 0). */
   Type getTemplateArgument(int n) { result = getTarget().getTemplateArgument(n) }
 
+  /** Gets the nth template argument value for this call (indexed from 0). */
+  Expr getTemplateArgumentValue(int n) { result = getTarget().getTemplateArgumentValue(n) }
+
   /** Holds if any template arguments for this call are implicit / deduced. */
   predicate hasImplicitTemplateArguments() {
     exists(int i |

From 469832668fae1aa5202bf8881af4b7796949f14c Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 18 Oct 2019 15:30:41 +0100
Subject: [PATCH 122/232] C++: Add some simple non-type template tests

---
 .../templates/nontype_instantiations/classes/test.cpp        | 4 ++++
 .../templates/nontype_instantiations/classes/test.expected   | 2 ++
 .../templates/nontype_instantiations/classes/test.ql         | 4 ++++
 .../templates/nontype_instantiations/functions/test.cpp      | 5 +++++
 .../templates/nontype_instantiations/functions/test.expected | 2 ++
 .../templates/nontype_instantiations/functions/test.ql       | 4 ++++
 6 files changed, 21 insertions(+)
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.cpp
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.cpp
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql

diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.cpp b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.cpp
new file mode 100644
index 00000000000..4f16f623daf
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.cpp
@@ -0,0 +1,4 @@
+template <int i>
+class Int { };
+
+Int<10> i;
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
new file mode 100644
index 00000000000..524097b88d6
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
@@ -0,0 +1,2 @@
+| test.cpp:2:7:2:9 | Int<10> | file://:0:0:0:0 | int | test.cpp:4:5:4:6 | 10 |
+| test.cpp:2:7:2:9 | Int<i> | file://:0:0:0:0 | int | file://:0:0:0:0 | Unknown literal |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
new file mode 100644
index 00000000000..347bb2dba00
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Class c
+select c, c.getATemplateArgument(), c.getATemplateArgumentValue()
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.cpp b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.cpp
new file mode 100644
index 00000000000..625258906db
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.cpp
@@ -0,0 +1,5 @@
+// semmle-extractor-options: --edg --trap_container=folder --edg --trap-compression=none
+template <int i>
+int addToSelf() { return i + i; };
+
+int bar() { return addToSelf<10>(); }
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
new file mode 100644
index 00000000000..70e845e7b59
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
@@ -0,0 +1,2 @@
+| test.cpp:3:5:3:5 | addToSelf | file://:0:0:0:0 | int | test.cpp:5:30:5:31 | 10 |
+| test.cpp:3:5:3:13 | addToSelf | file://:0:0:0:0 | int | file://:0:0:0:0 | Unknown literal |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql
new file mode 100644
index 00000000000..4dd6e754cd6
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Function f
+select f, f.getATemplateArgument(), f.getATemplateArgumentValue()

From 57cd9b3990f2396e36c3d38c53db8ca4e6f70e79 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Mon, 21 Oct 2019 17:12:20 +0100
Subject: [PATCH 123/232] C++: Update test results

We now support getting the name used for non-type template parameters
---
 .../ptr_to_member/segfault/exprs.expected            |  8 ++++----
 .../library-tests/templates/CPP-204/element.expected | 12 ++++++------
 .../nontype_instantiations/classes/test.expected     |  2 +-
 .../nontype_instantiations/functions/test.expected   |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected b/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
index e745ca0142d..e5539a762ab 100644
--- a/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
+++ b/cpp/ql/test/library-tests/ptr_to_member/segfault/exprs.expected
@@ -1,7 +1,7 @@
-| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
-| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
-| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
-| file://:0:0:0:0 | Unknown literal | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | __i | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | uls | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | uls | file://:0:0:0:0 | unsigned long |
+| file://:0:0:0:0 | uls | file://:0:0:0:0 | unsigned long |
 | segfault.cpp:25:46:25:65 | call to S | file://:0:0:0:0 | void |
 | segfault.cpp:25:46:25:65 | call to S | file://:0:0:0:0 | void |
 | segfault.cpp:25:48:25:55 | __second | segfault.cpp:15:7:15:11 | tuple |
diff --git a/cpp/ql/test/library-tests/templates/CPP-204/element.expected b/cpp/ql/test/library-tests/templates/CPP-204/element.expected
index b1662c2a3b3..44384471af9 100644
--- a/cpp/ql/test/library-tests/templates/CPP-204/element.expected
+++ b/cpp/ql/test/library-tests/templates/CPP-204/element.expected
@@ -1,12 +1,12 @@
 | file://:0:0:0:0 |  |
 | file://:0:0:0:0 | 0 |
 | file://:0:0:0:0 | (global namespace) |
-| file://:0:0:0:0 | Unknown literal |
-| file://:0:0:0:0 | Unknown literal |
-| file://:0:0:0:0 | Unknown literal |
-| file://:0:0:0:0 | Unknown literal |
-| file://:0:0:0:0 | Unknown literal |
-| file://:0:0:0:0 | Unknown literal |
+| file://:0:0:0:0 | B |
+| file://:0:0:0:0 | X |
+| file://:0:0:0:0 | X |
+| file://:0:0:0:0 | X |
+| file://:0:0:0:0 | X |
+| file://:0:0:0:0 | Y |
 | file://:0:0:0:0 | __va_list_tag |
 | file://:0:0:0:0 | __va_list_tag & |
 | file://:0:0:0:0 | __va_list_tag && |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
index 524097b88d6..ffa9bfb2cf4 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.expected
@@ -1,2 +1,2 @@
 | test.cpp:2:7:2:9 | Int<10> | file://:0:0:0:0 | int | test.cpp:4:5:4:6 | 10 |
-| test.cpp:2:7:2:9 | Int<i> | file://:0:0:0:0 | int | file://:0:0:0:0 | Unknown literal |
+| test.cpp:2:7:2:9 | Int<i> | file://:0:0:0:0 | int | file://:0:0:0:0 | i |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
index 70e845e7b59..493e9f03b20 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.expected
@@ -1,2 +1,2 @@
 | test.cpp:3:5:3:5 | addToSelf | file://:0:0:0:0 | int | test.cpp:5:30:5:31 | 10 |
-| test.cpp:3:5:3:13 | addToSelf | file://:0:0:0:0 | int | file://:0:0:0:0 | Unknown literal |
+| test.cpp:3:5:3:13 | addToSelf | file://:0:0:0:0 | int | file://:0:0:0:0 | i |

From ca898d4be04ec3d899637e2e9e1627c5f5fd5541 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 22 Oct 2019 10:54:14 +0100
Subject: [PATCH 124/232] C++: Further nontype template testcases.

---
 .../nontype_instantiations/general/test.cpp   | 19 +++++++++++++++++++
 .../general/test.expected                     | 10 ++++++++++
 .../nontype_instantiations/general/test.ql    |  4 ++++
 3 files changed, 33 insertions(+)
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.cpp
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
 create mode 100644 cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql

diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.cpp b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.cpp
new file mode 100644
index 00000000000..1baabe3ca30
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.cpp
@@ -0,0 +1,19 @@
+// semmle-extractor-options: --edg --trap_container=folder --edg --trap-compression=none
+template<int x>
+struct C { };
+
+static const int one1 = 1, one2 = 1;
+C<one1> c = C<one2>();
+C<one1 + one2> e;
+
+template<typename T, T X>
+struct D { };
+
+D<int, 2> a;
+D<long, 2> b;
+
+template<typename T, T* X>
+struct E { };
+
+E<int, nullptr> z;
+
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
new file mode 100644
index 00000000000..70dfdbc3edf
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
@@ -0,0 +1,10 @@
+| test.cpp:3:8:3:8 | C<1> | file://:0:0:0:0 | int | test.cpp:5:25:5:25 | 1 |
+| test.cpp:3:8:3:8 | C<2> | file://:0:0:0:0 | int | file://:0:0:0:0 | 2 |
+| test.cpp:3:8:3:8 | C<x> | file://:0:0:0:0 | int | file://:0:0:0:0 | x |
+| test.cpp:10:8:10:8 | D<T, X> | test.cpp:9:19:9:19 | T | file://:0:0:0:0 | X |
+| test.cpp:10:8:10:8 | D<int, 2> | file://:0:0:0:0 | int | test.cpp:12:8:12:8 | 2 |
+| test.cpp:10:8:10:8 | D<long, 2L> | file://:0:0:0:0 | long | file://:0:0:0:0 | 2 |
+| test.cpp:16:8:16:8 | E<T, X> | file://:0:0:0:0 | T * | file://:0:0:0:0 | X |
+| test.cpp:16:8:16:8 | E<T, X> | test.cpp:15:19:15:19 | T | file://:0:0:0:0 | X |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | file://:0:0:0:0 | int | file://:0:0:0:0 | 0 |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | file://:0:0:0:0 | int * | file://:0:0:0:0 | 0 |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
new file mode 100644
index 00000000000..8915d6523b6
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Declaration d
+select d, d.getATemplateArgument(), d.getATemplateArgumentValue()

From f1c3ce04d1ae8a17a37dcea8010872ebe3377760 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 22 Oct 2019 10:54:58 +0100
Subject: [PATCH 125/232] C++: Correct spelling mistake

---
 .../98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties
index 3388d1abe28..495bdeebdac 100644
--- a/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties
+++ b/cpp/upgrades/98a075d5495d7be7ede26557708cf22cfa3964ef/upgrade.properties
@@ -1,2 +1,2 @@
-description: Add support for value template paramters.
+description: Add support for value template parameters.
 compatibility: partial

From 809d97de02f362e10381d2fc23b0c989705d7c40 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Wed, 23 Oct 2019 16:29:32 +0100
Subject: [PATCH 126/232] C++: Print print nontype template params

---
 cpp/ql/src/semmle/code/cpp/Print.qll              | 10 +++++++++-
 cpp/ql/test/library-tests/ir/ir/PrintAST.expected |  7 ++++---
 cpp/ql/test/library-tests/ir/ir/raw_ir.expected   |  2 +-
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Print.qll b/cpp/ql/src/semmle/code/cpp/Print.qll
index ab979d89b03..7be1537e83b 100644
--- a/cpp/ql/src/semmle/code/cpp/Print.qll
+++ b/cpp/ql/src/semmle/code/cpp/Print.qll
@@ -35,6 +35,14 @@ private string getParameterTypeString(Type parameterType) {
   else result = parameterType.(DumpType).getTypeIdentityString()
 }
 
+private string getTemplateArgumentString(Declaration d, int i) {
+  if exists(d.getTemplateArgumentValue(i))
+  then
+    result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString() + " " + d.getTemplateArgumentValue(i)
+  else
+    result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString()
+}
+
 /**
  * A `Declaration` extended to add methods for generating strings useful only for dumps and debugging.
  */
@@ -56,7 +64,7 @@ abstract private class DumpDeclaration extends Declaration {
           strictconcat(int i |
             exists(this.getTemplateArgument(i))
           |
-            this.getTemplateArgument(i).(DumpType).getTypeIdentityString(), ", " order by i
+            getTemplateArgumentString(this, i), ", " order by i
           ) + ">"
     else result = ""
   }
diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index e61fe2b440f..dab6a40fae6 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -67,7 +67,7 @@ bad_asts.cpp:
 #    5|   params: 
 #-----|     0: [Parameter] p#0
 #-----|         Type = [RValueReferenceType] S &&
-#    9| [FunctionTemplateInstantiation,MemberFunction] int Bad::S::MemberFunction<int>(int)
+#    9| [FunctionTemplateInstantiation,MemberFunction] int Bad::S::MemberFunction<int 6>(int)
 #    9|   params: 
 #    9|     0: [Parameter] y
 #    9|         Type = [IntType] int
@@ -92,7 +92,7 @@ bad_asts.cpp:
 #   10|         1: [VariableAccess] y
 #   10|             Type = [IntType] int
 #   10|             ValueCategory = prvalue(load)
-#    9| [MemberFunction,TemplateFunction] int Bad::S::MemberFunction<int>(int)
+#    9| [MemberFunction,TemplateFunction] int Bad::S::MemberFunction<int t>(int)
 #    9|   params: 
 #    9|     0: [Parameter] y
 #    9|         Type = [IntType] int
@@ -104,8 +104,9 @@ bad_asts.cpp:
 #   10|         0: [AddExpr] ... + ...
 #   10|             Type = [IntType] int
 #   10|             ValueCategory = prvalue
-#   10|           0: [Literal] Unknown literal
+#   10|           0: [Literal] t
 #   10|               Type = [IntType] int
+#   10|               Value = [Literal] t
 #   10|               ValueCategory = prvalue
 #   10|           1: [PointerFieldAccess] x
 #   10|               Type = [IntType] int
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index f0c96d2bfa0..b38e63e6e76 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -1,5 +1,5 @@
 bad_asts.cpp:
-#    9| int Bad::S::MemberFunction<int>(int)
+#    9| int Bad::S::MemberFunction<int 6>(int)
 #    9|   Block 0
 #    9|     v0_0(void)        = EnterFunction            : 
 #    9|     mu0_1(unknown)    = AliasedDefinition        : 

From afeaa6254d4fb367c02bad6e0edb12963402bbd4 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 29 Oct 2019 14:06:15 +0000
Subject: [PATCH 127/232] C++: Improve Template Value docs.

---
 cpp/ql/src/semmle/code/cpp/Declaration.qll | 33 ++++++++++++++++++++--
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index a10faf0f918..b3d12efe1e9 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -193,19 +193,34 @@ abstract class Declaration extends Locatable, @declaration {
 
   /**
    * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a template parameter.
+   * When called on a template, this will return a template parameter type for
+   * both typed and non-typed parameters.
    */
   final Type getATemplateArgument() { result = getTemplateArgument(_) }
 
   /**
    * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a template parameter value.
+   * When called on a template, this will return a non-typed template
+   * parameter value.
    */
   final Expr getATemplateArgumentValue() { result = getTemplateArgumentValue(_) }
 
   /**
    * Gets the `i`th template argument used to instantiate this declaration from a
-   * template. When called on a template, this will return the `i`th template parameter.
+   * template. When called on a template, this will return the `i`th template
+   * parameter's type.
+   *
+   * For example:
+   *
+   * `template<typename T, T X> class Foo;`
+   *
+   * Will have `getTemplateArgument(0)` return `T`, and
+   * `getTemplateArgument(1)` return `T`.
+   *
+   * `Foo<int, 1> bar;
+   *
+   * Will have `getTemplateArgument())` return `int`, and
+   * `getTemplateArgument(1)` return `int`.
    */
   Type getTemplateArgument(int index) { none() }
 
@@ -213,6 +228,18 @@ abstract class Declaration extends Locatable, @declaration {
    * Gets the `i`th template argument value used to instantiate this declaration
    * from a template. When called on a template, this will return the `i`th template
    * parameter value if it exists.
+   *
+   * For example:
+   *
+   * `template<typename T, T X> class Foo;`
+   *
+   * Will have `getTemplateArgumentValue(1)` return `X`, and no result for
+   * `getTemplateArgumentValue(0)`.
+   *
+   * `Foo<int, 10> bar;
+   *
+   * Will have `getTemplateArgumentValue(1)` return `10`, and no result for
+   * `getTemplateArgumentValue(0)`.
    */
   Expr getTemplateArgumentValue(int index) { none() }
 

From 45ec8527c3c03812e2d02bfd8abb4de4a91a945a Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 29 Oct 2019 16:21:41 +0000
Subject: [PATCH 128/232] C++: Update expected test output.

---
 cpp/ql/test/library-tests/ir/ir/raw_ir.expected | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index b38e63e6e76..a188c1b3629 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -20,7 +20,8 @@ bad_asts.cpp:
 #    9|     r0_16(glval<int>) = VariableAddress[#return] : 
 #    9|     v0_17(void)       = ReturnValue              : &:r0_16, ~mu0_2
 #    9|     v0_18(void)       = UnmodeledUse             : mu*
-#    9|     v0_19(void)       = ExitFunction             : 
+#    9|     v0_19(void)       = AliasedUse               : ~mu0_2
+#    9|     v0_20(void)       = ExitFunction             : 
 
 #   14| void Bad::CallBadMemberFunction()
 #   14|   Block 0

From 6fe22a76da7dd14eda5b002df5d3788c2f366652 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 1 Nov 2019 14:31:51 +0000
Subject: [PATCH 129/232] C++: Change API for exposing template parameters.

Note that Declaration::getTemplateArgumentType() and
Declaration::getTemplateArgumentValue() need to be public so that they
can be overriden in derived classes.
---
 cpp/ql/src/semmle/code/cpp/Class.qll          |  4 +-
 cpp/ql/src/semmle/code/cpp/Declaration.qll    | 51 ++++++++++++++-----
 cpp/ql/src/semmle/code/cpp/Function.qll       |  2 +-
 cpp/ql/src/semmle/code/cpp/Print.qll          |  8 +--
 cpp/ql/src/semmle/code/cpp/Type.qll           |  2 +-
 cpp/ql/src/semmle/code/cpp/Variable.qll       |  2 +-
 cpp/ql/src/semmle/code/cpp/exprs/Call.qll     | 21 ++++----
 .../templates/CPP-202/template_args.expected  |  4 +-
 .../nontype_instantiations/classes/test.ql    |  2 +-
 .../nontype_instantiations/functions/test.ql  |  2 +-
 .../general/test.expected                     | 23 +++++----
 .../nontype_instantiations/general/test.ql    | 14 ++++-
 12 files changed, 86 insertions(+), 49 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Class.qll b/cpp/ql/src/semmle/code/cpp/Class.qll
index 44e8b4e65ef..5ccf6193c4f 100644
--- a/cpp/ql/src/semmle/code/cpp/Class.qll
+++ b/cpp/ql/src/semmle/code/cpp/Class.qll
@@ -610,7 +610,7 @@ class Class extends UserType {
    * class template. When called on a class template, this will return the
    * `i`th template parameter.
    */
-  override Type getTemplateArgument(int i) {
+  override Type getTemplateArgumentType(int i) {
     class_template_argument(underlyingElement(this), i, unresolveElement(result))
   }
 
@@ -632,7 +632,7 @@ class Class extends UserType {
   }
 
   override predicate involvesTemplateParameter() {
-    getATemplateArgument().involvesTemplateParameter()
+    getATemplateArgument().(Type).involvesTemplateParameter()
   }
 
   /** Holds if this class, struct or union was declared 'final'. */
diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index b3d12efe1e9..9c8ce250d8d 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -196,33 +196,36 @@ abstract class Declaration extends Locatable, @declaration {
    * When called on a template, this will return a template parameter type for
    * both typed and non-typed parameters.
    */
-  final Type getATemplateArgument() { result = getTemplateArgument(_) }
+  final Locatable getATemplateArgument() { result = getTemplateArgument(_) }
 
   /**
    * Gets a template argument used to instantiate this declaration from a template.
    * When called on a template, this will return a non-typed template
    * parameter value.
    */
-  final Expr getATemplateArgumentValue() { result = getTemplateArgumentValue(_) }
+  final Locatable getATemplateArgumentKind() { result = getTemplateArgumentKind(_) }
 
   /**
    * Gets the `i`th template argument used to instantiate this declaration from a
-   * template. When called on a template, this will return the `i`th template
-   * parameter's type.
+   * template.
    *
    * For example:
    *
    * `template<typename T, T X> class Foo;`
    *
    * Will have `getTemplateArgument(0)` return `T`, and
-   * `getTemplateArgument(1)` return `T`.
+   * `getTemplateArgument(1)` return `X`.
    *
    * `Foo<int, 1> bar;
    *
    * Will have `getTemplateArgument())` return `int`, and
-   * `getTemplateArgument(1)` return `int`.
+   * `getTemplateArgument(1)` return `1`.
    */
-  Type getTemplateArgument(int index) { none() }
+  final Locatable getTemplateArgument(int index) {
+    if exists(getTemplateArgumentValue(index))
+    then result = getTemplateArgumentValue(index)
+    else result = getTemplateArgumentType(index)
+  }
 
   /**
    * Gets the `i`th template argument value used to instantiate this declaration
@@ -233,20 +236,44 @@ abstract class Declaration extends Locatable, @declaration {
    *
    * `template<typename T, T X> class Foo;`
    *
-   * Will have `getTemplateArgumentValue(1)` return `X`, and no result for
-   * `getTemplateArgumentValue(0)`.
+   * Will have `getTemplateArgumentKind(1)` return `T`, and no result for
+   * `getTemplateArgumentKind(0)`.
    *
    * `Foo<int, 10> bar;
    *
-   * Will have `getTemplateArgumentValue(1)` return `10`, and no result for
-   * `getTemplateArgumentValue(0)`.
+   * Will have `getTemplateArgumentKind(1)` return `int`, and no result for
+   * `getTemplateArgumentKind(0)`.
    */
-  Expr getTemplateArgumentValue(int index) { none() }
+  final Locatable getTemplateArgumentKind(int index) {
+    if exists(getTemplateArgumentValue(index))
+    then result = getTemplateArgumentType(index)
+    else none()
+  }
 
   /** Gets the number of template arguments for this declaration. */
   final int getNumberOfTemplateArguments() {
     result = count(int i | exists(getTemplateArgument(i)))
   }
+
+  /**
+   * INTERNAL: Do not use.
+   *
+   * Gets a Type for a template argument.  May be the template argument itself
+   * or the type of a non-type template argument.
+   *
+   * Use `getTemplateArgument` or `getTemplateKind` instead.
+   */
+  Type getTemplateArgumentType(int index) { none() }
+
+  /**
+   * INTERNAL: Do not use.
+   *
+   * Gets an Expression representing the value of a non-type template
+   * argument.
+   *
+   * Use `getTemplateArgument` or `getTemplateKind` instead.
+   */
+  Expr getTemplateArgumentValue(int index) { none() }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index be031f2b915..5436c3ba218 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -348,7 +348,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
    * function template. When called on a function template, this will return the
    * `i`th template parameter.
    */
-  override Type getTemplateArgument(int index) {
+  override Type getTemplateArgumentType(int index) {
     function_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/Print.qll b/cpp/ql/src/semmle/code/cpp/Print.qll
index 7be1537e83b..e3ad19f6028 100644
--- a/cpp/ql/src/semmle/code/cpp/Print.qll
+++ b/cpp/ql/src/semmle/code/cpp/Print.qll
@@ -36,11 +36,11 @@ private string getParameterTypeString(Type parameterType) {
 }
 
 private string getTemplateArgumentString(Declaration d, int i) {
-  if exists(d.getTemplateArgumentValue(i))
+  if exists(d.getTemplateArgumentKind(i))
   then
-    result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString() + " " + d.getTemplateArgumentValue(i)
-  else
-    result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString()
+    result = d.getTemplateArgumentKind(i).(DumpType).getTypeIdentityString() + " " +
+        d.getTemplateArgument(i)
+  else result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString()
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
index 10a1b6b1724..ea1e7fd5026 100644
--- a/cpp/ql/src/semmle/code/cpp/Type.qll
+++ b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -210,7 +210,7 @@ class Type extends Locatable, @type {
     // A function call that provides an explicit template argument that refers to T uses T.
     // We exclude calls within instantiations, since they do not appear directly in the source.
     exists(FunctionCall c |
-      c.getAnExplicitTemplateArgument().refersTo(this) and
+      c.getAnExplicitTemplateArgument().(Type).refersTo(this) and
       result = c and
       not c.getEnclosingFunction().isConstructedFrom(_)
     )
diff --git a/cpp/ql/src/semmle/code/cpp/Variable.qll b/cpp/ql/src/semmle/code/cpp/Variable.qll
index deae1069aab..689f1c3bfa5 100644
--- a/cpp/ql/src/semmle/code/cpp/Variable.qll
+++ b/cpp/ql/src/semmle/code/cpp/Variable.qll
@@ -160,7 +160,7 @@ class Variable extends Declaration, @variable {
    * variable template. When called on a variable template, this will return the
    * `i`th template parameter.
    */
-  override Type getTemplateArgument(int index) {
+  override Type getTemplateArgumentType(int index) {
     variable_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
index 85807cf0d14..22a25969a8f 100644
--- a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
@@ -139,27 +139,27 @@ class FunctionCall extends Call, @funbindexpr {
   override string getCanonicalQLClass() { result = "FunctionCall" }
 
   /** Gets an explicit template argument for this call. */
-  Type getAnExplicitTemplateArgument() { result = getExplicitTemplateArgument(_) }
+  Locatable getAnExplicitTemplateArgument() { result = getExplicitTemplateArgument(_) }
 
   /** Gets an explicit template argument value for this call. */
-  Expr getAnExplicitTemplateArgumentValue() { result = getExplicitTemplateArgumentValue(_) }
+  Locatable getAnExplicitTemplateArgumentKind() { result = getExplicitTemplateArgumentKind(_) }
 
   /** Gets a template argument for this call. */
-  Type getATemplateArgument() { result = getTarget().getATemplateArgument() }
+  Locatable getATemplateArgument() { result = getTarget().getATemplateArgument() }
 
   /** Gets a template argument value for this call. */
-  Expr getATemplateArgumentValue() { result = getTarget().getATemplateArgumentValue() }
+  Locatable getATemplateArgumentKind() { result = getTarget().getATemplateArgumentKind() }
 
   /** Gets the nth explicit template argument for this call. */
-  Type getExplicitTemplateArgument(int n) {
+  Locatable getExplicitTemplateArgument(int n) {
     n < getNumberOfExplicitTemplateArguments() and
     result = getTemplateArgument(n)
   }
 
   /** Gets the nth explicit template argument value for this call. */
-  Expr getExplicitTemplateArgumentValue(int n) {
+  Locatable getExplicitTemplateArgumentKind(int n) {
     n < getNumberOfExplicitTemplateArguments() and
-    result = getTemplateArgumentValue(n)
+    result = getTemplateArgumentKind(n)
   }
 
   /** Gets the number of explicit template arguments for this call. */
@@ -172,14 +172,11 @@ class FunctionCall extends Call, @funbindexpr {
   /** Gets the number of template arguments for this call. */
   int getNumberOfTemplateArguments() { result = count(int i | exists(getTemplateArgument(i))) }
 
-  /** Gets the number of template argument which are values for this call. */
-  int getNumberOfTemplateArgumentValues() { result = count(int i | exists(getTemplateArgumentValue(i))) }
-
   /** Gets the nth template argument for this call (indexed from 0). */
-  Type getTemplateArgument(int n) { result = getTarget().getTemplateArgument(n) }
+  Locatable getTemplateArgument(int n) { result = getTarget().getTemplateArgument(n) }
 
   /** Gets the nth template argument value for this call (indexed from 0). */
-  Expr getTemplateArgumentValue(int n) { result = getTarget().getTemplateArgumentValue(n) }
+  Locatable getTemplateArgumentKind(int n) { result = getTarget().getTemplateArgumentKind(n) }
 
   /** Holds if any template arguments for this call are implicit / deduced. */
   predicate hasImplicitTemplateArguments() {
diff --git a/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected b/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
index ae10f9ddf63..f38eef610e4 100644
--- a/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
+++ b/cpp/ql/test/library-tests/templates/CPP-202/template_args.expected
@@ -1,6 +1,6 @@
 | file://:0:0:0:0 | __va_list_tag | <none> |
-| test.cpp:3:8:3:9 | s1<<expression>> | bool |
-| test.cpp:3:8:3:9 | s1<<unnamed>> | bool |
+| test.cpp:3:8:3:9 | s1<<expression>> | {...} |
+| test.cpp:3:8:3:9 | s1<<unnamed>> | (null) |
 | test.cpp:5:8:5:9 | s2<T> | T |
 | test.cpp:5:8:5:9 | s2<T> | T |
 | test.cpp:7:8:7:9 | s3<T, <unnamed>> | (unnamed) |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
index 347bb2dba00..900424eb501 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/classes/test.ql
@@ -1,4 +1,4 @@
 import cpp
 
 from Class c
-select c, c.getATemplateArgument(), c.getATemplateArgumentValue()
+select c, c.getATemplateArgumentKind(), c.getATemplateArgument()
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql
index 4dd6e754cd6..98f8a4112d4 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/functions/test.ql
@@ -1,4 +1,4 @@
 import cpp
 
 from Function f
-select f, f.getATemplateArgument(), f.getATemplateArgumentValue()
+select f, f.getATemplateArgumentKind(), f.getATemplateArgument()
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
index 70dfdbc3edf..fa5df86f68f 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
@@ -1,10 +1,13 @@
-| test.cpp:3:8:3:8 | C<1> | file://:0:0:0:0 | int | test.cpp:5:25:5:25 | 1 |
-| test.cpp:3:8:3:8 | C<2> | file://:0:0:0:0 | int | file://:0:0:0:0 | 2 |
-| test.cpp:3:8:3:8 | C<x> | file://:0:0:0:0 | int | file://:0:0:0:0 | x |
-| test.cpp:10:8:10:8 | D<T, X> | test.cpp:9:19:9:19 | T | file://:0:0:0:0 | X |
-| test.cpp:10:8:10:8 | D<int, 2> | file://:0:0:0:0 | int | test.cpp:12:8:12:8 | 2 |
-| test.cpp:10:8:10:8 | D<long, 2L> | file://:0:0:0:0 | long | file://:0:0:0:0 | 2 |
-| test.cpp:16:8:16:8 | E<T, X> | file://:0:0:0:0 | T * | file://:0:0:0:0 | X |
-| test.cpp:16:8:16:8 | E<T, X> | test.cpp:15:19:15:19 | T | file://:0:0:0:0 | X |
-| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | file://:0:0:0:0 | int | file://:0:0:0:0 | 0 |
-| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | file://:0:0:0:0 | int * | file://:0:0:0:0 | 0 |
+| test.cpp:3:8:3:8 | C<1> | 0 | int | test.cpp:5:25:5:25 | 1 |
+| test.cpp:3:8:3:8 | C<2> | 0 | int | file://:0:0:0:0 | 2 |
+| test.cpp:3:8:3:8 | C<x> | 0 | int | file://:0:0:0:0 | x |
+| test.cpp:10:8:10:8 | D<T, X> | 0 | <none> | test.cpp:9:19:9:19 | T |
+| test.cpp:10:8:10:8 | D<T, X> | 1 | T | file://:0:0:0:0 | X |
+| test.cpp:10:8:10:8 | D<int, 2> | 0 | <none> | file://:0:0:0:0 | int |
+| test.cpp:10:8:10:8 | D<int, 2> | 1 | int | test.cpp:12:8:12:8 | 2 |
+| test.cpp:10:8:10:8 | D<long, 2L> | 0 | <none> | file://:0:0:0:0 | long |
+| test.cpp:10:8:10:8 | D<long, 2L> | 1 | long | file://:0:0:0:0 | 2 |
+| test.cpp:16:8:16:8 | E<T, X> | 0 | <none> | test.cpp:15:19:15:19 | T |
+| test.cpp:16:8:16:8 | E<T, X> | 1 | T * | file://:0:0:0:0 | X |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 0 | <none> | file://:0:0:0:0 | int |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 1 | int * | file://:0:0:0:0 | 0 |
diff --git a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
index 8915d6523b6..68d597e0f98 100644
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
@@ -1,4 +1,14 @@
 import cpp
 
-from Declaration d
-select d, d.getATemplateArgument(), d.getATemplateArgumentValue()
+string maybeGetTemplateArgumentKind(Declaration d, int i) {
+  (
+    if exists(d.getTemplateArgumentKind(i))
+    then result = d.getTemplateArgumentKind(i).toString()
+    else result = "<none>"
+  ) and
+  i = [0 .. d.getNumberOfTemplateArguments()]
+}
+
+from Declaration d, int i
+where i >= 0 and i < d.getNumberOfTemplateArguments()
+select d, i, maybeGetTemplateArgumentKind(d, i), d.getTemplateArgument(i)

From 6b4506dbea2edc9113c39238041d5a337087142c Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Fri, 1 Nov 2019 14:35:48 +0000
Subject: [PATCH 130/232] C++: Update schema stats

---
 cpp/ql/src/semmlecode.cpp.dbscheme.stats | 10940 +++++++++++----------
 1 file changed, 5769 insertions(+), 5171 deletions(-)

diff --git a/cpp/ql/src/semmlecode.cpp.dbscheme.stats b/cpp/ql/src/semmlecode.cpp.dbscheme.stats
index bd1964b0d4f..3a73724456a 100644
--- a/cpp/ql/src/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/src/semmlecode.cpp.dbscheme.stats
@@ -1,15 +1,15 @@
 <dbstats>
   <typesizes><e>
 <k>@compilation</k>
-<v>10588</v>
+<v>10177</v>
 </e>
 <e>
 <k>@externalDataElement</k>
-<v>72</v>
+<v>70</v>
 </e>
 <e>
 <k>@duplication</k>
-<v>185332</v>
+<v>185440</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -17,7 +17,7 @@
 </e>
 <e>
 <k>@external_package</k>
-<v>133</v>
+<v>128</v>
 </e>
 <e>
 <k>@svnentry</k>
@@ -25,67 +25,67 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>9664446</v>
+<v>9335283</v>
 </e>
 <e>
 <k>@location_stmt</k>
-<v>2176932</v>
+<v>2178211</v>
 </e>
 <e>
 <k>@location_expr</k>
-<v>9745314</v>
+<v>9746017</v>
 </e>
 <e>
 <k>@diagnostic</k>
-<v>76160</v>
+<v>73204</v>
 </e>
 <e>
 <k>@file</k>
-<v>66167</v>
+<v>63599</v>
 </e>
 <e>
 <k>@folder</k>
-<v>12107</v>
+<v>11637</v>
 </e>
 <e>
 <k>@macroinvocation</k>
-<v>40814994</v>
+<v>39320374</v>
 </e>
 <e>
 <k>@function</k>
-<v>3565918</v>
+<v>3552236</v>
 </e>
 <e>
 <k>@fun_decl</k>
-<v>3657006</v>
+<v>3635139</v>
 </e>
 <e>
 <k>@var_decl</k>
-<v>5579181</v>
+<v>5495954</v>
 </e>
 <e>
 <k>@type_decl</k>
-<v>1469165</v>
+<v>1413769</v>
 </e>
 <e>
 <k>@namespace_decl</k>
-<v>151627</v>
+<v>145743</v>
 </e>
 <e>
 <k>@using</k>
-<v>320601</v>
+<v>308161</v>
 </e>
 <e>
 <k>@static_assert</k>
-<v>132358</v>
+<v>131017</v>
 </e>
 <e>
 <k>@parameter</k>
-<v>4779409</v>
+<v>4724692</v>
 </e>
 <e>
 <k>@membervariable</k>
-<v>325099</v>
+<v>321201</v>
 </e>
 <e>
 <k>@globalvariable</k>
@@ -93,47 +93,47 @@
 </e>
 <e>
 <k>@localvariable</k>
-<v>527101</v>
+<v>521758</v>
 </e>
 <e>
 <k>@enumconstant</k>
-<v>94487</v>
+<v>94097</v>
 </e>
 <e>
 <k>@builtintype</k>
-<v>559</v>
+<v>537</v>
 </e>
 <e>
 <k>@derivedtype</k>
-<v>4572495</v>
+<v>4651908</v>
 </e>
 <e>
 <k>@decltype</k>
-<v>45841</v>
+<v>44063</v>
 </e>
 <e>
 <k>@usertype</k>
-<v>4363319</v>
+<v>4337028</v>
 </e>
 <e>
 <k>@mangledname</k>
-<v>532986</v>
+<v>514256</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1699359</v>
+<v>1682135</v>
 </e>
 <e>
 <k>@routinetype</k>
-<v>444572</v>
+<v>436132</v>
 </e>
 <e>
 <k>@ptrtomember</k>
-<v>12180</v>
+<v>13227</v>
 </e>
 <e>
 <k>@specifier</k>
-<v>547</v>
+<v>525</v>
 </e>
 <e>
 <k>@gnuattribute</k>
@@ -141,11 +141,11 @@
 </e>
 <e>
 <k>@stdattribute</k>
-<v>369</v>
+<v>365</v>
 </e>
 <e>
 <k>@declspec</k>
-<v>58441</v>
+<v>57849</v>
 </e>
 <e>
 <k>@msattribute</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@alignas</k>
-<v>267</v>
+<v>257</v>
 </e>
 <e>
 <k>@attribute_arg_empty</k>
@@ -161,55 +161,55 @@
 </e>
 <e>
 <k>@attribute_arg_token</k>
-<v>15930</v>
+<v>15768</v>
 </e>
 <e>
 <k>@attribute_arg_constant</k>
-<v>111500</v>
+<v>111565</v>
 </e>
 <e>
 <k>@attribute_arg_type</k>
-<v>60</v>
+<v>58</v>
 </e>
 <e>
 <k>@derivation</k>
-<v>370309</v>
+<v>392220</v>
 </e>
 <e>
 <k>@frienddecl</k>
-<v>231178</v>
+<v>222208</v>
 </e>
 <e>
 <k>@comment</k>
-<v>1743633</v>
+<v>1675974</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>8497</v>
+<v>8167</v>
 </e>
 <e>
 <k>@specialnamequalifyingelement</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>@namequalifier</k>
-<v>1125621</v>
+<v>1116919</v>
 </e>
 <e>
 <k>@value</k>
-<v>8776796</v>
+<v>8788031</v>
 </e>
 <e>
 <k>@initialiser</k>
-<v>1685017</v>
+<v>1668506</v>
 </e>
 <e>
 <k>@literal</k>
-<v>4374193</v>
+<v>4381545</v>
 </e>
 <e>
 <k>@errorexpr</k>
-<v>48066</v>
+<v>46201</v>
 </e>
 <e>
 <k>@address_of</k>
@@ -217,15 +217,15 @@
 </e>
 <e>
 <k>@reference_to</k>
-<v>1077837</v>
+<v>1039133</v>
 </e>
 <e>
 <k>@indirect</k>
-<v>294638</v>
+<v>294811</v>
 </e>
 <e>
 <k>@ref_indirect</k>
-<v>1267903</v>
+<v>1225212</v>
 </e>
 <e>
 <k>@array_to_pointer</k>
@@ -233,31 +233,31 @@
 </e>
 <e>
 <k>@vacuous_destructor_call</k>
-<v>4449</v>
+<v>4288</v>
 </e>
 <e>
 <k>@assume</k>
-<v>3328</v>
+<v>3294</v>
 </e>
 <e>
 <k>@parexpr</k>
-<v>3001187</v>
+<v>3002950</v>
 </e>
 <e>
 <k>@arithnegexpr</k>
-<v>654789</v>
+<v>654792</v>
 </e>
 <e>
 <k>@unaryplusexpr</k>
-<v>206</v>
+<v>198</v>
 </e>
 <e>
 <k>@complementexpr</k>
-<v>28027</v>
+<v>28043</v>
 </e>
 <e>
 <k>@notexpr</k>
-<v>357915</v>
+<v>358125</v>
 </e>
 <e>
 <k>@conjugation</k>
@@ -265,51 +265,51 @@
 </e>
 <e>
 <k>@realpartexpr</k>
-<v>72</v>
+<v>70</v>
 </e>
 <e>
 <k>@imagpartexpr</k>
-<v>72</v>
+<v>70</v>
 </e>
 <e>
 <k>@postincrexpr</k>
-<v>43039</v>
+<v>43064</v>
 </e>
 <e>
 <k>@postdecrexpr</k>
-<v>5401</v>
+<v>5404</v>
 </e>
 <e>
 <k>@preincrexpr</k>
-<v>63954</v>
+<v>61508</v>
 </e>
 <e>
 <k>@predecrexpr</k>
-<v>26586</v>
+<v>25554</v>
 </e>
 <e>
 <k>@conditionalexpr</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 <e>
 <k>@addexpr</k>
-<v>209503</v>
+<v>209626</v>
 </e>
 <e>
 <k>@subexpr</k>
-<v>134974</v>
+<v>135053</v>
 </e>
 <e>
 <k>@mulexpr</k>
-<v>91616</v>
+<v>91670</v>
 </e>
 <e>
 <k>@divexpr</k>
-<v>63973</v>
+<v>64010</v>
 </e>
 <e>
 <k>@remexpr</k>
-<v>4657</v>
+<v>4660</v>
 </e>
 <e>
 <k>@jmulexpr</k>
@@ -337,59 +337,59 @@
 </e>
 <e>
 <k>@paddexpr</k>
-<v>87252</v>
+<v>87303</v>
 </e>
 <e>
 <k>@psubexpr</k>
-<v>23151</v>
+<v>23165</v>
 </e>
 <e>
 <k>@pdiffexpr</k>
-<v>25868</v>
+<v>24865</v>
 </e>
 <e>
 <k>@lshiftexpr</k>
-<v>347564</v>
+<v>347768</v>
 </e>
 <e>
 <k>@rshiftexpr</k>
-<v>59286</v>
+<v>59321</v>
 </e>
 <e>
 <k>@andexpr</k>
-<v>236938</v>
+<v>237077</v>
 </e>
 <e>
 <k>@orexpr</k>
-<v>145217</v>
+<v>143745</v>
 </e>
 <e>
 <k>@xorexpr</k>
-<v>37281</v>
+<v>37303</v>
 </e>
 <e>
 <k>@eqexpr</k>
-<v>212621</v>
+<v>212746</v>
 </e>
 <e>
 <k>@neexpr</k>
-<v>88456</v>
+<v>88508</v>
 </e>
 <e>
 <k>@gtexpr</k>
-<v>43936</v>
+<v>43962</v>
 </e>
 <e>
 <k>@ltexpr</k>
-<v>54831</v>
+<v>54863</v>
 </e>
 <e>
 <k>@geexpr</k>
-<v>22361</v>
+<v>22374</v>
 </e>
 <e>
 <k>@leexpr</k>
-<v>213875</v>
+<v>214001</v>
 </e>
 <e>
 <k>@minexpr</k>
@@ -401,7 +401,7 @@
 </e>
 <e>
 <k>@assignexpr</k>
-<v>551713</v>
+<v>552037</v>
 </e>
 <e>
 <k>@assignaddexpr</k>
@@ -413,15 +413,15 @@
 </e>
 <e>
 <k>@assignmulexpr</k>
-<v>7597</v>
+<v>7302</v>
 </e>
 <e>
 <k>@assigndivexpr</k>
-<v>2297</v>
+<v>2208</v>
 </e>
 <e>
 <k>@assignremexpr</k>
-<v>303</v>
+<v>292</v>
 </e>
 <e>
 <k>@assignlshiftexpr</k>
@@ -433,39 +433,39 @@
 </e>
 <e>
 <k>@assignandexpr</k>
-<v>7740</v>
+<v>7744</v>
 </e>
 <e>
 <k>@assignorexpr</k>
-<v>18663</v>
+<v>18674</v>
 </e>
 <e>
 <k>@assignxorexpr</k>
-<v>21992</v>
+<v>22005</v>
 </e>
 <e>
 <k>@assignpaddexpr</k>
-<v>13214</v>
+<v>13080</v>
 </e>
 <e>
 <k>@assignpsubexpr</k>
-<v>583</v>
+<v>577</v>
 </e>
 <e>
 <k>@andlogicalexpr</k>
-<v>116840</v>
+<v>116908</v>
 </e>
 <e>
 <k>@orlogicalexpr</k>
-<v>57827</v>
+<v>57861</v>
 </e>
 <e>
 <k>@commaexpr</k>
-<v>10721</v>
+<v>10329</v>
 </e>
 <e>
 <k>@subscriptexpr</k>
-<v>165754</v>
+<v>165851</v>
 </e>
 <e>
 <k>@virtfunptrexpr</k>
@@ -473,15 +473,15 @@
 </e>
 <e>
 <k>@callexpr</k>
-<v>248513</v>
+<v>239197</v>
 </e>
 <e>
 <k>@vastartexpr</k>
-<v>3710</v>
+<v>3673</v>
 </e>
 <e>
 <k>@vaargexpr</k>
-<v>1094</v>
+<v>1051</v>
 </e>
 <e>
 <k>@vaendexpr</k>
@@ -493,63 +493,63 @@
 </e>
 <e>
 <k>@varaccess</k>
-<v>5376400</v>
+<v>5325591</v>
 </e>
 <e>
 <k>@thisaccess</k>
-<v>1181340</v>
+<v>1169367</v>
 </e>
 <e>
 <k>@new_expr</k>
-<v>29515</v>
+<v>28370</v>
 </e>
 <e>
 <k>@delete_expr</k>
-<v>6564</v>
+<v>6309</v>
 </e>
 <e>
 <k>@throw_expr</k>
-<v>23777</v>
+<v>22855</v>
 </e>
 <e>
 <k>@condition_decl</k>
-<v>7646</v>
+<v>7349</v>
 </e>
 <e>
 <k>@braced_init_list</k>
-<v>133</v>
+<v>128</v>
 </e>
 <e>
 <k>@type_id</k>
-<v>4899</v>
+<v>4708</v>
 </e>
 <e>
 <k>@runtime_sizeof</k>
-<v>281622</v>
+<v>281787</v>
 </e>
 <e>
 <k>@runtime_alignof</k>
-<v>1560</v>
+<v>1561</v>
 </e>
 <e>
 <k>@sizeof_pack</k>
-<v>267</v>
+<v>502</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>160546</v>
+<v>160640</v>
 </e>
 <e>
 <k>@routineexpr</k>
-<v>2309113</v>
+<v>2232038</v>
 </e>
 <e>
 <k>@type_operand</k>
-<v>127928</v>
+<v>128003</v>
 </e>
 <e>
 <k>@offsetofexpr</k>
-<v>35356</v>
+<v>35377</v>
 </e>
 <e>
 <k>@hasassignexpr</k>
@@ -597,11 +597,11 @@
 </e>
 <e>
 <k>@isbaseofexpr</k>
-<v>19</v>
+<v>39</v>
 </e>
 <e>
 <k>@isclassexpr</k>
-<v>6</v>
+<v>215</v>
 </e>
 <e>
 <k>@isconvtoexpr</k>
@@ -609,15 +609,15 @@
 </e>
 <e>
 <k>@isemptyexpr</k>
-<v>5</v>
+<v>175</v>
 </e>
 <e>
 <k>@isenumexpr</k>
-<v>3</v>
+<v>23</v>
 </e>
 <e>
 <k>@ispodexpr</k>
-<v>3</v>
+<v>11</v>
 </e>
 <e>
 <k>@ispolyexpr</k>
@@ -629,7 +629,7 @@
 </e>
 <e>
 <k>@typescompexpr</k>
-<v>46285</v>
+<v>46312</v>
 </e>
 <e>
 <k>@intaddrexpr</k>
@@ -637,11 +637,11 @@
 </e>
 <e>
 <k>@hastrivialdestructor</k>
-<v>97</v>
+<v>105</v>
 </e>
 <e>
 <k>@uuidof</k>
-<v>856</v>
+<v>848</v>
 </e>
 <e>
 <k>@aggregateliteral</k>
@@ -649,11 +649,11 @@
 </e>
 <e>
 <k>@delete_array_expr</k>
-<v>1495</v>
+<v>1437</v>
 </e>
 <e>
 <k>@new_array_expr</k>
-<v>5364</v>
+<v>5310</v>
 </e>
 <e>
 <k>@foldexpr</k>
@@ -661,59 +661,59 @@
 </e>
 <e>
 <k>@ctordirectinit</k>
-<v>93264</v>
+<v>89645</v>
 </e>
 <e>
 <k>@ctorvirtualinit</k>
-<v>6904</v>
+<v>6636</v>
 </e>
 <e>
 <k>@ctorfieldinit</k>
-<v>209661</v>
+<v>201538</v>
 </e>
 <e>
 <k>@ctordelegatinginit</k>
-<v>741</v>
+<v>712</v>
 </e>
 <e>
 <k>@dtordirectdestruct</k>
-<v>30828</v>
+<v>30111</v>
 </e>
 <e>
 <k>@dtorvirtualdestruct</k>
-<v>2698</v>
+<v>2594</v>
 </e>
 <e>
 <k>@dtorfielddestruct</k>
-<v>32542</v>
+<v>31279</v>
 </e>
 <e>
 <k>@static_cast</k>
-<v>224735</v>
+<v>226064</v>
 </e>
 <e>
 <k>@reinterpret_cast</k>
-<v>31207</v>
+<v>30891</v>
 </e>
 <e>
 <k>@const_cast</k>
-<v>5847</v>
+<v>5643</v>
 </e>
 <e>
 <k>@dynamic_cast</k>
-<v>1094</v>
+<v>1051</v>
 </e>
 <e>
 <k>@c_style_cast</k>
-<v>4242732</v>
+<v>4244118</v>
 </e>
 <e>
 <k>@lambdaexpr</k>
-<v>12641</v>
+<v>12513</v>
 </e>
 <e>
 <k>@param_ref</k>
-<v>53208</v>
+<v>51144</v>
 </e>
 <e>
 <k>@noopexpr</k>
@@ -745,7 +745,7 @@
 </e>
 <e>
 <k>@istrivialexpr</k>
-<v>2565</v>
+<v>2512</v>
 </e>
 <e>
 <k>@isstandardlayoutexpr</k>
@@ -753,7 +753,7 @@
 </e>
 <e>
 <k>@istriviallycopyableexpr</k>
-<v>48</v>
+<v>46</v>
 </e>
 <e>
 <k>@isliteraltypeexpr</k>
@@ -813,11 +813,11 @@
 </e>
 <e>
 <k>@isfinalexpr</k>
-<v>2</v>
+<v>175</v>
 </e>
 <e>
 <k>@noexceptexpr</k>
-<v>449</v>
+<v>432</v>
 </e>
 <e>
 <k>@builtinshufflevector</k>
@@ -825,11 +825,11 @@
 </e>
 <e>
 <k>@builtinchooseexpr</k>
-<v>7028</v>
+<v>7032</v>
 </e>
 <e>
 <k>@builtinaddressof</k>
-<v>4388</v>
+<v>4218</v>
 </e>
 <e>
 <k>@vec_fill</k>
@@ -845,67 +845,67 @@
 </e>
 <e>
 <k>@lambdacapture</k>
-<v>21730</v>
+<v>21509</v>
 </e>
 <e>
 <k>@stmt_expr</k>
-<v>1284462</v>
+<v>1271443</v>
 </e>
 <e>
 <k>@stmt_if</k>
-<v>524558</v>
+<v>524866</v>
 </e>
 <e>
 <k>@stmt_while</k>
-<v>32907</v>
+<v>31630</v>
 </e>
 <e>
 <k>@stmt_goto</k>
-<v>111432</v>
+<v>111498</v>
 </e>
 <e>
 <k>@stmt_label</k>
-<v>85508</v>
+<v>85558</v>
 </e>
 <e>
 <k>@stmt_return</k>
-<v>1197201</v>
+<v>1154730</v>
 </e>
 <e>
 <k>@stmt_block</k>
-<v>1398281</v>
+<v>1348007</v>
 </e>
 <e>
 <k>@stmt_end_test_while</k>
-<v>149900</v>
+<v>149988</v>
 </e>
 <e>
 <k>@stmt_for</k>
-<v>32387</v>
+<v>32059</v>
 </e>
 <e>
 <k>@stmt_switch_case</k>
-<v>281530</v>
+<v>281695</v>
 </e>
 <e>
 <k>@stmt_switch</k>
-<v>55225</v>
+<v>55258</v>
 </e>
 <e>
 <k>@stmt_asm</k>
-<v>251715</v>
+<v>251863</v>
 </e>
 <e>
 <k>@stmt_try_block</k>
-<v>18964</v>
+<v>18228</v>
 </e>
 <e>
 <k>@stmt_microsoft_try</k>
-<v>171</v>
+<v>169</v>
 </e>
 <e>
 <k>@stmt_decl</k>
-<v>647378</v>
+<v>623601</v>
 </e>
 <e>
 <k>@stmt_set_vla_size</k>
@@ -917,27 +917,27 @@
 </e>
 <e>
 <k>@stmt_assigned_goto</k>
-<v>9137</v>
+<v>9142</v>
 </e>
 <e>
 <k>@stmt_empty</k>
-<v>103681</v>
+<v>102630</v>
 </e>
 <e>
 <k>@stmt_continue</k>
-<v>8603</v>
+<v>8608</v>
 </e>
 <e>
 <k>@stmt_break</k>
-<v>232406</v>
+<v>232543</v>
 </e>
 <e>
 <k>@stmt_range_based_for</k>
-<v>24</v>
+<v>23</v>
 </e>
 <e>
 <k>@stmt_handler</k>
-<v>21888</v>
+<v>21666</v>
 </e>
 <e>
 <k>@stmt_constexpr_if</k>
@@ -945,51 +945,51 @@
 </e>
 <e>
 <k>@ppd_plain_include</k>
-<v>321707</v>
+<v>309224</v>
 </e>
 <e>
 <k>@ppd_define</k>
-<v>349947</v>
+<v>336367</v>
 </e>
 <e>
 <k>@ppd_if</k>
-<v>171077</v>
+<v>164439</v>
 </e>
 <e>
 <k>@ppd_ifdef</k>
-<v>66823</v>
+<v>64230</v>
 </e>
 <e>
 <k>@ppd_ifndef</k>
-<v>91793</v>
+<v>88231</v>
 </e>
 <e>
 <k>@ppd_elif</k>
-<v>22768</v>
+<v>21885</v>
 </e>
 <e>
 <k>@ppd_else</k>
-<v>63638</v>
+<v>61169</v>
 </e>
 <e>
 <k>@ppd_endif</k>
-<v>329694</v>
+<v>316901</v>
 </e>
 <e>
 <k>@ppd_undef</k>
-<v>21152</v>
+<v>20331</v>
 </e>
 <e>
 <k>@ppd_line</k>
-<v>12523</v>
+<v>12530</v>
 </e>
 <e>
 <k>@ppd_error</k>
-<v>48</v>
+<v>46</v>
 </e>
 <e>
 <k>@ppd_pragma</k>
-<v>37040</v>
+<v>36665</v>
 </e>
 <e>
 <k>@ppd_objc_import</k>
@@ -997,7 +997,7 @@
 </e>
 <e>
 <k>@ppd_include_next</k>
-<v>97</v>
+<v>93</v>
 </e>
 <e>
 <k>@ppd_warning</k>
@@ -1005,7 +1005,7 @@
 </e>
 <e>
 <k>@link_target</k>
-<v>644</v>
+<v>619</v>
 </e>
 <e>
 <k>@xmldtd</k>
@@ -1034,15 +1034,15 @@
 </typesizes>
   <stats><relation>
 <name>compilations</name>
-<cardinality>10588</cardinality>
+<cardinality>10177</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10588</v>
+<v>10177</v>
 </e>
 <e>
 <k>cwd</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1056,7 +1056,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10588</v>
+<v>10177</v>
 </b>
 </bs>
 </hist>
@@ -1072,7 +1072,7 @@
 <b>
 <a>871</a>
 <b>872</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1082,11 +1082,11 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>394124</cardinality>
+<cardinality>394355</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4637</v>
+<v>4640</v>
 </e>
 <e>
 <k>num</k>
@@ -1094,7 +1094,7 @@
 </e>
 <e>
 <k>arg</k>
-<v>20097</v>
+<v>20109</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1113,7 +1113,7 @@
 <b>
 <a>87</a>
 <b>88</b>
-<v>3527</v>
+<v>3529</v>
 </b>
 <b>
 <a>88</a>
@@ -1149,7 +1149,7 @@
 <b>
 <a>86</a>
 <b>87</b>
-<v>3529</v>
+<v>3531</v>
 </b>
 <b>
 <a>87</a>
@@ -1322,12 +1322,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19123</v>
+<v>19134</v>
 </b>
 <b>
 <a>2</a>
 <b>2575</b>
-<v>974</v>
+<v>975</v>
 </b>
 </bs>
 </hist>
@@ -1343,7 +1343,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19748</v>
+<v>19760</v>
 </b>
 <b>
 <a>2</a>
@@ -1358,19 +1358,19 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>10588</cardinality>
+<cardinality>10177</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10588</v>
+<v>10177</v>
 </e>
 <e>
 <k>num</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>file</k>
-<v>5373</v>
+<v>5164</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1384,7 +1384,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10588</v>
+<v>10177</v>
 </b>
 </bs>
 </hist>
@@ -1400,7 +1400,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10588</v>
+<v>10177</v>
 </b>
 </bs>
 </hist>
@@ -1416,7 +1416,7 @@
 <b>
 <a>871</a>
 <b>872</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1432,7 +1432,7 @@
 <b>
 <a>442</a>
 <b>443</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1448,17 +1448,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>303</v>
+<v>292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5044</v>
+<v>4849</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -1474,7 +1474,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5373</v>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -1484,23 +1484,23 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>42255</cardinality>
+<cardinality>40616</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10563</v>
+<v>10154</v>
 </e>
 <e>
 <k>num</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>kind</k>
-<v>48</v>
+<v>46</v>
 </e>
 <e>
 <k>seconds</k>
-<v>12375</v>
+<v>11965</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1514,7 +1514,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10563</v>
+<v>10154</v>
 </b>
 </bs>
 </hist>
@@ -1530,7 +1530,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>10563</v>
+<v>10154</v>
 </b>
 </bs>
 </hist>
@@ -1544,14 +1544,19 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>2</a>
+<b>3</b>
+<v>58</v>
+</b>
+<b>
 <a>3</a>
 <b>4</b>
-<v>3160</v>
+<v>2792</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7403</v>
+<v>7302</v>
 </b>
 </bs>
 </hist>
@@ -1567,7 +1572,7 @@
 <b>
 <a>869</a>
 <b>870</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1583,7 +1588,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1597,9 +1602,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1018</a>
-<b>1019</b>
-<v>12</v>
+<a>1024</a>
+<b>1025</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1615,7 +1620,7 @@
 <b>
 <a>869</a>
 <b>870</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -1631,7 +1636,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -1645,24 +1650,24 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>6</a>
-<b>7</b>
-<v>12</v>
+<a>7</a>
+<b>8</b>
+<v>11</v>
 </b>
 <b>
-<a>9</a>
-<b>10</b>
-<v>12</v>
+<a>10</a>
+<b>11</b>
+<v>11</v>
 </b>
 <b>
-<a>561</a>
-<b>562</b>
-<v>12</v>
+<a>560</a>
+<b>561</b>
+<v>11</v>
 </b>
 <b>
-<a>597</a>
-<b>598</b>
-<v>12</v>
+<a>591</a>
+<b>592</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1678,27 +1683,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7755</v>
+<v>7501</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2613</v>
+<v>2617</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1045</v>
+<v>759</v>
 </b>
 <b>
 <a>4</a>
-<b>324</b>
-<v>936</v>
+<b>8</b>
+<v>899</v>
 </b>
 <b>
-<a>417</a>
-<b>614</b>
-<v>24</v>
+<a>8</a>
+<b>632</b>
+<v>186</v>
 </b>
 </bs>
 </hist>
@@ -1714,7 +1719,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12375</v>
+<v>11965</v>
 </b>
 </bs>
 </hist>
@@ -1730,12 +1735,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10490</v>
+<v>10305</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1884</v>
+<v>1635</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -1745,23 +1755,23 @@
 </relation>
 <relation>
 <name>diagnostic_for</name>
-<cardinality>940397</cardinality>
+<cardinality>903906</cardinality>
 <columnsizes>
 <e>
 <k>diagnostic</k>
-<v>940397</v>
+<v>73204</v>
 </e>
 <e>
 <k>compilation</k>
-<v>10223</v>
+<v>9826</v>
 </e>
 <e>
 <k>file_number</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>file_number_diagnostic_number</k>
-<v>7208</v>
+<v>6929</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1775,7 +1785,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>940397</v>
+<v>9861</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>60456</v>
+</b>
+<b>
+<a>118</a>
+<b>840</b>
+<v>2886</v>
 </b>
 </bs>
 </hist>
@@ -1791,7 +1811,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>940397</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -1807,7 +1827,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>940397</v>
+<v>73181</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -1823,37 +1848,37 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>5227</v>
+<v>5024</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>1665</v>
+<v>1600</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>247</a>
 <b>248</b>
-<v>2066</v>
+<v>1986</v>
 </b>
 <b>
 <a>263</a>
 <b>444</b>
-<v>802</v>
+<v>771</v>
 </b>
 <b>
 <a>446</a>
 <b>594</b>
-<v>218</v>
+<v>210</v>
 </b>
 </bs>
 </hist>
@@ -1869,7 +1894,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10223</v>
+<v>9826</v>
 </b>
 </bs>
 </hist>
@@ -1885,37 +1910,37 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>5227</v>
+<v>5024</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>1665</v>
+<v>1600</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>247</a>
 <b>248</b>
-<v>2066</v>
+<v>1986</v>
 </b>
 <b>
 <a>263</a>
 <b>444</b>
-<v>802</v>
+<v>771</v>
 </b>
 <b>
 <a>446</a>
 <b>594</b>
-<v>218</v>
+<v>210</v>
 </b>
 </bs>
 </hist>
@@ -1931,7 +1956,7 @@
 <b>
 <a>6265</a>
 <b>6266</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1947,7 +1972,7 @@
 <b>
 <a>841</a>
 <b>842</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1963,7 +1988,7 @@
 <b>
 <a>593</a>
 <b>594</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -1979,47 +2004,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2954</v>
+<v>2839</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1057</v>
+<v>1016</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>571</v>
+<v>549</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>632</v>
+<v>607</v>
 </b>
 <b>
 <a>18</a>
 <b>23</b>
-<v>486</v>
+<v>467</v>
 </b>
 <b>
 <a>26</a>
 <b>40</b>
-<v>583</v>
+<v>560</v>
 </b>
 <b>
 <a>42</a>
 <b>842</b>
-<v>206</v>
+<v>198</v>
 </b>
 </bs>
 </hist>
@@ -2035,52 +2060,52 @@
 <b>
 <a>4</a>
 <b>9</b>
-<v>619</v>
+<v>595</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>1057</v>
+<v>1016</v>
 </b>
 <b>
 <a>14</a>
 <b>27</b>
-<v>571</v>
+<v>549</v>
 </b>
 <b>
 <a>30</a>
 <b>31</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>34</a>
 <b>35</b>
-<v>632</v>
+<v>607</v>
 </b>
 <b>
 <a>36</a>
 <b>45</b>
-<v>486</v>
+<v>467</v>
 </b>
 <b>
 <a>52</a>
 <b>79</b>
-<v>583</v>
+<v>560</v>
 </b>
 <b>
 <a>84</a>
 <b>85</b>
-<v>194</v>
+<v>186</v>
 </b>
 <b>
 <a>254</a>
 <b>255</b>
-<v>2893</v>
+<v>2780</v>
 </b>
 <b>
 <a>272</a>
 <b>842</b>
-<v>109</v>
+<v>105</v>
 </b>
 </bs>
 </hist>
@@ -2096,7 +2121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7208</v>
+<v>6929</v>
 </b>
 </bs>
 </hist>
@@ -2106,19 +2131,19 @@
 </relation>
 <relation>
 <name>compilation_finished</name>
-<cardinality>10588</cardinality>
+<cardinality>10177</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10588</v>
+<v>10177</v>
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>8436</v>
+<v>7957</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
-<v>182</v>
+<v>186</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2132,7 +2157,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10588</v>
+<v>10177</v>
 </b>
 </bs>
 </hist>
@@ -2148,7 +2173,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10588</v>
+<v>10177</v>
 </b>
 </bs>
 </hist>
@@ -2164,17 +2189,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7184</v>
+<v>6730</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>850</v>
+<v>712</v>
 </b>
 <b>
 <a>3</a>
-<b>12</b>
-<v>401</v>
+<b>9</b>
+<v>514</v>
 </b>
 </bs>
 </hist>
@@ -2190,12 +2215,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8023</v>
+<v>7560</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>413</v>
+<v>397</v>
 </b>
 </bs>
 </hist>
@@ -2211,67 +2236,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>35</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>12</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>12</v>
+<a>7</a>
+<b>8</b>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>20</a>
-<b>21</b>
-<v>12</v>
+<a>21</a>
+<b>22</b>
+<v>11</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
-<v>12</v>
+<a>27</a>
+<b>28</b>
+<v>11</v>
 </b>
 <b>
 <a>53</a>
 <b>54</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>124</a>
-<b>125</b>
-<v>12</v>
+<a>120</a>
+<b>121</b>
+<v>11</v>
 </b>
 <b>
-<a>134</a>
-<b>135</b>
-<v>12</v>
+<a>125</a>
+<b>126</b>
+<v>11</v>
 </b>
 <b>
-<a>230</a>
-<b>231</b>
-<v>12</v>
+<a>233</a>
+<b>234</b>
+<v>11</v>
 </b>
 <b>
-<a>258</a>
-<b>259</b>
-<v>12</v>
+<a>263</a>
+<b>264</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -2287,67 +2307,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>35</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>12</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>12</v>
+<a>7</a>
+<b>8</b>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>20</a>
-<b>21</b>
-<v>12</v>
+<a>21</a>
+<b>22</b>
+<v>11</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
-<v>12</v>
+<a>26</a>
+<b>27</b>
+<v>11</v>
 </b>
 <b>
-<a>49</a>
-<b>50</b>
-<v>12</v>
+<a>51</a>
+<b>52</b>
+<v>11</v>
 </b>
 <b>
-<a>100</a>
-<b>101</b>
-<v>12</v>
+<a>92</a>
+<b>93</b>
+<v>11</v>
 </b>
 <b>
 <a>118</a>
 <b>119</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>172</a>
-<b>173</b>
-<v>12</v>
+<a>163</a>
+<b>164</b>
+<v>11</v>
 </b>
 <b>
-<a>217</a>
-<b>218</b>
-<v>12</v>
+<a>215</a>
+<b>216</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -2357,23 +2372,23 @@
 </relation>
 <relation>
 <name>externalData</name>
-<cardinality>145</cardinality>
+<cardinality>140</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>72</v>
+<v>70</v>
 </e>
 <e>
 <k>path</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>column</k>
-<v>24</v>
+<v>23</v>
 </e>
 <e>
 <k>value</k>
-<v>145</v>
+<v>140</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2387,7 +2402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72</v>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -2403,7 +2418,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>72</v>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -2419,7 +2434,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>72</v>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -2435,7 +2450,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -2451,7 +2466,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -2467,7 +2482,7 @@
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -2483,7 +2498,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -2499,7 +2514,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -2515,7 +2530,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -2531,7 +2546,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -2547,7 +2562,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -2563,7 +2578,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -2573,41 +2588,41 @@
 </relation>
 <relation>
 <name>snapshotDate</name>
-<cardinality>12</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>snapshotDate</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>sourceLocationPrefix</name>
-<cardinality>12</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>prefix</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>185332</cardinality>
+<cardinality>185440</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>185332</v>
+<v>185440</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>761</v>
+<v>762</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>76596</v>
+<v>76641</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2621,7 +2636,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185332</v>
+<v>185440</v>
 </b>
 </bs>
 </hist>
@@ -2637,7 +2652,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185332</v>
+<v>185440</v>
 </b>
 </bs>
 </hist>
@@ -2765,27 +2780,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20462</v>
+<v>20474</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32635</v>
+<v>32655</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10716</v>
+<v>10723</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>6015</v>
+<v>6019</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5954</v>
+<v>5957</v>
 </b>
 <b>
 <a>9</a>
@@ -2806,7 +2821,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75730</v>
+<v>75775</v>
 </b>
 <b>
 <a>2</a>
@@ -3122,27 +3137,27 @@
 </relation>
 <relation>
 <name>tokens</name>
-<cardinality>39620249</cardinality>
+<cardinality>39643528</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>279171</v>
+<v>279335</v>
 </e>
 <e>
 <k>offset</k>
-<v>21169</v>
+<v>21181</v>
 </e>
 <e>
 <k>beginLine</k>
-<v>785436</v>
+<v>785898</v>
 </e>
 <e>
 <k>beginColumn</k>
-<v>1302</v>
+<v>1303</v>
 </e>
 <e>
 <k>endLine</k>
-<v>785436</v>
+<v>785898</v>
 </e>
 <e>
 <k>endColumn</k>
@@ -3160,72 +3175,72 @@
 <b>
 <a>100</a>
 <b>101</b>
-<v>8596</v>
+<v>8601</v>
 </b>
 <b>
 <a>101</a>
 <b>102</b>
-<v>27640</v>
+<v>27656</v>
 </b>
 <b>
 <a>102</a>
 <b>105</b>
-<v>22613</v>
+<v>22626</v>
 </b>
 <b>
 <a>105</a>
 <b>108</b>
-<v>24506</v>
+<v>24520</v>
 </b>
 <b>
 <a>108</a>
 <b>111</b>
-<v>13844</v>
+<v>13852</v>
 </b>
 <b>
 <a>111</a>
 <b>114</b>
-<v>23787</v>
+<v>23801</v>
 </b>
 <b>
 <a>114</a>
 <b>116</b>
-<v>22681</v>
+<v>22694</v>
 </b>
 <b>
 <a>116</a>
 <b>124</b>
-<v>23658</v>
+<v>23672</v>
 </b>
 <b>
 <a>124</a>
 <b>132</b>
-<v>21660</v>
+<v>21673</v>
 </b>
 <b>
 <a>132</a>
 <b>154</b>
-<v>21347</v>
+<v>21360</v>
 </b>
 <b>
 <a>154</a>
 <b>186</b>
-<v>21323</v>
+<v>21335</v>
 </b>
 <b>
 <a>186</a>
 <b>202</b>
-<v>23418</v>
+<v>23432</v>
 </b>
 <b>
 <a>202</a>
 <b>416</b>
-<v>20978</v>
+<v>20991</v>
 </b>
 <b>
 <a>416</a>
 <b>3446</b>
-<v>3115</v>
+<v>3117</v>
 </b>
 </bs>
 </hist>
@@ -3246,47 +3261,47 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>109755</v>
+<v>109819</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>15399</v>
+<v>15408</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>28395</v>
+<v>28412</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>23645</v>
+<v>23659</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>22797</v>
+<v>22811</v>
 </b>
 <b>
 <a>17</a>
 <b>19</b>
-<v>18969</v>
+<v>18980</v>
 </b>
 <b>
 <a>19</a>
 <b>22</b>
-<v>22791</v>
+<v>22805</v>
 </b>
 <b>
 <a>22</a>
 <b>28</b>
-<v>21470</v>
+<v>21483</v>
 </b>
 <b>
 <a>28</a>
 <b>151</b>
-<v>14545</v>
+<v>14553</v>
 </b>
 </bs>
 </hist>
@@ -3302,42 +3317,42 @@
 <b>
 <a>2</a>
 <b>26</b>
-<v>22933</v>
+<v>22946</v>
 </b>
 <b>
 <a>26</a>
 <b>31</b>
-<v>22318</v>
+<v>22331</v>
 </b>
 <b>
 <a>31</a>
 <b>32</b>
-<v>2642</v>
+<v>2643</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>163572</v>
+<v>163668</v>
 </b>
 <b>
 <a>33</a>
 <b>51</b>
-<v>21310</v>
+<v>21323</v>
 </b>
 <b>
 <a>51</a>
 <b>61</b>
-<v>22472</v>
+<v>22485</v>
 </b>
 <b>
 <a>61</a>
 <b>80</b>
-<v>21058</v>
+<v>21071</v>
 </b>
 <b>
 <a>80</a>
 <b>132</b>
-<v>2863</v>
+<v>2865</v>
 </b>
 </bs>
 </hist>
@@ -3358,47 +3373,47 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>109755</v>
+<v>109819</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>15399</v>
+<v>15408</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>28395</v>
+<v>28412</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>23645</v>
+<v>23659</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>22797</v>
+<v>22811</v>
 </b>
 <b>
 <a>17</a>
 <b>19</b>
-<v>18969</v>
+<v>18980</v>
 </b>
 <b>
 <a>19</a>
 <b>22</b>
-<v>22791</v>
+<v>22805</v>
 </b>
 <b>
 <a>22</a>
 <b>28</b>
-<v>21470</v>
+<v>21483</v>
 </b>
 <b>
 <a>28</a>
 <b>151</b>
-<v>14545</v>
+<v>14553</v>
 </b>
 </bs>
 </hist>
@@ -3414,42 +3429,42 @@
 <b>
 <a>2</a>
 <b>26</b>
-<v>21667</v>
+<v>21679</v>
 </b>
 <b>
 <a>26</a>
 <b>31</b>
-<v>24352</v>
+<v>24366</v>
 </b>
 <b>
 <a>31</a>
 <b>32</b>
-<v>1622</v>
+<v>1623</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>163861</v>
+<v>163957</v>
 </b>
 <b>
 <a>33</a>
 <b>54</b>
-<v>22103</v>
+<v>22116</v>
 </b>
 <b>
 <a>54</a>
 <b>63</b>
-<v>20942</v>
+<v>20954</v>
 </b>
 <b>
 <a>63</a>
 <b>82</b>
-<v>21488</v>
+<v>21501</v>
 </b>
 <b>
 <a>82</a>
 <b>133</b>
-<v>3133</v>
+<v>3135</v>
 </b>
 </bs>
 </hist>
@@ -3465,17 +3480,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4559</v>
+<v>4562</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1339</v>
+<v>1340</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2593</v>
+<v>2594</v>
 </b>
 <b>
 <a>8</a>
@@ -3485,37 +3500,37 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>13</a>
 <b>23</b>
-<v>1855</v>
+<v>1856</v>
 </b>
 <b>
 <a>24</a>
 <b>62</b>
-<v>1622</v>
+<v>1623</v>
 </b>
 <b>
 <a>64</a>
 <b>130</b>
-<v>1646</v>
+<v>1647</v>
 </b>
 <b>
 <a>141</a>
 <b>250</b>
-<v>1597</v>
+<v>1598</v>
 </b>
 <b>
 <a>251</a>
 <b>982</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>986</a>
 <b>45432</b>
-<v>1929</v>
+<v>1930</v>
 </b>
 </bs>
 </hist>
@@ -3531,17 +3546,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4559</v>
+<v>4562</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1339</v>
+<v>1340</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2593</v>
+<v>2594</v>
 </b>
 <b>
 <a>8</a>
@@ -3551,42 +3566,42 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>13</a>
 <b>23</b>
-<v>1855</v>
+<v>1856</v>
 </b>
 <b>
 <a>24</a>
 <b>62</b>
-<v>1622</v>
+<v>1623</v>
 </b>
 <b>
 <a>64</a>
 <b>130</b>
-<v>1646</v>
+<v>1647</v>
 </b>
 <b>
 <a>141</a>
 <b>246</b>
-<v>1597</v>
+<v>1598</v>
 </b>
 <b>
 <a>247</a>
 <b>964</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>969</a>
 <b>32541</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>32546</a>
 <b>33841</b>
-<v>337</v>
+<v>338</v>
 </b>
 </bs>
 </hist>
@@ -3602,47 +3617,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5899</v>
+<v>5902</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3416</v>
+<v>3418</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1886</v>
+<v>1887</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>1837</v>
+<v>1838</v>
 </b>
 <b>
 <a>12</a>
 <b>15</b>
-<v>1640</v>
+<v>1641</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>23</a>
 <b>68</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>68</a>
 <b>161</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>161</a>
@@ -3663,17 +3678,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4559</v>
+<v>4562</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1339</v>
+<v>1340</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2593</v>
+<v>2594</v>
 </b>
 <b>
 <a>8</a>
@@ -3683,42 +3698,42 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>13</a>
 <b>23</b>
-<v>1855</v>
+<v>1856</v>
 </b>
 <b>
 <a>24</a>
 <b>62</b>
-<v>1622</v>
+<v>1623</v>
 </b>
 <b>
 <a>64</a>
 <b>130</b>
-<v>1646</v>
+<v>1647</v>
 </b>
 <b>
 <a>141</a>
 <b>246</b>
-<v>1597</v>
+<v>1598</v>
 </b>
 <b>
 <a>247</a>
 <b>964</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>969</a>
 <b>32541</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>32546</a>
 <b>33841</b>
-<v>337</v>
+<v>338</v>
 </b>
 </bs>
 </hist>
@@ -3734,47 +3749,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5899</v>
+<v>5902</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3416</v>
+<v>3418</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1911</v>
+<v>1912</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>1825</v>
+<v>1826</v>
 </b>
 <b>
 <a>12</a>
 <b>15</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>15</a>
 <b>24</b>
-<v>1677</v>
+<v>1678</v>
 </b>
 <b>
 <a>24</a>
 <b>74</b>
-<v>1616</v>
+<v>1617</v>
 </b>
 <b>
 <a>74</a>
 <b>169</b>
-<v>1591</v>
+<v>1592</v>
 </b>
 <b>
 <a>170</a>
@@ -3795,37 +3810,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>403939</v>
+<v>404176</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>103118</v>
+<v>103179</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44274</v>
+<v>44300</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>70568</v>
+<v>70610</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>58457</v>
+<v>58491</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>65861</v>
+<v>65900</v>
 </b>
 <b>
 <a>13</a>
 <b>138</b>
-<v>39217</v>
+<v>39240</v>
 </b>
 </bs>
 </hist>
@@ -3841,52 +3856,52 @@
 <b>
 <a>1</a>
 <b>7</b>
-<v>64810</v>
+<v>64849</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>64350</v>
+<v>64387</v>
 </b>
 <b>
 <a>12</a>
 <b>23</b>
-<v>60079</v>
+<v>60114</v>
 </b>
 <b>
 <a>23</a>
 <b>32</b>
-<v>36740</v>
+<v>36762</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>267244</v>
+<v>267401</v>
 </b>
 <b>
 <a>33</a>
 <b>41</b>
-<v>62672</v>
+<v>62709</v>
 </b>
 <b>
 <a>41</a>
 <b>55</b>
-<v>61271</v>
+<v>61307</v>
 </b>
 <b>
 <a>55</a>
 <b>69</b>
-<v>61541</v>
+<v>61577</v>
 </b>
 <b>
 <a>69</a>
 <b>94</b>
-<v>59243</v>
+<v>59278</v>
 </b>
 <b>
 <a>94</a>
 <b>248</b>
-<v>47482</v>
+<v>47510</v>
 </b>
 </bs>
 </hist>
@@ -3902,47 +3917,47 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>64429</v>
+<v>64467</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>62611</v>
+<v>62647</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>63016</v>
+<v>63053</v>
 </b>
 <b>
 <a>15</a>
 <b>29</b>
-<v>59870</v>
+<v>59905</v>
 </b>
 <b>
 <a>29</a>
 <b>32</b>
-<v>9205</v>
+<v>9210</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>349310</v>
+<v>349515</v>
 </b>
 <b>
 <a>33</a>
 <b>37</b>
-<v>61959</v>
+<v>61996</v>
 </b>
 <b>
 <a>37</a>
 <b>42</b>
-<v>61400</v>
+<v>61436</v>
 </b>
 <b>
 <a>42</a>
 <b>122</b>
-<v>53633</v>
+<v>53664</v>
 </b>
 </bs>
 </hist>
@@ -3958,7 +3973,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>785436</v>
+<v>785898</v>
 </b>
 </bs>
 </hist>
@@ -3974,47 +3989,47 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>64294</v>
+<v>64332</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>62611</v>
+<v>62647</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>63133</v>
+<v>63170</v>
 </b>
 <b>
 <a>15</a>
 <b>29</b>
-<v>59735</v>
+<v>59770</v>
 </b>
 <b>
 <a>29</a>
 <b>32</b>
-<v>9254</v>
+<v>9259</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>350355</v>
+<v>350560</v>
 </b>
 <b>
 <a>33</a>
 <b>37</b>
-<v>63588</v>
+<v>63625</v>
 </b>
 <b>
 <a>37</a>
 <b>43</b>
-<v>65241</v>
+<v>65279</v>
 </b>
 <b>
 <a>43</a>
 <b>123</b>
-<v>47224</v>
+<v>47251</v>
 </b>
 </bs>
 </hist>
@@ -4430,37 +4445,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>403939</v>
+<v>404176</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>103118</v>
+<v>103179</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44274</v>
+<v>44300</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>70568</v>
+<v>70610</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>58457</v>
+<v>58491</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>65861</v>
+<v>65900</v>
 </b>
 <b>
 <a>13</a>
 <b>138</b>
-<v>39217</v>
+<v>39240</v>
 </b>
 </bs>
 </hist>
@@ -4476,52 +4491,52 @@
 <b>
 <a>1</a>
 <b>7</b>
-<v>64810</v>
+<v>64849</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>64350</v>
+<v>64387</v>
 </b>
 <b>
 <a>12</a>
 <b>23</b>
-<v>60079</v>
+<v>60114</v>
 </b>
 <b>
 <a>23</a>
 <b>32</b>
-<v>36740</v>
+<v>36762</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>267244</v>
+<v>267401</v>
 </b>
 <b>
 <a>33</a>
 <b>41</b>
-<v>62672</v>
+<v>62709</v>
 </b>
 <b>
 <a>41</a>
 <b>55</b>
-<v>61271</v>
+<v>61307</v>
 </b>
 <b>
 <a>55</a>
 <b>69</b>
-<v>61541</v>
+<v>61577</v>
 </b>
 <b>
 <a>69</a>
 <b>94</b>
-<v>59243</v>
+<v>59278</v>
 </b>
 <b>
 <a>94</a>
 <b>248</b>
-<v>47482</v>
+<v>47510</v>
 </b>
 </bs>
 </hist>
@@ -4537,7 +4552,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>785436</v>
+<v>785898</v>
 </b>
 </bs>
 </hist>
@@ -4553,47 +4568,47 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>64429</v>
+<v>64467</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>62611</v>
+<v>62647</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>63016</v>
+<v>63053</v>
 </b>
 <b>
 <a>15</a>
 <b>29</b>
-<v>59870</v>
+<v>59905</v>
 </b>
 <b>
 <a>29</a>
 <b>32</b>
-<v>9205</v>
+<v>9210</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>349310</v>
+<v>349515</v>
 </b>
 <b>
 <a>33</a>
 <b>37</b>
-<v>61959</v>
+<v>61996</v>
 </b>
 <b>
 <a>37</a>
 <b>42</b>
-<v>61400</v>
+<v>61436</v>
 </b>
 <b>
 <a>42</a>
 <b>122</b>
-<v>53633</v>
+<v>53664</v>
 </b>
 </bs>
 </hist>
@@ -4609,47 +4624,47 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>64294</v>
+<v>64332</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>62611</v>
+<v>62647</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>63133</v>
+<v>63170</v>
 </b>
 <b>
 <a>15</a>
 <b>29</b>
-<v>59735</v>
+<v>59770</v>
 </b>
 <b>
 <a>29</a>
 <b>32</b>
-<v>9254</v>
+<v>9259</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>350355</v>
+<v>350560</v>
 </b>
 <b>
 <a>33</a>
 <b>37</b>
-<v>63588</v>
+<v>63625</v>
 </b>
 <b>
 <a>37</a>
 <b>43</b>
-<v>65241</v>
+<v>65279</v>
 </b>
 <b>
 <a>43</a>
 <b>123</b>
-<v>47224</v>
+<v>47251</v>
 </b>
 </bs>
 </hist>
@@ -5039,23 +5054,23 @@
 </relation>
 <relation>
 <name>external_packages</name>
-<cardinality>133</cardinality>
+<cardinality>128</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>133</v>
+<v>128</v>
 </e>
 <e>
 <k>namespace</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>package_name</k>
-<v>133</v>
+<v>128</v>
 </e>
 <e>
 <k>version</k>
-<v>133</v>
+<v>128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5069,7 +5084,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5085,7 +5100,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5101,7 +5116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5117,7 +5132,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -5133,7 +5148,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -5149,7 +5164,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -5165,7 +5180,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5181,7 +5196,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5197,7 +5212,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5213,7 +5228,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5229,7 +5244,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5245,7 +5260,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -5255,15 +5270,15 @@
 </relation>
 <relation>
 <name>header_to_external_package</name>
-<cardinality>9093</cardinality>
+<cardinality>8740</cardinality>
 <columnsizes>
 <e>
 <k>fileid</k>
-<v>9093</v>
+<v>8740</v>
 </e>
 <e>
 <k>package</k>
-<v>133</v>
+<v>128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5277,7 +5292,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9093</v>
+<v>8740</v>
 </b>
 </bs>
 </hist>
@@ -5293,42 +5308,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>63</a>
 <b>64</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>71</a>
 <b>72</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>85</a>
 <b>86</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>243</a>
 <b>244</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>251</a>
 <b>252</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -6546,31 +6561,31 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>9664446</cardinality>
+<cardinality>9335283</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>9664446</v>
+<v>9335283</v>
 </e>
 <e>
 <k>container</k>
-<v>78275</v>
+<v>75237</v>
 </e>
 <e>
 <k>startLine</k>
-<v>161084</v>
+<v>154834</v>
 </e>
 <e>
 <k>startColumn</k>
-<v>6017</v>
+<v>5818</v>
 </e>
 <e>
 <k>endLine</k>
-<v>160902</v>
+<v>154658</v>
 </e>
 <e>
 <k>endColumn</k>
-<v>8169</v>
+<v>11182</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6584,7 +6599,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9664446</v>
+<v>9335283</v>
 </b>
 </bs>
 </hist>
@@ -6600,7 +6615,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9664446</v>
+<v>9335283</v>
 </b>
 </bs>
 </hist>
@@ -6616,7 +6631,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9664446</v>
+<v>9335283</v>
 </b>
 </bs>
 </hist>
@@ -6632,7 +6647,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9664446</v>
+<v>9335283</v>
 </b>
 </bs>
 </hist>
@@ -6648,7 +6663,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9664446</v>
+<v>9335283</v>
 </b>
 </bs>
 </hist>
@@ -6664,62 +6679,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12752</v>
+<v>12257</v>
 </b>
 <b>
 <a>2</a>
 <b>19</b>
-<v>6625</v>
+<v>6368</v>
 </b>
 <b>
 <a>19</a>
 <b>25</b>
-<v>6090</v>
+<v>5818</v>
 </b>
 <b>
 <a>25</a>
 <b>31</b>
-<v>6066</v>
+<v>5830</v>
 </b>
 <b>
 <a>31</a>
 <b>41</b>
-<v>6491</v>
+<v>6204</v>
 </b>
 <b>
 <a>41</a>
 <b>54</b>
-<v>6138</v>
+<v>5854</v>
 </b>
 <b>
 <a>54</a>
 <b>72</b>
-<v>6175</v>
+<v>5877</v>
 </b>
 <b>
 <a>72</a>
-<b>99</b>
-<v>5968</v>
+<b>98</b>
+<v>5690</v>
 </b>
 <b>
-<a>99</a>
-<b>137</b>
-<v>5944</v>
+<a>98</a>
+<b>136</b>
+<v>5702</v>
 </b>
 <b>
-<a>137</a>
-<b>221</b>
-<v>5895</v>
+<a>136</a>
+<b>216</b>
+<v>5690</v>
 </b>
 <b>
-<a>221</a>
-<b>431</b>
-<v>5871</v>
+<a>216</a>
+<b>417</b>
+<v>5655</v>
 </b>
 <b>
-<a>431</a>
+<a>417</a>
 <b>19703</b>
-<v>4254</v>
+<v>4288</v>
 </b>
 </bs>
 </hist>
@@ -6735,62 +6750,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12752</v>
+<v>12257</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>6503</v>
+<v>6251</v>
 </b>
 <b>
 <a>15</a>
 <b>20</b>
-<v>6758</v>
+<v>6496</v>
 </b>
 <b>
 <a>20</a>
 <b>25</b>
-<v>6102</v>
+<v>5842</v>
 </b>
 <b>
 <a>25</a>
 <b>32</b>
-<v>6710</v>
+<v>6461</v>
 </b>
 <b>
 <a>32</a>
 <b>41</b>
-<v>6284</v>
+<v>6052</v>
 </b>
 <b>
 <a>41</a>
 <b>53</b>
-<v>6321</v>
+<v>6064</v>
 </b>
 <b>
 <a>53</a>
 <b>70</b>
-<v>5932</v>
+<v>5690</v>
 </b>
 <b>
 <a>70</a>
 <b>96</b>
-<v>5908</v>
+<v>5678</v>
 </b>
 <b>
 <a>96</a>
 <b>152</b>
-<v>5883</v>
+<v>5667</v>
 </b>
 <b>
 <a>152</a>
-<b>325</b>
-<v>5871</v>
+<b>322</b>
+<v>5643</v>
 </b>
 <b>
-<a>325</a>
+<a>324</a>
 <b>8863</b>
-<v>3245</v>
+<v>3131</v>
 </b>
 </bs>
 </hist>
@@ -6806,62 +6821,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12752</v>
+<v>12257</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>6722</v>
+<v>6461</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>7087</v>
+<v>6812</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>5895</v>
+<v>5632</v>
 </b>
 <b>
 <a>11</a>
 <b>14</b>
-<v>6418</v>
+<v>6099</v>
 </b>
 <b>
 <a>14</a>
 <b>18</b>
-<v>6880</v>
+<v>6601</v>
 </b>
 <b>
 <a>18</a>
 <b>23</b>
-<v>6394</v>
+<v>6134</v>
 </b>
 <b>
 <a>23</a>
 <b>29</b>
-<v>6455</v>
+<v>6227</v>
 </b>
 <b>
 <a>29</a>
 <b>37</b>
-<v>6260</v>
+<v>6029</v>
 </b>
 <b>
 <a>37</a>
 <b>50</b>
-<v>6224</v>
+<v>6052</v>
 </b>
 <b>
 <a>50</a>
 <b>78</b>
-<v>5944</v>
+<v>5737</v>
 </b>
 <b>
 <a>78</a>
-<b>167</b>
-<v>1239</v>
+<b>168</b>
+<v>1191</v>
 </b>
 </bs>
 </hist>
@@ -6877,62 +6892,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12752</v>
+<v>12257</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>6479</v>
+<v>6227</v>
 </b>
 <b>
 <a>15</a>
 <b>20</b>
-<v>6795</v>
+<v>6531</v>
 </b>
 <b>
 <a>20</a>
 <b>25</b>
-<v>6029</v>
+<v>5772</v>
 </b>
 <b>
 <a>25</a>
 <b>32</b>
-<v>6710</v>
+<v>6473</v>
 </b>
 <b>
 <a>32</a>
 <b>41</b>
-<v>6297</v>
+<v>6052</v>
 </b>
 <b>
 <a>41</a>
 <b>53</b>
-<v>6309</v>
+<v>6052</v>
 </b>
 <b>
 <a>53</a>
 <b>70</b>
-<v>6017</v>
+<v>5772</v>
 </b>
 <b>
 <a>70</a>
 <b>96</b>
-<v>5920</v>
+<v>5690</v>
 </b>
 <b>
 <a>96</a>
 <b>153</b>
-<v>5932</v>
+<v>5725</v>
 </b>
 <b>
 <a>153</a>
 <b>332</b>
-<v>5883</v>
+<v>5643</v>
 </b>
 <b>
 <a>332</a>
 <b>8863</b>
-<v>3148</v>
+<v>3038</v>
 </b>
 </bs>
 </hist>
@@ -6948,62 +6963,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12752</v>
+<v>12257</v>
 </b>
 <b>
 <a>2</a>
 <b>14</b>
-<v>6236</v>
+<v>5994</v>
 </b>
 <b>
 <a>14</a>
 <b>19</b>
-<v>6710</v>
+<v>6414</v>
 </b>
 <b>
 <a>19</a>
 <b>23</b>
-<v>6224</v>
+<v>5994</v>
 </b>
 <b>
 <a>23</a>
 <b>27</b>
-<v>6005</v>
+<v>5690</v>
 </b>
 <b>
 <a>27</a>
 <b>32</b>
-<v>6187</v>
+<v>5994</v>
 </b>
 <b>
 <a>32</a>
 <b>38</b>
-<v>6005</v>
+<v>5690</v>
 </b>
 <b>
 <a>38</a>
 <b>45</b>
-<v>6138</v>
+<v>5830</v>
 </b>
 <b>
 <a>45</a>
 <b>54</b>
-<v>5920</v>
+<v>5713</v>
 </b>
 <b>
 <a>54</a>
 <b>65</b>
-<v>5993</v>
+<v>5807</v>
 </b>
 <b>
 <a>65</a>
-<b>79</b>
-<v>5883</v>
+<b>80</b>
+<v>5842</v>
 </b>
 <b>
-<a>79</a>
-<b>184</b>
-<v>4218</v>
+<a>80</a>
+<b>336</b>
+<v>4007</v>
 </b>
 </bs>
 </hist>
@@ -7019,62 +7034,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31193</v>
+<v>29982</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19802</v>
+<v>19034</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18234</v>
+<v>17527</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10260</v>
+<v>9861</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9129</v>
+<v>8775</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6734</v>
+<v>6473</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14344</v>
+<v>13787</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>13943</v>
+<v>13390</v>
 </b>
 <b>
 <a>13</a>
 <b>30</b>
-<v>12350</v>
+<v>11871</v>
 </b>
 <b>
 <a>30</a>
 <b>112</b>
-<v>12119</v>
+<v>11637</v>
 </b>
 <b>
 <a>112</a>
-<b>2168</b>
-<v>12083</v>
+<b>2116</b>
+<v>11614</v>
 </b>
 <b>
-<a>2193</a>
+<a>2135</a>
 <b>6440</b>
-<v>887</v>
+<v>876</v>
 </b>
 </bs>
 </hist>
@@ -7090,42 +7105,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57268</v>
+<v>55046</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35496</v>
+<v>34119</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11341</v>
+<v>10901</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8983</v>
+<v>8635</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>14794</v>
+<v>14220</v>
 </b>
 <b>
 <a>8</a>
 <b>26</b>
-<v>12363</v>
+<v>11871</v>
 </b>
 <b>
 <a>26</a>
 <b>115</b>
-<v>12095</v>
+<v>11637</v>
 </b>
 <b>
 <a>115</a>
 <b>6440</b>
-<v>8740</v>
+<v>8401</v>
 </b>
 </bs>
 </hist>
@@ -7141,57 +7156,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32287</v>
+<v>31034</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19693</v>
+<v>18929</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20544</v>
+<v>19747</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9737</v>
+<v>9359</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9384</v>
+<v>9020</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6856</v>
+<v>6590</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14612</v>
+<v>14033</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>14028</v>
+<v>13495</v>
 </b>
 <b>
 <a>13</a>
 <b>27</b>
-<v>12436</v>
+<v>11953</v>
 </b>
 <b>
 <a>27</a>
 <b>60</b>
-<v>12132</v>
+<v>11637</v>
 </b>
 <b>
 <a>60</a>
 <b>153</b>
-<v>9372</v>
+<v>9032</v>
 </b>
 </bs>
 </hist>
@@ -7207,22 +7222,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119911</v>
+<v>115246</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18976</v>
+<v>18239</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>13530</v>
+<v>13016</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>8667</v>
+<v>8331</v>
 </b>
 </bs>
 </hist>
@@ -7238,57 +7253,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32311</v>
+<v>31057</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19584</v>
+<v>18824</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19024</v>
+<v>18286</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10247</v>
+<v>9850</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9409</v>
+<v>9043</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6637</v>
+<v>6379</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14636</v>
+<v>14068</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>13700</v>
+<v>13168</v>
 </b>
 <b>
 <a>13</a>
 <b>28</b>
-<v>12144</v>
+<v>11673</v>
 </b>
 <b>
 <a>28</a>
-<b>68</b>
-<v>12119</v>
+<b>69</b>
+<v>11813</v>
 </b>
 <b>
-<a>68</a>
-<b>190</b>
-<v>11269</v>
+<a>69</a>
+<b>258</b>
+<v>10668</v>
 </b>
 </bs>
 </hist>
@@ -7304,57 +7319,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>948</v>
+<v>934</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1142</v>
+<v>1074</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>534</v>
+<v>537</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>547</v>
+<v>514</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>474</v>
+<v>467</v>
 </b>
 <b>
 <a>16</a>
-<b>38</b>
-<v>461</v>
+<b>37</b>
+<v>444</v>
 </b>
 <b>
-<a>39</a>
-<b>126</b>
-<v>461</v>
+<a>37</a>
+<b>119</b>
+<v>444</v>
 </b>
 <b>
-<a>135</a>
-<b>517</b>
-<v>461</v>
+<a>125</a>
+<b>511</b>
+<v>444</v>
 </b>
 <b>
-<a>553</a>
-<b>5009</b>
-<v>461</v>
+<a>518</a>
+<b>4987</b>
+<v>444</v>
 </b>
 <b>
-<a>5423</a>
-<b>19562</b>
-<v>461</v>
+<a>5021</a>
+<b>19113</b>
+<v>444</v>
 </b>
 <b>
-<a>23702</a>
-<b>199709</b>
-<v>60</v>
+<a>19590</a>
+<b>199744</b>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -7370,47 +7385,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2589</v>
+<v>2500</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>522</v>
+<v>525</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>474</v>
+<v>455</v>
 </b>
 <b>
 <a>6</a>
 <b>15</b>
-<v>486</v>
+<v>467</v>
 </b>
 <b>
 <a>15</a>
 <b>55</b>
-<v>461</v>
+<v>444</v>
 </b>
 <b>
 <a>59</a>
-<b>223</b>
-<v>461</v>
+<b>226</b>
+<v>444</v>
 </b>
 <b>
 <a>229</a>
-<b>1196</b>
-<v>461</v>
+<b>1198</b>
+<v>444</v>
 </b>
 <b>
-<a>1266</a>
+<a>1275</a>
 <b>2344</b>
-<v>461</v>
+<v>444</v>
 </b>
 <b>
-<a>2536</a>
+<a>2542</a>
 <b>6440</b>
-<v>97</v>
+<v>93</v>
 </b>
 </bs>
 </hist>
@@ -7426,57 +7441,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>984</v>
+<v>969</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1130</v>
+<v>1063</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>291</v>
+<v>280</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>498</v>
+<v>502</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>486</v>
+<v>455</v>
 </b>
 <b>
 <a>10</a>
-<b>21</b>
-<v>474</v>
+<b>20</b>
+<v>444</v>
 </b>
 <b>
-<a>21</a>
-<b>60</b>
-<v>461</v>
+<a>20</a>
+<b>55</b>
+<v>444</v>
 </b>
 <b>
-<a>60</a>
-<b>208</b>
-<v>461</v>
+<a>56</a>
+<b>195</b>
+<v>444</v>
 </b>
 <b>
-<a>209</a>
-<b>929</b>
-<v>461</v>
+<a>196</a>
+<b>829</b>
+<v>444</v>
 </b>
 <b>
-<a>957</a>
-<b>1965</b>
-<v>461</v>
+<a>851</a>
+<b>1958</b>
+<v>444</v>
 </b>
 <b>
-<a>1969</a>
+<a>1958</a>
 <b>6490</b>
-<v>303</v>
+<v>327</v>
 </b>
 </bs>
 </hist>
@@ -7492,55 +7507,55 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>984</v>
+<v>969</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1130</v>
+<v>1063</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>291</v>
+<v>280</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>498</v>
+<v>502</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>486</v>
+<v>455</v>
 </b>
 <b>
 <a>10</a>
-<b>21</b>
-<v>474</v>
+<b>20</b>
+<v>444</v>
 </b>
 <b>
-<a>21</a>
-<b>60</b>
-<v>461</v>
+<a>20</a>
+<b>55</b>
+<v>444</v>
 </b>
 <b>
-<a>60</a>
-<b>208</b>
-<v>461</v>
+<a>56</a>
+<b>195</b>
+<v>444</v>
 </b>
 <b>
-<a>209</a>
-<b>931</b>
-<v>461</v>
+<a>205</a>
+<b>828</b>
+<v>444</v>
 </b>
 <b>
-<a>958</a>
-<b>1966</b>
-<v>461</v>
+<a>851</a>
+<b>1962</b>
+<v>467</v>
 </b>
 <b>
-<a>1969</a>
+<a>1965</a>
 <b>6462</b>
 <v>303</v>
 </b>
@@ -7558,42 +7573,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2735</v>
+<v>2640</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>522</v>
+<v>525</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>547</v>
+<v>525</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>474</v>
+<v>455</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>498</v>
+<v>479</v>
 </b>
 <b>
 <a>29</a>
-<b>51</b>
-<v>474</v>
+<b>54</b>
+<v>455</v>
 </b>
 <b>
-<a>51</a>
-<b>90</b>
-<v>461</v>
+<a>54</a>
+<b>109</b>
+<v>444</v>
 </b>
 <b>
-<a>91</a>
+<a>110</a>
 <b>428</b>
-<v>303</v>
+<v>292</v>
 </b>
 </bs>
 </hist>
@@ -7609,62 +7624,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30670</v>
+<v>29480</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20240</v>
+<v>19455</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>17979</v>
+<v>17281</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10430</v>
+<v>10025</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8898</v>
+<v>8553</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6868</v>
+<v>6601</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14368</v>
+<v>13811</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>13992</v>
+<v>13437</v>
 </b>
 <b>
 <a>13</a>
 <b>30</b>
-<v>12302</v>
+<v>11824</v>
 </b>
 <b>
 <a>30</a>
 <b>111</b>
-<v>12144</v>
+<v>11649</v>
 </b>
 <b>
 <a>111</a>
-<b>2100</b>
-<v>12071</v>
+<b>2058</b>
+<v>11602</v>
 </b>
 <b>
-<a>2100</a>
+<a>2083</a>
 <b>6440</b>
-<v>936</v>
+<v>934</v>
 </b>
 </bs>
 </hist>
@@ -7680,42 +7695,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>56758</v>
+<v>54555</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35654</v>
+<v>34271</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11341</v>
+<v>10901</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9105</v>
+<v>8751</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>11949</v>
+<v>11474</v>
 </b>
 <b>
 <a>7</a>
 <b>19</b>
-<v>12338</v>
+<v>11859</v>
 </b>
 <b>
 <a>19</a>
 <b>76</b>
-<v>12083</v>
+<v>11614</v>
 </b>
 <b>
 <a>76</a>
 <b>6440</b>
-<v>11670</v>
+<v>11229</v>
 </b>
 </bs>
 </hist>
@@ -7731,22 +7746,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118792</v>
+<v>114171</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19267</v>
+<v>18508</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>12983</v>
+<v>12502</v>
 </b>
 <b>
 <a>7</a>
 <b>46</b>
-<v>9858</v>
+<v>9476</v>
 </b>
 </bs>
 </hist>
@@ -7762,57 +7777,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31752</v>
+<v>30520</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20082</v>
+<v>19303</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20252</v>
+<v>19466</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9992</v>
+<v>9604</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9263</v>
+<v>8903</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6977</v>
+<v>6707</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14599</v>
+<v>14021</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>14101</v>
+<v>13565</v>
 </b>
 <b>
 <a>13</a>
 <b>27</b>
-<v>12350</v>
+<v>11871</v>
 </b>
 <b>
 <a>27</a>
 <b>60</b>
-<v>12107</v>
+<v>11626</v>
 </b>
 <b>
 <a>60</a>
 <b>153</b>
-<v>9421</v>
+<v>9067</v>
 </b>
 </bs>
 </hist>
@@ -7828,57 +7843,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31801</v>
+<v>30567</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19973</v>
+<v>19197</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18745</v>
+<v>18017</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10490</v>
+<v>10083</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9263</v>
+<v>8903</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>6710</v>
+<v>6449</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>14526</v>
+<v>13963</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>14174</v>
+<v>13612</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>12350</v>
+<v>11871</v>
 </b>
 <b>
 <a>29</a>
 <b>71</b>
-<v>12132</v>
+<v>11602</v>
 </b>
 <b>
 <a>71</a>
-<b>190</b>
-<v>10734</v>
+<b>258</b>
+<v>10387</v>
 </b>
 </bs>
 </hist>
@@ -7894,52 +7909,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2309</v>
+<v>4428</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1094</v>
+<v>1180</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>607</v>
+<v>888</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>753</v>
+<b>6</b>
+<v>1004</v>
 </b>
 <b>
-<a>7</a>
-<b>17</b>
-<v>656</v>
+<a>6</a>
+<b>13</b>
+<v>841</v>
 </b>
 <b>
-<a>17</a>
-<b>49</b>
-<v>619</v>
+<a>13</a>
+<b>61</b>
+<v>841</v>
 </b>
 <b>
-<a>55</a>
-<b>236</b>
-<v>619</v>
+<a>61</a>
+<b>698</b>
+<v>841</v>
 </b>
 <b>
-<a>241</a>
-<b>4440</b>
-<v>619</v>
+<a>705</a>
+<b>10765</b>
+<v>841</v>
 </b>
 <b>
-<a>4617</a>
-<b>11969</b>
-<v>619</v>
-</b>
-<b>
-<a>12066</a>
-<b>25444</b>
-<v>267</v>
+<a>11014</a>
+<b>25447</b>
+<v>315</v>
 </b>
 </bs>
 </hist>
@@ -7955,47 +7965,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3257</v>
+<v>5106</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1033</v>
+<v>1285</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>583</v>
+<v>1028</v>
 </b>
 <b>
 <a>4</a>
-<b>9</b>
-<v>644</v>
+<b>7</b>
+<v>969</v>
 </b>
 <b>
-<a>9</a>
-<b>29</b>
-<v>619</v>
+<a>7</a>
+<b>33</b>
+<v>841</v>
 </b>
 <b>
-<a>29</a>
-<b>166</b>
-<v>619</v>
+<a>33</a>
+<b>376</b>
+<v>841</v>
 </b>
 <b>
-<a>172</a>
-<b>1667</b>
-<v>619</v>
+<a>387</a>
+<b>2684</b>
+<v>841</v>
 </b>
 <b>
-<a>1667</a>
-<b>2846</b>
-<v>619</v>
-</b>
-<b>
-<a>2870</a>
+<a>2688</a>
 <b>6440</b>
-<v>170</v>
+<v>268</v>
 </b>
 </bs>
 </hist>
@@ -8011,52 +8016,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2334</v>
+<v>4463</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1106</v>
+<v>1180</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>632</v>
+<v>899</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>741</v>
+<b>6</b>
+<v>1004</v>
 </b>
 <b>
-<a>7</a>
-<b>17</b>
-<v>632</v>
+<a>6</a>
+<b>14</b>
+<v>852</v>
 </b>
 <b>
-<a>17</a>
-<b>45</b>
-<v>619</v>
+<a>14</a>
+<b>57</b>
+<v>852</v>
 </b>
 <b>
-<a>45</a>
-<b>189</b>
-<v>619</v>
+<a>58</a>
+<b>510</b>
+<v>841</v>
 </b>
 <b>
-<a>192</a>
-<b>1191</b>
-<v>619</v>
+<a>518</a>
+<b>2401</b>
+<v>841</v>
 </b>
 <b>
-<a>1218</a>
-<b>2414</b>
-<v>619</v>
-</b>
-<b>
-<a>2469</a>
+<a>2415</a>
 <b>4808</b>
-<v>243</v>
+<v>245</v>
 </b>
 </bs>
 </hist>
@@ -8072,42 +8072,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3367</v>
+<v>5141</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1130</v>
+<v>1343</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>595</v>
+<v>1028</v>
 </b>
 <b>
 <a>4</a>
-<b>11</b>
-<v>668</v>
+<b>7</b>
+<v>969</v>
 </b>
 <b>
-<a>11</a>
+<a>7</a>
 <b>23</b>
-<v>632</v>
+<v>852</v>
 </b>
 <b>
 <a>23</a>
-<b>40</b>
-<v>632</v>
+<b>47</b>
+<v>864</v>
 </b>
 <b>
-<a>40</a>
-<b>68</b>
-<v>632</v>
+<a>47</a>
+<b>81</b>
+<v>864</v>
 </b>
 <b>
-<a>68</a>
-<b>82</b>
-<v>510</v>
+<a>81</a>
+<b>83</b>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -8123,52 +8123,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2334</v>
+<v>4463</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1106</v>
+<v>1180</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>632</v>
+<v>911</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>741</v>
+<b>6</b>
+<v>993</v>
 </b>
 <b>
-<a>7</a>
-<b>17</b>
-<v>644</v>
+<a>6</a>
+<b>13</b>
+<v>841</v>
 </b>
 <b>
-<a>17</a>
-<b>46</b>
-<v>619</v>
+<a>13</a>
+<b>56</b>
+<v>841</v>
 </b>
 <b>
-<a>46</a>
-<b>194</b>
-<v>619</v>
+<a>56</a>
+<b>501</b>
+<v>841</v>
 </b>
 <b>
-<a>202</a>
-<b>1220</b>
-<v>619</v>
+<a>505</a>
+<b>2374</b>
+<v>841</v>
 </b>
 <b>
-<a>1252</a>
-<b>2470</b>
-<v>619</v>
-</b>
-<b>
-<a>2481</a>
+<a>2398</a>
 <b>4808</b>
-<v>230</v>
+<v>268</v>
 </b>
 </bs>
 </hist>
@@ -8178,31 +8173,31 @@
 </relation>
 <relation>
 <name>locations_stmt</name>
-<cardinality>2176932</cardinality>
+<cardinality>2178211</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2176932</v>
+<v>2178211</v>
 </e>
 <e>
 <k>container</k>
-<v>3078</v>
+<v>3080</v>
 </e>
 <e>
 <k>startLine</k>
-<v>296727</v>
+<v>296902</v>
 </e>
 <e>
 <k>startColumn</k>
-<v>1228</v>
+<v>1229</v>
 </e>
 <e>
 <k>endLine</k>
-<v>294872</v>
+<v>295045</v>
 </e>
 <e>
 <k>endColumn</k>
-<v>1493</v>
+<v>1494</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -8216,7 +8211,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176932</v>
+<v>2178211</v>
 </b>
 </bs>
 </hist>
@@ -8232,7 +8227,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176932</v>
+<v>2178211</v>
 </b>
 </bs>
 </hist>
@@ -8248,7 +8243,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176932</v>
+<v>2178211</v>
 </b>
 </bs>
 </hist>
@@ -8264,7 +8259,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176932</v>
+<v>2178211</v>
 </b>
 </bs>
 </hist>
@@ -8280,7 +8275,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176932</v>
+<v>2178211</v>
 </b>
 </bs>
 </hist>
@@ -8493,7 +8488,7 @@
 <b>
 <a>38</a>
 <b>48</b>
-<v>251</v>
+<v>252</v>
 </b>
 <b>
 <a>48</a>
@@ -8534,7 +8529,7 @@
 <b>
 <a>6</a>
 <b>15</b>
-<v>251</v>
+<v>252</v>
 </b>
 <b>
 <a>15</a>
@@ -8681,37 +8676,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113847</v>
+<v>113914</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78993</v>
+<v>79039</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31327</v>
+<v>31345</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>24942</v>
+<v>24957</v>
 </b>
 <b>
 <a>6</a>
 <b>16</b>
-<v>22619</v>
+<v>22632</v>
 </b>
 <b>
 <a>16</a>
 <b>129</b>
-<v>22275</v>
+<v>22288</v>
 </b>
 <b>
 <a>129</a>
 <b>222</b>
-<v>2722</v>
+<v>2723</v>
 </b>
 </bs>
 </hist>
@@ -8727,32 +8722,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175967</v>
+<v>176070</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>51906</v>
+<v>51936</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>22552</v>
+<v>22565</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>22373</v>
+<v>22386</v>
 </b>
 <b>
 <a>13</a>
 <b>125</b>
-<v>22257</v>
+<v>22270</v>
 </b>
 <b>
 <a>125</a>
 <b>176</b>
-<v>1671</v>
+<v>1672</v>
 </b>
 </bs>
 </hist>
@@ -8768,32 +8763,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>130943</v>
+<v>131019</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73506</v>
+<v>73549</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>30767</v>
+<v>30785</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>26583</v>
+<v>26598</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>22312</v>
+<v>22325</v>
 </b>
 <b>
 <a>16</a>
 <b>45</b>
-<v>12615</v>
+<v>12623</v>
 </b>
 </bs>
 </hist>
@@ -8809,27 +8804,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>192251</v>
+<v>192364</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47310</v>
+<v>47337</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21765</v>
+<v>21778</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>23264</v>
+<v>23278</v>
 </b>
 <b>
 <a>9</a>
 <b>30</b>
-<v>12136</v>
+<v>12143</v>
 </b>
 </bs>
 </hist>
@@ -8845,32 +8840,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156444</v>
+<v>156536</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62371</v>
+<v>62408</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20782</v>
+<v>20794</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>24659</v>
+<v>24674</v>
 </b>
 <b>
 <a>9</a>
 <b>30</b>
-<v>22398</v>
+<v>22411</v>
 </b>
 <b>
 <a>30</a>
 <b>73</b>
-<v>10071</v>
+<v>10077</v>
 </b>
 </bs>
 </hist>
@@ -9266,37 +9261,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>116305</v>
+<v>116374</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72848</v>
+<v>72891</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31996</v>
+<v>32015</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>25618</v>
+<v>25633</v>
 </b>
 <b>
 <a>6</a>
 <b>16</b>
-<v>23031</v>
+<v>23044</v>
 </b>
 <b>
 <a>16</a>
 <b>126</b>
-<v>22121</v>
+<v>22134</v>
 </b>
 <b>
 <a>126</a>
 <b>228</b>
-<v>2949</v>
+<v>2951</v>
 </b>
 </bs>
 </hist>
@@ -9312,27 +9307,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175604</v>
+<v>175707</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>52066</v>
+<v>52096</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>22207</v>
+<v>22220</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>23375</v>
+<v>23389</v>
 </b>
 <b>
 <a>14</a>
 <b>173</b>
-<v>21617</v>
+<v>21630</v>
 </b>
 </bs>
 </hist>
@@ -9348,27 +9343,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194592</v>
+<v>194706</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42314</v>
+<v>42339</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20677</v>
+<v>20689</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>22760</v>
+<v>22774</v>
 </b>
 <b>
 <a>8</a>
 <b>32</b>
-<v>14526</v>
+<v>14535</v>
 </b>
 </bs>
 </hist>
@@ -9384,32 +9379,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133173</v>
+<v>133251</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>67871</v>
+<v>67910</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>32611</v>
+<v>32630</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>26503</v>
+<v>26518</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>22183</v>
+<v>22196</v>
 </b>
 <b>
 <a>16</a>
 <b>46</b>
-<v>12529</v>
+<v>12536</v>
 </b>
 </bs>
 </hist>
@@ -9425,32 +9420,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156272</v>
+<v>156364</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62230</v>
+<v>62266</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21132</v>
+<v>21144</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>23756</v>
+<v>23770</v>
 </b>
 <b>
 <a>9</a>
 <b>33</b>
-<v>22318</v>
+<v>22331</v>
 </b>
 <b>
 <a>33</a>
 <b>73</b>
-<v>9162</v>
+<v>9167</v>
 </b>
 </bs>
 </hist>
@@ -9830,15 +9825,15 @@
 </relation>
 <relation>
 <name>locations_expr</name>
-<cardinality>9745314</cardinality>
+<cardinality>9746017</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>9745314</v>
+<v>9746017</v>
 </e>
 <e>
 <k>container</k>
-<v>3559</v>
+<v>3563</v>
 </e>
 <e>
 <k>startLine</k>
@@ -9868,7 +9863,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9745314</v>
+<v>9746017</v>
 </b>
 </bs>
 </hist>
@@ -9884,7 +9879,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9745314</v>
+<v>9746017</v>
 </b>
 </bs>
 </hist>
@@ -9900,7 +9895,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9745314</v>
+<v>9746017</v>
 </b>
 </bs>
 </hist>
@@ -9916,7 +9911,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9745314</v>
+<v>9746017</v>
 </b>
 </bs>
 </hist>
@@ -9932,7 +9927,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9745314</v>
+<v>9746017</v>
 </b>
 </bs>
 </hist>
@@ -9953,67 +9948,67 @@
 <b>
 <a>4</a>
 <b>11</b>
-<v>280</v>
+<v>284</v>
 </b>
 <b>
 <a>11</a>
-<b>36</b>
-<v>267</v>
+<b>37</b>
+<v>272</v>
 </b>
 <b>
-<a>36</a>
-<b>112</b>
-<v>270</v>
+<a>37</a>
+<b>114</b>
+<v>269</v>
 </b>
 <b>
-<a>112</a>
-<b>207</b>
+<a>114</a>
+<b>210</b>
+<v>269</v>
+</b>
+<b>
+<a>210</a>
+<b>328</b>
 <v>268</v>
 </b>
 <b>
-<a>207</a>
-<b>326</b>
+<a>328</a>
+<b>498</b>
 <v>268</v>
 </b>
 <b>
-<a>326</a>
-<b>493</b>
-<v>267</v>
+<a>499</a>
+<b>771</b>
+<v>269</v>
 </b>
 <b>
-<a>493</a>
-<b>760</b>
-<v>267</v>
+<a>772</a>
+<b>1223</b>
+<v>268</v>
 </b>
 <b>
-<a>760</a>
-<b>1208</b>
-<v>267</v>
+<a>1223</a>
+<b>1918</b>
+<v>268</v>
 </b>
 <b>
-<a>1210</a>
-<b>1899</b>
-<v>267</v>
+<a>1918</a>
+<b>3307</b>
+<v>268</v>
 </b>
 <b>
-<a>1900</a>
-<b>3251</b>
-<v>267</v>
+<a>3322</a>
+<b>7569</b>
+<v>268</v>
 </b>
 <b>
-<a>3258</a>
-<b>7330</b>
-<v>267</v>
+<a>7607</a>
+<b>160039</b>
+<v>268</v>
 </b>
 <b>
-<a>7359</a>
-<b>51115</b>
-<v>267</v>
-</b>
-<b>
-<a>51126</a>
+<a>170837</a>
 <b>491727</b>
-<v>16</v>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -10029,17 +10024,17 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>300</v>
+<v>296</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>315</v>
+<v>319</v>
 </b>
 <b>
 <a>7</a>
 <b>17</b>
-<v>271</v>
+<v>272</v>
 </b>
 <b>
 <a>17</a>
@@ -10049,47 +10044,47 @@
 <b>
 <a>35</a>
 <b>59</b>
-<v>279</v>
+<v>278</v>
 </b>
 <b>
 <a>59</a>
 <b>88</b>
-<v>270</v>
+<v>271</v>
 </b>
 <b>
 <a>88</a>
 <b>138</b>
-<v>268</v>
+<v>271</v>
 </b>
 <b>
 <a>138</a>
-<b>206</b>
-<v>267</v>
+<b>207</b>
+<v>271</v>
 </b>
 <b>
-<a>206</a>
-<b>336</b>
+<a>207</a>
+<b>339</b>
 <v>268</v>
 </b>
 <b>
-<a>336</a>
-<b>525</b>
+<a>339</a>
+<b>532</b>
 <v>268</v>
 </b>
 <b>
-<a>525</a>
-<b>946</b>
-<v>267</v>
+<a>532</a>
+<b>949</b>
+<v>268</v>
 </b>
 <b>
-<a>947</a>
-<b>2013</b>
-<v>267</v>
+<a>951</a>
+<b>2069</b>
+<v>268</v>
 </b>
 <b>
-<a>2019</a>
+<a>2076</a>
 <b>142752</b>
-<v>248</v>
+<v>242</v>
 </b>
 </bs>
 </hist>
@@ -10105,67 +10100,67 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>308</v>
+<v>307</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>293</v>
+<v>296</v>
 </b>
 <b>
 <a>7</a>
 <b>17</b>
-<v>273</v>
+<v>274</v>
 </b>
 <b>
 <a>17</a>
-<b>35</b>
-<v>267</v>
+<b>36</b>
+<v>283</v>
 </b>
 <b>
-<a>35</a>
-<b>51</b>
-<v>278</v>
+<a>36</a>
+<b>52</b>
+<v>287</v>
 </b>
 <b>
-<a>51</a>
-<b>63</b>
-<v>289</v>
+<a>52</a>
+<b>64</b>
+<v>297</v>
 </b>
 <b>
-<a>63</a>
-<b>73</b>
-<v>290</v>
+<a>64</a>
+<b>74</b>
+<v>279</v>
 </b>
 <b>
-<a>73</a>
-<b>83</b>
+<a>74</a>
+<b>84</b>
+<v>296</v>
+</b>
+<b>
+<a>84</a>
+<b>93</b>
+<v>270</v>
+</b>
+<b>
+<a>93</a>
+<b>106</b>
 <v>282</v>
 </b>
 <b>
-<a>83</a>
-<b>92</b>
-<v>276</v>
+<a>106</a>
+<b>122</b>
+<v>271</v>
 </b>
 <b>
-<a>92</a>
-<b>104</b>
-<v>270</v>
+<a>122</a>
+<b>150</b>
+<v>268</v>
 </b>
 <b>
-<a>104</a>
-<b>120</b>
-<v>276</v>
-</b>
-<b>
-<a>120</a>
-<b>145</b>
-<v>270</v>
-</b>
-<b>
-<a>145</a>
+<a>150</a>
 <b>330</b>
-<v>187</v>
+<v>153</v>
 </b>
 </bs>
 </hist>
@@ -10181,17 +10176,17 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>300</v>
+<v>296</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>312</v>
+<v>316</v>
 </b>
 <b>
 <a>7</a>
 <b>17</b>
-<v>274</v>
+<v>275</v>
 </b>
 <b>
 <a>17</a>
@@ -10201,17 +10196,17 @@
 <b>
 <a>35</a>
 <b>59</b>
-<v>278</v>
+<v>277</v>
 </b>
 <b>
 <a>59</a>
 <b>89</b>
-<v>275</v>
+<v>277</v>
 </b>
 <b>
 <a>89</a>
 <b>139</b>
-<v>271</v>
+<v>273</v>
 </b>
 <b>
 <a>139</a>
@@ -10230,18 +10225,18 @@
 </b>
 <b>
 <a>547</a>
-<b>971</b>
-<v>267</v>
+<b>973</b>
+<v>269</v>
 </b>
 <b>
-<a>972</a>
-<b>2152</b>
-<v>267</v>
+<a>975</a>
+<b>2167</b>
+<v>268</v>
 </b>
 <b>
-<a>2152</a>
+<a>2170</a>
 <b>143560</b>
-<v>242</v>
+<v>239</v>
 </b>
 </bs>
 </hist>
@@ -10257,7 +10252,7 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>278</v>
+<v>279</v>
 </b>
 <b>
 <a>3</a>
@@ -10267,57 +10262,57 @@
 <b>
 <a>7</a>
 <b>19</b>
-<v>278</v>
+<v>281</v>
 </b>
 <b>
 <a>19</a>
-<b>41</b>
-<v>268</v>
+<b>42</b>
+<v>275</v>
 </b>
 <b>
-<a>41</a>
+<a>42</a>
 <b>60</b>
-<v>279</v>
+<v>272</v>
 </b>
 <b>
 <a>60</a>
-<b>72</b>
-<v>267</v>
+<b>73</b>
+<v>294</v>
 </b>
 <b>
-<a>72</a>
-<b>83</b>
-<v>280</v>
+<a>73</a>
+<b>84</b>
+<v>277</v>
 </b>
 <b>
-<a>83</a>
-<b>94</b>
-<v>283</v>
+<a>84</a>
+<b>95</b>
+<v>291</v>
 </b>
 <b>
-<a>94</a>
-<b>105</b>
-<v>292</v>
-</b>
-<b>
-<a>105</a>
-<b>119</b>
-<v>278</v>
-</b>
-<b>
-<a>119</a>
-<b>136</b>
+<a>95</a>
+<b>106</b>
 <v>279</v>
 </b>
 <b>
-<a>136</a>
-<b>162</b>
-<v>269</v>
+<a>106</a>
+<b>120</b>
+<v>282</v>
 </b>
 <b>
-<a>162</a>
+<a>120</a>
+<b>138</b>
+<v>275</v>
+</b>
+<b>
+<a>138</a>
+<b>166</b>
+<v>270</v>
+</b>
+<b>
+<a>166</a>
 <b>416</b>
-<v>210</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -10667,22 +10662,22 @@
 </b>
 <b>
 <a>16130</a>
-<b>46279</b>
+<b>46280</b>
 <v>29</v>
 </b>
 <b>
-<a>48722</a>
-<b>86671</b>
+<a>48729</a>
+<b>86681</b>
 <v>29</v>
 </b>
 <b>
-<a>87010</a>
-<b>224371</b>
+<a>87033</a>
+<b>224378</b>
 <v>29</v>
 </b>
 <b>
-<a>237409</a>
-<b>710014</b>
+<a>237411</a>
+<b>710028</b>
 <v>6</v>
 </b>
 </bs>
@@ -10743,17 +10738,17 @@
 </b>
 <b>
 <a>1424</a>
-<b>2061</b>
+<b>2063</b>
 <v>29</v>
 </b>
 <b>
-<a>2064</a>
-<b>2425</b>
+<a>2066</a>
+<b>2429</b>
 <v>29</v>
 </b>
 <b>
-<a>2427</a>
-<b>2796</b>
+<a>2429</a>
+<b>2797</b>
 <v>22</v>
 </b>
 </bs>
@@ -11336,18 +11331,18 @@
 <v>35</v>
 </b>
 <b>
-<a>20304</a>
-<b>51564</b>
+<a>20305</a>
+<b>51570</b>
 <v>35</v>
 </b>
 <b>
-<a>54934</a>
+<a>54937</a>
 <b>117747</b>
 <v>35</v>
 </b>
 <b>
-<a>117846</a>
-<b>185890</b>
+<a>117863</a>
+<b>185908</b>
 <v>35</v>
 </b>
 </bs>
@@ -11408,12 +11403,12 @@
 </b>
 <b>
 <a>1983</a>
-<b>2458</b>
+<b>2459</b>
 <v>35</v>
 </b>
 <b>
-<a>2468</a>
-<b>2637</b>
+<a>2470</a>
+<b>2640</b>
 <v>32</v>
 </b>
 </bs>
@@ -11469,7 +11464,7 @@
 </b>
 <b>
 <a>2070</a>
-<b>5989</b>
+<b>5990</b>
 <v>35</v>
 </b>
 <b>
@@ -11616,7 +11611,7 @@
 </b>
 <b>
 <a>2067</a>
-<b>5989</b>
+<b>5990</b>
 <v>35</v>
 </b>
 <b>
@@ -11647,23 +11642,23 @@
 </relation>
 <relation>
 <name>numlines</name>
-<cardinality>544741</cardinality>
+<cardinality>523603</cardinality>
 <columnsizes>
 <e>
 <k>element_id</k>
-<v>537168</v>
+<v>516324</v>
 </e>
 <e>
 <k>num_lines</k>
-<v>10272</v>
+<v>9873</v>
 </e>
 <e>
 <k>num_code</k>
-<v>7938</v>
+<v>7630</v>
 </e>
 <e>
 <k>num_comment</k>
-<v>4364</v>
+<v>4194</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11677,12 +11672,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>529679</v>
+<v>509126</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>7488</v>
+<v>7197</v>
 </b>
 </bs>
 </hist>
@@ -11698,12 +11693,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>529740</v>
+<v>509184</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>7427</v>
+<v>7139</v>
 </b>
 </bs>
 </hist>
@@ -11719,12 +11714,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>537083</v>
+<v>516242</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -11740,393 +11735,41 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4655</v>
+<v>4475</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1325</v>
+<v>1273</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>765</v>
+<v>736</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>838</v>
+<v>806</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>814</v>
+<v>782</v>
 </b>
 <b>
 <a>12</a>
 <b>24</b>
-<v>778</v>
+<v>747</v>
 </b>
 <b>
 <a>24</a>
 <b>118</b>
-<v>778</v>
+<v>747</v>
 </b>
 <b>
 <a>118</a>
 <b>7658</b>
-<v>316</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_lines</src>
-<trg>num_code</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>4728</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1337</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>802</v>
-</b>
-<b>
-<a>4</a>
-<b>6</b>
-<v>850</v>
-</b>
-<b>
-<a>6</a>
-<b>11</b>
-<v>923</v>
-</b>
-<b>
-<a>11</a>
-<b>18</b>
-<v>790</v>
-</b>
-<b>
-<a>18</a>
-<b>29</b>
-<v>790</v>
-</b>
-<b>
-<a>29</a>
-<b>32</b>
-<v>48</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_lines</src>
-<trg>num_comment</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>4716</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1337</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>826</v>
-</b>
-<b>
-<a>4</a>
-<b>6</b>
-<v>838</v>
-</b>
-<b>
-<a>6</a>
-<b>10</b>
-<v>802</v>
-</b>
-<b>
-<a>10</a>
-<b>16</b>
-<v>899</v>
-</b>
-<b>
-<a>16</a>
-<b>26</b>
-<v>814</v>
-</b>
-<b>
-<a>26</a>
-<b>27</b>
-<v>36</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_code</src>
-<trg>element_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>3184</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1239</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>632</v>
-</b>
-<b>
-<a>4</a>
-<b>6</b>
-<v>607</v>
-</b>
-<b>
-<a>6</a>
-<b>10</b>
-<v>619</v>
-</b>
-<b>
-<a>10</a>
-<b>21</b>
-<v>619</v>
-</b>
-<b>
-<a>21</a>
-<b>67</b>
-<v>595</v>
-</b>
-<b>
-<a>68</a>
-<b>7861</b>
-<v>437</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_code</src>
-<trg>num_lines</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>3209</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1264</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>644</v>
-</b>
-<b>
-<a>4</a>
-<b>6</b>
-<v>607</v>
-</b>
-<b>
-<a>6</a>
-<b>10</b>
-<v>692</v>
-</b>
-<b>
-<a>10</a>
-<b>21</b>
-<v>644</v>
-</b>
-<b>
-<a>21</a>
-<b>34</b>
-<v>607</v>
-</b>
-<b>
-<a>34</a>
-<b>42</b>
-<v>267</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_code</src>
-<trg>num_comment</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>3233</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1227</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>680</v>
-</b>
-<b>
-<a>4</a>
-<b>6</b>
-<v>619</v>
-</b>
-<b>
-<a>6</a>
-<b>10</b>
-<v>680</v>
-</b>
-<b>
-<a>10</a>
-<b>19</b>
-<v>668</v>
-</b>
-<b>
-<a>19</a>
-<b>28</b>
-<v>595</v>
-</b>
-<b>
-<a>28</a>
-<b>33</b>
-<v>230</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_comment</src>
-<trg>element_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2030</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>559</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>328</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>340</v>
-</b>
-<b>
-<a>7</a>
-<b>14</b>
-<v>340</v>
-</b>
-<b>
-<a>14</a>
-<b>38</b>
-<v>328</v>
-</b>
-<b>
-<a>39</a>
-<b>280</b>
-<v>328</v>
-</b>
-<b>
-<a>283</a>
-<b>35679</b>
-<v>109</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num_comment</src>
-<trg>num_lines</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2042</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>571</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>389</v>
-</b>
-<b>
-<a>5</a>
-<b>8</b>
-<v>364</v>
-</b>
-<b>
-<a>8</a>
-<b>18</b>
-<v>364</v>
-</b>
-<b>
-<a>18</a>
-<b>58</b>
-<v>328</v>
-</b>
-<b>
-<a>61</a>
-<b>118</b>
 <v>303</v>
 </b>
 </bs>
@@ -12134,6 +11777,358 @@
 </val>
 </dep>
 <dep>
+<src>num_lines</src>
+<trg>num_code</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4545</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1285</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>771</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>817</v>
+</b>
+<b>
+<a>6</a>
+<b>11</b>
+<v>888</v>
+</b>
+<b>
+<a>11</a>
+<b>18</b>
+<v>759</v>
+</b>
+<b>
+<a>18</a>
+<b>29</b>
+<v>759</v>
+</b>
+<b>
+<a>29</a>
+<b>32</b>
+<v>46</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_lines</src>
+<trg>num_comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4533</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1285</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>794</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>806</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>771</v>
+</b>
+<b>
+<a>10</a>
+<b>16</b>
+<v>864</v>
+</b>
+<b>
+<a>16</a>
+<b>26</b>
+<v>782</v>
+</b>
+<b>
+<a>26</a>
+<b>27</b>
+<v>35</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>element_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3061</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1191</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>607</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>584</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>595</v>
+</b>
+<b>
+<a>10</a>
+<b>21</b>
+<v>595</v>
+</b>
+<b>
+<a>21</a>
+<b>67</b>
+<v>572</v>
+</b>
+<b>
+<a>68</a>
+<b>7861</b>
+<v>420</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>num_lines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3084</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1215</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>619</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>584</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>666</v>
+</b>
+<b>
+<a>10</a>
+<b>21</b>
+<v>619</v>
+</b>
+<b>
+<a>21</a>
+<b>34</b>
+<v>584</v>
+</b>
+<b>
+<a>34</a>
+<b>42</b>
+<v>257</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>num_comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3108</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1180</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>654</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>595</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>654</v>
+</b>
+<b>
+<a>10</a>
+<b>19</b>
+<v>642</v>
+</b>
+<b>
+<a>19</a>
+<b>28</b>
+<v>572</v>
+</b>
+<b>
+<a>28</a>
+<b>33</b>
+<v>222</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_comment</src>
+<trg>element_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1951</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>537</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>315</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>327</v>
+</b>
+<b>
+<a>7</a>
+<b>14</b>
+<v>327</v>
+</b>
+<b>
+<a>14</a>
+<b>38</b>
+<v>315</v>
+</b>
+<b>
+<a>39</a>
+<b>280</b>
+<v>315</v>
+</b>
+<b>
+<a>283</a>
+<b>35679</b>
+<v>105</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_comment</src>
+<trg>num_lines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1963</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>549</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>373</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>350</v>
+</b>
+<b>
+<a>8</a>
+<b>18</b>
+<v>350</v>
+</b>
+<b>
+<a>18</a>
+<b>58</b>
+<v>315</v>
+</b>
+<b>
+<a>61</a>
+<b>118</b>
+<v>292</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
 <src>num_comment</src>
 <trg>num_code</trg>
 <val>
@@ -12143,37 +12138,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2042</v>
+<v>1963</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>571</v>
+<v>549</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>389</v>
+<v>373</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>364</v>
+<v>350</v>
 </b>
 <b>
 <a>8</a>
 <b>17</b>
-<v>340</v>
+<v>327</v>
 </b>
 <b>
 <a>17</a>
 <b>52</b>
-<v>328</v>
+<v>315</v>
 </b>
 <b>
 <a>56</a>
 <b>108</b>
-<v>328</v>
+<v>315</v>
 </b>
 </bs>
 </hist>
@@ -12183,31 +12178,31 @@
 </relation>
 <relation>
 <name>diagnostics</name>
-<cardinality>76160</cardinality>
+<cardinality>73204</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>76160</v>
+<v>73204</v>
 </e>
 <e>
 <k>severity</k>
-<v>36</v>
+<v>35</v>
 </e>
 <e>
 <k>error_tag</k>
-<v>97</v>
+<v>93</v>
 </e>
 <e>
 <k>error_message</k>
-<v>121</v>
+<v>116</v>
 </e>
 <e>
 <k>full_error_message</k>
-<v>65948</v>
+<v>63389</v>
 </e>
 <e>
 <k>location</k>
-<v>145</v>
+<v>140</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12221,7 +12216,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76160</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -12237,7 +12232,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76160</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -12253,7 +12248,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76160</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -12269,7 +12264,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76160</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -12285,7 +12280,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76160</v>
+<v>73204</v>
 </b>
 </bs>
 </hist>
@@ -12301,17 +12296,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>6262</a>
 <b>6263</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12327,12 +12322,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12348,12 +12343,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12369,17 +12364,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5422</a>
 <b>5423</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12395,17 +12390,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12421,32 +12416,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>417</a>
 <b>418</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>841</a>
 <b>842</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4996</a>
 <b>4997</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12462,7 +12457,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97</v>
+<v>93</v>
 </b>
 </bs>
 </hist>
@@ -12478,12 +12473,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12499,27 +12494,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>417</a>
 <b>418</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4996</a>
 <b>4997</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12535,17 +12530,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12561,42 +12556,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>75</a>
 <b>76</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>332</a>
 <b>333</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>841</a>
 <b>842</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4996</a>
 <b>4997</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12612,7 +12607,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -12628,7 +12623,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -12644,37 +12639,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>75</a>
 <b>76</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>332</a>
 <b>333</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4996</a>
 <b>4997</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12690,17 +12685,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12716,12 +12711,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65936</v>
+<v>63377</v>
 </b>
 <b>
 <a>841</a>
 <b>842</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12737,7 +12732,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65948</v>
+<v>63389</v>
 </b>
 </bs>
 </hist>
@@ -12753,7 +12748,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65948</v>
+<v>63389</v>
 </b>
 </bs>
 </hist>
@@ -12769,7 +12764,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65948</v>
+<v>63389</v>
 </b>
 </bs>
 </hist>
@@ -12785,7 +12780,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65948</v>
+<v>63389</v>
 </b>
 </bs>
 </hist>
@@ -12801,12 +12796,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>6254</a>
 <b>6255</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12822,7 +12817,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -12838,12 +12833,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12859,12 +12854,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12880,12 +12875,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>5414</a>
 <b>5415</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -12895,27 +12890,27 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>66167</cardinality>
+<cardinality>63599</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>66167</v>
+<v>63599</v>
 </e>
 <e>
 <k>name</k>
-<v>66167</v>
+<v>63599</v>
 </e>
 <e>
 <k>simple</k>
-<v>45148</v>
+<v>43397</v>
 </e>
 <e>
 <k>ext</k>
-<v>109</v>
+<v>105</v>
 </e>
 <e>
 <k>fromSource</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12929,7 +12924,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -12945,7 +12940,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -12961,7 +12956,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -12977,7 +12972,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -12993,7 +12988,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -13009,7 +13004,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -13025,7 +13020,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -13041,7 +13036,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66167</v>
+<v>63599</v>
 </b>
 </bs>
 </hist>
@@ -13057,22 +13052,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>34196</v>
+<v>32869</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6868</v>
+<v>6601</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>3586</v>
+<v>3446</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>498</v>
+<v>479</v>
 </b>
 </bs>
 </hist>
@@ -13088,22 +13083,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>34196</v>
+<v>32869</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6868</v>
+<v>6601</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>3586</v>
+<v>3446</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>498</v>
+<v>479</v>
 </b>
 </bs>
 </hist>
@@ -13119,17 +13114,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40322</v>
+<v>38758</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4193</v>
+<v>4031</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>632</v>
+<v>607</v>
 </b>
 </bs>
 </hist>
@@ -13145,7 +13140,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45148</v>
+<v>43397</v>
 </b>
 </bs>
 </hist>
@@ -13161,47 +13156,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>80</a>
 <b>81</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>114</a>
 <b>115</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>441</a>
 <b>442</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>738</a>
 <b>739</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4013</a>
 <b>4014</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13217,47 +13212,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>80</a>
 <b>81</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>114</a>
 <b>115</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>441</a>
 <b>442</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>738</a>
 <b>739</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4013</a>
 <b>4014</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13273,47 +13268,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>75</a>
 <b>76</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>112</a>
 <b>113</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>428</a>
 <b>429</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>658</a>
 <b>659</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2838</a>
 <b>2839</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13329,7 +13324,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>109</v>
+<v>105</v>
 </b>
 </bs>
 </hist>
@@ -13345,7 +13340,7 @@
 <b>
 <a>5443</a>
 <b>5444</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13361,7 +13356,7 @@
 <b>
 <a>5443</a>
 <b>5444</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13377,7 +13372,7 @@
 <b>
 <a>3714</a>
 <b>3715</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13393,7 +13388,7 @@
 <b>
 <a>9</a>
 <b>10</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13403,19 +13398,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>12107</cardinality>
+<cardinality>11637</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12107</v>
+<v>11637</v>
 </e>
 <e>
 <k>name</k>
-<v>12107</v>
+<v>11637</v>
 </e>
 <e>
 <k>simple</k>
-<v>3476</v>
+<v>3341</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13429,7 +13424,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12107</v>
+<v>11637</v>
 </b>
 </bs>
 </hist>
@@ -13445,7 +13440,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12107</v>
+<v>11637</v>
 </b>
 </bs>
 </hist>
@@ -13461,7 +13456,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12107</v>
+<v>11637</v>
 </b>
 </bs>
 </hist>
@@ -13477,7 +13472,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12107</v>
+<v>11637</v>
 </b>
 </bs>
 </hist>
@@ -13493,27 +13488,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1872</v>
+<v>1799</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>741</v>
+<v>712</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>498</v>
+<v>479</v>
 </b>
 <b>
 <a>4</a>
 <b>28</b>
-<v>279</v>
+<v>268</v>
 </b>
 <b>
 <a>28</a>
 <b>121</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -13529,27 +13524,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1872</v>
+<v>1799</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>741</v>
+<v>712</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>498</v>
+<v>479</v>
 </b>
 <b>
 <a>4</a>
 <b>28</b>
-<v>279</v>
+<v>268</v>
 </b>
 <b>
 <a>28</a>
 <b>121</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -13559,15 +13554,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>78250</cardinality>
+<cardinality>75214</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>12107</v>
+<v>11637</v>
 </e>
 <e>
 <k>child</k>
-<v>78250</v>
+<v>75214</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13581,42 +13576,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5506</v>
+<v>5293</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1568</v>
+<v>1507</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>668</v>
+<v>642</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>1118</v>
+<v>1074</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>899</v>
+<v>864</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>960</v>
+<v>923</v>
 </b>
 <b>
 <a>14</a>
 <b>30</b>
-<v>923</v>
+<v>888</v>
 </b>
 <b>
 <a>30</a>
 <b>153</b>
-<v>461</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -13632,7 +13627,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78250</v>
+<v>75214</v>
 </b>
 </bs>
 </hist>
@@ -13642,23 +13637,23 @@
 </relation>
 <relation>
 <name>fileannotations</name>
-<cardinality>5688625</cardinality>
+<cardinality>5467887</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5348</v>
+<v>5141</v>
 </e>
 <e>
 <k>kind</k>
-<v>24</v>
+<v>23</v>
 </e>
 <e>
 <k>name</k>
-<v>60186</v>
+<v>57851</v>
 </e>
 <e>
 <k>value</k>
-<v>49318</v>
+<v>47404</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13672,12 +13667,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5202</v>
+<v>5001</v>
 </b>
 </bs>
 </hist>
@@ -13693,62 +13688,62 @@
 <b>
 <a>1</a>
 <b>96</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>96</a>
 <b>219</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>221</a>
 <b>285</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>285</a>
 <b>444</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>445</a>
 <b>521</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>526</a>
 <b>619</b>
-<v>425</v>
+<v>408</v>
 </b>
 <b>
 <a>619</a>
 <b>708</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>708</a>
 <b>895</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>896</a>
 <b>928</b>
-<v>97</v>
+<v>93</v>
 </b>
 <b>
 <a>930</a>
 <b>931</b>
-<v>1531</v>
+<v>1472</v>
 </b>
 <b>
 <a>1076</a>
 <b>1667</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>1689</a>
 <b>2272</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -13764,57 +13759,57 @@
 <b>
 <a>1</a>
 <b>108</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>108</a>
 <b>269</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>269</a>
 <b>356</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>371</a>
 <b>630</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>630</a>
 <b>729</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>733</a>
 <b>948</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>948</a>
 <b>1062</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>1079</a>
 <b>1494</b>
-<v>279</v>
+<v>268</v>
 </b>
 <b>
 <a>1495</a>
 <b>1496</b>
-<v>1531</v>
+<v>1472</v>
 </b>
 <b>
 <a>1496</a>
 <b>1865</b>
-<v>401</v>
+<v>385</v>
 </b>
 <b>
 <a>1963</a>
 <b>4058</b>
-<v>328</v>
+<v>315</v>
 </b>
 </bs>
 </hist>
@@ -13830,12 +13825,12 @@
 <b>
 <a>428</a>
 <b>429</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>440</a>
 <b>441</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13851,12 +13846,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4949</a>
 <b>4950</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13872,12 +13867,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4057</a>
 <b>4058</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -13893,62 +13888,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9871</v>
+<v>9487</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6491</v>
+<v>6239</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>4996</v>
+<v>4802</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4935</v>
+<v>4743</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>4850</v>
+<v>4662</v>
 </b>
 <b>
 <a>14</a>
 <b>18</b>
-<v>4424</v>
+<v>4253</v>
 </b>
 <b>
 <a>18</a>
 <b>21</b>
-<v>4619</v>
+<v>4440</v>
 </b>
 <b>
 <a>21</a>
 <b>34</b>
-<v>4862</v>
+<v>4673</v>
 </b>
 <b>
 <a>34</a>
 <b>128</b>
-<v>4813</v>
+<v>4627</v>
 </b>
 <b>
 <a>129</a>
 <b>236</b>
-<v>4595</v>
+<v>4416</v>
 </b>
 <b>
 <a>236</a>
 <b>395</b>
-<v>4558</v>
+<v>4381</v>
 </b>
 <b>
 <a>395</a>
 <b>440</b>
-<v>1167</v>
+<v>1121</v>
 </b>
 </bs>
 </hist>
@@ -13964,7 +13959,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60186</v>
+<v>57851</v>
 </b>
 </bs>
 </hist>
@@ -13980,62 +13975,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11038</v>
+<v>10609</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8728</v>
+<v>8389</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2808</v>
+<v>2699</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>4352</v>
+<v>4183</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>5470</v>
+<v>5258</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>3586</v>
+<v>3446</v>
 </b>
 <b>
 <a>14</a>
 <b>17</b>
-<v>4643</v>
+<v>4463</v>
 </b>
 <b>
 <a>17</a>
 <b>22</b>
-<v>4643</v>
+<v>4463</v>
 </b>
 <b>
 <a>22</a>
 <b>40</b>
-<v>4558</v>
+<v>4381</v>
 </b>
 <b>
 <a>40</a>
 <b>83</b>
-<v>4582</v>
+<v>4405</v>
 </b>
 <b>
 <a>83</a>
 <b>163</b>
-<v>4534</v>
+<v>4358</v>
 </b>
 <b>
 <a>164</a>
 <b>1933</b>
-<v>1239</v>
+<v>1191</v>
 </b>
 </bs>
 </hist>
@@ -14051,67 +14046,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7524</v>
+<v>7232</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>2419</v>
+<v>2325</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>3573</v>
+<v>3435</v>
 </b>
 <b>
 <a>8</a>
 <b>21</b>
-<v>3804</v>
+<v>3657</v>
 </b>
 <b>
 <a>21</a>
 <b>23</b>
-<v>2735</v>
+<v>2629</v>
 </b>
 <b>
 <a>23</a>
 <b>25</b>
-<v>4461</v>
+<v>4288</v>
 </b>
 <b>
 <a>25</a>
 <b>40</b>
-<v>3586</v>
+<v>3446</v>
 </b>
 <b>
 <a>40</a>
 <b>195</b>
-<v>3890</v>
+<v>3739</v>
 </b>
 <b>
 <a>195</a>
 <b>207</b>
-<v>3902</v>
+<v>3750</v>
 </b>
 <b>
 <a>207</a>
 <b>273</b>
-<v>4048</v>
+<v>3891</v>
 </b>
 <b>
 <a>273</a>
 <b>327</b>
-<v>3744</v>
+<v>3598</v>
 </b>
 <b>
 <a>328</a>
 <b>407</b>
-<v>4315</v>
+<v>4148</v>
 </b>
 <b>
 <a>407</a>
 <b>441</b>
-<v>1312</v>
+<v>1261</v>
 </b>
 </bs>
 </hist>
@@ -14127,12 +14122,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49306</v>
+<v>47393</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -14148,67 +14143,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7549</v>
+<v>7256</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>2795</v>
+<v>2687</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>3610</v>
+<v>3470</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>4060</v>
+<v>3902</v>
 </b>
 <b>
 <a>16</a>
 <b>18</b>
-<v>3343</v>
+<v>3213</v>
 </b>
 <b>
 <a>18</a>
 <b>21</b>
-<v>4072</v>
+<v>3914</v>
 </b>
 <b>
 <a>21</a>
 <b>31</b>
-<v>4461</v>
+<v>4288</v>
 </b>
 <b>
 <a>31</a>
 <b>42</b>
-<v>4023</v>
+<v>3867</v>
 </b>
 <b>
 <a>42</a>
 <b>54</b>
-<v>3768</v>
+<v>3622</v>
 </b>
 <b>
 <a>54</a>
 <b>81</b>
-<v>3780</v>
+<v>3633</v>
 </b>
 <b>
 <a>81</a>
 <b>109</b>
-<v>3829</v>
+<v>3680</v>
 </b>
 <b>
 <a>109</a>
 <b>133</b>
-<v>3756</v>
+<v>3610</v>
 </b>
 <b>
 <a>133</a>
 <b>149</b>
-<v>267</v>
+<v>257</v>
 </b>
 </bs>
 </hist>
@@ -14218,15 +14213,15 @@
 </relation>
 <relation>
 <name>inmacroexpansion</name>
-<cardinality>57126596</cardinality>
+<cardinality>57160160</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15544516</v>
+<v>15553649</v>
 </e>
 <e>
 <k>inv</k>
-<v>2493763</v>
+<v>2495229</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14240,42 +14235,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3895411</v>
+<v>3897700</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2466113</v>
+<v>2467562</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2018102</v>
+<v>2019287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1769908</v>
+<v>1770948</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1845270</v>
+<v>1846354</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>884925</v>
+<v>885445</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1535759</v>
+<v>1536661</v>
 </b>
 <b>
 <a>8</a>
 <b>6265</b>
-<v>1129025</v>
+<v>1129688</v>
 </b>
 </bs>
 </hist>
@@ -14291,52 +14286,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>651228</v>
+<v>651611</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>350884</v>
+<v>351091</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>145822</v>
+<v>145908</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>276335</v>
+<v>276498</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>230677</v>
+<v>230812</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>202111</v>
+<v>202230</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>210471</v>
+<v>210594</v>
 </b>
 <b>
 <a>19</a>
 <b>34</b>
-<v>192538</v>
+<v>192651</v>
 </b>
 <b>
 <a>34</a>
 <b>167</b>
-<v>188020</v>
+<v>188130</v>
 </b>
 <b>
 <a>167</a>
 <b>153127</b>
-<v>45673</v>
+<v>45699</v>
 </b>
 </bs>
 </hist>
@@ -14346,15 +14341,15 @@
 </relation>
 <relation>
 <name>affectedbymacroexpansion</name>
-<cardinality>35527526</cardinality>
+<cardinality>35548400</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4083475</v>
+<v>4085874</v>
 </e>
 <e>
 <k>inv</k>
-<v>3282712</v>
+<v>3284641</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14368,42 +14363,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1341531</v>
+<v>1342319</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>719304</v>
+<v>719727</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>682963</v>
+<v>683364</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>320945</v>
+<v>321133</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>313534</v>
+<v>313718</v>
 </b>
 <b>
 <a>10</a>
 <b>24</b>
-<v>308059</v>
+<v>308240</v>
 </b>
 <b>
 <a>24</a>
 <b>64</b>
-<v>309945</v>
+<v>310127</v>
 </b>
 <b>
 <a>64</a>
 <b>9803</b>
-<v>87190</v>
+<v>87242</v>
 </b>
 </bs>
 </hist>
@@ -14419,72 +14414,72 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>253184</v>
+<v>253333</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>209979</v>
+<v>210102</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>202347</v>
+<v>202466</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>258125</v>
+<v>258276</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>301422</v>
+<v>301599</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>247881</v>
+<v>248027</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>231148</v>
+<v>231284</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>228002</v>
+<v>228136</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>182499</v>
+<v>182606</v>
 </b>
 <b>
 <a>10</a>
 <b>12</b>
-<v>285679</v>
+<v>285847</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>297410</v>
+<v>297584</v>
 </b>
 <b>
 <a>16</a>
 <b>23</b>
-<v>275398</v>
+<v>275560</v>
 </b>
 <b>
 <a>23</a>
 <b>60</b>
-<v>248963</v>
+<v>249109</v>
 </b>
 <b>
 <a>60</a>
 <b>526</b>
-<v>60669</v>
+<v>60704</v>
 </b>
 </bs>
 </hist>
@@ -14494,23 +14489,23 @@
 </relation>
 <relation>
 <name>macroinvocations</name>
-<cardinality>40814994</cardinality>
+<cardinality>39320374</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>40814994</v>
+<v>39320374</v>
 </e>
 <e>
 <k>macro_id</k>
-<v>89374</v>
+<v>85906</v>
 </e>
 <e>
 <k>location</k>
-<v>836970</v>
+<v>804492</v>
 </e>
 <e>
 <k>kind</k>
-<v>24</v>
+<v>23</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14524,7 +14519,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40814994</v>
+<v>39320374</v>
 </b>
 </bs>
 </hist>
@@ -14540,7 +14535,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40814994</v>
+<v>39320374</v>
 </b>
 </bs>
 </hist>
@@ -14556,7 +14551,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40814994</v>
+<v>39320374</v>
 </b>
 </bs>
 </hist>
@@ -14572,52 +14567,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19267</v>
+<v>18286</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>16946</v>
+<v>16475</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3744</v>
+<v>3598</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>7925</v>
+<v>7630</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>7658</v>
+<v>7326</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>7160</v>
+<v>6823</v>
 </b>
 <b>
 <a>21</a>
 <b>41</b>
-<v>6758</v>
+<v>6555</v>
 </b>
 <b>
 <a>41</a>
-<b>104</b>
-<v>6710</v>
+<b>107</b>
+<v>6485</v>
 </b>
 <b>
-<a>104</a>
-<b>454</b>
-<v>6710</v>
+<a>107</a>
+<b>450</b>
+<v>6449</v>
 </b>
 <b>
-<a>454</a>
-<b>201153</b>
-<v>6491</v>
+<a>453</a>
+<b>201240</b>
+<v>6274</v>
 </b>
 </bs>
 </hist>
@@ -14633,37 +14628,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47483</v>
+<v>45640</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11803</v>
+<v>11345</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5895</v>
+<v>5667</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>7682</v>
+<v>7384</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>7403</v>
+<v>7115</v>
 </b>
 <b>
 <a>13</a>
 <b>65</b>
-<v>6734</v>
+<v>6473</v>
 </b>
 <b>
 <a>65</a>
 <b>3614</b>
-<v>2370</v>
+<v>2278</v>
 </b>
 </bs>
 </hist>
@@ -14679,12 +14674,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82566</v>
+<v>79362</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6807</v>
+<v>6543</v>
 </b>
 </bs>
 </hist>
@@ -14700,42 +14695,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>314219</v>
+<v>299713</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>186394</v>
+<v>180341</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44431</v>
+<v>42999</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>58533</v>
+<v>56378</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>67687</v>
+<v>65247</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>64113</v>
+<v>61777</v>
 </b>
 <b>
 <a>16</a>
 <b>46</b>
-<v>64830</v>
+<v>62536</v>
 </b>
 <b>
 <a>46</a>
-<b>262302</b>
-<v>36761</v>
+<b>262546</b>
+<v>35498</v>
 </b>
 </bs>
 </hist>
@@ -14751,12 +14746,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>783044</v>
+<v>752659</v>
 </b>
 <b>
 <a>2</a>
 <b>353</b>
-<v>53925</v>
+<v>51833</v>
 </b>
 </bs>
 </hist>
@@ -14772,7 +14767,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>836970</v>
+<v>804492</v>
 </b>
 </bs>
 </hist>
@@ -14788,12 +14783,12 @@
 <b>
 <a>37566</a>
 <b>37567</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>3319916</a>
-<b>3319917</b>
-<v>12</v>
+<a>3327545</a>
+<b>3327546</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -14809,12 +14804,12 @@
 <b>
 <a>2199</a>
 <b>2200</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5713</a>
 <b>5714</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -14830,12 +14825,12 @@
 <b>
 <a>6537</a>
 <b>6538</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>62313</a>
 <b>62314</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -14845,15 +14840,15 @@
 </relation>
 <relation>
 <name>macroparent</name>
-<cardinality>35822215</cardinality>
+<cardinality>34476404</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>35822215</v>
+<v>34476404</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>27895299</v>
+<v>26856682</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14867,7 +14862,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35822215</v>
+<v>34476404</v>
 </b>
 </bs>
 </hist>
@@ -14883,17 +14878,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21477676</v>
+<v>20687700</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5474478</v>
+<v>5262423</v>
 </b>
 <b>
 <a>3</a>
 <b>88</b>
-<v>943144</v>
+<v>906558</v>
 </b>
 </bs>
 </hist>
@@ -14903,15 +14898,15 @@
 </relation>
 <relation>
 <name>macrolocationbind</name>
-<cardinality>4016679</cardinality>
+<cardinality>4019039</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2801506</v>
+<v>2803152</v>
 </e>
 <e>
 <k>location</k>
-<v>2004363</v>
+<v>2005541</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14925,22 +14920,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2200726</v>
+<v>2202019</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>339324</v>
+<v>339524</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>231800</v>
+<v>231936</v>
 </b>
 <b>
 <a>7</a>
 <b>57</b>
-<v>29655</v>
+<v>29673</v>
 </b>
 </bs>
 </hist>
@@ -14956,22 +14951,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1602305</v>
+<v>1603246</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>171008</v>
+<v>171108</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>155504</v>
+<v>155595</v>
 </b>
 <b>
 <a>8</a>
 <b>723</b>
-<v>75546</v>
+<v>75590</v>
 </b>
 </bs>
 </hist>
@@ -14981,19 +14976,19 @@
 </relation>
 <relation>
 <name>macro_argument_unexpanded</name>
-<cardinality>104803767</cardinality>
+<cardinality>100941827</cardinality>
 <columnsizes>
 <e>
 <k>invocation</k>
-<v>31131960</v>
+<v>30008413</v>
 </e>
 <e>
 <k>argument_index</k>
-<v>802</v>
+<v>771</v>
 </e>
 <e>
 <k>text</k>
-<v>345935</v>
+<v>332512</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15007,22 +15002,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8804221</v>
+<v>8477672</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12965574</v>
+<v>12498009</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7092535</v>
+<v>6840222</v>
 </b>
 <b>
 <a>4</a>
 <b>67</b>
-<v>2269629</v>
+<v>2192508</v>
 </b>
 </bs>
 </hist>
@@ -15038,22 +15033,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8880284</v>
+<v>8550795</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13152746</v>
+<v>12678071</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6885304</v>
+<v>6640869</v>
 </b>
 <b>
 <a>4</a>
 <b>67</b>
-<v>2213625</v>
+<v>2138677</v>
 </b>
 </bs>
 </hist>
@@ -15069,17 +15064,17 @@
 <b>
 <a>51815</a>
 <b>51816</b>
-<v>705</v>
+<v>677</v>
 </b>
 <b>
 <a>52017</a>
-<b>186703</b>
-<v>60</v>
+<b>187640</b>
+<v>58</v>
 </b>
 <b>
-<a>770141</a>
-<b>2560947</b>
-<v>36</v>
+<a>773038</a>
+<b>2568177</b>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -15095,17 +15090,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>705</v>
+<v>677</v>
 </b>
 <b>
 <a>13</a>
 <b>1002</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>6617</a>
 <b>19688</b>
-<v>36</v>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -15121,62 +15116,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42535</v>
+<v>39868</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>69291</v>
+<v>64826</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>15621</v>
+<v>15435</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>46376</v>
+<v>44296</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>26513</v>
+<v>26980</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>15560</v>
+<v>15447</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>24531</v>
+<v>23275</v>
 </b>
 <b>
 <a>16</a>
 <b>22</b>
-<v>26403</v>
+<v>25414</v>
 </b>
 <b>
 <a>22</a>
-<b>42</b>
-<v>26257</v>
+<b>41</b>
+<v>25075</v>
 </b>
 <b>
-<a>42</a>
-<b>113</b>
-<v>25978</v>
+<a>41</a>
+<b>101</b>
+<v>24970</v>
 </b>
 <b>
-<a>113</a>
-<b>51881</b>
-<v>25953</v>
+<a>101</a>
+<b>4363</b>
+<v>24958</v>
 </b>
 <b>
-<a>51881</a>
-<b>580841</b>
-<v>911</v>
+<a>4608</a>
+<b>581891</b>
+<v>1963</v>
 </b>
 </bs>
 </hist>
@@ -15192,17 +15187,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>250082</v>
+<v>240378</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84450</v>
+<v>81173</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>11402</v>
+<v>10960</v>
 </b>
 </bs>
 </hist>
@@ -15212,19 +15207,19 @@
 </relation>
 <relation>
 <name>macro_argument_expanded</name>
-<cardinality>104803767</cardinality>
+<cardinality>100941827</cardinality>
 <columnsizes>
 <e>
 <k>invocation</k>
-<v>31131960</v>
+<v>30008413</v>
 </e>
 <e>
 <k>argument_index</k>
-<v>802</v>
+<v>771</v>
 </e>
 <e>
 <k>text</k>
-<v>209491</v>
+<v>201362</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15238,22 +15233,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8804221</v>
+<v>8477672</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12965574</v>
+<v>12498009</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7092535</v>
+<v>6840222</v>
 </b>
 <b>
 <a>4</a>
 <b>67</b>
-<v>2269629</v>
+<v>2192508</v>
 </b>
 </bs>
 </hist>
@@ -15269,22 +15264,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12795323</v>
+<v>12315365</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11169279</v>
+<v>10770085</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5961987</v>
+<v>5753415</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>1205370</v>
+<v>1169546</v>
 </b>
 </bs>
 </hist>
@@ -15300,17 +15295,17 @@
 <b>
 <a>51815</a>
 <b>51816</b>
-<v>705</v>
+<v>677</v>
 </b>
 <b>
 <a>52017</a>
-<b>186703</b>
-<v>60</v>
+<b>187640</b>
+<v>58</v>
 </b>
 <b>
-<a>770141</a>
-<b>2560947</b>
-<v>36</v>
+<a>773038</a>
+<b>2568177</b>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -15326,17 +15321,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>692</v>
+<v>666</v>
 </b>
 <b>
 <a>2</a>
 <b>75</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>867</a>
 <b>13964</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -15352,62 +15347,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>25820</v>
+<v>23871</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42583</v>
+<v>40791</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6758</v>
+<v>6636</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>15791</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>3367</v>
+<v>18450</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>24555</v>
+<v>23743</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>16702</v>
+<v>16475</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>19146</v>
+<v>17597</v>
 </b>
 <b>
 <a>15</a>
 <b>31</b>
-<v>15851</v>
+<v>15984</v>
 </b>
 <b>
 <a>31</a>
-<b>87</b>
-<v>15912</v>
+<b>86</b>
+<v>15108</v>
 </b>
 <b>
-<a>87</a>
-<b>393</b>
-<v>15742</v>
+<a>86</a>
+<b>365</b>
+<v>15225</v>
 </b>
 <b>
-<a>396</a>
-<b>1164221</b>
-<v>7257</v>
+<a>365</a>
+<b>1165688</b>
+<v>7478</v>
 </b>
 </bs>
 </hist>
@@ -15423,22 +15413,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105651</v>
+<v>101551</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87976</v>
+<v>84562</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>15779</v>
+<v>15166</v>
 </b>
 <b>
 <a>6</a>
 <b>66</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -15448,19 +15438,19 @@
 </relation>
 <relation>
 <name>functions</name>
-<cardinality>3565918</cardinality>
+<cardinality>3552236</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3565918</v>
+<v>3552236</v>
 </e>
 <e>
 <k>name</k>
-<v>315848</v>
+<v>303954</v>
 </e>
 <e>
 <k>kind</k>
-<v>85</v>
+<v>81</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15474,7 +15464,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3565918</v>
+<v>3552236</v>
 </b>
 </bs>
 </hist>
@@ -15490,7 +15480,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3565918</v>
+<v>3552236</v>
 </b>
 </bs>
 </hist>
@@ -15506,27 +15496,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>214682</v>
+<v>206387</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31266</v>
+<v>29924</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28360</v>
+<v>27435</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>23826</v>
+<v>23100</v>
 </b>
 <b>
 <a>13</a>
-<b>109484</b>
-<v>17711</v>
+<b>118759</b>
+<v>17106</v>
 </b>
 </bs>
 </hist>
@@ -15542,12 +15532,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>314231</v>
+<v>302400</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1616</v>
+<v>1554</v>
 </b>
 </bs>
 </hist>
@@ -15563,37 +15553,37 @@
 <b>
 <a>32</a>
 <b>33</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>477</a>
-<b>478</b>
-<v>12</v>
+<a>478</a>
+<b>479</b>
+<v>11</v>
 </b>
 <b>
 <a>2735</a>
 <b>2736</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>5928</a>
-<b>5929</b>
-<v>12</v>
+<a>6052</a>
+<b>6053</b>
+<v>11</v>
 </b>
 <b>
-<a>43779</a>
-<b>43780</b>
-<v>12</v>
+<a>43879</a>
+<b>43880</b>
+<v>11</v>
 </b>
 <b>
-<a>108979</a>
-<b>108980</b>
-<v>12</v>
+<a>109948</a>
+<b>109949</b>
+<v>11</v>
 </b>
 <b>
-<a>131406</a>
-<b>131407</b>
-<v>12</v>
+<a>140883</a>
+<b>140884</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -15609,37 +15599,37 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>42</a>
 <b>43</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>228</a>
-<b>229</b>
-<v>12</v>
+<a>229</a>
+<b>230</b>
+<v>11</v>
 </b>
 <b>
-<a>1485</a>
-<b>1486</b>
-<v>12</v>
+<a>1494</a>
+<b>1495</b>
+<v>11</v>
 </b>
 <b>
 <a>2735</a>
 <b>2736</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>2858</a>
-<b>2859</b>
-<v>12</v>
+<a>2879</a>
+<b>2880</b>
+<v>11</v>
 </b>
 <b>
 <a>18756</a>
 <b>18757</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -15649,15 +15639,15 @@
 </relation>
 <relation>
 <name>function_entry_point</name>
-<cardinality>1068501</cardinality>
+<cardinality>1030977</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1065255</v>
+<v>1027857</v>
 </e>
 <e>
 <k>entry_point</k>
-<v>1068501</v>
+<v>1030977</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15671,12 +15661,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1062313</v>
+<v>1025030</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>2941</v>
+<v>2827</v>
 </b>
 </bs>
 </hist>
@@ -15692,7 +15682,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1068501</v>
+<v>1030977</v>
 </b>
 </bs>
 </hist>
@@ -15702,15 +15692,15 @@
 </relation>
 <relation>
 <name>function_return_type</name>
-<cardinality>3577065</cardinality>
+<cardinality>3562951</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3565347</v>
+<v>3551686</v>
 </e>
 <e>
 <k>return_type</k>
-<v>1033588</v>
+<v>1048715</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15724,12 +15714,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3554126</v>
+<v>3540901</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>11220</v>
+<v>10784</v>
 </b>
 </bs>
 </hist>
@@ -15745,17 +15735,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>319945</v>
+<v>309177</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>649566</v>
+<v>677865</v>
 </b>
 <b>
 <a>3</a>
-<b>81742</b>
-<v>64076</v>
+<b>82133</b>
+<v>61671</v>
 </b>
 </bs>
 </hist>
@@ -15765,60 +15755,60 @@
 </relation>
 <relation>
 <name>purefunctions</name>
-<cardinality>21018</cardinality>
+<cardinality>20805</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21018</v>
+<v>20805</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>function_deleted</name>
-<cardinality>51251</cardinality>
+<cardinality>49379</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>51251</v>
+<v>49379</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>function_defaulted</name>
-<cardinality>9554</cardinality>
+<cardinality>9184</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>9554</v>
+<v>9184</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>fun_decls</name>
-<cardinality>3668324</cardinality>
+<cardinality>3646017</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3657006</v>
+<v>3635139</v>
 </e>
 <e>
 <k>function</k>
-<v>3484737</v>
+<v>3469555</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1026294</v>
+<v>1041634</v>
 </e>
 <e>
 <k>name</k>
-<v>281968</v>
+<v>271389</v>
 </e>
 <e>
 <k>location</k>
-<v>875943</v>
+<v>843835</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15832,7 +15822,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3657006</v>
+<v>3635139</v>
 </b>
 </bs>
 </hist>
@@ -15848,12 +15838,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3646053</v>
+<v>3624611</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>10952</v>
+<v>10527</v>
 </b>
 </bs>
 </hist>
@@ -15869,7 +15859,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3657006</v>
+<v>3635139</v>
 </b>
 </bs>
 </hist>
@@ -15885,7 +15875,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3657006</v>
+<v>3635139</v>
 </b>
 </bs>
 </hist>
@@ -15901,12 +15891,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3343699</v>
+<v>3333988</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>141038</v>
+<v>135566</v>
 </b>
 </bs>
 </hist>
@@ -15922,12 +15912,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3466345</v>
+<v>3451876</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>18392</v>
+<v>17678</v>
 </b>
 </bs>
 </hist>
@@ -15943,7 +15933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3484737</v>
+<v>3469555</v>
 </b>
 </bs>
 </hist>
@@ -15959,12 +15949,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3389832</v>
+<v>3378332</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>94905</v>
+<v>91222</v>
 </b>
 </bs>
 </hist>
@@ -15980,17 +15970,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305953</v>
+<v>295716</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>648059</v>
+<v>676381</v>
 </b>
 <b>
 <a>3</a>
-<b>87017</b>
-<v>72282</v>
+<b>87408</b>
+<v>69535</v>
 </b>
 </bs>
 </hist>
@@ -16006,17 +15996,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>318972</v>
+<v>308231</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>644096</v>
+<v>672572</v>
 </b>
 <b>
 <a>3</a>
-<b>80918</b>
-<v>63225</v>
+<b>81309</b>
+<v>60830</v>
 </b>
 </bs>
 </hist>
@@ -16032,12 +16022,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>956638</v>
+<v>974669</v>
 </b>
 <b>
 <a>2</a>
-<b>7429</b>
-<v>69656</v>
+<b>7459</b>
+<v>66965</v>
 </b>
 </bs>
 </hist>
@@ -16053,17 +16043,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>921129</v>
+<v>940538</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>81642</v>
+<v>78474</v>
 </b>
 <b>
 <a>5</a>
-<b>22296</b>
-<v>23522</v>
+<b>22349</b>
+<v>22621</v>
 </b>
 </bs>
 </hist>
@@ -16079,32 +16069,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>169351</v>
+<v>162826</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32554</v>
+<v>31420</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18866</v>
+<v>17994</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>25650</v>
+<v>24841</v>
 </b>
 <b>
 <a>7</a>
 <b>19</b>
-<v>21261</v>
+<v>20518</v>
 </b>
 <b>
 <a>19</a>
-<b>109747</b>
-<v>14283</v>
+<b>119022</b>
+<v>13787</v>
 </b>
 </bs>
 </hist>
@@ -16120,32 +16110,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>181155</v>
+<v>174172</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31412</v>
+<v>30099</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16654</v>
+<v>16171</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>22623</v>
+<v>21862</v>
 </b>
 <b>
 <a>7</a>
-<b>26</b>
-<v>21383</v>
+<b>25</b>
+<v>20366</v>
 </b>
 <b>
-<a>26</a>
-<b>109468</b>
-<v>8740</v>
+<a>25</a>
+<b>118743</b>
+<v>8716</v>
 </b>
 </bs>
 </hist>
@@ -16161,17 +16151,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>246046</v>
+<v>236860</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>23170</v>
+<v>22271</v>
 </b>
 <b>
 <a>5</a>
-<b>56245</b>
-<v>12752</v>
+<b>60936</b>
+<v>12257</v>
 </b>
 </bs>
 </hist>
@@ -16187,27 +16177,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>180486</v>
+<v>173599</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47823</v>
+<v>46213</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18040</v>
+<v>17340</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>22696</v>
+<v>21815</v>
 </b>
 <b>
 <a>8</a>
-<b>8793</b>
-<v>12922</v>
+<b>8910</b>
+<v>12420</v>
 </b>
 </bs>
 </hist>
@@ -16223,27 +16213,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>589769</v>
+<v>567012</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>147895</v>
+<v>142319</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>69790</v>
+<v>67350</v>
 </b>
 <b>
 <a>5</a>
-<b>179</b>
-<v>65766</v>
+<b>141</b>
+<v>63307</v>
 </b>
 <b>
-<a>179</a>
-<b>3027</b>
-<v>2723</v>
+<a>142</a>
+<b>3039</b>
+<v>3844</v>
 </b>
 </bs>
 </hist>
@@ -16259,22 +16249,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>602727</v>
+<v>579468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>164743</v>
+<v>158514</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>69753</v>
+<v>67747</v>
 </b>
 <b>
 <a>9</a>
-<b>3027</b>
-<v>38718</v>
+<b>3039</b>
+<v>38103</v>
 </b>
 </bs>
 </hist>
@@ -16290,17 +16280,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>773854</v>
+<v>744445</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68209</v>
+<v>65890</v>
 </b>
 <b>
 <a>4</a>
-<b>1514</b>
-<v>33879</v>
+<b>1520</b>
+<v>33500</v>
 </b>
 </bs>
 </hist>
@@ -16316,12 +16306,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>848299</v>
+<v>817018</v>
 </b>
 <b>
 <a>2</a>
 <b>134</b>
-<v>27643</v>
+<v>26816</v>
 </b>
 </bs>
 </hist>
@@ -16331,22 +16321,22 @@
 </relation>
 <relation>
 <name>fun_def</name>
-<cardinality>1296860</cardinality>
+<cardinality>1250592</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1296860</v>
+<v>1250592</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>fun_specialized</name>
-<cardinality>6505</cardinality>
+<cardinality>6439</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>6505</v>
+<v>6439</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -16364,11 +16354,11 @@
 </relation>
 <relation>
 <name>fun_decl_specifiers</name>
-<cardinality>512313</cardinality>
+<cardinality>512614</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>274687</v>
+<v>274848</v>
 </e>
 <e>
 <k>name</k>
@@ -16386,17 +16376,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72048</v>
+<v>72090</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>167651</v>
+<v>167750</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34987</v>
+<v>35007</v>
 </b>
 </bs>
 </hist>
@@ -16583,26 +16573,26 @@
 </relation>
 <relation>
 <name>fun_decl_empty_throws</name>
-<cardinality>1416734</cardinality>
+<cardinality>1471304</cardinality>
 <columnsizes>
 <e>
 <k>fun_decl</k>
-<v>1416734</v>
+<v>1471304</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>fun_decl_noexcept</name>
-<cardinality>16569</cardinality>
+<cardinality>15937</cardinality>
 <columnsizes>
 <e>
 <k>fun_decl</k>
-<v>15693</v>
+<v>15096</v>
 </e>
 <e>
 <k>constant</k>
-<v>16435</v>
+<v>15809</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16616,12 +16606,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14818</v>
+<v>14255</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>875</v>
+<v>841</v>
 </b>
 </bs>
 </hist>
@@ -16637,12 +16627,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16301</v>
+<v>15680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -16652,26 +16642,26 @@
 </relation>
 <relation>
 <name>fun_decl_empty_noexcept</name>
-<cardinality>364559</cardinality>
+<cardinality>350681</cardinality>
 <columnsizes>
 <e>
 <k>fun_decl</k>
-<v>364559</v>
+<v>350681</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>fun_decl_typedef_type</name>
-<cardinality>194</cardinality>
+<cardinality>186</cardinality>
 <columnsizes>
 <e>
 <k>fun_decl</k>
-<v>194</v>
+<v>186</v>
 </e>
 <e>
 <k>typedeftype_id</k>
-<v>97</v>
+<v>93</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16685,7 +16675,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194</v>
+<v>186</v>
 </b>
 </bs>
 </hist>
@@ -16701,7 +16691,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>97</v>
+<v>93</v>
 </b>
 </bs>
 </hist>
@@ -16711,19 +16701,19 @@
 </relation>
 <relation>
 <name>param_decl_bind</name>
-<cardinality>4830661</cardinality>
+<cardinality>4766932</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4830661</v>
+<v>4766932</v>
 </e>
 <e>
 <k>index</k>
-<v>389</v>
+<v>373</v>
 </e>
 <e>
 <k>fun_decl</k>
-<v>3158896</v>
+<v>3153051</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16737,7 +16727,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4830661</v>
+<v>4766932</v>
 </b>
 </bs>
 </hist>
@@ -16753,7 +16743,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4830661</v>
+<v>4766932</v>
 </b>
 </bs>
 </hist>
@@ -16769,57 +16759,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>15</a>
 <b>44</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>115</a>
 <b>191</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>263</a>
 <b>337</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>422</a>
 <b>615</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>885</a>
 <b>1215</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1695</a>
 <b>2656</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>4907</a>
-<b>13240</b>
-<v>24</v>
+<b>13252</b>
+<v>23</v>
 </b>
 <b>
-<a>34828</a>
-<b>76062</b>
-<v>24</v>
+<a>34902</a>
+<b>76574</b>
+<v>23</v>
 </b>
 <b>
-<a>259854</a>
-<b>259855</b>
-<v>12</v>
+<a>269844</a>
+<b>269845</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -16835,57 +16825,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>15</a>
 <b>44</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>115</a>
 <b>191</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>263</a>
 <b>337</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>422</a>
 <b>615</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>885</a>
 <b>1215</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1695</a>
 <b>2656</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>4907</a>
-<b>13240</b>
-<v>24</v>
+<b>13252</b>
+<v>23</v>
 </b>
 <b>
-<a>34828</a>
-<b>76062</b>
-<v>24</v>
+<a>34902</a>
+<b>76574</b>
+<v>23</v>
 </b>
 <b>
-<a>259854</a>
-<b>259855</b>
-<v>12</v>
+<a>269844</a>
+<b>269845</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -16901,22 +16891,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2234266</v>
+<v>2258317</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>501246</v>
+<v>486913</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>262445</v>
+<v>252985</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>160938</v>
+<v>154834</v>
 </b>
 </bs>
 </hist>
@@ -16932,22 +16922,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2234266</v>
+<v>2258317</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>501246</v>
+<v>486913</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>262445</v>
+<v>252985</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>160938</v>
+<v>154834</v>
 </b>
 </bs>
 </hist>
@@ -16957,27 +16947,27 @@
 </relation>
 <relation>
 <name>var_decls</name>
-<cardinality>5602108</cardinality>
+<cardinality>5518014</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5579181</v>
+<v>5495954</v>
 </e>
 <e>
 <k>variable</k>
-<v>5340611</v>
+<v>5266618</v>
 </e>
 <e>
 <k>type_id</k>
-<v>2038268</v>
+<v>2068405</v>
 </e>
 <e>
 <k>name</k>
-<v>139592</v>
+<v>134175</v>
 </e>
 <e>
 <k>location</k>
-<v>1358468</v>
+<v>1305755</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16991,7 +16981,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5579181</v>
+<v>5495954</v>
 </b>
 </bs>
 </hist>
@@ -17007,12 +16997,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5556716</v>
+<v>5474337</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>22465</v>
+<v>21616</v>
 </b>
 </bs>
 </hist>
@@ -17028,7 +17018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5579181</v>
+<v>5495954</v>
 </b>
 </bs>
 </hist>
@@ -17044,12 +17034,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5579132</v>
+<v>5495907</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -17065,12 +17055,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5146145</v>
+<v>5079674</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>194466</v>
+<v>186943</v>
 </b>
 </bs>
 </hist>
@@ -17086,12 +17076,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5290709</v>
+<v>5218605</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>49902</v>
+<v>48012</v>
 </b>
 </bs>
 </hist>
@@ -17107,12 +17097,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5321866</v>
+<v>5248600</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18745</v>
+<v>18017</v>
 </b>
 </bs>
 </hist>
@@ -17128,12 +17118,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5225490</v>
+<v>5155963</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>115121</v>
+<v>110654</v>
 </b>
 </bs>
 </hist>
@@ -17149,22 +17139,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1580700</v>
+<v>1627085</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>244952</v>
+<v>236522</v>
 </b>
 <b>
 <a>3</a>
-<b>9</b>
-<v>154629</v>
+<b>10</b>
+<v>155430</v>
 </b>
 <b>
-<a>9</a>
-<b>5708</b>
-<v>57986</v>
+<a>10</a>
+<b>5721</b>
+<v>49367</v>
 </b>
 </bs>
 </hist>
@@ -17180,22 +17170,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1607080</v>
+<v>1652441</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>234777</v>
+<v>226741</v>
 </b>
 <b>
 <a>3</a>
-<b>11</b>
-<v>155359</v>
+<b>13</b>
+<v>156353</v>
 </b>
 <b>
-<a>11</a>
-<b>5254</b>
-<v>41052</v>
+<a>13</a>
+<b>5267</b>
+<v>32869</v>
 </b>
 </bs>
 </hist>
@@ -17211,17 +17201,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1850925</v>
+<v>1888086</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>162458</v>
+<v>156341</v>
 </b>
 <b>
 <a>5</a>
 <b>770</b>
-<v>24884</v>
+<v>23977</v>
 </b>
 </bs>
 </hist>
@@ -17237,17 +17227,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1771751</v>
+<v>1811867</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>165132</v>
+<v>159052</v>
 </b>
 <b>
 <a>4</a>
 <b>3604</b>
-<v>101384</v>
+<v>97485</v>
 </b>
 </bs>
 </hist>
@@ -17263,42 +17253,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>58861</v>
+<v>56530</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20860</v>
+<v>20039</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12290</v>
+<v>11801</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>12715</v>
+<v>12268</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>11524</v>
+<v>11088</v>
 </b>
 <b>
 <a>10</a>
 <b>22</b>
-<v>10673</v>
+<v>10270</v>
 </b>
 <b>
 <a>22</a>
 <b>255</b>
-<v>10490</v>
+<v>10083</v>
 </b>
 <b>
 <a>263</a>
-<b>149390</b>
-<v>2176</v>
+<b>159500</b>
+<v>2091</v>
 </b>
 </bs>
 </hist>
@@ -17314,37 +17304,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62277</v>
+<v>59814</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20118</v>
+<v>19314</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13359</v>
+<v>12841</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>11949</v>
+<v>11532</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>11499</v>
+<v>11077</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>10515</v>
+<v>10095</v>
 </b>
 <b>
 <a>28</a>
-<b>148426</b>
-<v>9871</v>
+<b>158536</b>
+<v>9499</v>
 </b>
 </bs>
 </hist>
@@ -17360,32 +17350,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84973</v>
+<v>81606</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18149</v>
+<v>17445</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9676</v>
+<v>9347</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11706</v>
+<v>11275</v>
 </b>
 <b>
 <a>7</a>
 <b>28</b>
-<v>10576</v>
+<v>10165</v>
 </b>
 <b>
 <a>28</a>
-<b>111448</b>
-<v>4510</v>
+<b>120730</b>
+<v>4335</v>
 </b>
 </bs>
 </hist>
@@ -17401,32 +17391,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80329</v>
+<v>77212</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21273</v>
+<v>20448</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7780</v>
+<v>7478</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>12423</v>
+<v>11941</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>10563</v>
+<v>10154</v>
 </b>
 <b>
 <a>21</a>
 <b>9993</b>
-<v>7220</v>
+<v>6940</v>
 </b>
 </bs>
 </hist>
@@ -17442,22 +17432,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1008108</v>
+<v>967927</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>144734</v>
+<v>139422</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>124044</v>
+<v>119546</v>
 </b>
 <b>
 <a>6</a>
-<b>114124</b>
-<v>81581</v>
+<b>123459</b>
+<v>78860</v>
 </b>
 </bs>
 </hist>
@@ -17473,22 +17463,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1060320</v>
+<v>1018112</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>107961</v>
+<v>103970</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>111863</v>
+<v>107943</v>
 </b>
 <b>
 <a>6</a>
-<b>113877</b>
-<v>78323</v>
+<b>123212</b>
+<v>75728</v>
 </b>
 </bs>
 </hist>
@@ -17504,17 +17494,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1166129</v>
+<v>1119863</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93045</v>
+<v>89797</v>
 </b>
 <b>
 <a>3</a>
-<b>104379</b>
-<v>99293</v>
+<b>113652</b>
+<v>96095</v>
 </b>
 </bs>
 </hist>
@@ -17530,12 +17520,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1348524</v>
+<v>1296197</v>
 </b>
 <b>
 <a>2</a>
 <b>52</b>
-<v>9943</v>
+<v>9558</v>
 </b>
 </bs>
 </hist>
@@ -17545,11 +17535,11 @@
 </relation>
 <relation>
 <name>var_def</name>
-<cardinality>2573394</cardinality>
+<cardinality>2477557</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2573394</v>
+<v>2477557</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -17619,19 +17609,19 @@
 </relation>
 <relation>
 <name>type_decls</name>
-<cardinality>1469165</cardinality>
+<cardinality>1413769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1469165</v>
+<v>1413769</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1433996</v>
+<v>1379965</v>
 </e>
 <e>
 <k>location</k>
-<v>1203571</v>
+<v>1156868</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17645,7 +17635,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1469165</v>
+<v>1413769</v>
 </b>
 </bs>
 </hist>
@@ -17661,7 +17651,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1469165</v>
+<v>1413769</v>
 </b>
 </bs>
 </hist>
@@ -17677,12 +17667,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1408431</v>
+<v>1355392</v>
 </b>
 <b>
 <a>2</a>
 <b>24</b>
-<v>25564</v>
+<v>24572</v>
 </b>
 </bs>
 </hist>
@@ -17698,12 +17688,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1409866</v>
+<v>1356771</v>
 </b>
 <b>
 <a>2</a>
 <b>24</b>
-<v>24130</v>
+<v>23194</v>
 </b>
 </bs>
 </hist>
@@ -17719,12 +17709,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1142582</v>
+<v>1098234</v>
 </b>
 <b>
 <a>2</a>
 <b>469</b>
-<v>60988</v>
+<v>58633</v>
 </b>
 </bs>
 </hist>
@@ -17740,12 +17730,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1144223</v>
+<v>1099812</v>
 </b>
 <b>
 <a>2</a>
 <b>469</b>
-<v>59347</v>
+<v>57056</v>
 </b>
 </bs>
 </hist>
@@ -17755,45 +17745,45 @@
 </relation>
 <relation>
 <name>type_def</name>
-<cardinality>1035654</cardinality>
+<cardinality>995467</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1035654</v>
+<v>995467</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>type_decl_top</name>
-<cardinality>297552</cardinality>
+<cardinality>286006</cardinality>
 <columnsizes>
 <e>
 <k>type_decl</k>
-<v>297552</v>
+<v>286006</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>namespace_decls</name>
-<cardinality>151627</cardinality>
+<cardinality>145743</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>151627</v>
+<v>145743</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>8485</v>
+<v>8155</v>
 </e>
 <e>
 <k>location</k>
-<v>135422</v>
+<v>130167</v>
 </e>
 <e>
 <k>bodylocation</k>
-<v>135787</v>
+<v>130518</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17807,7 +17797,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>151627</v>
+<v>145743</v>
 </b>
 </bs>
 </hist>
@@ -17823,7 +17813,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>151627</v>
+<v>145743</v>
 </b>
 </bs>
 </hist>
@@ -17839,7 +17829,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>151627</v>
+<v>145743</v>
 </b>
 </bs>
 </hist>
@@ -17855,42 +17845,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4011</v>
+<v>3855</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1191</v>
+<v>1145</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>449</v>
+<v>432</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>717</v>
+<v>689</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>13</a>
 <b>27</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>28</a>
 <b>163</b>
-<v>644</v>
+<v>619</v>
 </b>
 <b>
 <a>172</a>
 <b>3743</b>
-<v>158</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -17906,42 +17896,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4011</v>
+<v>3855</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1191</v>
+<v>1145</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>449</v>
+<v>432</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>717</v>
+<v>689</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>13</a>
 <b>27</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>28</a>
 <b>163</b>
-<v>644</v>
+<v>619</v>
 </b>
 <b>
 <a>172</a>
 <b>3743</b>
-<v>158</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -17957,42 +17947,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4011</v>
+<v>3855</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1191</v>
+<v>1145</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>449</v>
+<v>432</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>717</v>
+<v>689</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>13</a>
 <b>27</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>28</a>
 <b>163</b>
-<v>644</v>
+<v>619</v>
 </b>
 <b>
 <a>172</a>
 <b>3742</b>
-<v>158</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -18008,12 +17998,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>126135</v>
+<v>121240</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>9287</v>
+<v>8927</v>
 </b>
 </bs>
 </hist>
@@ -18029,12 +18019,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>126135</v>
+<v>121240</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>9287</v>
+<v>8927</v>
 </b>
 </bs>
 </hist>
@@ -18050,12 +18040,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>134595</v>
+<v>129373</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>826</v>
+<v>794</v>
 </b>
 </bs>
 </hist>
@@ -18071,12 +18061,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>126900</v>
+<v>121976</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>8886</v>
+<v>8541</v>
 </b>
 </bs>
 </hist>
@@ -18092,12 +18082,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>126900</v>
+<v>121976</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>8886</v>
+<v>8541</v>
 </b>
 </bs>
 </hist>
@@ -18113,12 +18103,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>135349</v>
+<v>130097</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>437</v>
+<v>420</v>
 </b>
 </bs>
 </hist>
@@ -18128,19 +18118,19 @@
 </relation>
 <relation>
 <name>usings</name>
-<cardinality>320601</cardinality>
+<cardinality>308161</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>320601</v>
+<v>308161</v>
 </e>
 <e>
 <k>element_id</k>
-<v>49002</v>
+<v>47101</v>
 </e>
 <e>
 <k>location</k>
-<v>26464</v>
+<v>25437</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18154,7 +18144,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>320601</v>
+<v>308161</v>
 </b>
 </bs>
 </hist>
@@ -18170,7 +18160,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>320601</v>
+<v>308161</v>
 </b>
 </bs>
 </hist>
@@ -18186,17 +18176,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41234</v>
+<v>39634</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>4169</v>
+<v>4007</v>
 </b>
 <b>
 <a>4</a>
 <b>127</b>
-<v>3598</v>
+<v>3458</v>
 </b>
 </bs>
 </hist>
@@ -18212,17 +18202,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41234</v>
+<v>39634</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>4169</v>
+<v>4007</v>
 </b>
 <b>
 <a>4</a>
 <b>127</b>
-<v>3598</v>
+<v>3458</v>
 </b>
 </bs>
 </hist>
@@ -18238,22 +18228,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20033</v>
+<v>19256</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2540</v>
+<v>2442</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>2054</v>
+<v>1974</v>
 </b>
 <b>
 <a>21</a>
 <b>347</b>
-<v>1835</v>
+<v>1764</v>
 </b>
 </bs>
 </hist>
@@ -18269,22 +18259,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20033</v>
+<v>19256</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2540</v>
+<v>2442</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>2054</v>
+<v>1974</v>
 </b>
 <b>
 <a>21</a>
 <b>347</b>
-<v>1835</v>
+<v>1764</v>
 </b>
 </bs>
 </hist>
@@ -18294,15 +18284,15 @@
 </relation>
 <relation>
 <name>using_container</name>
-<cardinality>485187</cardinality>
+<cardinality>466360</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>8667</v>
+<v>8331</v>
 </e>
 <e>
 <k>child</k>
-<v>301029</v>
+<v>289348</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18316,47 +18306,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3379</v>
+<v>3248</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>559</v>
+<v>537</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>668</v>
+<v>642</v>
 </b>
 <b>
 <a>6</a>
 <b>15</b>
-<v>656</v>
+<v>630</v>
 </b>
 <b>
 <a>16</a>
 <b>31</b>
-<v>705</v>
+<v>677</v>
 </b>
 <b>
 <a>31</a>
 <b>143</b>
-<v>291</v>
+<v>280</v>
 </b>
 <b>
 <a>178</a>
 <b>179</b>
-<v>1397</v>
+<v>1343</v>
 </b>
 <b>
 <a>179</a>
 <b>182</b>
-<v>765</v>
+<v>736</v>
 </b>
 <b>
 <a>182</a>
 <b>501</b>
-<v>243</v>
+<v>233</v>
 </b>
 </bs>
 </hist>
@@ -18372,22 +18362,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>217478</v>
+<v>209039</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55773</v>
+<v>53609</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>22659</v>
+<v>21780</v>
 </b>
 <b>
 <a>6</a>
 <b>47</b>
-<v>5117</v>
+<v>4919</v>
 </b>
 </bs>
 </hist>
@@ -18397,23 +18387,23 @@
 </relation>
 <relation>
 <name>static_asserts</name>
-<cardinality>132358</cardinality>
+<cardinality>131017</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>132358</v>
+<v>131017</v>
 </e>
 <e>
 <k>condition</k>
-<v>132358</v>
+<v>131017</v>
 </e>
 <e>
 <k>message</k>
-<v>30094</v>
+<v>29789</v>
 </e>
 <e>
 <k>location</k>
-<v>16938</v>
+<v>16766</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18427,7 +18417,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18443,7 +18433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18459,7 +18449,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18475,7 +18465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18491,7 +18481,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18507,7 +18497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132358</v>
+<v>131017</v>
 </b>
 </bs>
 </hist>
@@ -18523,32 +18513,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22395</v>
+<v>22168</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>428</v>
+<v>424</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2867</v>
+<v>2837</v>
 </b>
 <b>
 <a>4</a>
 <b>11</b>
-<v>1463</v>
+<v>1448</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>2379</v>
+<v>2355</v>
 </b>
 <b>
 <a>17</a>
 <b>513</b>
-<v>560</v>
+<v>554</v>
 </b>
 </bs>
 </hist>
@@ -18564,32 +18554,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22395</v>
+<v>22168</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>428</v>
+<v>424</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2867</v>
+<v>2837</v>
 </b>
 <b>
 <a>4</a>
 <b>11</b>
-<v>1463</v>
+<v>1448</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>2379</v>
+<v>2355</v>
 </b>
 <b>
 <a>17</a>
 <b>513</b>
-<v>560</v>
+<v>554</v>
 </b>
 </bs>
 </hist>
@@ -18605,12 +18595,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27912</v>
+<v>27629</v>
 </b>
 <b>
 <a>2</a>
 <b>33</b>
-<v>2181</v>
+<v>2159</v>
 </b>
 </bs>
 </hist>
@@ -18626,32 +18616,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2939</v>
+<v>2909</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2801</v>
+<v>2772</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1344</v>
+<v>1330</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3776</v>
+<v>3738</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>177</v>
+<v>176</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2062</v>
+<v>2042</v>
 </b>
 <b>
 <a>16</a>
@@ -18661,12 +18651,12 @@
 <b>
 <a>17</a>
 <b>18</b>
-<v>3447</v>
+<v>3412</v>
 </b>
 <b>
 <a>19</a>
 <b>52</b>
-<v>349</v>
+<v>345</v>
 </b>
 </bs>
 </hist>
@@ -18682,32 +18672,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2939</v>
+<v>2909</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2801</v>
+<v>2772</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1344</v>
+<v>1330</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3776</v>
+<v>3738</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>177</v>
+<v>176</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2062</v>
+<v>2042</v>
 </b>
 <b>
 <a>16</a>
@@ -18717,12 +18707,12 @@
 <b>
 <a>17</a>
 <b>18</b>
-<v>3447</v>
+<v>3412</v>
 </b>
 <b>
 <a>19</a>
 <b>52</b>
-<v>349</v>
+<v>345</v>
 </b>
 </bs>
 </hist>
@@ -18738,22 +18728,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4475</v>
+<v>4429</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6063</v>
+<v>6002</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6208</v>
+<v>6145</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>191</v>
+<v>189</v>
 </b>
 </bs>
 </hist>
@@ -18763,23 +18753,23 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>4803552</cardinality>
+<cardinality>4749557</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4779409</v>
+<v>4724692</v>
 </e>
 <e>
 <k>function</k>
-<v>3118318</v>
+<v>3117564</v>
 </e>
 <e>
 <k>index</k>
-<v>389</v>
+<v>373</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1865866</v>
+<v>1906163</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18793,12 +18783,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4778668</v>
+<v>4723979</v>
 </b>
 <b>
 <a>2</a>
 <b>69</b>
-<v>741</v>
+<v>712</v>
 </b>
 </bs>
 </hist>
@@ -18814,7 +18804,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4779409</v>
+<v>4724692</v>
 </b>
 </bs>
 </hist>
@@ -18830,12 +18820,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4757747</v>
+<v>4702211</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>21662</v>
+<v>22481</v>
 </b>
 </bs>
 </hist>
@@ -18851,22 +18841,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2207692</v>
+<v>2232786</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>482853</v>
+<v>472740</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>264220</v>
+<v>254691</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>163552</v>
+<v>157346</v>
 </b>
 </bs>
 </hist>
@@ -18882,22 +18872,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2207692</v>
+<v>2232786</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>482853</v>
+<v>472740</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>264220</v>
+<v>254691</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>163552</v>
+<v>157346</v>
 </b>
 </bs>
 </hist>
@@ -18913,22 +18903,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2314438</v>
+<v>2335471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>493113</v>
+<v>480884</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>270978</v>
+<v>262941</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>39787</v>
+<v>38267</v>
 </b>
 </bs>
 </hist>
@@ -18944,57 +18934,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>15</a>
 <b>44</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>115</a>
 <b>191</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>263</a>
 <b>337</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>422</a>
 <b>615</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>883</a>
 <b>1209</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1659</a>
 <b>2596</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>4880</a>
-<b>13455</b>
-<v>24</v>
+<b>13467</b>
+<v>23</v>
 </b>
 <b>
-<a>35189</a>
-<b>74910</b>
-<v>24</v>
+<a>35263</a>
+<b>75722</b>
+<v>23</v>
 </b>
 <b>
-<a>256345</a>
-<b>256346</b>
-<v>12</v>
+<a>266636</a>
+<b>266637</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -19010,57 +19000,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>15</a>
 <b>44</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>115</a>
 <b>191</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>263</a>
 <b>337</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>422</a>
 <b>615</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>883</a>
 <b>1209</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1659</a>
 <b>2596</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>4880</a>
-<b>13455</b>
-<v>24</v>
+<b>13467</b>
+<v>23</v>
 </b>
 <b>
-<a>35189</a>
-<b>74910</b>
-<v>24</v>
+<a>35263</a>
+<b>75722</b>
+<v>23</v>
 </b>
 <b>
-<a>256516</a>
-<b>256517</b>
-<v>12</v>
+<a>266807</a>
+<b>266808</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -19076,57 +19066,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>8</a>
 <b>20</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>36</a>
 <b>40</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>42</a>
 <b>45</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>61</a>
 <b>105</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>173</a>
 <b>257</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>406</a>
 <b>661</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1178</a>
 <b>2710</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
-<a>7491</a>
-<b>16702</b>
-<v>24</v>
+<a>7492</a>
+<b>16795</b>
+<v>23</v>
 </b>
 <b>
-<a>135733</a>
-<b>135734</b>
-<v>12</v>
+<a>145286</a>
+<b>145287</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -19142,22 +19132,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1495095</v>
+<v>1547921</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>199608</v>
+<v>193171</v>
 </b>
 <b>
 <a>3</a>
-<b>13</b>
-<v>141671</v>
+<b>18</b>
+<v>144002</v>
 </b>
 <b>
-<a>13</a>
-<b>5275</b>
-<v>29491</v>
+<a>18</a>
+<b>5288</b>
+<v>21067</v>
 </b>
 </bs>
 </hist>
@@ -19173,22 +19163,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1517195</v>
+<v>1569164</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>187245</v>
+<v>181276</v>
 </b>
 <b>
 <a>3</a>
-<b>17</b>
-<v>140893</v>
+<b>25</b>
+<v>143324</v>
 </b>
 <b>
-<a>17</a>
-<b>4798</b>
-<v>20532</v>
+<a>25</a>
+<b>4811</b>
+<v>12397</v>
 </b>
 </bs>
 </hist>
@@ -19204,12 +19194,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1751170</v>
+<v>1795906</v>
 </b>
 <b>
 <a>2</a>
 <b>33</b>
-<v>114695</v>
+<v>110257</v>
 </b>
 </bs>
 </hist>
@@ -19219,15 +19209,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>161127</cardinality>
+<cardinality>159494</cardinality>
 <columnsizes>
 <e>
 <k>new</k>
-<v>126169</v>
+<v>124890</v>
 </e>
 <e>
 <k>old</k>
-<v>15666</v>
+<v>15507</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19241,12 +19231,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91218</v>
+<v>90293</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34944</v>
+<v>34590</v>
 </b>
 <b>
 <a>3</a>
@@ -19267,37 +19257,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8232</v>
+<v>8148</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2043</v>
+<v>2022</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>883</v>
+<v>874</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1278</v>
+<v>1265</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>1245</v>
+<v>1233</v>
 </b>
 <b>
 <a>10</a>
 <b>43</b>
-<v>1179</v>
+<v>1167</v>
 </b>
 <b>
 <a>44</a>
 <b>218</b>
-<v>804</v>
+<v>795</v>
 </b>
 </bs>
 </hist>
@@ -19307,19 +19297,19 @@
 </relation>
 <relation>
 <name>membervariables</name>
-<cardinality>329658</cardinality>
+<cardinality>325582</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>325099</v>
+<v>321201</v>
 </e>
 <e>
 <k>type_id</k>
-<v>145086</v>
+<v>139772</v>
 </e>
 <e>
 <k>name</k>
-<v>59068</v>
+<v>56776</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19333,12 +19323,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>320637</v>
+<v>316912</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4461</v>
+<v>4288</v>
 </b>
 </bs>
 </hist>
@@ -19354,7 +19344,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325099</v>
+<v>321201</v>
 </b>
 </bs>
 </hist>
@@ -19370,22 +19360,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118391</v>
+<v>113949</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13396</v>
+<v>12934</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>10989</v>
+<v>10656</v>
 </b>
 <b>
 <a>11</a>
-<b>1212</b>
-<v>2309</v>
+<b>1715</b>
+<v>2231</v>
 </b>
 </bs>
 </hist>
@@ -19401,17 +19391,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>125916</v>
+<v>121310</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9883</v>
+<v>9511</v>
 </b>
 <b>
 <a>3</a>
 <b>266</b>
-<v>9287</v>
+<v>8950</v>
 </b>
 </bs>
 </hist>
@@ -19427,32 +19417,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31217</v>
+<v>29971</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9056</v>
+<v>8705</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5944</v>
+<v>5725</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>4485</v>
+<v>4311</v>
 </b>
 <b>
 <a>6</a>
 <b>15</b>
-<v>4534</v>
+<v>4358</v>
 </b>
 <b>
 <a>15</a>
-<b>1317</b>
-<v>3829</v>
+<b>1953</b>
+<v>3704</v>
 </b>
 </bs>
 </hist>
@@ -19468,32 +19458,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38256</v>
+<v>36736</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7524</v>
+<v>7232</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4035</v>
+<v>3891</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4765</v>
+<v>4592</v>
 </b>
 <b>
 <a>7</a>
-<b>319</b>
-<v>4437</v>
+<b>291</b>
+<v>4264</v>
 </b>
 <b>
-<a>323</a>
+<a>318</a>
 <b>605</b>
-<v>48</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -19674,19 +19664,19 @@
 </relation>
 <relation>
 <name>localvariables</name>
-<cardinality>527180</cardinality>
+<cardinality>521836</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>527101</v>
+<v>521758</v>
 </e>
 <e>
 <k>type_id</k>
-<v>48087</v>
+<v>47599</v>
 </e>
 <e>
 <k>name</k>
-<v>76217</v>
+<v>75444</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19700,12 +19690,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>527022</v>
+<v>521680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79</v>
+<v>78</v>
 </b>
 </bs>
 </hist>
@@ -19721,7 +19711,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>527101</v>
+<v>521758</v>
 </b>
 </bs>
 </hist>
@@ -19737,32 +19727,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26759</v>
+<v>26487</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6841</v>
+<v>6772</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2893</v>
+<v>2864</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>4119</v>
+<v>4077</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>3862</v>
+<v>3823</v>
 </b>
 <b>
 <a>13</a>
 <b>4908</b>
-<v>3611</v>
+<v>3575</v>
 </b>
 </bs>
 </hist>
@@ -19778,22 +19768,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36072</v>
+<v>35706</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4969</v>
+<v>4919</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4323</v>
+<v>4279</v>
 </b>
 <b>
 <a>5</a>
 <b>1158</b>
-<v>2722</v>
+<v>2694</v>
 </b>
 </bs>
 </hist>
@@ -19809,32 +19799,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43526</v>
+<v>43085</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13096</v>
+<v>12963</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5140</v>
+<v>5088</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6821</v>
+<v>6752</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>5767</v>
+<v>5708</v>
 </b>
 <b>
 <a>31</a>
 <b>6112</b>
-<v>1865</v>
+<v>1846</v>
 </b>
 </bs>
 </hist>
@@ -19850,17 +19840,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64564</v>
+<v>63910</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6472</v>
+<v>6406</v>
 </b>
 <b>
 <a>3</a>
 <b>819</b>
-<v>5180</v>
+<v>5127</v>
 </b>
 </bs>
 </hist>
@@ -19870,11 +19860,11 @@
 </relation>
 <relation>
 <name>autoderivation</name>
-<cardinality>19759</cardinality>
+<cardinality>19559</cardinality>
 <columnsizes>
 <e>
 <k>var</k>
-<v>19759</v>
+<v>19559</v>
 </e>
 <e>
 <k>derivation_type</k>
@@ -19892,7 +19882,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19759</v>
+<v>19559</v>
 </b>
 </bs>
 </hist>
@@ -19938,31 +19928,31 @@
 </relation>
 <relation>
 <name>enumconstants</name>
-<cardinality>94487</cardinality>
+<cardinality>94097</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>94487</v>
+<v>94097</v>
 </e>
 <e>
 <k>parent</k>
-<v>7539</v>
+<v>8031</v>
 </e>
 <e>
 <k>index</k>
-<v>7678</v>
+<v>7600</v>
 </e>
 <e>
 <k>type_id</k>
-<v>7394</v>
+<v>7887</v>
 </e>
 <e>
 <k>name</k>
-<v>73851</v>
+<v>73102</v>
 </e>
 <e>
 <k>location</k>
-<v>76856</v>
+<v>76077</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19976,7 +19966,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94487</v>
+<v>94097</v>
 </b>
 </bs>
 </hist>
@@ -19992,7 +19982,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94487</v>
+<v>94097</v>
 </b>
 </bs>
 </hist>
@@ -20008,7 +19998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94487</v>
+<v>94097</v>
 </b>
 </bs>
 </hist>
@@ -20024,7 +20014,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94487</v>
+<v>94097</v>
 </b>
 </bs>
 </hist>
@@ -20040,7 +20030,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94487</v>
+<v>94097</v>
 </b>
 </bs>
 </hist>
@@ -20056,47 +20046,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>830</v>
+<v>822</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2484</v>
+<v>2459</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>586</v>
+<v>580</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>586</v>
+<v>580</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>540</v>
+<b>9</b>
+<v>730</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>659</v>
+<a>9</a>
+<b>16</b>
+<v>613</v>
 </b>
 <b>
-<a>13</a>
-<b>46</b>
-<v>573</v>
+<a>16</a>
+<b>392</b>
+<v>606</v>
 </b>
 <b>
-<a>46</a>
+<a>426</a>
 <b>1166</b>
-<v>237</v>
+<v>39</v>
 </b>
 </bs>
 </hist>
@@ -20112,47 +20102,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>843</v>
+<v>835</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2530</v>
+<v>2505</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>593</v>
+<v>587</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>527</v>
+<b>9</b>
+<v>704</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>632</v>
+<a>9</a>
+<b>17</b>
+<v>626</v>
 </b>
 <b>
-<a>13</a>
-<b>49</b>
-<v>566</v>
-</b>
-<b>
-<a>50</a>
+<a>17</a>
 <b>1166</b>
-<v>224</v>
+<v>600</v>
 </b>
 </bs>
 </hist>
@@ -20168,12 +20153,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6788</v>
+<v>7287</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>751</v>
+<v>743</v>
 </b>
 </bs>
 </hist>
@@ -20189,47 +20174,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>843</v>
+<v>835</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2530</v>
+<v>2505</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>593</v>
+<v>587</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>527</v>
+<b>9</b>
+<v>704</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>632</v>
+<a>9</a>
+<b>17</b>
+<v>626</v>
 </b>
 <b>
-<a>13</a>
-<b>49</b>
-<v>566</v>
-</b>
-<b>
-<a>50</a>
+<a>17</a>
 <b>1166</b>
-<v>224</v>
+<v>600</v>
 </b>
 </bs>
 </hist>
@@ -20245,47 +20225,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1080</v>
+<v>1637</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>843</v>
+<v>835</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2484</v>
+<v>2459</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>586</v>
+<v>580</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>566</v>
+<v>561</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>514</v>
+<b>9</b>
+<v>704</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>659</v>
+<a>9</a>
+<b>16</b>
+<v>613</v>
 </b>
 <b>
-<a>13</a>
-<b>46</b>
-<v>566</v>
+<a>16</a>
+<b>427</b>
+<v>606</v>
 </b>
 <b>
-<a>46</a>
+<a>466</a>
 <b>1166</b>
-<v>237</v>
+<v>32</v>
 </b>
 </bs>
 </hist>
@@ -20301,47 +20281,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2642</v>
+<v>2616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>935</v>
+<v>926</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>698</v>
+<v>691</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>355</v>
+<v>352</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>12</a>
 <b>30</b>
-<v>606</v>
+<v>600</v>
 </b>
 <b>
 <a>30</a>
-<b>1166</b>
-<v>355</v>
+<b>1253</b>
+<v>352</v>
 </b>
 </bs>
 </hist>
@@ -20357,47 +20337,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2642</v>
+<v>2616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>935</v>
+<v>926</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>685</v>
+<v>678</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>369</v>
+<v>365</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>12</a>
 <b>29</b>
-<v>606</v>
+<v>600</v>
 </b>
 <b>
 <a>29</a>
-<b>1145</b>
-<v>355</v>
+<b>1232</b>
+<v>352</v>
 </b>
 </bs>
 </hist>
@@ -20413,47 +20393,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2642</v>
+<v>2616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>935</v>
+<v>926</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>685</v>
+<v>678</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>369</v>
+<v>365</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>12</a>
 <b>28</b>
-<v>606</v>
+<v>600</v>
 </b>
 <b>
 <a>28</a>
-<b>1123</b>
-<v>355</v>
+<b>1210</b>
+<v>352</v>
 </b>
 </bs>
 </hist>
@@ -20469,47 +20449,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2642</v>
+<v>2616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>935</v>
+<v>926</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>698</v>
+<v>691</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>355</v>
+<v>352</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>12</a>
 <b>28</b>
-<v>606</v>
+<v>600</v>
 </b>
 <b>
 <a>28</a>
 <b>674</b>
-<v>355</v>
+<v>352</v>
 </b>
 </bs>
 </hist>
@@ -20525,47 +20505,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2642</v>
+<v>2616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>935</v>
+<v>926</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>579</v>
+<v>574</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>698</v>
+<v>691</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>355</v>
+<v>352</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>12</a>
 <b>28</b>
-<v>606</v>
+<v>600</v>
 </b>
 <b>
 <a>28</a>
 <b>774</b>
-<v>355</v>
+<v>352</v>
 </b>
 </bs>
 </hist>
@@ -20581,47 +20561,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>810</v>
+<v>802</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2458</v>
+<v>2433</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>566</v>
+<v>561</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>566</v>
+<v>561</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>520</v>
+<b>9</b>
+<v>704</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>639</v>
+<a>9</a>
+<b>16</b>
+<v>600</v>
 </b>
 <b>
-<a>13</a>
-<b>46</b>
-<v>560</v>
+<a>16</a>
+<b>470</b>
+<v>593</v>
 </b>
 <b>
-<a>46</a>
+<a>479</a>
 <b>1166</b>
-<v>230</v>
+<v>32</v>
 </b>
 </bs>
 </hist>
@@ -20637,7 +20617,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7388</v>
+<v>7881</v>
 </b>
 <b>
 <a>137</a>
@@ -20658,47 +20638,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>823</v>
+<v>815</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2504</v>
+<v>2479</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>573</v>
+<v>567</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>507</v>
+<b>9</b>
+<v>678</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>612</v>
+<a>9</a>
+<b>17</b>
+<v>613</v>
 </b>
 <b>
-<a>13</a>
-<b>51</b>
-<v>560</v>
-</b>
-<b>
-<a>52</a>
+<a>17</a>
 <b>1166</b>
-<v>210</v>
+<v>580</v>
 </b>
 </bs>
 </hist>
@@ -20714,47 +20689,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1041</v>
+<v>1598</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>823</v>
+<v>815</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2504</v>
+<v>2479</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>560</v>
+<v>554</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>573</v>
+<v>567</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>507</v>
+<b>9</b>
+<v>678</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>612</v>
+<a>9</a>
+<b>17</b>
+<v>613</v>
 </b>
 <b>
-<a>13</a>
-<b>51</b>
-<v>560</v>
-</b>
-<b>
-<a>52</a>
+<a>17</a>
 <b>1166</b>
-<v>210</v>
+<v>580</v>
 </b>
 </bs>
 </hist>
@@ -20770,47 +20740,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1080</v>
+<v>1637</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>823</v>
+<v>815</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2458</v>
+<v>2433</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>566</v>
+<v>561</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>547</v>
+<v>541</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>494</v>
+<b>9</b>
+<v>678</v>
 </b>
 <b>
-<a>8</a>
-<b>13</b>
-<v>639</v>
+<a>9</a>
+<b>16</b>
+<v>600</v>
 </b>
 <b>
-<a>13</a>
-<b>47</b>
-<v>560</v>
+<a>16</a>
+<b>470</b>
+<v>593</v>
 </b>
 <b>
-<a>48</a>
+<a>621</a>
 <b>1166</b>
-<v>224</v>
+<v>26</v>
 </b>
 </bs>
 </hist>
@@ -20826,17 +20796,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66396</v>
+<v>65723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6927</v>
+<v>6856</v>
 </b>
 <b>
 <a>3</a>
 <b>239</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -20852,17 +20822,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67049</v>
+<v>66369</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6274</v>
+<v>6210</v>
 </b>
 <b>
 <a>3</a>
 <b>239</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -20878,12 +20848,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68762</v>
+<v>68065</v>
 </b>
 <b>
 <a>2</a>
 <b>13</b>
-<v>5088</v>
+<v>5036</v>
 </b>
 </bs>
 </hist>
@@ -20899,17 +20869,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61941</v>
+<v>61313</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11382</v>
+<v>11267</v>
 </b>
 <b>
 <a>3</a>
 <b>239</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -20925,12 +20895,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71346</v>
+<v>70623</v>
 </b>
 <b>
 <a>2</a>
 <b>23</b>
-<v>2504</v>
+<v>2479</v>
 </b>
 </bs>
 </hist>
@@ -20946,12 +20916,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71531</v>
+<v>70773</v>
 </b>
 <b>
 <a>2</a>
 <b>229</b>
-<v>5325</v>
+<v>5304</v>
 </b>
 </bs>
 </hist>
@@ -20967,12 +20937,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71643</v>
+<v>70884</v>
 </b>
 <b>
 <a>2</a>
 <b>229</b>
-<v>5213</v>
+<v>5193</v>
 </b>
 </bs>
 </hist>
@@ -20988,12 +20958,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>73211</v>
+<v>72469</v>
 </b>
 <b>
 <a>2</a>
 <b>17</b>
-<v>3644</v>
+<v>3607</v>
 </b>
 </bs>
 </hist>
@@ -21009,17 +20979,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66535</v>
+<v>65828</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10090</v>
+<v>9994</v>
 </b>
 <b>
 <a>3</a>
 <b>229</b>
-<v>230</v>
+<v>254</v>
 </b>
 </bs>
 </hist>
@@ -21035,12 +21005,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76685</v>
+<v>75907</v>
 </b>
 <b>
 <a>2</a>
 <b>27</b>
-<v>171</v>
+<v>169</v>
 </b>
 </bs>
 </hist>
@@ -21050,31 +21020,31 @@
 </relation>
 <relation>
 <name>builtintypes</name>
-<cardinality>559</cardinality>
+<cardinality>537</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>559</v>
+<v>537</v>
 </e>
 <e>
 <k>name</k>
-<v>559</v>
+<v>537</v>
 </e>
 <e>
 <k>kind</k>
-<v>559</v>
+<v>537</v>
 </e>
 <e>
 <k>size</k>
-<v>85</v>
+<v>81</v>
 </e>
 <e>
 <k>sign</k>
-<v>36</v>
+<v>35</v>
 </e>
 <e>
 <k>alignment</k>
-<v>60</v>
+<v>58</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21088,7 +21058,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21104,7 +21074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21120,7 +21090,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21136,7 +21106,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21152,7 +21122,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21168,7 +21138,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21184,7 +21154,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21200,7 +21170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21216,7 +21186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21232,7 +21202,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21248,7 +21218,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21264,7 +21234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21280,7 +21250,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21296,7 +21266,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21312,7 +21282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>537</v>
 </b>
 </bs>
 </hist>
@@ -21328,37 +21298,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21374,37 +21344,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21420,37 +21390,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21466,12 +21436,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>60</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -21487,12 +21457,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -21508,17 +21478,17 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28</a>
 <b>29</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21534,17 +21504,17 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28</a>
 <b>29</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21560,17 +21530,17 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28</a>
 <b>29</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21586,12 +21556,12 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21607,7 +21577,7 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>36</v>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -21623,27 +21593,27 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21659,27 +21629,27 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21695,27 +21665,27 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21731,12 +21701,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -21752,7 +21722,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>60</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -21762,23 +21732,23 @@
 </relation>
 <relation>
 <name>derivedtypes</name>
-<cardinality>4572495</cardinality>
+<cardinality>4651908</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4572495</v>
+<v>4651908</v>
 </e>
 <e>
 <k>name</k>
-<v>2240442</v>
+<v>2328554</v>
 </e>
 <e>
 <k>kind</k>
-<v>97</v>
+<v>93</v>
 </e>
 <e>
 <k>type_id</k>
-<v>2743147</v>
+<v>2780308</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21792,7 +21762,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4572495</v>
+<v>4651908</v>
 </b>
 </bs>
 </hist>
@@ -21808,7 +21778,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4572495</v>
+<v>4651908</v>
 </b>
 </bs>
 </hist>
@@ -21824,7 +21794,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4572495</v>
+<v>4651908</v>
 </b>
 </bs>
 </hist>
@@ -21840,17 +21810,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1640327</v>
+<v>1709696</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>479376</v>
+<v>500222</v>
 </b>
 <b>
 <a>3</a>
-<b>42612</b>
-<v>120737</v>
+<b>43371</b>
+<v>118634</v>
 </b>
 </bs>
 </hist>
@@ -21866,12 +21836,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2240417</v>
+<v>2328530</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -21887,17 +21857,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1640607</v>
+<v>1709965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>479097</v>
+<v>499954</v>
 </b>
 <b>
 <a>3</a>
-<b>42594</b>
-<v>120737</v>
+<b>43353</b>
+<v>118634</v>
 </b>
 </bs>
 </hist>
@@ -21913,42 +21883,42 @@
 <b>
 <a>21</a>
 <b>22</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>61</a>
 <b>62</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2051</a>
 <b>2052</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>25122</a>
-<b>25123</b>
-<v>12</v>
+<a>27346</a>
+<b>27347</b>
+<v>11</v>
 </b>
 <b>
-<a>42664</a>
-<b>42665</b>
-<v>12</v>
+<a>43423</a>
+<b>43424</b>
+<v>11</v>
 </b>
 <b>
-<a>53936</a>
-<b>53937</b>
-<v>12</v>
+<a>58521</a>
+<b>58522</b>
+<v>11</v>
 </b>
 <b>
-<a>97759</a>
-<b>97760</b>
-<v>12</v>
+<a>102765</a>
+<b>102766</b>
+<v>11</v>
 </b>
 <b>
-<a>154522</a>
-<b>154523</b>
-<v>12</v>
+<a>163929</a>
+<b>163930</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -21964,42 +21934,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1152</a>
 <b>1153</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>13367</a>
-<b>13368</b>
-<v>12</v>
+<a>15027</a>
+<b>15028</b>
+<v>11</v>
 </b>
 <b>
-<a>36098</a>
-<b>36099</b>
-<v>12</v>
+<a>39331</a>
+<b>39332</b>
+<v>11</v>
 </b>
 <b>
-<a>50248</a>
-<b>50249</b>
-<v>12</v>
+<a>53789</a>
+<b>53790</b>
+<v>11</v>
 </b>
 <b>
-<a>83386</a>
-<b>83387</b>
-<v>12</v>
+<a>89933</a>
+<b>89934</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22015,42 +21985,42 @@
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>21</a>
 <b>22</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>969</a>
 <b>970</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>25122</a>
-<b>25123</b>
-<v>12</v>
+<a>27346</a>
+<b>27347</b>
+<v>11</v>
 </b>
 <b>
-<a>42664</a>
-<b>42665</b>
-<v>12</v>
+<a>43423</a>
+<b>43424</b>
+<v>11</v>
 </b>
 <b>
-<a>53936</a>
-<b>53937</b>
-<v>12</v>
+<a>58521</a>
+<b>58522</b>
+<v>11</v>
 </b>
 <b>
-<a>97431</a>
-<b>97432</b>
-<v>12</v>
+<a>102434</a>
+<b>102435</b>
+<v>11</v>
 </b>
 <b>
-<a>154522</a>
-<b>154523</b>
-<v>12</v>
+<a>163929</a>
+<b>163930</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22066,22 +22036,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1661856</v>
+<v>1683160</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>405550</v>
+<v>392781</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>615674</v>
+<v>646083</v>
 </b>
 <b>
 <a>4</a>
 <b>202</b>
-<v>60064</v>
+<v>58283</v>
 </b>
 </bs>
 </hist>
@@ -22097,22 +22067,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1663206</v>
+<v>1684457</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>405380</v>
+<v>392618</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>614495</v>
+<v>644949</v>
 </b>
 <b>
 <a>4</a>
 <b>198</b>
-<v>60064</v>
+<v>58283</v>
 </b>
 </bs>
 </hist>
@@ -22128,22 +22098,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1663534</v>
+<v>1684784</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>406814</v>
+<v>393985</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>614446</v>
+<v>644902</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>58350</v>
+<v>56635</v>
 </b>
 </bs>
 </hist>
@@ -22153,19 +22123,19 @@
 </relation>
 <relation>
 <name>pointerishsize</name>
-<cardinality>3358396</cardinality>
+<cardinality>3426426</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3358396</v>
+<v>3426426</v>
 </e>
 <e>
 <k>size</k>
-<v>24</v>
+<v>23</v>
 </e>
 <e>
 <k>alignment</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22179,7 +22149,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3358396</v>
+<v>3426426</v>
 </b>
 </bs>
 </hist>
@@ -22195,7 +22165,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3358396</v>
+<v>3426426</v>
 </b>
 </bs>
 </hist>
@@ -22211,12 +22181,12 @@
 <b>
 <a>21</a>
 <b>22</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>276244</a>
-<b>276245</b>
-<v>12</v>
+<a>293219</a>
+<b>293220</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22232,7 +22202,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -22246,9 +22216,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>276265</a>
-<b>276266</b>
-<v>12</v>
+<a>293240</a>
+<b>293241</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22264,7 +22234,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22274,23 +22244,23 @@
 </relation>
 <relation>
 <name>arraysizes</name>
-<cardinality>18830</cardinality>
+<cardinality>18099</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>18830</v>
+<v>18099</v>
 </e>
 <e>
 <k>num_elements</k>
-<v>2394</v>
+<v>2301</v>
 </e>
 <e>
 <k>bytesize</k>
-<v>2783</v>
+<v>2675</v>
 </e>
 <e>
 <k>alignment</k>
-<v>85</v>
+<v>81</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22304,7 +22274,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18830</v>
+<v>18099</v>
 </b>
 </bs>
 </hist>
@@ -22320,7 +22290,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18830</v>
+<v>18099</v>
 </b>
 </bs>
 </hist>
@@ -22336,7 +22306,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18830</v>
+<v>18099</v>
 </b>
 </bs>
 </hist>
@@ -22352,37 +22322,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1422</v>
+<v>1367</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>13</a>
 <b>25</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>38</a>
 <b>116</b>
-<v>158</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -22398,27 +22368,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1762</v>
+<v>1694</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>243</v>
+<v>233</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>72</v>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -22434,27 +22404,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1774</v>
+<v>1705</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>255</v>
+<v>245</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>158</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>182</v>
+<v>175</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -22470,42 +22440,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>170</v>
+<v>163</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1556</v>
+<v>1495</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>9</a>
 <b>17</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>17</a>
 <b>53</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>55</a>
 <b>75</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -22521,22 +22491,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2115</v>
+<v>2033</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>389</v>
+<v>373</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>243</v>
+<v>233</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>36</v>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -22552,22 +22522,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2176</v>
+<v>2091</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>303</v>
+<v>292</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>255</v>
+<v>245</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>48</v>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -22583,37 +22553,37 @@
 <b>
 <a>17</a>
 <b>18</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>18</a>
 <b>19</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>33</a>
 <b>34</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>50</a>
 <b>51</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>181</a>
 <b>182</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>389</a>
 <b>390</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>861</a>
 <b>862</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22629,37 +22599,37 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>39</a>
 <b>40</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>190</a>
 <b>191</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22675,37 +22645,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>41</a>
 <b>42</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>53</a>
 <b>54</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>191</a>
 <b>192</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -22715,15 +22685,15 @@
 </relation>
 <relation>
 <name>typedefbase</name>
-<cardinality>1919913</cardinality>
+<cardinality>1867884</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1919913</v>
+<v>1867884</v>
 </e>
 <e>
 <k>type_id</k>
-<v>899600</v>
+<v>871937</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22737,7 +22707,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1919913</v>
+<v>1867884</v>
 </b>
 </bs>
 </hist>
@@ -22753,22 +22723,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>698168</v>
+<v>676919</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93312</v>
+<v>90264</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>72975</v>
+<v>70856</v>
 </b>
 <b>
 <a>6</a>
-<b>5423</b>
-<v>35144</v>
+<b>5485</b>
+<v>33897</v>
 </b>
 </bs>
 </hist>
@@ -22778,23 +22748,23 @@
 </relation>
 <relation>
 <name>decltypes</name>
-<cardinality>45841</cardinality>
+<cardinality>44063</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>45841</v>
+<v>44063</v>
 </e>
 <e>
 <k>expr</k>
-<v>43325</v>
+<v>41644</v>
 </e>
 <e>
 <k>base_type</k>
-<v>6479</v>
+<v>6227</v>
 </e>
 <e>
 <k>parentheses_would_change_meaning</k>
-<v>24</v>
+<v>23</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22808,7 +22778,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45841</v>
+<v>44063</v>
 </b>
 </bs>
 </hist>
@@ -22824,7 +22794,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45841</v>
+<v>44063</v>
 </b>
 </bs>
 </hist>
@@ -22840,7 +22810,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45841</v>
+<v>44063</v>
 </b>
 </bs>
 </hist>
@@ -22856,12 +22826,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40809</v>
+<v>39225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2516</v>
+<v>2418</v>
 </b>
 </bs>
 </hist>
@@ -22877,12 +22847,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40809</v>
+<v>39225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2516</v>
+<v>2418</v>
 </b>
 </bs>
 </hist>
@@ -22898,7 +22868,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43325</v>
+<v>41644</v>
 </b>
 </bs>
 </hist>
@@ -22914,17 +22884,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3622</v>
+<v>3482</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2552</v>
+<v>2453</v>
 </b>
 <b>
 <a>3</a>
 <b>277</b>
-<v>303</v>
+<v>292</v>
 </b>
 </bs>
 </hist>
@@ -22940,22 +22910,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2540</v>
+<v>2442</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3282</v>
+<v>3154</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>522</v>
+<v>502</v>
 </b>
 <b>
 <a>13</a>
 <b>2445</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -22971,7 +22941,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6479</v>
+<v>6227</v>
 </b>
 </bs>
 </hist>
@@ -22987,12 +22957,12 @@
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1082</a>
 <b>1083</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23008,12 +22978,12 @@
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3556</a>
 <b>3557</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23029,12 +22999,12 @@
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>525</a>
 <b>526</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23044,19 +23014,19 @@
 </relation>
 <relation>
 <name>usertypes</name>
-<cardinality>4363319</cardinality>
+<cardinality>4337028</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4363319</v>
+<v>4337028</v>
 </e>
 <e>
 <k>name</k>
-<v>899429</v>
+<v>917472</v>
 </e>
 <e>
 <k>kind</k>
-<v>133</v>
+<v>128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23070,7 +23040,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4363319</v>
+<v>4337028</v>
 </b>
 </bs>
 </hist>
@@ -23086,7 +23056,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4363319</v>
+<v>4337028</v>
 </b>
 </bs>
 </hist>
@@ -23102,22 +23072,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>596127</v>
+<v>606962</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>199888</v>
+<v>203676</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>67589</v>
+<v>69886</v>
 </b>
 <b>
 <a>8</a>
-<b>31201</b>
-<v>35824</v>
+<b>32070</b>
+<v>36947</v>
 </b>
 </bs>
 </hist>
@@ -23133,12 +23103,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>842355</v>
+<v>861619</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>57074</v>
+<v>55852</v>
 </b>
 </bs>
 </hist>
@@ -23154,57 +23124,57 @@
 <b>
 <a>23</a>
 <b>24</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>372</a>
 <b>373</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>773</a>
 <b>774</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>1526</a>
-<b>1527</b>
-<v>12</v>
+<a>1856</a>
+<b>1857</b>
+<v>11</v>
 </b>
 <b>
-<a>4123</a>
-<b>4124</b>
-<v>12</v>
+<a>4195</a>
+<b>4196</b>
+<v>11</v>
 </b>
 <b>
 <a>14604</a>
 <b>14605</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>17528</a>
-<b>17529</b>
-<v>12</v>
+<a>17544</a>
+<b>17545</b>
+<v>11</v>
 </b>
 <b>
-<a>20287</a>
-<b>20288</b>
-<v>12</v>
+<a>20425</a>
+<b>20426</b>
+<v>11</v>
 </b>
 <b>
-<a>75247</a>
-<b>75248</b>
-<v>12</v>
+<a>75551</a>
+<b>75552</b>
+<v>11</v>
 </b>
 <b>
-<a>81118</a>
-<b>81119</b>
-<v>12</v>
+<a>90575</a>
+<b>90576</b>
+<v>11</v>
 </b>
 <b>
-<a>143330</a>
-<b>143331</b>
-<v>12</v>
+<a>145253</a>
+<b>145254</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23220,52 +23190,52 @@
 <b>
 <a>16</a>
 <b>17</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>404</a>
 <b>405</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>548</a>
 <b>549</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>776</a>
-<b>777</b>
-<v>12</v>
+<a>777</a>
+<b>778</b>
+<v>11</v>
 </b>
 <b>
-<a>2846</a>
-<b>2847</b>
-<v>12</v>
+<a>2848</a>
+<b>2849</b>
+<v>11</v>
 </b>
 <b>
 <a>4545</a>
 <b>4546</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>9121</a>
-<b>9122</b>
-<v>12</v>
+<a>9129</a>
+<b>9130</b>
+<v>11</v>
 </b>
 <b>
 <a>11659</a>
 <b>11660</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>49218</a>
-<b>49219</b>
-<v>12</v>
+<a>53824</a>
+<b>53825</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23275,19 +23245,19 @@
 </relation>
 <relation>
 <name>usertypesize</name>
-<cardinality>1364814</cardinality>
+<cardinality>1420908</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1364814</v>
+<v>1420908</v>
 </e>
 <e>
 <k>size</k>
-<v>1641</v>
+<v>1577</v>
 </e>
 <e>
 <k>alignment</k>
-<v>97</v>
+<v>93</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23301,7 +23271,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1364814</v>
+<v>1420908</v>
 </b>
 </bs>
 </hist>
@@ -23317,7 +23287,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1364814</v>
+<v>1420908</v>
 </b>
 </bs>
 </hist>
@@ -23333,52 +23303,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>474</v>
+<v>455</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>72</v>
+<v>70</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>109</v>
+<v>105</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>121</v>
+<v>116</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>109</v>
+<v>105</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>16</a>
 <b>36</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>37</a>
 <b>170</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>260</a>
-<b>86086</b>
-<v>133</v>
+<b>95028</b>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -23394,17 +23364,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1349</v>
+<v>1297</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>194</v>
+<v>186</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>97</v>
+<v>93</v>
 </b>
 </bs>
 </hist>
@@ -23420,42 +23390,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>50</a>
 <b>51</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>54</a>
 <b>55</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>1916</a>
-<b>1917</b>
-<v>12</v>
+<a>2246</a>
+<b>2247</b>
+<v>11</v>
 </b>
 <b>
-<a>9656</a>
-<b>9657</b>
-<v>12</v>
+<a>9717</a>
+<b>9718</b>
+<v>11</v>
 </b>
 <b>
-<a>100584</a>
-<b>100585</b>
-<v>12</v>
+<a>109526</a>
+<b>109527</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23471,37 +23441,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>25</a>
 <b>26</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>106</a>
 <b>107</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -23511,26 +23481,26 @@
 </relation>
 <relation>
 <name>usertype_final</name>
-<cardinality>1331</cardinality>
+<cardinality>1317</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1331</v>
+<v>1317</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>usertype_uuid</name>
-<cardinality>4897</cardinality>
+<cardinality>4847</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4897</v>
+<v>4847</v>
 </e>
 <e>
 <k>uuid</k>
-<v>4897</v>
+<v>4847</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23544,7 +23514,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4897</v>
+<v>4847</v>
 </b>
 </bs>
 </hist>
@@ -23560,7 +23530,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4897</v>
+<v>4847</v>
 </b>
 </bs>
 </hist>
@@ -23570,15 +23540,15 @@
 </relation>
 <relation>
 <name>mangled_name</name>
-<cardinality>4359684</cardinality>
+<cardinality>4333558</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4359684</v>
+<v>4333558</v>
 </e>
 <e>
 <k>mangled_name</k>
-<v>532986</v>
+<v>514256</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23592,7 +23562,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4359684</v>
+<v>4333558</v>
 </b>
 </bs>
 </hist>
@@ -23608,32 +23578,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325269</v>
+<v>310895</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>68246</v>
+<v>66497</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>35958</v>
+<v>35217</v>
 </b>
 <b>
 <a>4</a>
-<b>8</b>
-<v>45307</v>
+<b>7</b>
+<v>39225</v>
 </b>
 <b>
-<a>8</a>
-<b>34</b>
-<v>40237</v>
+<a>7</a>
+<b>23</b>
+<v>38664</v>
 </b>
 <b>
-<a>34</a>
-<b>8470</b>
-<v>17967</v>
+<a>23</a>
+<b>8589</b>
+<v>23755</v>
 </b>
 </bs>
 </hist>
@@ -23643,59 +23613,59 @@
 </relation>
 <relation>
 <name>is_pod_class</name>
-<cardinality>1041477</cardinality>
+<cardinality>1104649</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1041477</v>
+<v>1104649</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>is_standard_layout_class</name>
-<cardinality>1118962</cardinality>
+<cardinality>1180366</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118962</v>
+<v>1180366</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>is_complete</name>
-<cardinality>1345984</cardinality>
+<cardinality>1398952</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1345984</v>
+<v>1398952</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>is_class_template</name>
-<cardinality>246617</cardinality>
+<cardinality>238660</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>246617</v>
+<v>238660</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>class_instantiation</name>
-<cardinality>1108921</cardinality>
+<cardinality>1176522</cardinality>
 <columnsizes>
 <e>
 <k>to</k>
-<v>1107195</v>
+<v>1174863</v>
 </e>
 <e>
 <k>from</k>
-<v>72513</v>
+<v>72363</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23709,12 +23679,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1105566</v>
+<v>1173297</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1628</v>
+<v>1565</v>
 </b>
 </bs>
 </hist>
@@ -23730,47 +23700,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21601</v>
+<v>21289</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12897</v>
+<v>12771</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7488</v>
+<v>7314</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4789</v>
+<v>4942</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>5871</v>
+<v>5994</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>6503</v>
+<v>6438</v>
 </b>
 <b>
 <a>11</a>
 <b>20</b>
-<v>5555</v>
+<v>5585</v>
 </b>
 <b>
 <a>20</a>
-<b>89</b>
-<v>5470</v>
+<b>87</b>
+<v>5456</v>
 </b>
 <b>
-<a>89</a>
-<b>2079</b>
-<v>2334</v>
+<a>87</a>
+<b>3629</b>
+<v>2570</v>
 </b>
 </bs>
 </hist>
@@ -23780,19 +23750,19 @@
 </relation>
 <relation>
 <name>class_template_argument</name>
-<cardinality>2800063</cardinality>
+<cardinality>3135757</cardinality>
 <columnsizes>
 <e>
 <k>type_id</k>
-<v>1339675</v>
+<v>1428725</v>
 </e>
 <e>
 <k>index</k>
-<v>1361</v>
+<v>1308</v>
 </e>
 <e>
 <k>arg_type</k>
-<v>921287</v>
+<v>904899</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23806,27 +23776,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>593732</v>
+<v>586000</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>438105</v>
+<v>428957</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>175599</v>
+<v>258501</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>108629</v>
+<v>129501</v>
 </b>
 <b>
 <a>7</a>
 <b>113</b>
-<v>23607</v>
+<v>25764</v>
 </b>
 </bs>
 </hist>
@@ -23842,22 +23812,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>619710</v>
+<v>613658</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>445691</v>
+<v>442173</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>187999</v>
+<v>272382</v>
 </b>
 <b>
 <a>4</a>
 <b>113</b>
-<v>86274</v>
+<v>100511</v>
 </b>
 </bs>
 </hist>
@@ -23873,37 +23843,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>863</v>
+<v>829</v>
 </b>
 <b>
 <a>3</a>
 <b>26</b>
-<v>109</v>
+<v>105</v>
 </b>
 <b>
 <a>29</a>
 <b>64</b>
-<v>109</v>
+<v>105</v>
 </b>
 <b>
 <a>69</a>
-<b>427</b>
-<v>109</v>
+<b>435</b>
+<v>105</v>
 </b>
 <b>
-<a>594</a>
-<b>8438</b>
-<v>109</v>
+<a>616</a>
+<b>9263</b>
+<v>105</v>
 </b>
 <b>
-<a>11951</a>
-<b>101100</b>
-<v>48</v>
+<a>13601</a>
+<b>119714</b>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -23919,37 +23889,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>863</v>
+<v>829</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>121</v>
+<v>116</v>
 </b>
 <b>
 <a>14</a>
 <b>26</b>
-<v>109</v>
+<v>105</v>
 </b>
 <b>
 <a>29</a>
-<b>147</b>
-<v>109</v>
+<b>148</b>
+<v>105</v>
 </b>
 <b>
-<a>191</a>
-<b>3560</b>
-<v>109</v>
+<a>198</a>
+<b>3591</b>
+<v>105</v>
 </b>
 <b>
-<a>11321</a>
-<b>39550</b>
-<v>36</v>
+<a>11582</a>
+<b>41130</b>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -23965,22 +23935,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>571096</v>
+<v>550198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>205784</v>
+<v>200100</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>75369</v>
+<b>4</b>
+<v>54918</v>
 </b>
 <b>
-<a>5</a>
-<b>5259</b>
-<v>69036</v>
+<a>4</a>
+<b>10</b>
+<v>70727</v>
+</b>
+<b>
+<a>10</a>
+<b>11421</b>
+<v>28954</v>
 </b>
 </bs>
 </hist>
@@ -23996,17 +23971,253 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805922</v>
+<v>786767</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96011</v>
+<v>98069</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>19353</v>
+<v>20062</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>class_template_argument_value</name>
+<cardinality>362635</cardinality>
+<columnsizes>
+<e>
+<k>type_id</k>
+<v>233565</v>
+</e>
+<e>
+<k>index</k>
+<v>163</v>
+</e>
+<e>
+<k>arg_value</k>
+<v>345447</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>type_id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>209845</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14512</v>
+</b>
+<b>
+<a>3</a>
+<b>14</b>
+<v>9207</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>197436</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17971</v>
+</b>
+<b>
+<a>3</a>
+<b>22</b>
+<v>17527</v>
+</b>
+<b>
+<a>24</a>
+<b>173</b>
+<v>630</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>8</a>
+<b>9</b>
+<v>58</v>
+</b>
+<b>
+<a>20</a>
+<b>21</b>
+<v>11</v>
+</b>
+<b>
+<a>25</a>
+<b>26</b>
+<v>11</v>
+</b>
+<b>
+<a>206</a>
+<b>207</b>
+<v>11</v>
+</b>
+<b>
+<a>389</a>
+<b>390</b>
+<v>11</v>
+</b>
+<b>
+<a>552</a>
+<b>553</b>
+<v>11</v>
+</b>
+<b>
+<a>1312</a>
+<b>1313</b>
+<v>11</v>
+</b>
+<b>
+<a>5393</a>
+<b>5394</b>
+<v>11</v>
+</b>
+<b>
+<a>5423</a>
+<b>5424</b>
+<v>11</v>
+</b>
+<b>
+<a>9668</a>
+<b>9669</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>8</a>
+<b>9</b>
+<v>58</v>
+</b>
+<b>
+<a>20</a>
+<b>21</b>
+<v>11</v>
+</b>
+<b>
+<a>42</a>
+<b>43</b>
+<v>11</v>
+</b>
+<b>
+<a>311</a>
+<b>312</b>
+<v>11</v>
+</b>
+<b>
+<a>514</a>
+<b>515</b>
+<v>11</v>
+</b>
+<b>
+<a>715</a>
+<b>716</b>
+<v>11</v>
+</b>
+<b>
+<a>1585</a>
+<b>1586</b>
+<v>11</v>
+</b>
+<b>
+<a>6302</a>
+<b>6303</b>
+<v>11</v>
+</b>
+<b>
+<a>8160</a>
+<b>8161</b>
+<v>11</v>
+</b>
+<b>
+<a>11875</a>
+<b>11876</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>328387</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>17059</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>345447</v>
 </b>
 </bs>
 </hist>
@@ -24016,15 +24227,15 @@
 </relation>
 <relation>
 <name>is_proxy_class_for</name>
-<cardinality>50120</cardinality>
+<cardinality>49017</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>50120</v>
+<v>49017</v>
 </e>
 <e>
 <k>templ_param_id</k>
-<v>50120</v>
+<v>49017</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24038,7 +24249,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50120</v>
+<v>49017</v>
 </b>
 </bs>
 </hist>
@@ -24054,7 +24265,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50120</v>
+<v>49017</v>
 </b>
 </bs>
 </hist>
@@ -24064,19 +24275,19 @@
 </relation>
 <relation>
 <name>type_mentions</name>
-<cardinality>1699359</cardinality>
+<cardinality>1682135</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1699359</v>
+<v>1682135</v>
 </e>
 <e>
 <k>type_id</k>
-<v>68077</v>
+<v>67387</v>
 </e>
 <e>
 <k>location</k>
-<v>1668455</v>
+<v>1651543</v>
 </e>
 <e>
 <k>kind</k>
@@ -24094,7 +24305,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1699359</v>
+<v>1682135</v>
 </b>
 </bs>
 </hist>
@@ -24110,7 +24321,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1699359</v>
+<v>1682135</v>
 </b>
 </bs>
 </hist>
@@ -24126,7 +24337,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1699359</v>
+<v>1682135</v>
 </b>
 </bs>
 </hist>
@@ -24142,37 +24353,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30463</v>
+<v>30154</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12463</v>
+<v>12337</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3684</v>
+<v>3646</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6142</v>
+<v>6080</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>5213</v>
+<v>5160</v>
 </b>
 <b>
 <a>13</a>
 <b>35</b>
-<v>5259</v>
+<v>5206</v>
 </b>
 <b>
 <a>35</a>
 <b>9490</b>
-<v>4850</v>
+<v>4801</v>
 </b>
 </bs>
 </hist>
@@ -24188,37 +24399,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30463</v>
+<v>30154</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12463</v>
+<v>12337</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3684</v>
+<v>3646</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6142</v>
+<v>6080</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>5213</v>
+<v>5160</v>
 </b>
 <b>
 <a>13</a>
 <b>35</b>
-<v>5259</v>
+<v>5206</v>
 </b>
 <b>
 <a>35</a>
 <b>9490</b>
-<v>4850</v>
+<v>4801</v>
 </b>
 </bs>
 </hist>
@@ -24234,12 +24445,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66818</v>
+<v>66141</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1258</v>
+<v>1246</v>
 </b>
 </bs>
 </hist>
@@ -24255,12 +24466,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1637892</v>
+<v>1621291</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>30562</v>
+<v>30252</v>
 </b>
 </bs>
 </hist>
@@ -24276,12 +24487,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1637892</v>
+<v>1621291</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>30562</v>
+<v>30252</v>
 </b>
 </bs>
 </hist>
@@ -24297,7 +24508,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1668455</v>
+<v>1651543</v>
 </b>
 </bs>
 </hist>
@@ -24370,26 +24581,26 @@
 </relation>
 <relation>
 <name>is_function_template</name>
-<cardinality>1058083</cardinality>
+<cardinality>1023581</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1058083</v>
+<v>1023581</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>function_instantiation</name>
-<cardinality>739463</cardinality>
+<cardinality>719194</cardinality>
 <columnsizes>
 <e>
 <k>to</k>
-<v>739463</v>
+<v>719194</v>
 </e>
 <e>
 <k>from</k>
-<v>136103</v>
+<v>134923</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24403,7 +24614,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>739463</v>
+<v>719194</v>
 </b>
 </bs>
 </hist>
@@ -24419,37 +24630,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63018</v>
+<v>64125</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32396</v>
+<v>31385</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8193</v>
+<v>7898</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>9299</v>
+<b>6</b>
+<v>12467</v>
 </b>
 <b>
-<a>5</a>
-<b>10</b>
-<v>10940</v>
+<a>6</a>
+<b>15</b>
+<v>10434</v>
 </b>
 <b>
-<a>10</a>
-<b>57</b>
-<v>10223</v>
-</b>
-<b>
-<a>58</a>
+<a>15</a>
 <b>645</b>
-<v>2030</v>
+<v>8611</v>
 </b>
 </bs>
 </hist>
@@ -24459,19 +24665,19 @@
 </relation>
 <relation>
 <name>function_template_argument</name>
-<cardinality>1910796</cardinality>
+<cardinality>1981225</cardinality>
 <columnsizes>
 <e>
 <k>function_id</k>
-<v>1112422</v>
+<v>1088560</v>
 </e>
 <e>
 <k>index</k>
-<v>243</v>
+<v>233</v>
 </e>
 <e>
 <k>arg_type</k>
-<v>369847</v>
+<v>359386</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24485,22 +24691,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>634796</v>
+<v>600045</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>361033</v>
+<v>302330</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>84645</v>
+<b>4</b>
+<v>131242</v>
 </b>
 <b>
-<a>5</a>
+<a>4</a>
 <b>21</b>
-<v>31947</v>
+<v>54941</v>
 </b>
 </bs>
 </hist>
@@ -24516,22 +24722,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>657966</v>
+<v>618530</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>332393</v>
+<v>293520</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>90905</v>
+<b>4</b>
+<v>116683</v>
 </b>
 <b>
-<a>5</a>
+<a>4</a>
 <b>21</b>
-<v>31156</v>
+<v>59825</v>
 </b>
 </bs>
 </hist>
@@ -24547,102 +24753,102 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>39</a>
 <b>40</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>65</a>
 <b>66</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>152</a>
 <b>153</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>238</a>
-<b>239</b>
-<v>12</v>
+<a>241</a>
+<b>242</b>
+<v>11</v>
 </b>
 <b>
-<a>325</a>
-<b>326</b>
-<v>12</v>
+<a>328</a>
+<b>329</b>
+<v>11</v>
 </b>
 <b>
-<a>422</a>
-<b>423</b>
-<v>12</v>
+<a>425</a>
+<b>426</b>
+<v>11</v>
 </b>
 <b>
-<a>520</a>
-<b>521</b>
-<v>12</v>
+<a>523</a>
+<b>524</b>
+<v>11</v>
 </b>
 <b>
-<a>754</a>
-<b>755</b>
-<v>12</v>
+<a>758</a>
+<b>759</b>
+<v>11</v>
 </b>
 <b>
-<a>1007</a>
-<b>1008</b>
-<v>12</v>
+<a>1011</a>
+<b>1012</b>
+<v>11</v>
 </b>
 <b>
-<a>1259</a>
-<b>1260</b>
-<v>12</v>
+<a>1520</a>
+<b>1521</b>
+<v>11</v>
 </b>
 <b>
-<a>1514</a>
-<b>1515</b>
-<v>12</v>
+<a>1701</a>
+<b>1702</b>
+<v>11</v>
 </b>
 <b>
-<a>2559</a>
-<b>2560</b>
-<v>12</v>
+<a>2566</a>
+<b>2567</b>
+<v>11</v>
 </b>
 <b>
-<a>2804</a>
-<b>2805</b>
-<v>12</v>
+<a>2917</a>
+<b>2918</b>
+<v>11</v>
 </b>
 <b>
-<a>4818</a>
-<b>4819</b>
-<v>12</v>
+<a>5686</a>
+<b>5687</b>
+<v>11</v>
 </b>
 <b>
-<a>13309</a>
-<b>13310</b>
-<v>12</v>
+<a>17602</a>
+<b>17603</b>
+<v>11</v>
 </b>
 <b>
-<a>40569</a>
-<b>40570</b>
-<v>12</v>
+<a>42858</a>
+<b>42859</b>
+<v>11</v>
 </b>
 <b>
-<a>84931</a>
-<b>84932</b>
-<v>12</v>
+<a>88286</a>
+<b>88287</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -24658,102 +24864,102 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>22</a>
 <b>23</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>32</a>
 <b>33</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>54</a>
 <b>55</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>57</a>
-<b>58</b>
-<v>12</v>
+<a>60</a>
+<b>61</b>
+<v>11</v>
 </b>
 <b>
-<a>61</a>
-<b>62</b>
-<v>12</v>
+<a>62</a>
+<b>63</b>
+<v>11</v>
 </b>
 <b>
-<a>75</a>
-<b>76</b>
-<v>12</v>
+<a>78</a>
+<b>79</b>
+<v>11</v>
 </b>
 <b>
-<a>90</a>
-<b>91</b>
-<v>12</v>
+<a>91</a>
+<b>92</b>
+<v>11</v>
 </b>
 <b>
-<a>137</a>
-<b>138</b>
-<v>12</v>
+<a>140</a>
+<b>141</b>
+<v>11</v>
 </b>
 <b>
 <a>214</a>
 <b>215</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>238</a>
-<b>239</b>
-<v>12</v>
+<a>242</a>
+<b>243</b>
+<v>11</v>
 </b>
 <b>
-<a>316</a>
-<b>317</b>
-<v>12</v>
+<a>317</a>
+<b>318</b>
+<v>11</v>
 </b>
 <b>
-<a>517</a>
-<b>518</b>
-<v>12</v>
+<a>521</a>
+<b>522</b>
+<v>11</v>
 </b>
 <b>
-<a>695</a>
-<b>696</b>
-<v>12</v>
+<a>700</a>
+<b>701</b>
+<v>11</v>
 </b>
 <b>
-<a>1468</a>
-<b>1469</b>
-<v>12</v>
+<a>1491</a>
+<b>1492</b>
+<v>11</v>
 </b>
 <b>
-<a>3652</a>
-<b>3653</b>
-<v>12</v>
+<a>3698</a>
+<b>3699</b>
+<v>11</v>
 </b>
 <b>
-<a>8773</a>
-<b>8774</b>
-<v>12</v>
+<a>8798</a>
+<b>8799</b>
+<v>11</v>
 </b>
 <b>
-<a>17388</a>
-<b>17389</b>
-<v>12</v>
+<a>17653</a>
+<b>17654</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -24769,27 +24975,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>249547</v>
+<v>242738</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48698</v>
+<v>46902</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>29783</v>
+<v>28756</v>
 </b>
 <b>
 <a>6</a>
-<b>19</b>
-<v>27996</v>
+<b>20</b>
+<v>27704</v>
 </b>
 <b>
-<a>19</a>
-<b>906</b>
-<v>13821</v>
+<a>20</a>
+<b>1989</b>
+<v>13285</v>
 </b>
 </bs>
 </hist>
@@ -24805,17 +25011,238 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341230</v>
+<v>331740</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28129</v>
+<v>27131</v>
 </b>
 <b>
 <a>5</a>
-<b>10</b>
-<v>486</v>
+<b>12</b>
+<v>514</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>function_template_argument_value</name>
+<cardinality>209892</cardinality>
+<columnsizes>
+<e>
+<k>function_id</k>
+<v>113037</v>
+</e>
+<e>
+<k>index</k>
+<v>163</v>
+</e>
+<e>
+<k>arg_value</k>
+<v>181755</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>function_id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>107207</v>
+</b>
+<b>
+<a>2</a>
+<b>14</b>
+<v>5830</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>function_id</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>89610</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17106</v>
+</b>
+<b>
+<a>3</a>
+<b>113</b>
+<v>6321</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>function_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>70</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>11</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>11</v>
+</b>
+<b>
+<a>111</a>
+<b>112</b>
+<v>11</v>
+</b>
+<b>
+<a>441</a>
+<b>442</b>
+<v>11</v>
+</b>
+<b>
+<a>857</a>
+<b>858</b>
+<v>11</v>
+</b>
+<b>
+<a>2136</a>
+<b>2137</b>
+<v>11</v>
+</b>
+<b>
+<a>2428</a>
+<b>2429</b>
+<v>11</v>
+</b>
+<b>
+<a>4217</a>
+<b>4218</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>5</a>
+<b>6</b>
+<v>70</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>11</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>11</v>
+</b>
+<b>
+<a>157</a>
+<b>158</b>
+<v>11</v>
+</b>
+<b>
+<a>405</a>
+<b>406</b>
+<v>11</v>
+</b>
+<b>
+<a>973</a>
+<b>974</b>
+<v>11</v>
+</b>
+<b>
+<a>2523</a>
+<b>2524</b>
+<v>11</v>
+</b>
+<b>
+<a>4848</a>
+<b>4849</b>
+<v>11</v>
+</b>
+<b>
+<a>6604</a>
+<b>6605</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>function_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>153712</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>27949</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>93</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>181755</v>
 </b>
 </bs>
 </hist>
@@ -24825,26 +25252,26 @@
 </relation>
 <relation>
 <name>is_variable_template</name>
-<cardinality>19778</cardinality>
+<cardinality>19011</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19778</v>
+<v>19011</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>variable_instantiation</name>
-<cardinality>31837</cardinality>
+<cardinality>38057</cardinality>
 <columnsizes>
 <e>
 <k>to</k>
-<v>31837</v>
+<v>38057</v>
 </e>
 <e>
 <k>from</k>
-<v>6734</v>
+<v>6929</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24858,7 +25285,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31837</v>
+<v>38057</v>
 </b>
 </bs>
 </hist>
@@ -24874,37 +25301,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2382</v>
+<v>2383</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2030</v>
+<v>2033</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>449</v>
+<v>432</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>692</v>
+<v>782</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>534</v>
+<v>560</v>
 </b>
 <b>
 <a>9</a>
-<b>29</b>
-<v>534</v>
+<b>21</b>
+<v>525</v>
 </b>
 <b>
-<a>42</a>
-<b>214</b>
-<v>109</v>
+<a>24</a>
+<b>286</b>
+<v>210</v>
 </b>
 </bs>
 </hist>
@@ -24914,11 +25341,11 @@
 </relation>
 <relation>
 <name>variable_template_argument</name>
-<cardinality>5529</cardinality>
+<cardinality>5499</cardinality>
 <columnsizes>
 <e>
 <k>variable_id</k>
-<v>843</v>
+<v>848</v>
 </e>
 <e>
 <k>index</k>
@@ -24926,7 +25353,7 @@
 </e>
 <e>
 <k>arg_type</k>
-<v>4257</v>
+<v>4214</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24940,12 +25367,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>692</v>
+<v>685</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>112</v>
+<v>123</v>
 </b>
 <b>
 <a>3</a>
@@ -24966,12 +25393,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>369</v>
+<v>371</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>125</v>
+<v>130</v>
 </b>
 <b>
 <a>3</a>
@@ -24981,12 +25408,12 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>72</v>
+<v>71</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>72</v>
+<v>71</v>
 </b>
 <b>
 <a>8</a>
@@ -25025,13 +25452,13 @@
 <v>6</v>
 </b>
 <b>
-<a>9</a>
-<b>10</b>
+<a>10</a>
+<b>11</b>
 <v>6</v>
 </b>
 <b>
-<a>17</a>
-<b>18</b>
+<a>20</a>
+<b>21</b>
 <v>6</v>
 </b>
 <b>
@@ -25066,8 +25493,8 @@
 <v>6</v>
 </b>
 <b>
-<a>137</a>
-<b>138</b>
+<a>139</a>
+<b>140</b>
 <v>6</v>
 </b>
 <b>
@@ -25089,17 +25516,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3532</v>
+<v>3490</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>481</v>
+<v>476</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>243</v>
+<v>247</v>
 </b>
 </bs>
 </hist>
@@ -25115,12 +25542,148 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4046</v>
+<v>3999</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>215</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>variable_template_argument_value</name>
+<cardinality>137</cardinality>
+<columnsizes>
+<e>
+<k>variable_id</k>
+<v>19</v>
+</e>
+<e>
+<k>index</k>
+<v>13</v>
+</e>
+<e>
+<k>arg_value</k>
+<v>137</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>variable_id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>13</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>210</v>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>variable_id</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>13</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>variable_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>arg_value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>6</a>
+<b>7</b>
+<v>6</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>variable_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>137</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>arg_value</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>137</v>
 </b>
 </bs>
 </hist>
@@ -25130,15 +25693,15 @@
 </relation>
 <relation>
 <name>routinetypes</name>
-<cardinality>444572</cardinality>
+<cardinality>436132</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>444572</v>
+<v>436132</v>
 </e>
 <e>
 <k>return_type</k>
-<v>184814</v>
+<v>178086</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25152,7 +25715,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444572</v>
+<v>436132</v>
 </b>
 </bs>
 </hist>
@@ -25168,22 +25731,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>148344</v>
+<v>142985</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21030</v>
+<v>20191</v>
 </b>
 <b>
 <a>3</a>
-<b>18</b>
-<v>13943</v>
+<b>17</b>
+<v>13367</v>
 </b>
 <b>
-<a>18</a>
-<b>7709</b>
-<v>1495</v>
+<a>17</a>
+<b>8001</b>
+<v>1542</v>
 </b>
 </bs>
 </hist>
@@ -25193,19 +25756,19 @@
 </relation>
 <relation>
 <name>routinetypeargs</name>
-<cardinality>741201</cardinality>
+<cardinality>726544</cardinality>
 <columnsizes>
 <e>
 <k>routine</k>
-<v>362760</v>
+<v>357377</v>
 </e>
 <e>
 <k>index</k>
-<v>389</v>
+<v>373</v>
 </e>
 <e>
 <k>type_id</k>
-<v>209394</v>
+<v>208724</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25219,27 +25782,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>169412</v>
+<v>166448</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>95355</v>
+<v>96574</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>58144</v>
+<v>55888</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>31351</v>
+<v>30298</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>8497</v>
+<v>8167</v>
 </b>
 </bs>
 </hist>
@@ -25255,22 +25818,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194831</v>
+<v>190916</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>95853</v>
+<v>97018</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49707</v>
+<v>47778</v>
 </b>
 <b>
 <a>4</a>
 <b>22</b>
-<v>22367</v>
+<v>21663</v>
 </b>
 </bs>
 </hist>
@@ -25286,62 +25849,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>10</a>
 <b>16</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>19</a>
 <b>33</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>52</a>
 <b>74</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>93</a>
 <b>115</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>139</a>
 <b>199</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>269</a>
 <b>364</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>473</a>
 <b>700</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>1319</a>
-<b>3279</b>
-<v>24</v>
+<b>3293</b>
+<v>23</v>
 </b>
 <b>
-<a>8061</a>
-<b>15906</b>
-<v>24</v>
+<a>8075</a>
+<b>16341</b>
+<v>23</v>
 </b>
 <b>
-<a>29841</a>
-<b>29842</b>
-<v>12</v>
+<a>30585</a>
+<b>30586</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -25357,62 +25920,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>33</a>
 <b>37</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>38</a>
 <b>42</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>44</a>
 <b>83</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>124</a>
 <b>183</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>248</a>
 <b>346</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>463</a>
 <b>950</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
-<a>2463</a>
-<b>5546</b>
-<v>24</v>
+<a>2464</a>
+<b>5642</b>
+<v>23</v>
 </b>
 <b>
-<a>12306</a>
-<b>12307</b>
-<v>12</v>
+<a>12850</a>
+<b>12851</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -25428,27 +25991,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>123691</v>
+<v>124231</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40869</v>
+<v>41258</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13505</v>
+<v>13016</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>17942</v>
+<v>17293</v>
 </b>
 <b>
 <a>7</a>
-<b>1097</b>
-<v>13384</v>
+<b>1099</b>
+<v>12923</v>
 </b>
 </bs>
 </hist>
@@ -25464,17 +26027,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156830</v>
+<v>158176</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41161</v>
+<v>39576</v>
 </b>
 <b>
 <a>3</a>
 <b>33</b>
-<v>11402</v>
+<v>10971</v>
 </b>
 </bs>
 </hist>
@@ -25484,19 +26047,19 @@
 </relation>
 <relation>
 <name>ptrtomembers</name>
-<cardinality>12180</cardinality>
+<cardinality>13227</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12180</v>
+<v>13227</v>
 </e>
 <e>
 <k>type_id</k>
-<v>10247</v>
+<v>10013</v>
 </e>
 <e>
 <k>class_id</k>
-<v>5519</v>
+<v>6601</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25510,7 +26073,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12180</v>
+<v>13227</v>
 </b>
 </bs>
 </hist>
@@ -25526,7 +26089,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12180</v>
+<v>13227</v>
 </b>
 </bs>
 </hist>
@@ -25542,12 +26105,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9895</v>
+<v>9628</v>
 </b>
 <b>
 <a>2</a>
-<b>65</b>
-<v>352</v>
+<b>100</b>
+<v>385</v>
 </b>
 </bs>
 </hist>
@@ -25563,12 +26126,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9895</v>
+<v>9628</v>
 </b>
 <b>
 <a>2</a>
-<b>65</b>
-<v>352</v>
+<b>100</b>
+<v>385</v>
 </b>
 </bs>
 </hist>
@@ -25584,22 +26147,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4619</v>
+<v>5573</v>
 </b>
 <b>
 <a>2</a>
-<b>7</b>
-<v>352</v>
+<b>3</b>
+<v>490</v>
 </b>
 <b>
 <a>8</a>
-<b>9</b>
-<v>461</v>
+<b>17</b>
+<v>502</v>
 </b>
 <b>
-<a>16</a>
+<a>64</a>
 <b>65</b>
-<v>85</v>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -25615,22 +26178,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4619</v>
+<v>5573</v>
 </b>
 <b>
 <a>2</a>
-<b>7</b>
-<v>352</v>
+<b>3</b>
+<v>490</v>
 </b>
 <b>
 <a>8</a>
-<b>9</b>
-<v>461</v>
+<b>17</b>
+<v>502</v>
 </b>
 <b>
-<a>16</a>
+<a>64</a>
 <b>65</b>
-<v>85</v>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -25640,15 +26203,15 @@
 </relation>
 <relation>
 <name>specifiers</name>
-<cardinality>547</cardinality>
+<cardinality>525</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>547</v>
+<v>525</v>
 </e>
 <e>
 <k>str</k>
-<v>547</v>
+<v>525</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25662,7 +26225,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>547</v>
+<v>525</v>
 </b>
 </bs>
 </hist>
@@ -25678,7 +26241,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>547</v>
+<v>525</v>
 </b>
 </bs>
 </hist>
@@ -25688,15 +26251,15 @@
 </relation>
 <relation>
 <name>typespecifiers</name>
-<cardinality>1464874</cardinality>
+<cardinality>1479986</cardinality>
 <columnsizes>
 <e>
 <k>type_id</k>
-<v>1460193</v>
+<v>1472695</v>
 </e>
 <e>
 <k>spec_id</k>
-<v>85</v>
+<v>81</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25710,12 +26273,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1455513</v>
+<v>1465403</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4680</v>
+<v>7291</v>
 </b>
 </bs>
 </hist>
@@ -25731,37 +26294,37 @@
 <b>
 <a>102</a>
 <b>103</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>518</a>
 <b>519</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>718</a>
-<b>719</b>
-<v>12</v>
+<a>957</a>
+<b>958</b>
+<v>11</v>
 </b>
 <b>
 <a>2323</a>
 <b>2324</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>19328</a>
-<b>19329</b>
-<v>12</v>
+<a>20241</a>
+<b>20242</b>
+<v>11</v>
 </b>
 <b>
-<a>97291</a>
-<b>97292</b>
-<v>12</v>
+<a>102297</a>
+<b>102298</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -25771,15 +26334,15 @@
 </relation>
 <relation>
 <name>funspecifiers</name>
-<cardinality>11370456</cardinality>
+<cardinality>11412148</cardinality>
 <columnsizes>
 <e>
 <k>func_id</k>
-<v>3511992</v>
+<v>3500391</v>
 </e>
 <e>
 <k>spec_id</k>
-<v>194</v>
+<v>186</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25793,27 +26356,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>342616</v>
+<v>329999</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>464083</v>
+<v>448167</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>909155</v>
+<v>883458</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1670402</v>
+<v>1717910</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>125733</v>
+<v>120855</v>
 </b>
 </bs>
 </hist>
@@ -25829,82 +26392,82 @@
 <b>
 <a>22</a>
 <b>23</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>169</a>
 <b>170</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>491</a>
 <b>492</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>506</a>
-<b>507</b>
-<v>12</v>
+<a>598</a>
+<b>599</b>
+<v>11</v>
 </b>
 <b>
 <a>632</a>
 <b>633</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5650</a>
 <b>5651</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>9530</a>
 <b>9531</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10451</a>
 <b>10452</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>11821</a>
-<b>11822</b>
-<v>12</v>
+<a>11834</a>
+<b>11835</b>
+<v>11</v>
 </b>
 <b>
 <a>14848</a>
 <b>14849</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>25330</a>
-<b>25331</b>
-<v>12</v>
+<a>26196</a>
+<b>26197</b>
+<v>11</v>
 </b>
 <b>
-<a>33532</a>
-<b>33533</b>
-<v>12</v>
+<a>33724</a>
+<b>33725</b>
+<v>11</v>
 </b>
 <b>
-<a>122462</a>
-<b>122463</b>
-<v>12</v>
+<a>131801</a>
+<b>131802</b>
+<v>11</v>
 </b>
 <b>
-<a>204591</a>
-<b>204592</b>
-<v>12</v>
+<a>214925</a>
+<b>214926</b>
+<v>11</v>
 </b>
 <b>
-<a>232301</a>
-<b>232302</b>
-<v>12</v>
+<a>242884</a>
+<b>242885</b>
+<v>11</v>
 </b>
 <b>
-<a>263009</a>
-<b>263010</b>
-<v>12</v>
+<a>272918</a>
+<b>272919</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -25914,11 +26477,11 @@
 </relation>
 <relation>
 <name>varspecifiers</name>
-<cardinality>1124158</cardinality>
+<cardinality>1113938</cardinality>
 <columnsizes>
 <e>
 <k>var_id</k>
-<v>935091</v>
+<v>926194</v>
 </e>
 <e>
 <k>spec_id</k>
@@ -25936,17 +26499,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795258</v>
+<v>787198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92279</v>
+<v>91911</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>47553</v>
+<v>47084</v>
 </b>
 </bs>
 </hist>
@@ -25980,13 +26543,13 @@
 <v>6</v>
 </b>
 <b>
-<a>8409</a>
-<b>8410</b>
+<a>8411</a>
+<b>8412</b>
 <v>6</v>
 </b>
 <b>
-<a>8751</a>
-<b>8752</b>
+<a>8753</a>
+<b>8754</b>
 <v>6</v>
 </b>
 <b>
@@ -25995,13 +26558,13 @@
 <v>6</v>
 </b>
 <b>
-<a>13352</a>
-<b>13353</b>
+<a>13439</a>
+<b>13440</b>
 <v>6</v>
 </b>
 <b>
-<a>42323</a>
-<b>42324</b>
+<a>42412</a>
+<b>42413</b>
 <v>6</v>
 </b>
 <b>
@@ -26590,11 +27153,11 @@
 </relation>
 <relation>
 <name>attribute_args</name>
-<cardinality>118319</cardinality>
+<cardinality>118389</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>118319</v>
+<v>118389</v>
 </e>
 <e>
 <k>kind</k>
@@ -26602,7 +27165,7 @@
 </e>
 <e>
 <k>attribute</k>
-<v>116952</v>
+<v>117020</v>
 </e>
 <e>
 <k>index</k>
@@ -26610,7 +27173,7 @@
 </e>
 <e>
 <k>location</k>
-<v>58256</v>
+<v>58290</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26624,7 +27187,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118319</v>
+<v>118389</v>
 </b>
 </bs>
 </hist>
@@ -26640,7 +27203,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118319</v>
+<v>118389</v>
 </b>
 </bs>
 </hist>
@@ -26656,7 +27219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118319</v>
+<v>118389</v>
 </b>
 </bs>
 </hist>
@@ -26672,7 +27235,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118319</v>
+<v>118389</v>
 </b>
 </bs>
 </hist>
@@ -26772,12 +27335,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>116132</v>
+<v>116200</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>819</v>
+<v>820</v>
 </b>
 </bs>
 </hist>
@@ -26793,7 +27356,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>116431</v>
+<v>116499</v>
 </b>
 <b>
 <a>2</a>
@@ -26814,12 +27377,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>116132</v>
+<v>116200</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>819</v>
+<v>820</v>
 </b>
 </bs>
 </hist>
@@ -26835,7 +27398,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>116137</v>
+<v>116205</v>
 </b>
 <b>
 <a>2</a>
@@ -26955,22 +27518,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28468</v>
+<v>28485</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7516</v>
+<v>7521</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19458</v>
+<v>19469</v>
 </b>
 <b>
 <a>4</a>
 <b>25</b>
-<v>2812</v>
+<v>2814</v>
 </b>
 </bs>
 </hist>
@@ -26986,12 +27549,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52020</v>
+<v>52051</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6235</v>
+<v>6239</v>
 </b>
 </bs>
 </hist>
@@ -27007,22 +27570,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28452</v>
+<v>28469</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7534</v>
+<v>7539</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19454</v>
+<v>19466</v>
 </b>
 <b>
 <a>4</a>
 <b>25</b>
-<v>2814</v>
+<v>2815</v>
 </b>
 </bs>
 </hist>
@@ -27038,7 +27601,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>58250</v>
+<v>58285</v>
 </b>
 <b>
 <a>3</a>
@@ -27053,15 +27616,15 @@
 </relation>
 <relation>
 <name>attribute_arg_value</name>
-<cardinality>118292</cardinality>
+<cardinality>118362</cardinality>
 <columnsizes>
 <e>
 <k>arg</k>
-<v>118292</v>
+<v>118362</v>
 </e>
 <e>
 <k>value</k>
-<v>2257</v>
+<v>2258</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27075,7 +27638,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118292</v>
+<v>118362</v>
 </b>
 </bs>
 </hist>
@@ -27091,7 +27654,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1808</v>
+<v>1809</v>
 </b>
 <b>
 <a>2</a>
@@ -27116,15 +27679,15 @@
 </relation>
 <relation>
 <name>attribute_arg_type</name>
-<cardinality>60</cardinality>
+<cardinality>58</cardinality>
 <columnsizes>
 <e>
 <k>arg</k>
-<v>60</v>
+<v>58</v>
 </e>
 <e>
 <k>type_id</k>
-<v>36</v>
+<v>35</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27138,7 +27701,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -27154,12 +27717,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -27222,15 +27785,15 @@
 </relation>
 <relation>
 <name>typeattributes</name>
-<cardinality>12119</cardinality>
+<cardinality>12701</cardinality>
 <columnsizes>
 <e>
 <k>type_id</k>
-<v>10831</v>
+<v>11462</v>
 </e>
 <e>
 <k>spec_id</k>
-<v>12119</v>
+<v>12701</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27244,12 +27807,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10296</v>
+<v>10948</v>
 </b>
 <b>
 <a>2</a>
 <b>34</b>
-<v>534</v>
+<v>514</v>
 </b>
 </bs>
 </hist>
@@ -27265,7 +27828,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12119</v>
+<v>12701</v>
 </b>
 </bs>
 </hist>
@@ -27275,15 +27838,15 @@
 </relation>
 <relation>
 <name>funcattributes</name>
-<cardinality>327044</cardinality>
+<cardinality>314529</cardinality>
 <columnsizes>
 <e>
 <k>func_id</k>
-<v>174943</v>
+<v>168330</v>
 </e>
 <e>
 <k>spec_id</k>
-<v>327044</v>
+<v>314529</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27297,22 +27860,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94078</v>
+<v>90603</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13554</v>
+<v>13028</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>65134</v>
+<v>62606</v>
 </b>
 <b>
 <a>4</a>
 <b>14</b>
-<v>2176</v>
+<v>2091</v>
 </b>
 </bs>
 </hist>
@@ -27328,7 +27891,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>327044</v>
+<v>314529</v>
 </b>
 </bs>
 </hist>
@@ -27444,15 +28007,15 @@
 </relation>
 <relation>
 <name>unspecifiedtype</name>
-<cardinality>9406353</cardinality>
+<cardinality>9451546</cardinality>
 <columnsizes>
 <e>
 <k>type_id</k>
-<v>9406353</v>
+<v>9451546</v>
 </e>
 <e>
 <k>unspecified_type_id</k>
-<v>5062897</v>
+<v>5133540</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27466,7 +28029,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9406353</v>
+<v>9451546</v>
 </b>
 </bs>
 </hist>
@@ -27482,22 +28045,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2733810</v>
+<v>2776289</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1943594</v>
+<v>1978655</v>
 </b>
 <b>
 <a>3</a>
-<b>30</b>
-<v>379779</v>
-</b>
-<b>
-<a>30</a>
-<b>7873</b>
-<v>5713</v>
+<b>7936</b>
+<v>378596</v>
 </b>
 </bs>
 </hist>
@@ -27507,19 +28065,19 @@
 </relation>
 <relation>
 <name>member</name>
-<cardinality>5112192</cardinality>
+<cardinality>5066844</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>809800</v>
+<v>833190</v>
 </e>
 <e>
 <k>index</k>
-<v>2966</v>
+<v>2851</v>
 </e>
 <e>
 <k>child</k>
-<v>5095258</v>
+<v>5050544</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27533,47 +28091,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>46948</v>
+<v>45126</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>191658</v>
+<v>219789</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>208336</v>
+<v>209109</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>90285</v>
+<v>90638</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>65073</v>
+<v>67210</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>67212</v>
+<v>65539</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>68221</v>
+<v>66497</v>
 </b>
 <b>
 <a>15</a>
-<b>39</b>
-<v>62471</v>
+<b>45</b>
+<v>62758</v>
 </b>
 <b>
-<a>39</a>
+<a>45</a>
 <b>245</b>
-<v>9591</v>
+<v>6520</v>
 </b>
 </bs>
 </hist>
@@ -27589,47 +28147,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>46218</v>
+<v>44425</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>191719</v>
+<v>219824</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>202769</v>
+<v>203723</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>93154</v>
+<v>93454</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>65766</v>
+<v>67876</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>67346</v>
+<v>65668</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>68999</v>
+<v>67245</v>
 </b>
 <b>
 <a>15</a>
-<b>38</b>
-<v>61462</v>
+<b>41</b>
+<v>62641</v>
 </b>
 <b>
-<a>38</a>
+<a>41</a>
 <b>281</b>
-<v>12363</v>
+<v>8331</v>
 </b>
 </bs>
 </hist>
@@ -27645,62 +28203,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>547</v>
+<v>525</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>267</v>
+<v>257</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>255</v>
+<v>245</v>
 </b>
 <b>
 <a>9</a>
 <b>18</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>23</a>
 <b>100</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>122</a>
 <b>186</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>188</a>
 <b>293</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>296</a>
 <b>374</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>375</a>
 <b>542</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>572</a>
 <b>3257</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>3427</a>
-<b>21556</b>
-<v>230</v>
+<b>22111</b>
+<v>222</v>
 </b>
 <b>
-<a>29162</a>
-<b>65993</b>
-<v>48</v>
+<a>30337</a>
+<b>70680</b>
+<v>46</v>
 </b>
 </bs>
 </hist>
@@ -27716,62 +28274,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>534</v>
+<v>514</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>218</v>
+<v>210</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>13</a>
 <b>70</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>71</a>
 <b>160</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>160</a>
 <b>256</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>263</a>
 <b>345</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>346</a>
 <b>476</b>
-<v>243</v>
+<v>233</v>
 </b>
 <b>
 <a>492</a>
 <b>1685</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>1926</a>
-<b>8765</b>
-<v>230</v>
+<b>8775</b>
+<v>222</v>
 </b>
 <b>
-<a>10213</a>
-<b>66838</b>
-<v>121</v>
+<a>10226</a>
+<b>71530</b>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -27787,7 +28345,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5095258</v>
+<v>5050544</v>
 </b>
 </bs>
 </hist>
@@ -27803,12 +28361,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5078555</v>
+<v>5034466</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>16702</v>
+<v>16078</v>
 </b>
 </bs>
 </hist>
@@ -27818,15 +28376,15 @@
 </relation>
 <relation>
 <name>enclosingfunction</name>
-<cardinality>131751</cardinality>
+<cardinality>127164</cardinality>
 <columnsizes>
 <e>
 <k>child</k>
-<v>131751</v>
+<v>127164</v>
 </e>
 <e>
 <k>parent</k>
-<v>74239</v>
+<v>71639</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27840,7 +28398,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>131751</v>
+<v>127164</v>
 </b>
 </bs>
 </hist>
@@ -27856,27 +28414,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39240</v>
+<v>37811</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21930</v>
+<v>21231</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7208</v>
+<v>6952</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5652</v>
+<v>5445</v>
 </b>
 <b>
 <a>6</a>
 <b>45</b>
-<v>206</v>
+<v>198</v>
 </b>
 </bs>
 </hist>
@@ -27886,27 +28444,27 @@
 </relation>
 <relation>
 <name>derivations</name>
-<cardinality>370309</cardinality>
+<cardinality>392220</cardinality>
 <columnsizes>
 <e>
 <k>derivation</k>
-<v>370309</v>
+<v>392220</v>
 </e>
 <e>
 <k>sub</k>
-<v>346555</v>
+<v>367484</v>
 </e>
 <e>
 <k>index</k>
-<v>72</v>
+<v>70</v>
 </e>
 <e>
 <k>super</k>
-<v>237840</v>
+<v>236475</v>
 </e>
 <e>
 <k>location</k>
-<v>96351</v>
+<v>92613</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27920,7 +28478,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370309</v>
+<v>392220</v>
 </b>
 </bs>
 </hist>
@@ -27936,7 +28494,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370309</v>
+<v>392220</v>
 </b>
 </bs>
 </hist>
@@ -27952,7 +28510,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370309</v>
+<v>392220</v>
 </b>
 </bs>
 </hist>
@@ -27968,7 +28526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370309</v>
+<v>392220</v>
 </b>
 </bs>
 </hist>
@@ -27984,12 +28542,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>326108</v>
+<v>345926</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>20447</v>
+<v>21558</v>
 </b>
 </bs>
 </hist>
@@ -28005,12 +28563,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334933</v>
+<v>356161</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>11621</v>
+<v>11322</v>
 </b>
 </bs>
 </hist>
@@ -28026,12 +28584,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>326120</v>
+<v>345937</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>20434</v>
+<v>21546</v>
 </b>
 </bs>
 </hist>
@@ -28047,12 +28605,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334921</v>
+<v>356150</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>11633</v>
+<v>11334</v>
 </b>
 </bs>
 </hist>
@@ -28068,32 +28626,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>44</a>
 <b>45</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>220</a>
 <b>221</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>957</a>
-<b>958</b>
-<v>12</v>
+<a>970</a>
+<b>971</b>
+<v>11</v>
 </b>
 <b>
-<a>29236</a>
-<b>29237</b>
-<v>12</v>
+<a>32328</a>
+<b>32329</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28109,32 +28667,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>44</a>
 <b>45</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>220</a>
 <b>221</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>956</a>
-<b>957</b>
-<v>12</v>
+<a>969</a>
+<b>970</b>
+<v>11</v>
 </b>
 <b>
-<a>28508</a>
-<b>28509</b>
-<v>12</v>
+<a>31450</a>
+<b>31451</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28150,32 +28708,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>29</a>
 <b>30</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>84</a>
 <b>85</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>441</a>
-<b>442</b>
-<v>12</v>
+<a>452</a>
+<b>453</b>
+<v>11</v>
 </b>
 <b>
-<a>19051</a>
-<b>19052</b>
-<v>12</v>
+<a>19713</a>
+<b>19714</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28191,32 +28749,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>51</a>
 <b>52</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>254</a>
 <b>255</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7602</a>
 <b>7603</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28232,12 +28790,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>222438</v>
+<v>221343</v>
 </b>
 <b>
 <a>2</a>
-<b>766</b>
-<v>15402</v>
+<b>1134</b>
+<v>15131</v>
 </b>
 </bs>
 </hist>
@@ -28253,12 +28811,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>222450</v>
+<v>221355</v>
 </b>
 <b>
 <a>2</a>
-<b>766</b>
-<v>15390</v>
+<b>1134</b>
+<v>15120</v>
 </b>
 </bs>
 </hist>
@@ -28274,12 +28832,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>237342</v>
+<v>235996</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>498</v>
+<v>479</v>
 </b>
 </bs>
 </hist>
@@ -28295,12 +28853,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229780</v>
+<v>228634</v>
 </b>
 <b>
 <a>2</a>
 <b>439</b>
-<v>8059</v>
+<v>7840</v>
 </b>
 </bs>
 </hist>
@@ -28316,22 +28874,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74652</v>
+<v>70786</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9336</v>
+<v>8985</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>7306</v>
+<v>7606</v>
 </b>
 <b>
 <a>8</a>
-<b>682</b>
-<v>5057</v>
+<b>698</b>
+<v>5234</v>
 </b>
 </bs>
 </hist>
@@ -28347,22 +28905,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77193</v>
+<v>73146</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7002</v>
+<v>6858</v>
 </b>
 <b>
 <a>3</a>
-<b>9</b>
-<v>7609</v>
+<b>8</b>
+<v>7443</v>
 </b>
 <b>
-<a>9</a>
-<b>682</b>
-<v>4546</v>
+<a>8</a>
+<b>698</b>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -28378,12 +28936,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96327</v>
+<v>92589</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -28399,22 +28957,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77655</v>
+<v>73882</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9056</v>
+<v>8833</v>
 </b>
 <b>
 <a>3</a>
-<b>11</b>
-<v>7269</v>
+<b>10</b>
+<v>7326</v>
 </b>
 <b>
-<a>11</a>
-<b>682</b>
-<v>2370</v>
+<a>10</a>
+<b>698</b>
+<v>2570</v>
 </b>
 </bs>
 </hist>
@@ -28424,15 +28982,15 @@
 </relation>
 <relation>
 <name>derspecifiers</name>
-<cardinality>372947</cardinality>
+<cardinality>394756</cardinality>
 <columnsizes>
 <e>
 <k>der_id</k>
-<v>370272</v>
+<v>392185</v>
 </e>
 <e>
 <k>spec_id</k>
-<v>48</v>
+<v>46</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28446,12 +29004,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>367598</v>
+<v>389615</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2674</v>
+<v>2570</v>
 </b>
 </bs>
 </hist>
@@ -28467,22 +29025,22 @@
 <b>
 <a>220</a>
 <b>221</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>242</a>
 <b>243</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>979</a>
 <b>980</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>29238</a>
-<b>29239</b>
-<v>12</v>
+<a>32343</a>
+<b>32344</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28492,15 +29050,15 @@
 </relation>
 <relation>
 <name>direct_base_offsets</name>
-<cardinality>282029</cardinality>
+<cardinality>307366</cardinality>
 <columnsizes>
 <e>
 <k>der_id</k>
-<v>282029</v>
+<v>307366</v>
 </e>
 <e>
 <k>offset</k>
-<v>206</v>
+<v>210</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28514,7 +29072,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>282029</v>
+<v>307366</v>
 </b>
 </bs>
 </hist>
@@ -28530,62 +29088,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>46</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>24</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>23</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>24</v>
+<v>11</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>11</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>21</a>
 <b>22</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>78</a>
-<b>79</b>
-<v>12</v>
+<a>85</a>
+<b>86</b>
+<v>11</v>
 </b>
 <b>
 <a>200</a>
 <b>201</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>22837</a>
-<b>22838</b>
-<v>12</v>
+<a>25931</a>
+<b>25932</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28595,19 +29158,19 @@
 </relation>
 <relation>
 <name>virtual_base_offsets</name>
-<cardinality>7026</cardinality>
+<cardinality>6753</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>3890</v>
+<v>3739</v>
 </e>
 <e>
 <k>super</k>
-<v>534</v>
+<v>514</v>
 </e>
 <e>
 <k>offset</k>
-<v>267</v>
+<v>257</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28621,22 +29184,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3063</v>
+<v>2944</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>340</v>
+<v>327</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>279</v>
+<v>268</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>206</v>
+<v>198</v>
 </b>
 </bs>
 </hist>
@@ -28652,17 +29215,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3282</v>
+<v>3154</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>328</v>
+<v>315</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>279</v>
+<v>268</v>
 </b>
 </bs>
 </hist>
@@ -28678,52 +29241,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>60</v>
+<v>58</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97</v>
+<v>93</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>13</a>
 <b>15</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>24</a>
 <b>60</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>196</a>
 <b>197</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28739,32 +29302,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>303</v>
+<v>292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28780,57 +29343,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>10</a>
 <b>12</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>14</a>
 <b>19</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>20</a>
 <b>27</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>28</a>
 <b>31</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>36</a>
 <b>97</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>97</a>
 <b>98</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -28846,37 +29409,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85</v>
+<v>81</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>12</a>
 <b>14</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>21</a>
 <b>29</b>
-<v>24</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -28886,23 +29449,23 @@
 </relation>
 <relation>
 <name>frienddecls</name>
-<cardinality>231178</cardinality>
+<cardinality>222208</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>231178</v>
+<v>222208</v>
 </e>
 <e>
 <k>type_id</k>
-<v>19511</v>
+<v>18753</v>
 </e>
 <e>
 <k>decl_id</k>
-<v>28810</v>
+<v>27692</v>
 </e>
 <e>
 <k>location</k>
-<v>8096</v>
+<v>7782</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28916,7 +29479,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>231178</v>
+<v>222208</v>
 </b>
 </bs>
 </hist>
@@ -28932,7 +29495,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>231178</v>
+<v>222208</v>
 </b>
 </bs>
 </hist>
@@ -28948,7 +29511,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>231178</v>
+<v>222208</v>
 </b>
 </bs>
 </hist>
@@ -28964,47 +29527,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6856</v>
+<v>6590</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2467</v>
+<v>2371</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1191</v>
+<v>1145</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>1714</v>
+<v>1647</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>1556</v>
+<v>1495</v>
 </b>
 <b>
 <a>10</a>
 <b>16</b>
-<v>1470</v>
+<v>1413</v>
 </b>
 <b>
 <a>16</a>
 <b>34</b>
-<v>1786</v>
+<v>1717</v>
 </b>
 <b>
 <a>36</a>
 <b>59</b>
-<v>1470</v>
+<v>1413</v>
 </b>
 <b>
 <a>59</a>
 <b>129</b>
-<v>996</v>
+<v>958</v>
 </b>
 </bs>
 </hist>
@@ -29020,47 +29583,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6856</v>
+<v>6590</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2467</v>
+<v>2371</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1191</v>
+<v>1145</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>1714</v>
+<v>1647</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>1556</v>
+<v>1495</v>
 </b>
 <b>
 <a>10</a>
 <b>16</b>
-<v>1470</v>
+<v>1413</v>
 </b>
 <b>
 <a>16</a>
 <b>34</b>
-<v>1786</v>
+<v>1717</v>
 </b>
 <b>
 <a>36</a>
 <b>59</b>
-<v>1470</v>
+<v>1413</v>
 </b>
 <b>
 <a>59</a>
 <b>129</b>
-<v>996</v>
+<v>958</v>
 </b>
 </bs>
 </hist>
@@ -29076,17 +29639,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17748</v>
+<v>17059</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>1543</v>
+<v>1483</v>
 </b>
 <b>
 <a>5</a>
 <b>31</b>
-<v>218</v>
+<v>210</v>
 </b>
 </bs>
 </hist>
@@ -29102,37 +29665,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15815</v>
+<v>15201</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2261</v>
+<v>2173</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2479</v>
+<v>2383</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>2188</v>
+<v>2103</v>
 </b>
 <b>
 <a>9</a>
 <b>20</b>
-<v>2030</v>
+<v>1951</v>
 </b>
 <b>
 <a>20</a>
 <b>28</b>
-<v>2467</v>
+<v>2371</v>
 </b>
 <b>
 <a>28</a>
 <b>390</b>
-<v>1568</v>
+<v>1507</v>
 </b>
 </bs>
 </hist>
@@ -29148,37 +29711,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15815</v>
+<v>15201</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2261</v>
+<v>2173</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2479</v>
+<v>2383</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>2188</v>
+<v>2103</v>
 </b>
 <b>
 <a>9</a>
 <b>20</b>
-<v>2030</v>
+<v>1951</v>
 </b>
 <b>
 <a>20</a>
 <b>28</b>
-<v>2467</v>
+<v>2371</v>
 </b>
 <b>
 <a>28</a>
 <b>390</b>
-<v>1568</v>
+<v>1507</v>
 </b>
 </bs>
 </hist>
@@ -29194,12 +29757,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28215</v>
+<v>27120</v>
 </b>
 <b>
 <a>2</a>
 <b>46</b>
-<v>595</v>
+<v>572</v>
 </b>
 </bs>
 </hist>
@@ -29215,17 +29778,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6917</v>
+<v>6648</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1045</v>
+<v>1004</v>
 </b>
 <b>
 <a>3</a>
 <b>18239</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -29241,12 +29804,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7609</v>
+<v>7314</v>
 </b>
 <b>
 <a>2</a>
 <b>1215</b>
-<v>486</v>
+<v>467</v>
 </b>
 </bs>
 </hist>
@@ -29262,17 +29825,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6929</v>
+<v>6660</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1033</v>
+<v>993</v>
 </b>
 <b>
 <a>3</a>
 <b>1734</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -29282,19 +29845,19 @@
 </relation>
 <relation>
 <name>comments</name>
-<cardinality>1743633</cardinality>
+<cardinality>1675974</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1743633</v>
+<v>1675974</v>
 </e>
 <e>
 <k>contents</k>
-<v>864492</v>
+<v>830947</v>
 </e>
 <e>
 <k>location</k>
-<v>1743633</v>
+<v>1675974</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29308,7 +29871,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1743633</v>
+<v>1675974</v>
 </b>
 </bs>
 </hist>
@@ -29324,7 +29887,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1743633</v>
+<v>1675974</v>
 </b>
 </bs>
 </hist>
@@ -29340,17 +29903,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>731525</v>
+<v>703139</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>83149</v>
+<v>79923</v>
 </b>
 <b>
 <a>3</a>
 <b>10736</b>
-<v>49817</v>
+<v>47883</v>
 </b>
 </bs>
 </hist>
@@ -29366,17 +29929,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>731525</v>
+<v>703139</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>83149</v>
+<v>79923</v>
 </b>
 <b>
 <a>3</a>
 <b>10736</b>
-<v>49817</v>
+<v>47883</v>
 </b>
 </bs>
 </hist>
@@ -29392,7 +29955,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1743633</v>
+<v>1675974</v>
 </b>
 </bs>
 </hist>
@@ -29408,7 +29971,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1743633</v>
+<v>1675974</v>
 </b>
 </bs>
 </hist>
@@ -29418,15 +29981,15 @@
 </relation>
 <relation>
 <name>commentbinding</name>
-<cardinality>778436</cardinality>
+<cardinality>748230</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>679021</v>
+<v>652673</v>
 </e>
 <e>
 <k>element</k>
-<v>747438</v>
+<v>718434</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29440,17 +30003,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>616002</v>
+<v>592099</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>58545</v>
+<v>56273</v>
 </b>
 <b>
 <a>4</a>
 <b>97</b>
-<v>4473</v>
+<v>4299</v>
 </b>
 </bs>
 </hist>
@@ -29466,12 +30029,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>716439</v>
+<v>688638</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30998</v>
+<v>29796</v>
 </b>
 </bs>
 </hist>
@@ -29481,15 +30044,15 @@
 </relation>
 <relation>
 <name>exprconv</name>
-<cardinality>6445331</cardinality>
+<cardinality>6446816</cardinality>
 <columnsizes>
 <e>
 <k>converted</k>
-<v>6445038</v>
+<v>6446523</v>
 </e>
 <e>
 <k>conversion</k>
-<v>6445331</v>
+<v>6446816</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29503,7 +30066,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6444746</v>
+<v>6446231</v>
 </b>
 <b>
 <a>2</a>
@@ -29524,7 +30087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6445331</v>
+<v>6446816</v>
 </b>
 </bs>
 </hist>
@@ -29534,30 +30097,30 @@
 </relation>
 <relation>
 <name>compgenerated</name>
-<cardinality>6720341</cardinality>
+<cardinality>6652484</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>6720341</v>
+<v>6652484</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>synthetic_destructor_call</name>
-<cardinality>59493</cardinality>
+<cardinality>57185</cardinality>
 <columnsizes>
 <e>
 <k>element</k>
-<v>47422</v>
+<v>45582</v>
 </e>
 <e>
 <k>i</k>
-<v>340</v>
+<v>327</v>
 </e>
 <e>
 <k>destructor_call</k>
-<v>49573</v>
+<v>47650</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29571,17 +30134,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38791</v>
+<v>37285</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6321</v>
+<v>6076</v>
 </b>
 <b>
 <a>3</a>
 <b>29</b>
-<v>2309</v>
+<v>2220</v>
 </b>
 </bs>
 </hist>
@@ -29597,17 +30160,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38791</v>
+<v>37285</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6321</v>
+<v>6076</v>
 </b>
 <b>
 <a>3</a>
 <b>29</b>
-<v>2309</v>
+<v>2220</v>
 </b>
 </bs>
 </hist>
@@ -29623,27 +30186,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>255</v>
+<v>245</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>22</a>
 <b>43</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>190</a>
 <b>711</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>3901</a>
 <b>3902</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -29659,27 +30222,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>255</v>
+<v>245</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>21</a>
 <b>37</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>146</a>
 <b>550</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>3297</a>
 <b>3298</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -29695,17 +30258,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43823</v>
+<v>42123</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3719</v>
+<v>3575</v>
 </b>
 <b>
 <a>3</a>
 <b>26</b>
-<v>2030</v>
+<v>1951</v>
 </b>
 </bs>
 </hist>
@@ -29721,7 +30284,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49573</v>
+<v>47650</v>
 </b>
 </bs>
 </hist>
@@ -29731,15 +30294,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>8497</cardinality>
+<cardinality>8167</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8497</v>
+<v>8167</v>
 </e>
 <e>
 <k>name</k>
-<v>4570</v>
+<v>4393</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29753,7 +30316,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8497</v>
+<v>8167</v>
 </b>
 </bs>
 </hist>
@@ -29769,17 +30332,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3841</v>
+<v>3692</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>461</v>
+<v>444</v>
 </b>
 <b>
 <a>3</a>
 <b>139</b>
-<v>267</v>
+<v>257</v>
 </b>
 </bs>
 </hist>
@@ -29789,26 +30352,26 @@
 </relation>
 <relation>
 <name>namespace_inline</name>
-<cardinality>170</cardinality>
+<cardinality>163</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>170</v>
+<v>163</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>namespacembrs</name>
-<cardinality>1570027</cardinality>
+<cardinality>1616300</cardinality>
 <columnsizes>
 <e>
 <k>parentid</k>
-<v>7913</v>
+<v>7606</v>
 </e>
 <e>
 <k>memberid</k>
-<v>1570027</v>
+<v>1616300</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29822,62 +30385,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>875</v>
+<v>829</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>826</v>
+<v>794</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>644</v>
+<v>385</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>680</v>
-</b>
-<b>
-<a>6</a>
-<b>9</b>
+<b>5</b>
 <v>607</v>
 </b>
 <b>
-<a>9</a>
-<b>16</b>
-<v>680</v>
+<a>5</a>
+<b>8</b>
+<v>666</v>
 </b>
 <b>
-<a>16</a>
-<b>27</b>
-<v>607</v>
+<a>8</a>
+<b>14</b>
+<v>677</v>
 </b>
 <b>
-<a>27</a>
-<b>46</b>
-<v>619</v>
-</b>
-<b>
-<a>46</a>
-<b>85</b>
-<v>607</v>
-</b>
-<b>
-<a>85</a>
-<b>169</b>
-<v>607</v>
-</b>
-<b>
-<a>169</a>
-<b>444</b>
+<a>14</a>
+<b>22</b>
 <v>595</v>
 </b>
 <b>
-<a>475</a>
-<b>29073</b>
-<v>559</v>
+<a>22</a>
+<b>42</b>
+<v>595</v>
+</b>
+<b>
+<a>42</a>
+<b>63</b>
+<v>572</v>
+</b>
+<b>
+<a>63</a>
+<b>127</b>
+<v>572</v>
+</b>
+<b>
+<a>127</a>
+<b>304</b>
+<v>572</v>
+</b>
+<b>
+<a>321</a>
+<b>1041</b>
+<v>572</v>
+</b>
+<b>
+<a>1101</a>
+<b>32701</b>
+<v>163</v>
 </b>
 </bs>
 </hist>
@@ -29893,7 +30461,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1570027</v>
+<v>1616300</v>
 </b>
 </bs>
 </hist>
@@ -29903,19 +30471,19 @@
 </relation>
 <relation>
 <name>exprparents</name>
-<cardinality>13615303</cardinality>
+<cardinality>13481241</cardinality>
 <columnsizes>
 <e>
 <k>expr_id</k>
-<v>13615112</v>
+<v>13481052</v>
 </e>
 <e>
 <k>child_index</k>
-<v>3163</v>
+<v>3131</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>9644209</v>
+<v>9549204</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29929,7 +30497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13615105</v>
+<v>13481045</v>
 </b>
 <b>
 <a>2</a>
@@ -29950,12 +30518,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13614927</v>
+<v>13480869</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>184</v>
+<v>182</v>
 </b>
 </bs>
 </hist>
@@ -29971,37 +30539,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72</v>
+<v>71</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>652</v>
+<v>645</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1674</v>
+<v>1657</v>
 </b>
 <b>
 <a>4</a>
 <b>46</b>
-<v>243</v>
+<v>241</v>
 </b>
 <b>
 <a>46</a>
 <b>56</b>
-<v>237</v>
+<v>234</v>
 </b>
 <b>
 <a>56</a>
 <b>3660</b>
-<v>237</v>
+<v>234</v>
 </b>
 <b>
 <a>6434</a>
-<b>1187727</b>
-<v>46</v>
+<b>1188148</b>
+<v>45</v>
 </b>
 </bs>
 </hist>
@@ -30017,37 +30585,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72</v>
+<v>71</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>652</v>
+<v>645</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1674</v>
+<v>1657</v>
 </b>
 <b>
 <a>4</a>
 <b>31</b>
-<v>243</v>
+<v>241</v>
 </b>
 <b>
 <a>31</a>
 <b>41</b>
-<v>237</v>
+<v>234</v>
 </b>
 <b>
 <a>41</a>
 <b>3645</b>
-<v>237</v>
+<v>234</v>
 </b>
 <b>
 <a>6419</a>
-<b>1187740</b>
-<v>46</v>
+<b>1188161</b>
+<v>45</v>
 </b>
 </bs>
 </hist>
@@ -30063,17 +30631,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6840662</v>
+<v>6772879</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2212086</v>
+<v>2190858</v>
 </b>
 <b>
 <a>3</a>
 <b>1681</b>
-<v>591461</v>
+<v>585466</v>
 </b>
 </bs>
 </hist>
@@ -30089,17 +30657,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6840682</v>
+<v>6772898</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2212066</v>
+<v>2190839</v>
 </b>
 <b>
 <a>3</a>
 <b>480</b>
-<v>591461</v>
+<v>585466</v>
 </b>
 </bs>
 </hist>
@@ -30109,22 +30677,22 @@
 </relation>
 <relation>
 <name>expr_isload</name>
-<cardinality>5063114</cardinality>
+<cardinality>5014574</cardinality>
 <columnsizes>
 <e>
 <k>expr_id</k>
-<v>5063114</v>
+<v>5014574</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>conversionkinds</name>
-<cardinality>4254113</cardinality>
+<cardinality>4255501</cardinality>
 <columnsizes>
 <e>
 <k>expr_id</k>
-<v>4254113</v>
+<v>4255501</v>
 </e>
 <e>
 <k>kind</k>
@@ -30142,7 +30710,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4254113</v>
+<v>4255501</v>
 </b>
 </bs>
 </hist>
@@ -30166,8 +30734,8 @@
 <v>1</v>
 </b>
 <b>
-<a>13109</a>
-<b>13110</b>
+<a>13672</a>
+<b>13673</b>
 <v>1</v>
 </b>
 <b>
@@ -30181,8 +30749,8 @@
 <v>1</v>
 </b>
 <b>
-<a>4161592</a>
-<b>4161593</b>
+<a>4162417</a>
+<b>4162418</b>
 <v>1</v>
 </b>
 </bs>
@@ -30193,15 +30761,15 @@
 </relation>
 <relation>
 <name>iscall</name>
-<cardinality>2365240</cardinality>
+<cardinality>2284876</cardinality>
 <columnsizes>
 <e>
 <k>caller</k>
-<v>2365240</v>
+<v>2284876</v>
 </e>
 <e>
 <k>kind</k>
-<v>36</v>
+<v>35</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30215,7 +30783,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2365240</v>
+<v>2284876</v>
 </b>
 </bs>
 </hist>
@@ -30231,17 +30799,17 @@
 <b>
 <a>1319</a>
 <b>1320</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>5604</a>
-<b>5605</b>
-<v>12</v>
+<a>5643</a>
+<b>5644</b>
+<v>11</v>
 </b>
 <b>
-<a>187644</a>
-<b>187645</b>
-<v>12</v>
+<a>188582</a>
+<b>188583</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30251,15 +30819,15 @@
 </relation>
 <relation>
 <name>numtemplatearguments</name>
-<cardinality>157948</cardinality>
+<cardinality>152181</cardinality>
 <columnsizes>
 <e>
 <k>expr_id</k>
-<v>157948</v>
+<v>152181</v>
 </e>
 <e>
 <k>num</k>
-<v>48</v>
+<v>46</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30273,7 +30841,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>157948</v>
+<v>152181</v>
 </b>
 </bs>
 </hist>
@@ -30289,22 +30857,22 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>41</a>
 <b>42</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>651</a>
 <b>652</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>12298</a>
-<b>12299</b>
-<v>12</v>
+<a>12329</a>
+<b>12330</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30314,15 +30882,15 @@
 </relation>
 <relation>
 <name>specialnamequalifyingelements</name>
-<cardinality>12</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12</v>
+<v>11</v>
 </e>
 <e>
 <k>name</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30336,7 +30904,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30352,7 +30920,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30362,23 +30930,23 @@
 </relation>
 <relation>
 <name>namequalifiers</name>
-<cardinality>1125621</cardinality>
+<cardinality>1116919</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1125621</v>
+<v>1116919</v>
 </e>
 <e>
 <k>qualifiableelement</k>
-<v>1125621</v>
+<v>1116919</v>
 </e>
 <e>
 <k>qualifyingelement</k>
-<v>37001</v>
+<v>38961</v>
 </e>
 <e>
 <k>location</k>
-<v>509589</v>
+<v>506087</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30392,7 +30960,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30408,7 +30976,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30424,7 +30992,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30440,7 +31008,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30456,7 +31024,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30472,7 +31040,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125621</v>
+<v>1116919</v>
 </b>
 </bs>
 </hist>
@@ -30488,109 +31056,109 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17109</v>
+<v>18965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7935</v>
+<v>8142</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5081</v>
-</b>
-<b>
-<a>4</a>
-<b>10</b>
-<v>2860</v>
-</b>
-<b>
-<a>10</a>
-<b>86</b>
-<v>2781</v>
-</b>
-<b>
-<a>86</a>
-<b>24926</b>
-<v>1232</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>qualifyingelement</src>
-<trg>qualifiableelement</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>17109</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>7935</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5081</v>
-</b>
-<b>
-<a>4</a>
-<b>10</b>
-<v>2860</v>
-</b>
-<b>
-<a>10</a>
-<b>86</b>
-<v>2781</v>
-</b>
-<b>
-<a>86</a>
-<b>24926</b>
-<v>1232</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>qualifyingelement</src>
-<trg>location</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>22745</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>4817</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>3802</v>
+<v>5043</v>
 </b>
 <b>
 <a>4</a>
 <b>11</b>
-<v>3018</v>
+<v>3027</v>
+</b>
+<b>
+<a>11</a>
+<b>129</b>
+<v>2935</v>
+</b>
+<b>
+<a>132</a>
+<b>24926</b>
+<v>848</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>qualifyingelement</src>
+<trg>qualifiableelement</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>18965</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8142</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5043</v>
+</b>
+<b>
+<a>4</a>
+<b>11</b>
+<v>3027</v>
+</b>
+<b>
+<a>11</a>
+<b>129</b>
+<v>2935</v>
+</b>
+<b>
+<a>132</a>
+<b>24926</b>
+<v>848</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>qualifyingelement</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>24850</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4762</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3770</v>
+</b>
+<b>
+<a>4</a>
+<b>11</b>
+<v>2974</v>
 </b>
 <b>
 <a>11</a>
 <b>16728</b>
-<v>2616</v>
+<v>2603</v>
 </b>
 </bs>
 </hist>
@@ -30606,22 +31174,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>387650</v>
+<v>384719</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57004</v>
+<v>56877</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>39037</v>
+<v>38851</v>
 </b>
 <b>
 <a>7</a>
 <b>381</b>
-<v>25895</v>
+<v>25639</v>
 </b>
 </bs>
 </hist>
@@ -30637,22 +31205,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>387650</v>
+<v>384719</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57004</v>
+<v>56877</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>39037</v>
+<v>38851</v>
 </b>
 <b>
 <a>7</a>
 <b>381</b>
-<v>25895</v>
+<v>25639</v>
 </b>
 </bs>
 </hist>
@@ -30668,17 +31236,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>452478</v>
+<v>449080</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44785</v>
+<v>44650</v>
 </b>
 <b>
 <a>3</a>
 <b>190</b>
-<v>12324</v>
+<v>12356</v>
 </b>
 </bs>
 </hist>
@@ -30688,15 +31256,15 @@
 </relation>
 <relation>
 <name>varbind</name>
-<cardinality>5497554</cardinality>
+<cardinality>5445518</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>5497428</v>
+<v>5445394</v>
 </e>
 <e>
 <k>var</k>
-<v>1549133</v>
+<v>1534266</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30710,12 +31278,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5497303</v>
+<v>5445270</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>125</v>
+<v>123</v>
 </b>
 </bs>
 </hist>
@@ -30731,32 +31299,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>685882</v>
+<v>679661</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>311295</v>
+<v>308179</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>236831</v>
+<v>234430</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>93953</v>
+<v>93020</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>134777</v>
+<v>133430</v>
 </b>
 <b>
 <a>9</a>
 <b>6150</b>
-<v>86393</v>
+<v>85544</v>
 </b>
 </bs>
 </hist>
@@ -30766,15 +31334,15 @@
 </relation>
 <relation>
 <name>funbind</name>
-<cardinality>2442767</cardinality>
+<cardinality>2419854</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>2142538</v>
+<v>2122577</v>
 </e>
 <e>
 <k>fun</k>
-<v>438611</v>
+<v>434205</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30788,17 +31356,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1842553</v>
+<v>1825541</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>299807</v>
+<v>296859</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>177</v>
+<v>176</v>
 </b>
 </bs>
 </hist>
@@ -30814,32 +31382,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>255153</v>
+<v>252065</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76151</v>
+<v>75516</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31642</v>
+<v>31302</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33910</v>
+<v>33957</v>
 </b>
 <b>
 <a>7</a>
 <b>37</b>
-<v>33831</v>
+<v>33520</v>
 </b>
 <b>
 <a>37</a>
 <b>6664</b>
-<v>7922</v>
+<v>7841</v>
 </b>
 </bs>
 </hist>
@@ -30849,19 +31417,19 @@
 </relation>
 <relation>
 <name>expr_allocator</name>
-<cardinality>27692</cardinality>
+<cardinality>26617</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>27692</v>
+<v>26617</v>
 </e>
 <e>
 <k>func</k>
-<v>133</v>
+<v>128</v>
 </e>
 <e>
 <k>form</k>
-<v>12</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30875,7 +31443,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27692</v>
+<v>26617</v>
 </b>
 </bs>
 </hist>
@@ -30891,7 +31459,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27692</v>
+<v>26617</v>
 </b>
 </bs>
 </hist>
@@ -30907,42 +31475,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>39</a>
 <b>40</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>973</a>
 <b>974</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1237</a>
 <b>1238</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30958,7 +31526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133</v>
+<v>128</v>
 </b>
 </bs>
 </hist>
@@ -30974,7 +31542,7 @@
 <b>
 <a>2278</a>
 <b>2279</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -30990,7 +31558,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -31000,19 +31568,19 @@
 </relation>
 <relation>
 <name>expr_deallocator</name>
-<cardinality>30998</cardinality>
+<cardinality>29796</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>30998</v>
+<v>29796</v>
 </e>
 <e>
 <k>func</k>
-<v>145</v>
+<v>140</v>
 </e>
 <e>
 <k>form</k>
-<v>24</v>
+<v>23</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31026,7 +31594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30998</v>
+<v>29796</v>
 </b>
 </bs>
 </hist>
@@ -31042,7 +31610,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30998</v>
+<v>29796</v>
 </b>
 </bs>
 </hist>
@@ -31058,42 +31626,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36</v>
+<v>35</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>118</a>
 <b>119</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>883</a>
 <b>884</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1521</a>
 <b>1522</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -31109,7 +31677,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -31125,12 +31693,12 @@
 <b>
 <a>891</a>
 <b>892</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1659</a>
 <b>1660</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -31146,12 +31714,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -31161,26 +31729,26 @@
 </relation>
 <relation>
 <name>expr_cond_two_operand</name>
-<cardinality>610</cardinality>
+<cardinality>611</cardinality>
 <columnsizes>
 <e>
 <k>cond</k>
-<v>610</v>
+<v>611</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_cond_guard</name>
-<cardinality>154429</cardinality>
+<cardinality>154519</cardinality>
 <columnsizes>
 <e>
 <k>cond</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 <e>
 <k>guard</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31194,7 +31762,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31210,7 +31778,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31220,15 +31788,15 @@
 </relation>
 <relation>
 <name>expr_cond_true</name>
-<cardinality>154429</cardinality>
+<cardinality>154519</cardinality>
 <columnsizes>
 <e>
 <k>cond</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 <e>
 <k>true</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31242,7 +31810,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31258,7 +31826,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31268,15 +31836,15 @@
 </relation>
 <relation>
 <name>expr_cond_false</name>
-<cardinality>154429</cardinality>
+<cardinality>154519</cardinality>
 <columnsizes>
 <e>
 <k>cond</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 <e>
 <k>false</k>
-<v>154429</v>
+<v>154519</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31290,7 +31858,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31306,7 +31874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>154429</v>
+<v>154519</v>
 </b>
 </bs>
 </hist>
@@ -31316,15 +31884,15 @@
 </relation>
 <relation>
 <name>values</name>
-<cardinality>8776796</cardinality>
+<cardinality>8788031</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8776796</v>
+<v>8788031</v>
 </e>
 <e>
 <k>str</k>
-<v>651390</v>
+<v>651491</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31338,7 +31906,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8776796</v>
+<v>8788031</v>
 </b>
 </bs>
 </hist>
@@ -31354,17 +31922,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>540103</v>
+<v>540120</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>65463</v>
+<v>65472</v>
 </b>
 <b>
 <a>3</a>
-<b>4044535</b>
-<v>45824</v>
+<b>4046841</b>
+<v>45899</v>
 </b>
 </bs>
 </hist>
@@ -31374,15 +31942,15 @@
 </relation>
 <relation>
 <name>valuetext</name>
-<cardinality>4759381</cardinality>
+<cardinality>4766569</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4759381</v>
+<v>4766569</v>
 </e>
 <e>
 <k>text</k>
-<v>704971</v>
+<v>705085</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31396,7 +31964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4759381</v>
+<v>4766569</v>
 </b>
 </bs>
 </hist>
@@ -31412,22 +31980,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>528095</v>
+<v>528108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>102815</v>
+<v>102830</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>56849</v>
+<v>56879</v>
 </b>
 <b>
 <a>7</a>
 <b>427516</b>
-<v>17212</v>
+<v>17268</v>
 </b>
 </bs>
 </hist>
@@ -31437,15 +32005,15 @@
 </relation>
 <relation>
 <name>valuebind</name>
-<cardinality>9499071</cardinality>
+<cardinality>9509366</cardinality>
 <columnsizes>
 <e>
 <k>val</k>
-<v>8769631</v>
+<v>8779926</v>
 </e>
 <e>
 <k>expr</k>
-<v>9499071</v>
+<v>9509366</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31459,7 +32027,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8040923</v>
+<v>8051218</v>
 </b>
 <b>
 <a>2</a>
@@ -31485,7 +32053,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9499071</v>
+<v>9509366</v>
 </b>
 </bs>
 </hist>
@@ -31495,19 +32063,19 @@
 </relation>
 <relation>
 <name>fieldoffsets</name>
-<cardinality>259539</cardinality>
+<cardinality>251575</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>259539</v>
+<v>251575</v>
 </e>
 <e>
 <k>byteoffset</k>
-<v>3914</v>
+<v>9022</v>
 </e>
 <e>
 <k>bitoffset</k>
-<v>85</v>
+<v>52</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31521,7 +32089,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>259539</v>
+<v>251575</v>
 </b>
 </bs>
 </hist>
@@ -31537,7 +32105,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>259539</v>
+<v>251575</v>
 </b>
 </bs>
 </hist>
@@ -31553,42 +32121,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1689</v>
+<v>6132</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>534</v>
+<v>782</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>194</v>
-</b>
-<b>
-<a>4</a>
 <b>6</b>
-<v>340</v>
+<v>750</v>
 </b>
 <b>
 <a>6</a>
-<b>11</b>
-<v>328</v>
+<b>17</b>
+<v>678</v>
 </b>
 <b>
-<a>11</a>
-<b>23</b>
-<v>328</v>
-</b>
-<b>
-<a>23</a>
-<b>84</b>
-<v>303</v>
-</b>
-<b>
-<a>90</a>
-<b>12369</b>
-<v>194</v>
+<a>17</a>
+<b>11685</b>
+<v>678</v>
 </b>
 </bs>
 </hist>
@@ -31604,12 +32157,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3853</v>
+<v>8579</v>
 </b>
 <b>
 <a>2</a>
-<b>8</b>
-<v>60</v>
+<b>9</b>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -31623,29 +32176,44 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>36</v>
+<a>83</a>
+<b>84</b>
+<v>6</v>
 </b>
 <b>
-<a>2</a>
-<b>3</b>
-<v>12</v>
+<a>87</a>
+<b>88</b>
+<v>6</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>12</v>
+<a>102</a>
+<b>103</b>
+<v>6</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>12</v>
+<a>122</a>
+<b>123</b>
+<v>6</v>
 </b>
 <b>
-<a>21338</a>
-<b>21339</b>
-<v>12</v>
+<a>127</a>
+<b>128</b>
+<v>6</v>
+</b>
+<b>
+<a>153</a>
+<b>154</b>
+<v>6</v>
+</b>
+<b>
+<a>195</a>
+<b>196</b>
+<v>6</v>
+</b>
+<b>
+<a>37692</a>
+<b>37693</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31659,24 +32227,44 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>36</v>
+<a>40</a>
+<b>41</b>
+<v>6</v>
 </b>
 <b>
-<a>2</a>
-<b>3</b>
-<v>24</v>
+<a>44</a>
+<b>45</b>
+<v>6</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>12</v>
+<a>45</a>
+<b>46</b>
+<v>6</v>
 </b>
 <b>
-<a>322</a>
-<b>323</b>
-<v>12</v>
+<a>52</a>
+<b>53</b>
+<v>6</v>
+</b>
+<b>
+<a>54</a>
+<b>55</b>
+<v>6</v>
+</b>
+<b>
+<a>58</a>
+<b>59</b>
+<v>6</v>
+</b>
+<b>
+<a>66</a>
+<b>67</b>
+<v>6</v>
+</b>
+<b>
+<a>1383</a>
+<b>1384</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31686,11 +32274,11 @@
 </relation>
 <relation>
 <name>bitfield</name>
-<cardinality>13357</cardinality>
+<cardinality>13365</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13357</v>
+<v>13365</v>
 </e>
 <e>
 <k>bits</k>
@@ -31712,7 +32300,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13357</v>
+<v>13365</v>
 </b>
 </bs>
 </hist>
@@ -31728,7 +32316,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13357</v>
+<v>13365</v>
 </b>
 </bs>
 </hist>
@@ -31892,23 +32480,23 @@
 </relation>
 <relation>
 <name>initialisers</name>
-<cardinality>1685017</cardinality>
+<cardinality>1668506</cardinality>
 <columnsizes>
 <e>
 <k>init</k>
-<v>1685017</v>
+<v>1668506</v>
 </e>
 <e>
 <k>var</k>
-<v>649685</v>
+<v>643667</v>
 </e>
 <e>
 <k>expr</k>
-<v>1685017</v>
+<v>1668506</v>
 </e>
 <e>
 <k>location</k>
-<v>321906</v>
+<v>318643</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31922,7 +32510,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -31938,7 +32526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -31954,7 +32542,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -31970,22 +32558,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>562000</v>
+<v>556871</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>29079</v>
+<v>28784</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>49688</v>
+<v>49185</v>
 </b>
 <b>
 <a>17</a>
 <b>53</b>
-<v>8917</v>
+<v>8827</v>
 </b>
 </bs>
 </hist>
@@ -32001,22 +32589,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>562000</v>
+<v>556871</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>29079</v>
+<v>28784</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>49688</v>
+<v>49185</v>
 </b>
 <b>
 <a>17</a>
 <b>53</b>
-<v>8917</v>
+<v>8827</v>
 </b>
 </bs>
 </hist>
@@ -32032,7 +32620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>649672</v>
+<v>643654</v>
 </b>
 <b>
 <a>2</a>
@@ -32053,7 +32641,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -32069,7 +32657,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -32085,7 +32673,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1685017</v>
+<v>1668506</v>
 </b>
 </bs>
 </hist>
@@ -32101,27 +32689,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>248450</v>
+<v>245906</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24096</v>
+<v>23845</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>24485</v>
+<v>24243</v>
 </b>
 <b>
 <a>7</a>
 <b>65</b>
-<v>24346</v>
+<v>24126</v>
 </b>
 <b>
 <a>67</a>
 <b>109238</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -32137,22 +32725,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>271334</v>
+<v>268551</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25342</v>
+<v>25091</v>
 </b>
 <b>
 <a>3</a>
-<b>24</b>
-<v>24155</v>
+<b>23</b>
+<v>23904</v>
 </b>
 <b>
-<a>24</a>
+<a>23</a>
 <b>12632</b>
-<v>1074</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -32168,27 +32756,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>248450</v>
+<v>245906</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24096</v>
+<v>23845</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>24485</v>
+<v>24243</v>
 </b>
 <b>
 <a>7</a>
 <b>65</b>
-<v>24346</v>
+<v>24126</v>
 </b>
 <b>
 <a>67</a>
 <b>109238</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -32198,15 +32786,15 @@
 </relation>
 <relation>
 <name>expr_ancestor</name>
-<cardinality>67772</cardinality>
+<cardinality>68706</cardinality>
 <columnsizes>
 <e>
 <k>exp</k>
-<v>67176</v>
+<v>68133</v>
 </e>
 <e>
 <k>ancestor</k>
-<v>49695</v>
+<v>51330</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -32220,12 +32808,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66605</v>
+<v>67584</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>571</v>
+<v>549</v>
 </b>
 </bs>
 </hist>
@@ -32241,17 +32829,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>37405</v>
+<v>39517</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10150</v>
+<v>9756</v>
 </b>
 <b>
 <a>3</a>
 <b>29</b>
-<v>2139</v>
+<v>2056</v>
 </b>
 </bs>
 </hist>
@@ -32261,19 +32849,19 @@
 </relation>
 <relation>
 <name>exprs</name>
-<cardinality>18449753</cardinality>
+<cardinality>18460593</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>18449753</v>
+<v>18460593</v>
 </e>
 <e>
 <k>kind</k>
-<v>393</v>
+<v>1168</v>
 </e>
 <e>
 <k>location</k>
-<v>6150603</v>
+<v>3836046</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -32287,7 +32875,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18449753</v>
+<v>18460593</v>
 </b>
 </bs>
 </hist>
@@ -32303,7 +32891,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18449753</v>
+<v>18460593</v>
 </b>
 </bs>
 </hist>
@@ -32317,69 +32905,69 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>5</a>
-<b>28</b>
-<v>30</v>
+<a>1</a>
+<b>14</b>
+<v>105</v>
 </b>
 <b>
-<a>71</a>
-<b>82</b>
-<v>30</v>
+<a>15</a>
+<b>44</b>
+<v>93</v>
 </b>
 <b>
-<a>94</a>
-<b>255</b>
-<v>30</v>
+<a>47</a>
+<b>86</b>
+<v>93</v>
 </b>
 <b>
-<a>271</a>
-<b>627</b>
-<v>30</v>
+<a>90</a>
+<b>223</b>
+<v>93</v>
 </b>
 <b>
-<a>858</a>
-<b>1879</b>
-<v>30</v>
+<a>296</a>
+<b>463</b>
+<v>93</v>
 </b>
 <b>
-<a>2191</a>
-<b>3716</b>
-<v>30</v>
+<a>483</a>
+<b>715</b>
+<v>93</v>
 </b>
 <b>
-<a>4305</a>
-<b>6068</b>
-<v>30</v>
+<a>788</a>
+<b>2129</b>
+<v>93</v>
 </b>
 <b>
-<a>7004</a>
-<b>11661</b>
-<v>30</v>
+<a>2165</a>
+<b>2950</b>
+<v>93</v>
 </b>
 <b>
-<a>12107</a>
-<b>20202</b>
-<v>30</v>
+<a>3030</a>
+<b>4378</b>
+<v>93</v>
 </b>
 <b>
-<a>21965</a>
-<b>29561</b>
-<v>30</v>
+<a>4477</a>
+<b>6077</b>
+<v>93</v>
 </b>
 <b>
-<a>32830</a>
-<b>41032</b>
-<v>30</v>
+<a>6490</a>
+<b>17249</b>
+<v>93</v>
 </b>
 <b>
-<a>44670</a>
-<b>145995</b>
-<v>30</v>
+<a>19347</a>
+<b>188353</b>
+<v>93</v>
 </b>
 <b>
-<a>447805</a>
-<b>725766</b>
-<v>24</v>
+<a>191022</a>
+<b>403956</b>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -32394,68 +32982,68 @@
 <bs>
 <b>
 <a>1</a>
+<b>4</b>
+<v>105</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>105</v>
+</b>
+<b>
+<a>13</a>
 <b>24</b>
-<v>30</v>
+<v>93</v>
 </b>
 <b>
-<a>27</a>
-<b>72</b>
-<v>30</v>
+<a>24</a>
+<b>38</b>
+<v>93</v>
 </b>
 <b>
-<a>77</a>
-<b>157</b>
-<v>30</v>
+<a>38</a>
+<b>134</b>
+<v>93</v>
 </b>
 <b>
-<a>171</a>
-<b>402</b>
-<v>30</v>
+<a>144</a>
+<b>259</b>
+<v>93</v>
 </b>
 <b>
-<a>422</a>
-<b>1083</b>
-<v>30</v>
+<a>269</a>
+<b>480</b>
+<v>93</v>
 </b>
 <b>
-<a>1179</a>
-<b>1862</b>
-<v>30</v>
+<a>481</a>
+<b>1074</b>
+<v>93</v>
 </b>
 <b>
-<a>2201</a>
-<b>4268</b>
-<v>30</v>
+<a>1095</a>
+<b>1411</b>
+<v>93</v>
 </b>
 <b>
-<a>4679</a>
-<b>6584</b>
-<v>30</v>
+<a>1422</a>
+<b>2045</b>
+<v>93</v>
 </b>
 <b>
-<a>6624</a>
-<b>11083</b>
-<v>30</v>
+<a>2059</a>
+<b>4557</b>
+<v>93</v>
 </b>
 <b>
-<a>11359</a>
-<b>12983</b>
-<v>30</v>
+<a>5888</a>
+<b>59687</b>
+<v>93</v>
 </b>
 <b>
-<a>17158</a>
-<b>28621</b>
-<v>30</v>
-</b>
-<b>
-<a>29980</a>
-<b>88945</b>
-<v>30</v>
-</b>
-<b>
-<a>128315</a>
-<b>425042</b>
-<v>24</v>
+<a>72153</a>
+<b>117893</b>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -32471,22 +33059,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4450587</v>
+<v>1838158</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>874643</v>
+<v>753582</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>496205</v>
+<b>4</b>
+<v>356208</v>
 </b>
 <b>
-<a>6</a>
-<b>22445</b>
-<v>329167</v>
+<a>4</a>
+<b>5</b>
+<v>276250</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>301489</v>
+</b>
+<b>
+<a>9</a>
+<b>72</b>
+<v>287759</v>
+</b>
+<b>
+<a>72</a>
+<b>136887</b>
+<v>22598</v>
 </b>
 </bs>
 </hist>
@@ -32502,22 +33105,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4599301</v>
+<v>2734142</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>812812</v>
+<v>859259</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>498909</v>
-</b>
-<b>
-<a>5</a>
-<b>33</b>
-<v>239579</v>
+<b>30</b>
+<v>242644</v>
 </b>
 </bs>
 </hist>
@@ -32527,19 +33125,19 @@
 </relation>
 <relation>
 <name>expr_types</name>
-<cardinality>18617706</cardinality>
+<cardinality>18629051</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>18444987</v>
+<v>18456012</v>
 </e>
 <e>
 <k>typeid</k>
-<v>1372691</v>
+<v>1345343</v>
 </e>
 <e>
 <k>value_category</k>
-<v>36</v>
+<v>35</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -32553,12 +33151,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18272500</v>
+<v>18283254</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>172487</v>
+<v>172758</v>
 </b>
 </bs>
 </hist>
@@ -32574,7 +33172,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18444987</v>
+<v>18456012</v>
 </b>
 </bs>
 </hist>
@@ -32590,42 +33188,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>530591</v>
+<v>526443</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>259102</v>
+<v>254107</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113553</v>
+<v>110864</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>95427</v>
+<v>92110</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>122925</v>
+<v>118483</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>105736</v>
+<v>102381</v>
 </b>
 <b>
 <a>14</a>
-<b>46</b>
-<v>103864</v>
+<b>47</b>
+<v>101797</v>
 </b>
 <b>
-<a>46</a>
-<b>111456</b>
-<v>41489</v>
+<a>47</a>
+<b>123210</b>
+<v>39155</v>
 </b>
 </bs>
 </hist>
@@ -32641,17 +33239,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1207109</v>
+<v>1185928</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>157753</v>
+<v>151877</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7828</v>
+<v>7536</v>
 </b>
 </bs>
 </hist>
@@ -32667,17 +33265,17 @@
 <b>
 <a>4533</a>
 <b>4534</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>340895</a>
-<b>340896</b>
-<v>12</v>
+<a>342547</a>
+<b>342548</b>
+<v>11</v>
 </b>
 <b>
-<a>1171875</a>
-<b>1171876</b>
-<v>12</v>
+<a>1232420</a>
+<b>1232421</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -32691,19 +33289,19 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1340</a>
-<b>1341</b>
-<v>12</v>
+<a>1341</a>
+<b>1342</b>
+<v>11</v>
 </b>
 <b>
-<a>29733</a>
-<b>29734</b>
-<v>12</v>
+<a>29841</a>
+<b>29842</b>
+<v>11</v>
 </b>
 <b>
-<a>96111</a>
-<b>96112</b>
-<v>12</v>
+<a>98243</a>
+<b>98244</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -32713,15 +33311,15 @@
 </relation>
 <relation>
 <name>new_allocated_type</name>
-<cardinality>29527</cardinality>
+<cardinality>28382</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>29527</v>
+<v>28382</v>
 </e>
 <e>
 <k>type_id</k>
-<v>18234</v>
+<v>17527</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -32735,7 +33333,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29527</v>
+<v>28382</v>
 </b>
 </bs>
 </hist>
@@ -32751,22 +33349,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12667</v>
+<v>12175</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4035</v>
+<v>3879</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>1446</v>
+<v>1390</v>
 </b>
 <b>
 <a>10</a>
 <b>92</b>
-<v>85</v>
+<v>81</v>
 </b>
 </bs>
 </hist>
@@ -32776,15 +33374,15 @@
 </relation>
 <relation>
 <name>new_array_allocated_type</name>
-<cardinality>5364</cardinality>
+<cardinality>5310</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>5364</v>
+<v>5310</v>
 </e>
 <e>
 <k>type_id</k>
-<v>2306</v>
+<v>2283</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -32798,7 +33396,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5364</v>
+<v>5310</v>
 </b>
 </bs>
 </hist>
@@ -32819,12 +33417,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2043</v>
+<v>2022</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>177</v>
+<v>176</v>
 </b>
 <b>
 <a>8</a>
@@ -33376,15 +33974,15 @@
 </relation>
 <relation>
 <name>condition_decl_bind</name>
-<cardinality>7646</cardinality>
+<cardinality>7349</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>7646</v>
+<v>7349</v>
 </e>
 <e>
 <k>decl</k>
-<v>7646</v>
+<v>7349</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33398,7 +33996,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7646</v>
+<v>7349</v>
 </b>
 </bs>
 </hist>
@@ -33414,7 +34012,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7646</v>
+<v>7349</v>
 </b>
 </bs>
 </hist>
@@ -33424,15 +34022,15 @@
 </relation>
 <relation>
 <name>typeid_bind</name>
-<cardinality>4899</cardinality>
+<cardinality>4708</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>4899</v>
+<v>4708</v>
 </e>
 <e>
 <k>type_id</k>
-<v>2601</v>
+<v>2500</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33446,7 +34044,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4899</v>
+<v>4708</v>
 </b>
 </bs>
 </hist>
@@ -33462,22 +34060,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1300</v>
+<v>1250</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>996</v>
+<v>958</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>230</v>
+<v>222</v>
 </b>
 <b>
 <a>6</a>
 <b>17</b>
-<v>72</v>
+<v>70</v>
 </b>
 </bs>
 </hist>
@@ -33487,15 +34085,15 @@
 </relation>
 <relation>
 <name>uuidof_bind</name>
-<cardinality>856</cardinality>
+<cardinality>848</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>856</v>
+<v>848</v>
 </e>
 <e>
 <k>type_id</k>
-<v>652</v>
+<v>645</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33509,7 +34107,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>856</v>
+<v>848</v>
 </b>
 </bs>
 </hist>
@@ -33525,12 +34123,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>481</v>
+<v>476</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>138</v>
+<v>137</v>
 </b>
 <b>
 <a>3</a>
@@ -33545,15 +34143,15 @@
 </relation>
 <relation>
 <name>sizeof_bind</name>
-<cardinality>156997</cardinality>
+<cardinality>157089</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>156997</v>
+<v>157089</v>
 </e>
 <e>
 <k>type_id</k>
-<v>2673</v>
+<v>2674</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33567,7 +34165,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156997</v>
+<v>157089</v>
 </b>
 </bs>
 </hist>
@@ -33583,7 +34181,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1044</v>
+<v>1045</v>
 </b>
 <b>
 <a>2</a>
@@ -33681,11 +34279,11 @@
 </relation>
 <relation>
 <name>lambdas</name>
-<cardinality>12641</cardinality>
+<cardinality>12513</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>12641</v>
+<v>12513</v>
 </e>
 <e>
 <k>default_capture</k>
@@ -33707,7 +34305,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12641</v>
+<v>12513</v>
 </b>
 </bs>
 </hist>
@@ -33723,7 +34321,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12641</v>
+<v>12513</v>
 </b>
 </bs>
 </hist>
@@ -33812,23 +34410,23 @@
 </relation>
 <relation>
 <name>lambda_capture</name>
-<cardinality>21730</cardinality>
+<cardinality>21509</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21730</v>
+<v>21509</v>
 </e>
 <e>
 <k>lambda</k>
-<v>10097</v>
+<v>9994</v>
 </e>
 <e>
 <k>index</k>
-<v>112</v>
+<v>110</v>
 </e>
 <e>
 <k>field</k>
-<v>21730</v>
+<v>21509</v>
 </e>
 <e>
 <k>captured_by_reference</k>
@@ -33840,7 +34438,7 @@
 </e>
 <e>
 <k>location</k>
-<v>14051</v>
+<v>13909</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33854,7 +34452,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33870,7 +34468,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33886,7 +34484,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33902,7 +34500,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33918,7 +34516,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33934,7 +34532,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -33950,27 +34548,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5002</v>
+<v>4951</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2379</v>
+<v>2355</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1265</v>
+<v>1252</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>922</v>
+<v>913</v>
 </b>
 <b>
 <a>6</a>
 <b>18</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -33986,27 +34584,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5002</v>
+<v>4951</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2379</v>
+<v>2355</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1265</v>
+<v>1252</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>922</v>
+<v>913</v>
 </b>
 <b>
 <a>6</a>
 <b>18</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -34022,27 +34620,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5002</v>
+<v>4951</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2379</v>
+<v>2355</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1265</v>
+<v>1252</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>922</v>
+<v>913</v>
 </b>
 <b>
 <a>6</a>
 <b>18</b>
-<v>527</v>
+<v>521</v>
 </b>
 </bs>
 </hist>
@@ -34058,12 +34656,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9629</v>
+<v>9531</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>467</v>
+<v>463</v>
 </b>
 </bs>
 </hist>
@@ -34079,7 +34677,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10077</v>
+<v>9975</v>
 </b>
 <b>
 <a>2</a>
@@ -34100,27 +34698,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5483</v>
+<v>5428</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2504</v>
+<v>2479</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1041</v>
+<v>1030</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>823</v>
+<v>815</v>
 </b>
 <b>
 <a>7</a>
 <b>18</b>
-<v>243</v>
+<v>241</v>
 </b>
 </bs>
 </hist>
@@ -34429,7 +35027,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>85</v>
+<v>84</v>
 </b>
 </bs>
 </hist>
@@ -34450,7 +35048,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>46</v>
+<v>45</v>
 </b>
 </bs>
 </hist>
@@ -34562,7 +35160,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34578,7 +35176,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34594,7 +35192,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34610,7 +35208,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34626,7 +35224,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34642,7 +35240,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21730</v>
+<v>21509</v>
 </b>
 </bs>
 </hist>
@@ -34900,17 +35498,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12667</v>
+<v>12539</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>1061</v>
+<v>1050</v>
 </b>
 <b>
 <a>6</a>
 <b>68</b>
-<v>322</v>
+<v>319</v>
 </b>
 </bs>
 </hist>
@@ -34926,12 +35524,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13115</v>
+<v>12982</v>
 </b>
 <b>
 <a>2</a>
 <b>68</b>
-<v>935</v>
+<v>926</v>
 </b>
 </bs>
 </hist>
@@ -34947,12 +35545,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13511</v>
+<v>13374</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>540</v>
+<v>534</v>
 </b>
 </bs>
 </hist>
@@ -34968,17 +35566,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12667</v>
+<v>12539</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>1061</v>
+<v>1050</v>
 </b>
 <b>
 <a>6</a>
 <b>68</b>
-<v>322</v>
+<v>319</v>
 </b>
 </bs>
 </hist>
@@ -34994,7 +35592,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14032</v>
+<v>13889</v>
 </b>
 <b>
 <a>2</a>
@@ -35015,7 +35613,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14051</v>
+<v>13909</v>
 </b>
 </bs>
 </hist>
@@ -35141,19 +35739,19 @@
 </relation>
 <relation>
 <name>stmts</name>
-<cardinality>4943740</cardinality>
+<cardinality>4765273</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4943740</v>
+<v>4765273</v>
 </e>
 <e>
 <k>kind</k>
-<v>230</v>
+<v>222</v>
 </e>
 <e>
 <k>location</k>
-<v>1317574</v>
+<v>1266448</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35167,7 +35765,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4943740</v>
+<v>4765273</v>
 </b>
 </bs>
 </hist>
@@ -35183,7 +35781,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4943740</v>
+<v>4765273</v>
 </b>
 </bs>
 </hist>
@@ -35199,97 +35797,97 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28</a>
 <b>29</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>338</a>
 <b>339</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>473</a>
 <b>474</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>690</a>
 <b>691</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1560</a>
 <b>1561</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1757</a>
 <b>1758</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>2076</a>
-<b>2077</b>
-<v>12</v>
+<a>2080</a>
+<b>2081</b>
+<v>11</v>
 </b>
 <b>
-<a>2191</a>
-<b>2192</b>
-<v>12</v>
+<a>2193</a>
+<b>2194</b>
+<v>11</v>
 </b>
 <b>
 <a>2707</a>
 <b>2708</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2748</a>
 <b>2749</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>2944</a>
-<b>2945</b>
-<v>12</v>
+<a>2946</a>
+<b>2947</b>
+<v>11</v>
 </b>
 <b>
 <a>3296</a>
 <b>3297</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>4540</a>
 <b>4541</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
-<a>28688</a>
-<b>28689</b>
-<v>12</v>
+<a>28694</a>
+<b>28695</b>
+<v>11</v>
 </b>
 <b>
-<a>53254</a>
-<b>53255</b>
-<v>12</v>
+<a>53369</a>
+<b>53370</b>
+<v>11</v>
 </b>
 <b>
-<a>85878</a>
-<b>85879</b>
-<v>12</v>
+<a>86211</a>
+<b>86212</b>
+<v>11</v>
 </b>
 <b>
-<a>98483</a>
-<b>98484</b>
-<v>12</v>
+<a>98824</a>
+<b>98825</b>
+<v>11</v>
 </b>
 <b>
-<a>115024</a>
-<b>115025</b>
-<v>12</v>
+<a>115365</a>
+<b>115366</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -35305,97 +35903,97 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>23</a>
 <b>24</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>106</a>
 <b>107</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>112</a>
 <b>113</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>178</a>
 <b>179</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>252</a>
 <b>253</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>296</a>
 <b>297</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>661</a>
 <b>662</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>663</a>
 <b>664</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>991</a>
 <b>992</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1030</a>
 <b>1031</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1408</a>
 <b>1409</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1918</a>
 <b>1919</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>2676</a>
 <b>2677</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10172</a>
 <b>10173</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>10231</a>
 <b>10232</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>22268</a>
 <b>22269</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>26534</a>
 <b>26535</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>31957</a>
 <b>31958</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -35411,32 +36009,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>779628</v>
+<v>747015</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>179173</v>
+<v>173050</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>120275</v>
+<v>116169</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>106891</v>
+<v>103199</v>
 </b>
 <b>
 <a>6</a>
 <b>19</b>
-<v>102794</v>
+<v>99168</v>
 </b>
 <b>
 <a>19</a>
-<b>4895</b>
-<v>28810</v>
+<b>4923</b>
+<v>27844</v>
 </b>
 </bs>
 </hist>
@@ -35452,12 +36050,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1291693</v>
+<v>1241571</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>25881</v>
+<v>24876</v>
 </b>
 </bs>
 </hist>
@@ -35563,15 +36161,15 @@
 </relation>
 <relation>
 <name>if_then</name>
-<cardinality>524558</cardinality>
+<cardinality>524866</cardinality>
 <columnsizes>
 <e>
 <k>if_stmt</k>
-<v>524558</v>
+<v>524866</v>
 </e>
 <e>
 <k>then_id</k>
-<v>524558</v>
+<v>524866</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35585,7 +36183,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>524558</v>
+<v>524866</v>
 </b>
 </bs>
 </hist>
@@ -35601,7 +36199,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>524558</v>
+<v>524866</v>
 </b>
 </bs>
 </hist>
@@ -35611,15 +36209,15 @@
 </relation>
 <relation>
 <name>if_else</name>
-<cardinality>148234</cardinality>
+<cardinality>148322</cardinality>
 <columnsizes>
 <e>
 <k>if_stmt</k>
-<v>148234</v>
+<v>148322</v>
 </e>
 <e>
 <k>else_id</k>
-<v>148234</v>
+<v>148322</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35633,7 +36231,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>148234</v>
+<v>148322</v>
 </b>
 </bs>
 </hist>
@@ -35649,7 +36247,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>148234</v>
+<v>148322</v>
 </b>
 </bs>
 </hist>
@@ -35755,15 +36353,15 @@
 </relation>
 <relation>
 <name>while_body</name>
-<cardinality>32907</cardinality>
+<cardinality>31630</cardinality>
 <columnsizes>
 <e>
 <k>while_stmt</k>
-<v>32907</v>
+<v>31630</v>
 </e>
 <e>
 <k>body_id</k>
-<v>32907</v>
+<v>31630</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35777,7 +36375,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32907</v>
+<v>31630</v>
 </b>
 </bs>
 </hist>
@@ -35793,7 +36391,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32907</v>
+<v>31630</v>
 </b>
 </bs>
 </hist>
@@ -35803,15 +36401,15 @@
 </relation>
 <relation>
 <name>do_body</name>
-<cardinality>149900</cardinality>
+<cardinality>149988</cardinality>
 <columnsizes>
 <e>
 <k>do_stmt</k>
-<v>149900</v>
+<v>149988</v>
 </e>
 <e>
 <k>body_id</k>
-<v>149900</v>
+<v>149988</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35825,7 +36423,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>149900</v>
+<v>149988</v>
 </b>
 </bs>
 </hist>
@@ -35841,7 +36439,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>149900</v>
+<v>149988</v>
 </b>
 </bs>
 </hist>
@@ -35851,11 +36449,11 @@
 </relation>
 <relation>
 <name>switch_case</name>
-<cardinality>281530</cardinality>
+<cardinality>281695</cardinality>
 <columnsizes>
 <e>
 <k>switch_stmt</k>
-<v>55225</v>
+<v>55258</v>
 </e>
 <e>
 <k>index</k>
@@ -35863,7 +36461,7 @@
 </e>
 <e>
 <k>case_id</k>
-<v>281530</v>
+<v>281695</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35877,17 +36475,17 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>4288</v>
+<v>4290</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>48725</v>
+<v>48753</v>
 </b>
 <b>
 <a>6</a>
 <b>156</b>
-<v>2212</v>
+<v>2213</v>
 </b>
 </bs>
 </hist>
@@ -35903,17 +36501,17 @@
 <b>
 <a>1</a>
 <b>5</b>
-<v>4288</v>
+<v>4290</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>48725</v>
+<v>48753</v>
 </b>
 <b>
 <a>6</a>
 <b>156</b>
-<v>2212</v>
+<v>2213</v>
 </b>
 </bs>
 </hist>
@@ -36031,7 +36629,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>281530</v>
+<v>281695</v>
 </b>
 </bs>
 </hist>
@@ -36047,7 +36645,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>281530</v>
+<v>281695</v>
 </b>
 </bs>
 </hist>
@@ -36057,15 +36655,15 @@
 </relation>
 <relation>
 <name>switch_body</name>
-<cardinality>55225</cardinality>
+<cardinality>55258</cardinality>
 <columnsizes>
 <e>
 <k>switch_stmt</k>
-<v>55225</v>
+<v>55258</v>
 </e>
 <e>
 <k>body_id</k>
-<v>55225</v>
+<v>55258</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36079,7 +36677,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55225</v>
+<v>55258</v>
 </b>
 </bs>
 </hist>
@@ -36095,7 +36693,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55225</v>
+<v>55258</v>
 </b>
 </bs>
 </hist>
@@ -36105,15 +36703,15 @@
 </relation>
 <relation>
 <name>for_initialization</name>
-<cardinality>29922</cardinality>
+<cardinality>29619</cardinality>
 <columnsizes>
 <e>
 <k>for_stmt</k>
-<v>29922</v>
+<v>29619</v>
 </e>
 <e>
 <k>init_id</k>
-<v>29922</v>
+<v>29619</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36127,7 +36725,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29922</v>
+<v>29619</v>
 </b>
 </bs>
 </hist>
@@ -36143,7 +36741,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29922</v>
+<v>29619</v>
 </b>
 </bs>
 </hist>
@@ -36153,15 +36751,15 @@
 </relation>
 <relation>
 <name>for_condition</name>
-<cardinality>31781</cardinality>
+<cardinality>31459</cardinality>
 <columnsizes>
 <e>
 <k>for_stmt</k>
-<v>31781</v>
+<v>31459</v>
 </e>
 <e>
 <k>condition_id</k>
-<v>31781</v>
+<v>31459</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36175,7 +36773,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31781</v>
+<v>31459</v>
 </b>
 </bs>
 </hist>
@@ -36191,7 +36789,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31781</v>
+<v>31459</v>
 </b>
 </bs>
 </hist>
@@ -36201,15 +36799,15 @@
 </relation>
 <relation>
 <name>for_update</name>
-<cardinality>29659</cardinality>
+<cardinality>29358</cardinality>
 <columnsizes>
 <e>
 <k>for_stmt</k>
-<v>29659</v>
+<v>29358</v>
 </e>
 <e>
 <k>update_id</k>
-<v>29659</v>
+<v>29358</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36223,7 +36821,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29659</v>
+<v>29358</v>
 </b>
 </bs>
 </hist>
@@ -36239,7 +36837,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29659</v>
+<v>29358</v>
 </b>
 </bs>
 </hist>
@@ -36249,15 +36847,15 @@
 </relation>
 <relation>
 <name>for_body</name>
-<cardinality>32387</cardinality>
+<cardinality>32059</cardinality>
 <columnsizes>
 <e>
 <k>for_stmt</k>
-<v>32387</v>
+<v>32059</v>
 </e>
 <e>
 <k>body_id</k>
-<v>32387</v>
+<v>32059</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36271,7 +36869,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32387</v>
+<v>32059</v>
 </b>
 </bs>
 </hist>
@@ -36287,7 +36885,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32387</v>
+<v>32059</v>
 </b>
 </bs>
 </hist>
@@ -36297,19 +36895,19 @@
 </relation>
 <relation>
 <name>stmtparents</name>
-<cardinality>4168478</cardinality>
+<cardinality>4131960</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4168478</v>
+<v>4131960</v>
 </e>
 <e>
 <k>index</k>
-<v>12799</v>
+<v>836</v>
 </e>
 <e>
 <k>parent</k>
-<v>1762006</v>
+<v>1583254</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36323,7 +36921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4168478</v>
+<v>4131960</v>
 </b>
 </bs>
 </hist>
@@ -36339,7 +36937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4168478</v>
+<v>4131960</v>
 </b>
 </bs>
 </hist>
@@ -36355,52 +36953,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4020</v>
+<v>182</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1094</v>
+<v>149</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>520</v>
+<b>5</b>
+<v>41</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>1496</v>
+<a>5</a>
+<b>7</b>
+<v>72</v>
 </b>
 <b>
 <a>7</a>
-<b>8</b>
-<v>1047</v>
+<b>9</b>
+<v>68</v>
 </b>
 <b>
-<a>8</a>
-<b>12</b>
-<v>830</v>
+<a>9</a>
+<b>18</b>
+<v>63</v>
 </b>
 <b>
-<a>12</a>
-<b>29</b>
-<v>1127</v>
+<a>18</a>
+<b>39</b>
+<v>64</v>
 </b>
 <b>
-<a>29</a>
-<b>37</b>
-<v>909</v>
+<a>39</a>
+<b>111</b>
+<v>63</v>
 </b>
 <b>
-<a>37</a>
-<b>74</b>
-<v>975</v>
+<a>112</a>
+<b>836</b>
+<v>63</v>
 </b>
 <b>
-<a>74</a>
-<b>191996</b>
-<v>777</v>
+<a>920</a>
+<b>136298</b>
+<v>63</v>
+</b>
+<b>
+<a>254134</a>
+<b>706946</b>
+<v>5</v>
 </b>
 </bs>
 </hist>
@@ -36416,52 +37019,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4020</v>
+<v>182</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1094</v>
+<v>149</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>520</v>
+<b>5</b>
+<v>41</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>1496</v>
+<a>5</a>
+<b>7</b>
+<v>72</v>
 </b>
 <b>
 <a>7</a>
-<b>8</b>
-<v>1047</v>
+<b>9</b>
+<v>68</v>
 </b>
 <b>
-<a>8</a>
-<b>12</b>
-<v>830</v>
+<a>9</a>
+<b>18</b>
+<v>63</v>
 </b>
 <b>
-<a>12</a>
-<b>29</b>
-<v>1127</v>
+<a>18</a>
+<b>39</b>
+<v>64</v>
 </b>
 <b>
-<a>29</a>
-<b>37</b>
-<v>909</v>
+<a>39</a>
+<b>111</b>
+<v>63</v>
 </b>
 <b>
-<a>37</a>
-<b>74</b>
-<v>975</v>
+<a>112</a>
+<b>836</b>
+<v>63</v>
 </b>
 <b>
-<a>74</a>
-<b>191996</b>
-<v>777</v>
+<a>920</a>
+<b>136298</b>
+<v>63</v>
+</b>
+<b>
+<a>254134</a>
+<b>706946</b>
+<v>5</v>
 </b>
 </bs>
 </hist>
@@ -36477,32 +37085,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1004414</v>
+<v>841847</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>386602</v>
+<v>376317</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>109343</v>
+<v>145318</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>115439</v>
+<b>9</b>
+<v>119501</v>
 </b>
 <b>
-<a>6</a>
-<b>17</b>
-<v>133386</v>
-</b>
-<b>
-<a>17</a>
-<b>1943</b>
-<v>12819</v>
+<a>9</a>
+<b>465</b>
+<v>100269</v>
 </b>
 </bs>
 </hist>
@@ -36518,32 +37121,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1004414</v>
+<v>841847</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>386602</v>
+<v>376317</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>109343</v>
+<v>145318</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>115439</v>
+<b>9</b>
+<v>119501</v>
 </b>
 <b>
-<a>6</a>
-<b>17</b>
-<v>133386</v>
-</b>
-<b>
-<a>17</a>
-<b>1943</b>
-<v>12819</v>
+<a>9</a>
+<b>465</b>
+<v>100269</v>
 </b>
 </bs>
 </hist>
@@ -36553,26 +37151,26 @@
 </relation>
 <relation>
 <name>ishandler</name>
-<cardinality>21888</cardinality>
+<cardinality>21666</cardinality>
 <columnsizes>
 <e>
 <k>block</k>
-<v>21888</v>
+<v>21666</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>successors</name>
-<cardinality>17214104</cardinality>
+<cardinality>17224218</cardinality>
 <columnsizes>
 <e>
 <k>from</k>
-<v>16042874</v>
+<v>16052300</v>
 </e>
 <e>
 <k>to</k>
-<v>16040997</v>
+<v>16050421</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36586,12 +37184,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15044821</v>
+<v>15053661</v>
 </b>
 <b>
 <a>2</a>
 <b>156</b>
-<v>998052</v>
+<v>998638</v>
 </b>
 </bs>
 </hist>
@@ -36607,12 +37205,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15328885</v>
+<v>15337891</v>
 </b>
 <b>
 <a>2</a>
 <b>419</b>
-<v>712111</v>
+<v>712530</v>
 </b>
 </bs>
 </hist>
@@ -36622,15 +37220,15 @@
 </relation>
 <relation>
 <name>truecond</name>
-<cardinality>966805</cardinality>
+<cardinality>967373</cardinality>
 <columnsizes>
 <e>
 <k>from</k>
-<v>966805</v>
+<v>967373</v>
 </e>
 <e>
 <k>to</k>
-<v>937112</v>
+<v>937663</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36644,7 +37242,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>966805</v>
+<v>967373</v>
 </b>
 </bs>
 </hist>
@@ -36660,12 +37258,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>913540</v>
+<v>914077</v>
 </b>
 <b>
 <a>2</a>
 <b>21</b>
-<v>23572</v>
+<v>23585</v>
 </b>
 </bs>
 </hist>
@@ -36675,15 +37273,15 @@
 </relation>
 <relation>
 <name>falsecond</name>
-<cardinality>966805</cardinality>
+<cardinality>967373</cardinality>
 <columnsizes>
 <e>
 <k>from</k>
-<v>966805</v>
+<v>967373</v>
 </e>
 <e>
 <k>to</k>
-<v>812105</v>
+<v>812583</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36697,7 +37295,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>966805</v>
+<v>967373</v>
 </b>
 </bs>
 </hist>
@@ -36713,17 +37311,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>698749</v>
+<v>699160</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87006</v>
+<v>87057</v>
 </b>
 <b>
 <a>3</a>
 <b>25</b>
-<v>26349</v>
+<v>26365</v>
 </b>
 </bs>
 </hist>
@@ -36733,11 +37331,11 @@
 </relation>
 <relation>
 <name>stmt_decl_bind</name>
-<cardinality>538233</cardinality>
+<cardinality>532777</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>531279</v>
+<v>525894</v>
 </e>
 <e>
 <k>num</k>
@@ -36745,7 +37343,7 @@
 </e>
 <e>
 <k>decl</k>
-<v>538233</v>
+<v>532777</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36759,12 +37357,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>525776</v>
+<v>520447</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>5503</v>
+<v>5447</v>
 </b>
 </bs>
 </hist>
@@ -36780,12 +37378,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>525756</v>
+<v>520427</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>5523</v>
+<v>5467</v>
 </b>
 </bs>
 </hist>
@@ -36903,7 +37501,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>538233</v>
+<v>532777</v>
 </b>
 </bs>
 </hist>
@@ -36919,7 +37517,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>538233</v>
+<v>532777</v>
 </b>
 </bs>
 </hist>
@@ -36929,19 +37527,19 @@
 </relation>
 <relation>
 <name>stmt_decl_entry_bind</name>
-<cardinality>519726</cardinality>
+<cardinality>520031</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>474524</v>
+<v>474803</v>
 </e>
 <e>
 <k>num</k>
-<v>491</v>
+<v>492</v>
 </e>
 <e>
 <k>decl_entry</k>
-<v>495657</v>
+<v>495948</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36955,12 +37553,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441842</v>
+<v>442101</v>
 </b>
 <b>
 <a>2</a>
 <b>274</b>
-<v>32682</v>
+<v>32702</v>
 </b>
 </bs>
 </hist>
@@ -36976,12 +37574,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441842</v>
+<v>442101</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>32682</v>
+<v>32702</v>
 </b>
 </bs>
 </hist>
@@ -37064,12 +37662,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>483634</v>
+<v>483918</v>
 </b>
 <b>
 <a>2</a>
 <b>85</b>
-<v>12022</v>
+<v>12029</v>
 </b>
 </bs>
 </hist>
@@ -37085,7 +37683,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>495588</v>
+<v>495879</v>
 </b>
 <b>
 <a>2</a>
@@ -37100,15 +37698,15 @@
 </relation>
 <relation>
 <name>blockscope</name>
-<cardinality>1398256</cardinality>
+<cardinality>1347984</cardinality>
 <columnsizes>
 <e>
 <k>block</k>
-<v>1398256</v>
+<v>1347984</v>
 </e>
 <e>
 <k>enclosing</k>
-<v>1254288</v>
+<v>1209602</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37122,7 +37720,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1398256</v>
+<v>1347984</v>
 </b>
 </bs>
 </hist>
@@ -37138,12 +37736,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1171636</v>
+<v>1130157</v>
 </b>
 <b>
 <a>2</a>
 <b>509</b>
-<v>82651</v>
+<v>79444</v>
 </b>
 </bs>
 </hist>
@@ -37153,19 +37751,19 @@
 </relation>
 <relation>
 <name>jumpinfo</name>
-<cardinality>366503</cardinality>
+<cardinality>366719</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>366503</v>
+<v>366719</v>
 </e>
 <e>
 <k>str</k>
-<v>6361</v>
+<v>6365</v>
 </e>
 <e>
 <k>target</k>
-<v>85508</v>
+<v>85558</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37179,7 +37777,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366503</v>
+<v>366719</v>
 </b>
 </bs>
 </hist>
@@ -37195,7 +37793,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366503</v>
+<v>366719</v>
 </b>
 </bs>
 </hist>
@@ -37216,12 +37814,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3507</v>
+<v>3509</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>835</v>
+<v>836</v>
 </b>
 <b>
 <a>4</a>
@@ -37231,12 +37829,12 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>491</v>
+<v>492</v>
 </b>
 <b>
 <a>7</a>
 <b>15</b>
-<v>500</v>
+<v>501</v>
 </b>
 <b>
 <a>15</a>
@@ -37257,12 +37855,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5095</v>
+<v>5098</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>700</v>
+<v>701</v>
 </b>
 <b>
 <a>3</a>
@@ -37293,32 +37891,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>21251</v>
+<v>21263</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7559</v>
+<v>7564</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3816</v>
+<v>3818</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>39695</v>
+<v>39718</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>11019</v>
+<v>11025</v>
 </b>
 <b>
 <a>7</a>
 <b>162</b>
-<v>1880</v>
+<v>1882</v>
 </b>
 </bs>
 </hist>
@@ -37334,7 +37932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85508</v>
+<v>85558</v>
 </b>
 </bs>
 </hist>
@@ -37344,19 +37942,19 @@
 </relation>
 <relation>
 <name>preprocdirects</name>
-<cardinality>1456121</cardinality>
+<cardinality>1399618</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1456121</v>
+<v>1399618</v>
 </e>
 <e>
 <k>kind</k>
-<v>158</v>
+<v>151</v>
 </e>
 <e>
 <k>location</k>
-<v>1449131</v>
+<v>1392900</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37370,7 +37968,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1456121</v>
+<v>1399618</v>
 </b>
 </bs>
 </hist>
@@ -37386,7 +37984,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1456121</v>
+<v>1399618</v>
 </b>
 </bs>
 </hist>
@@ -37402,67 +38000,67 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>500</a>
 <b>501</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>929</a>
 <b>930</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1740</a>
 <b>1741</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1873</a>
 <b>1874</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5235</a>
 <b>5236</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5497</a>
 <b>5498</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7551</a>
 <b>7552</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>14073</a>
 <b>14074</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>26464</a>
 <b>26465</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>27121</a>
 <b>27122</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28787</a>
 <b>28788</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -37478,67 +38076,67 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>500</a>
 <b>501</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>929</a>
 <b>930</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1740</a>
 <b>1741</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>1873</a>
 <b>1874</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5235</a>
 <b>5236</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>5497</a>
 <b>5498</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>7551</a>
 <b>7552</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>14073</a>
 <b>14074</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>26122</a>
 <b>26123</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>27121</a>
 <b>27122</b>
-<v>12</v>
+<v>11</v>
 </b>
 <b>
 <a>28555</a>
 <b>28556</b>
-<v>12</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -37554,12 +38152,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1448766</v>
+<v>1392549</v>
 </b>
 <b>
 <a>2</a>
 <b>234</b>
-<v>364</v>
+<v>350</v>
 </b>
 </bs>
 </hist>
@@ -37575,7 +38173,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1449131</v>
+<v>1392900</v>
 </b>
 </bs>
 </hist>
@@ -37585,15 +38183,15 @@
 </relation>
 <relation>
 <name>preprocpair</name>
-<cardinality>416102</cardinality>
+<cardinality>399956</cardinality>
 <columnsizes>
 <e>
 <k>begin</k>
-<v>329694</v>
+<v>316901</v>
 </e>
 <e>
 <k>elseelifend</k>
-<v>416102</v>
+<v>399956</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37607,17 +38205,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261399</v>
+<v>251256</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>60247</v>
+<v>57909</v>
 </b>
 <b>
 <a>3</a>
 <b>53</b>
-<v>8047</v>
+<v>7735</v>
 </b>
 </bs>
 </hist>
@@ -37633,7 +38231,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>416102</v>
+<v>399956</v>
 </b>
 </bs>
 </hist>
@@ -37643,41 +38241,41 @@
 </relation>
 <relation>
 <name>preproctrue</name>
-<cardinality>183112</cardinality>
+<cardinality>176006</cardinality>
 <columnsizes>
 <e>
 <k>branch</k>
-<v>183112</v>
+<v>176006</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>preprocfalse</name>
-<cardinality>130000</cardinality>
+<cardinality>124956</cardinality>
 <columnsizes>
 <e>
 <k>branch</k>
-<v>130000</v>
+<v>124956</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>preproctext</name>
-<cardinality>1062775</cardinality>
+<cardinality>1021536</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1062775</v>
+<v>1021536</v>
 </e>
 <e>
 <k>head</k>
-<v>510083</v>
+<v>490290</v>
 </e>
 <e>
 <k>body</k>
-<v>192959</v>
+<v>185471</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37691,7 +38289,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1062775</v>
+<v>1021536</v>
 </b>
 </bs>
 </hist>
@@ -37707,7 +38305,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1062775</v>
+<v>1021536</v>
 </b>
 </bs>
 </hist>
@@ -37723,22 +38321,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380459</v>
+<v>365696</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86116</v>
+<v>82774</v>
 </b>
 <b>
 <a>3</a>
 <b>19</b>
-<v>38414</v>
+<v>36923</v>
 </b>
 <b>
 <a>19</a>
 <b>752</b>
-<v>5093</v>
+<v>4895</v>
 </b>
 </bs>
 </hist>
@@ -37754,12 +38352,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>486208</v>
+<v>467341</v>
 </b>
 <b>
 <a>2</a>
 <b>38</b>
-<v>23875</v>
+<v>22948</v>
 </b>
 </bs>
 </hist>
@@ -37775,12 +38373,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>181252</v>
+<v>174219</v>
 </b>
 <b>
 <a>2</a>
 <b>64395</b>
-<v>11706</v>
+<v>11252</v>
 </b>
 </bs>
 </hist>
@@ -37796,12 +38394,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>182893</v>
+<v>175796</v>
 </b>
 <b>
 <a>2</a>
 <b>21671</b>
-<v>10065</v>
+<v>9674</v>
 </b>
 </bs>
 </hist>
@@ -37811,15 +38409,15 @@
 </relation>
 <relation>
 <name>includes</name>
-<cardinality>321805</cardinality>
+<cardinality>309317</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>321805</v>
+<v>309317</v>
 </e>
 <e>
 <k>included</k>
-<v>60162</v>
+<v>57827</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37833,7 +38431,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>321805</v>
+<v>309317</v>
 </b>
 </bs>
 </hist>
@@ -37849,37 +38447,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29503</v>
+<v>28358</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9895</v>
+<v>9511</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5117</v>
+<v>4919</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5348</v>
+<v>5141</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>4643</v>
+<v>4463</v>
 </b>
 <b>
 <a>11</a>
 <b>41</b>
-<v>4558</v>
+<v>4381</v>
 </b>
 <b>
 <a>41</a>
 <b>763</b>
-<v>1094</v>
+<v>1051</v>
 </b>
 </bs>
 </hist>
@@ -37889,15 +38487,15 @@
 </relation>
 <relation>
 <name>link_targets</name>
-<cardinality>644</cardinality>
+<cardinality>619</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>644</v>
+<v>619</v>
 </e>
 <e>
 <k>binary</k>
-<v>644</v>
+<v>619</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37911,7 +38509,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>644</v>
+<v>619</v>
 </b>
 </bs>
 </hist>
@@ -37927,7 +38525,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>644</v>
+<v>619</v>
 </b>
 </bs>
 </hist>
@@ -37937,15 +38535,15 @@
 </relation>
 <relation>
 <name>link_parent</name>
-<cardinality>19143690</cardinality>
+<cardinality>19072521</cardinality>
 <columnsizes>
 <e>
 <k>element</k>
-<v>5076549</v>
+<v>5117392</v>
 </e>
 <e>
 <k>link_target</k>
-<v>644</v>
+<v>619</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37959,32 +38557,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1439430</v>
+<v>1455425</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1904730</v>
+<v>1924496</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>772395</v>
+<v>779113</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>426167</v>
+<v>434215</v>
 </b>
 <b>
 <a>6</a>
-<b>27</b>
-<v>383109</v>
+<b>28</b>
+<v>394382</v>
 </b>
 <b>
-<a>27</a>
+<a>28</a>
 <b>45</b>
-<v>150715</v>
+<v>129758</v>
 </b>
 </bs>
 </hist>
@@ -38000,67 +38598,67 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>97</v>
+<v>93</v>
 </b>
 <b>
 <a>5</a>
 <b>557</b>
-<v>48</v>
+<v>46</v>
 </b>
 <b>
-<a>2555</a>
-<b>5912</b>
-<v>48</v>
+<a>2662</a>
+<b>6059</b>
+<v>46</v>
 </b>
 <b>
-<a>6322</a>
-<b>8240</b>
-<v>48</v>
+<a>6479</a>
+<b>8402</b>
+<v>46</v>
 </b>
 <b>
-<a>9873</a>
-<b>12705</b>
-<v>48</v>
+<a>10060</a>
+<b>12929</b>
+<v>46</v>
 </b>
 <b>
-<a>12726</a>
-<b>19568</b>
-<v>48</v>
+<a>13044</a>
+<b>20082</b>
+<v>46</v>
 </b>
 <b>
-<a>24613</a>
-<b>26319</b>
-<v>48</v>
+<a>24978</a>
+<b>26985</b>
+<v>46</v>
 </b>
 <b>
-<a>26410</a>
-<b>31881</b>
-<v>48</v>
+<a>27088</a>
+<b>32537</b>
+<v>46</v>
 </b>
 <b>
-<a>32502</a>
-<b>37729</b>
-<v>48</v>
+<a>33104</a>
+<b>38465</b>
+<v>46</v>
 </b>
 <b>
-<a>39858</a>
-<b>40615</b>
-<v>48</v>
+<a>41123</a>
+<b>42511</b>
+<v>46</v>
 </b>
 <b>
-<a>43096</a>
-<b>52498</b>
-<v>48</v>
+<a>44410</a>
+<b>55889</b>
+<v>46</v>
 </b>
 <b>
-<a>53361</a>
-<b>126529</b>
-<v>48</v>
+<a>55937</a>
+<b>132605</b>
+<v>46</v>
 </b>
 <b>
-<a>345660</a>
-<b>345661</b>
-<v>12</v>
+<a>362472</a>
+<b>362473</b>
+<v>11</v>
 </b>
 </bs>
 </hist>

From afe666500f54db4dc7aa7c688bcab1c1a12b7264 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 5 Nov 2019 11:34:37 +0000
Subject: [PATCH 131/232] C++: Simplify getTemplateArgument*() impl.

---
 cpp/ql/src/semmle/code/cpp/Class.qll       | 18 ------------
 cpp/ql/src/semmle/code/cpp/Declaration.qll | 33 ++++++++++------------
 cpp/ql/src/semmle/code/cpp/Function.qll    | 19 -------------
 cpp/ql/src/semmle/code/cpp/Variable.qll    | 18 ------------
 4 files changed, 15 insertions(+), 73 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Class.qll b/cpp/ql/src/semmle/code/cpp/Class.qll
index 5ccf6193c4f..297654a1afa 100644
--- a/cpp/ql/src/semmle/code/cpp/Class.qll
+++ b/cpp/ql/src/semmle/code/cpp/Class.qll
@@ -605,24 +605,6 @@ class Class extends UserType {
     class_instantiation(underlyingElement(this), unresolveElement(c))
   }
 
-  /**
-   * Gets the `i`th template argument used to instantiate this class from a
-   * class template. When called on a class template, this will return the
-   * `i`th template parameter.
-   */
-  override Type getTemplateArgumentType(int i) {
-    class_template_argument(underlyingElement(this), i, unresolveElement(result))
-  }
-
-  /**
-   * Gets the `i`th template argument value used to instantiate this class from a
-   * class template. When called on a class template, this will return the
-   * `i`th template parameter value.
-   */
-  override Expr getTemplateArgumentValue(int i) {
-    class_template_argument_value(underlyingElement(this), i, unresolveElement(result))
-  }
-
   /**
    * Holds if this class/struct is polymorphic (has a virtual function, or
    * inherits one).
diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index 9c8ce250d8d..89f52f174de 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -255,25 +255,22 @@ abstract class Declaration extends Locatable, @declaration {
     result = count(int i | exists(getTemplateArgument(i)))
   }
 
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Gets a Type for a template argument.  May be the template argument itself
-   * or the type of a non-type template argument.
-   *
-   * Use `getTemplateArgument` or `getTemplateKind` instead.
-   */
-  Type getTemplateArgumentType(int index) { none() }
+  private Type getTemplateArgumentType(int index) {
+    class_template_argument(underlyingElement(this), index, unresolveElement(result))
+      or
+    function_template_argument(underlyingElement(this), index, unresolveElement(result))
+      or
+    variable_template_argument(underlyingElement(this), index, unresolveElement(result))
+  }
 
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Gets an Expression representing the value of a non-type template
-   * argument.
-   *
-   * Use `getTemplateArgument` or `getTemplateKind` instead.
-   */
-  Expr getTemplateArgumentValue(int index) { none() }
+
+  private Expr getTemplateArgumentValue(int index) {
+    class_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+      or
+    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+      or
+    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
+  }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index 5436c3ba218..14edf014b21 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -343,25 +343,6 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
     function_instantiation(underlyingElement(this), unresolveElement(f))
   }
 
-  /**
-   * Gets the `i`th template argument used to instantiate this function from a
-   * function template. When called on a function template, this will return the
-   * `i`th template parameter.
-   */
-  override Type getTemplateArgumentType(int index) {
-    function_template_argument(underlyingElement(this), index, unresolveElement(result))
-  }
-
-  /**
-   * Gets the value of the `i`th template argument used to instantiate this
-   * function from a function template if that argument was a 'non-type'
-   * argument.  When called on a function template, this with return the value
-   * of the `i`th template parameter.
-   */
-  override Expr getTemplateArgumentValue(int index) {
-    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-  }
-
   /**
    * Holds if this function is defined in several files. This is illegal in
    * C (though possible in some C++ compilers), and likely indicates that
diff --git a/cpp/ql/src/semmle/code/cpp/Variable.qll b/cpp/ql/src/semmle/code/cpp/Variable.qll
index 689f1c3bfa5..194cc5333c7 100644
--- a/cpp/ql/src/semmle/code/cpp/Variable.qll
+++ b/cpp/ql/src/semmle/code/cpp/Variable.qll
@@ -155,24 +155,6 @@ class Variable extends Declaration, @variable {
     variable_instantiation(underlyingElement(this), unresolveElement(v))
   }
 
-  /**
-   * Gets the `i`th template argument used to instantiate this variable from a
-   * variable template. When called on a variable template, this will return the
-   * `i`th template parameter.
-   */
-  override Type getTemplateArgumentType(int index) {
-    variable_template_argument(underlyingElement(this), index, unresolveElement(result))
-  }
-
-  /**
-   * Gets the `i`th template argument value used to instantiate this variable from a
-   * variable template. When called on a variable template, this will return the
-   * `i`th template parameter value.
-   */
-  override Expr getTemplateArgumentValue(int index) {
-    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-  }
-
   /**
    * Holds if this is a compiler-generated variable. For example, a
    * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)

From 8eef953cd75ee10c1292a467fff3297202e5cbc1 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 5 Nov 2019 11:35:35 +0000
Subject: [PATCH 132/232] C++: Update 1.23 change notes

---
 change-notes/1.23/analysis-cpp.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index f22436f55cb..a92f78ca2f7 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -54,3 +54,8 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
   lead to regressions (or improvements) in how queries are optimized because
   optimization in QL relies on static size estimates, and the control-flow edge
   relations will now have different size estimates than before.
+* Support has been added for non-type template arguments.  This means that the
+  return type of `Declaration::getTemplateArgument()` and
+  `Declaration::getATemplateArgument` have changed to `Locatable`.  See the
+  documentation for `Declaration::getTemplateArgument()` and
+  `Declaration::getTemplateArgumentKind()` for details.

From 5106626bd07d613f8e2f08193921b14f8539581d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 5 Nov 2019 13:06:43 +0000
Subject: [PATCH 133/232] CPP: QLDoc helper predicates.

---
 .../CWE/CWE-457/InitializationFunctions.qll   | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 720cf11950b..52b251bad00 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -619,35 +619,41 @@ Function getAPossibleDefinition(Function undefinedFunction) {
   result.isDefined()
 }
  
+/**
+ * Helper predicate for `getTarget`, that computes possible targets of a `Call`.
+ *
+ * If there is at least one defined target after performing some simple virtual dispatch
+ * resolution, then the result is all the defined targets.
+ */
 private Function getTarget1(Call c) {
-  /*
-   * If there is at least one defined target after performing some simple virtual dispatch
-   * resolution, then the result is all the defined targets.
-   */
-
   result = VirtualDispatch::getAViableTarget(c) and
   result.isDefined()
 }
 
+/**
+ * Helper predicate for `getTarget`, that computes possible targets of a `Call`.
+ *
+ * If we can use the heuristic matching of functions to find definitions for some of the viable
+ * targets, return those.
+ */
 private Function getTarget2(Call c) {
-  /*
-   * If we can use the heuristic matching of functions to find definitions for some of the viable
-   * targets, return those.
-   */
-
   not exists(getTarget1(c)) and
   result = getAPossibleDefinition(VirtualDispatch::getAViableTarget(c))
 }
 
+/**
+ * Helper predicate for `getTarget`, that computes possible targets of a `Call`.
+ *
+ * Otherwise, the result is the undefined `Function` instances.
+ */
 private Function getTarget3(Call c) {
   not exists(getTarget1(c)) and
   not exists(getTarget2(c)) and
-  // Otherwise, the result is the undefined `Function` instances.
   result = VirtualDispatch::getAViableTarget(c)
 }
 
 /**
- * Gets a possible target for the Call, using the name and parameter matching if we did not associate
+ * Gets a possible target for the `Call`, using the name and parameter matching if we did not associate
  * this call with a specific definition at link or compile time, and performing simple virtual
  * dispatch resolution.
  */

From 7456a92d6dc5e45f449bf485faba572dfc5a1324 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 5 Nov 2019 13:10:19 +0000
Subject: [PATCH 134/232] CPP: Autoformat.

---
 cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 52b251bad00..86102008e2b 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -618,7 +618,7 @@ Function getAPossibleDefinition(Function undefinedFunction) {
   ) and
   result.isDefined()
 }
- 
+
 /**
  * Helper predicate for `getTarget`, that computes possible targets of a `Call`.
  *

From df2fbfb3d02485b5a568769ff78d49c6841282b5 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Fri, 1 Nov 2019 13:16:45 +0100
Subject: [PATCH 135/232] C++: localInstruction{Flow,Taint} helpers

These are analogous to the existing `localExpr{Flow,Taint}` predicates.
---
 .../semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll | 8 ++++++++
 .../code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll   | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index f824e0b6bf2..cd989c94710 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -214,6 +214,14 @@ private predicate simpleInstructionLocalFlowStep(Instruction iFrom, Instruction
  */
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
+/**
+ * Holds if data can flow from `i1` to `i2` in zero or more
+ * local (intra-procedural) steps.
+ */
+predicate localInstructionFlow(Instruction e1, Instruction e2) {
+  localFlow(instructionNode(e1), instructionNode(e2))
+}
+
 /**
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
index e34709e94ec..8d7c9194f4f 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
@@ -53,6 +53,14 @@ private predicate localInstructionTaintStep(Instruction nodeFrom, Instruction no
  */
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
+/**
+ * Holds if taint can flow from `i1` to `i2` in zero or more
+ * local (intra-procedural) steps.
+ */
+predicate localInstructionTaint(Instruction i1, Instruction i2) {
+  localTaint(DataFlow::instructionNode(i1), DataFlow::instructionNode(i2))
+}
+
 /**
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.

From 20ae183c16437c57ebdc651078caa39375103277 Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Tue, 5 Nov 2019 14:18:29 +0000
Subject: [PATCH 136/232] C++: Tidy up formatting

---
 cpp/ql/src/semmle/code/cpp/Declaration.qll | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index 89f52f174de..04135880129 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -257,18 +257,17 @@ abstract class Declaration extends Locatable, @declaration {
 
   private Type getTemplateArgumentType(int index) {
     class_template_argument(underlyingElement(this), index, unresolveElement(result))
-      or
+    or
     function_template_argument(underlyingElement(this), index, unresolveElement(result))
-      or
+    or
     variable_template_argument(underlyingElement(this), index, unresolveElement(result))
   }
 
-
   private Expr getTemplateArgumentValue(int index) {
     class_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-      or
+    or
     function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-      or
+    or
     variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
   }
 }

From 16b63b3d01a68b8065f463002f43254aa9cdb369 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 5 Nov 2019 15:45:17 +0100
Subject: [PATCH 137/232] move deferred model to the query where it is used

---
 .../src/Statements/UseOfReturnlessFunction.ql | 51 +++++++++++++++++++
 .../ql/src/semmle/javascript/Promises.qll     | 42 ---------------
 .../TaintTracking/BasicTaintTracking.expected |  1 -
 .../library-tests/TaintTracking/promise.js    | 11 ----
 .../Statements/UseOfReturnlessFunction/tst.js |  6 +++
 5 files changed, 57 insertions(+), 54 deletions(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index f8f459cc84d..48af33b8e43 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -149,6 +149,57 @@ predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
   )
 }
 
+
+/**
+ * Provides classes for working with various Deferred implementations. 
+ * It is a heuristic. The heuristic assume that a class is a promise defintion 
+ * if the class is called "Deferred" and the method `resolve` is called on an instance.
+ *  
+ * Removes some false positives in the js/use-of-returnless-function query.  
+ */
+module Deferred {
+  /**
+   * An instance of a `Deferred` class. 
+   * E.g. the result from `new Deferred()` or `new $.Deferred()`.  
+   */
+  class DeferredInstance extends DataFlow::NewNode {
+  	// Describes both `new Deferred()`, `new $.Deferred` and other variants. 
+    DeferredInstance() { this.getCalleeName() = "Deferred" }
+
+    private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
+      t.start() and
+      result = this
+      or
+      exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
+    }
+    
+    DataFlow::SourceNode ref() { result = ref(DataFlow::TypeTracker::end()) }
+  }
+
+  /**
+   * A promise object created by a Deferred constructor
+   */
+  private class DeferredPromiseDefinition extends PromiseDefinition, DeferredInstance {
+    DeferredPromiseDefinition() {
+      // hardening of the "Deferred" heuristic: a method call to `resolve`. 
+      exists(ref().getAMethodCall("resolve"))
+    }
+
+    override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
+  }
+
+  /**
+   * A resolved promise created by a `new Deferred().resolve()` call.
+   */
+  class ResolvedDeferredPromiseDefinition extends ResolvedPromiseDefinition {
+    ResolvedDeferredPromiseDefinition() {
+      this = any(DeferredPromiseDefinition def).ref().getAMethodCall("resolve")
+    }
+
+    override DataFlow::Node getValue() { result = getArgument(0) }
+  }
+}
+
 from DataFlow::CallNode call, Function func, string name, string msg
 where
   (
diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index ae8554c1a0a..858064e85a0 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -32,48 +32,6 @@ module Bluebird {
   }
 }
 
-/**
- * Provides classes for working with various Deferred implementations
- */
-module Deferred {
-  class DeferredInstance extends DataFlow::NewNode {
-  	// Describes both `new Deferred()`, `new $.Deferred` and other variants. 
-    DeferredInstance() { this.getCalleeName() = "Deferred" }
-
-    private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
-      t.start() and
-      result = this
-      or
-      exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
-    }
-    
-    DataFlow::SourceNode ref() { result = ref(DataFlow::TypeTracker::end()) }
-  }
-
-  /**
-   * A promise object created by a Deferred constructor
-   */
-  private class DeferredPromiseDefinition extends PromiseDefinition, DeferredInstance {
-    DeferredPromiseDefinition() {
-      // hardening of the "Deferred" heuristic: a method call to `resolve`. 
-      exists(ref().getAMethodCall("resolve"))
-    }
-
-    override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
-  }
-
-  /**
-   * A resolved promise created by a `new Deferred().resolve()` call.
-   */
-  class ResolvedDeferredPromiseDefinition extends ResolvedPromiseDefinition {
-    ResolvedDeferredPromiseDefinition() {
-      this = any(DeferredPromiseDefinition def).ref().getAMethodCall("resolve")
-    }
-
-    override DataFlow::Node getValue() { result = getArgument(0) }
-  }
-}
-
 /**
  * Provides classes for working with the `q` library (https://github.com/kriskowal/q).
  */
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index 77592a2e855..2722f67d6fd 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -69,7 +69,6 @@ typeInferenceMismatch
 | promise.js:5:25:5:32 | source() | promise.js:5:8:5:33 | bluebir ... urce()) |
 | promise.js:10:24:10:31 | source() | promise.js:10:8:10:32 | Promise ... urce()) |
 | promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise |
-| promise.js:22:23:22:30 | source() | promise.js:22:7:22:31 | promise ... urce()) |
 | sanitizer-guards.js:2:11:2:18 | source() | sanitizer-guards.js:4:8:4:8 | x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:15:10:15:15 | this.x |
 | sanitizer-guards.js:13:14:13:21 | source() | sanitizer-guards.js:21:14:21:19 | this.x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/promise.js b/javascript/ql/test/library-tests/TaintTracking/promise.js
index d16e57241e8..9714d258df5 100644
--- a/javascript/ql/test/library-tests/TaintTracking/promise.js
+++ b/javascript/ql/test/library-tests/TaintTracking/promise.js
@@ -11,15 +11,4 @@ function closure() {
   let resolver = Promise.withResolver();
   resolver.resolve(source());
   sink(resolver.promise); // NOT OK
-}
-
-class Deferred {
-	
-}
-
-function deferred() {
-	var promise = new Deferred();
-	sink(promise.resolve(source())); // NOT OK
-	
-	new Deferred().reject("foo") // <- a reject has to exist.
 }
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
index 8a6a44707ed..90a52153dea 100644
--- a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
+++ b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
@@ -82,4 +82,10 @@
 	
 	var baz = [1,2,3].filter(n => {n === 3}) // OK
 	console.log(baz);
+	
+	class Deferred {
+	
+	}
+	
+	new Deferred().resolve(onlySideEffects()); // OK
 })();
\ No newline at end of file

From 3e92d0ffb5cb1a3faf930570b46505f8ef42c53f Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 15:49:42 +0000
Subject: [PATCH 138/232] JavaScript: Remove redundant `--experimental`
 extractor options.

---
 .../library-tests/PropWrite/tests.expected    | 396 +++++++++---------
 .../ql/test/library-tests/PropWrite/tst.js    |   1 -
 .../library-tests/SpreadRestProperties/tst.js |   2 -
 .../library-tests/TaintTracking/exceptions.js |   2 -
 .../Templates/templates-revised.js            |   2 -
 .../TrailingFunctionCommas/tst.js             |   2 -
 .../library-tests/frameworks/SQL/mssql1.js    |   2 -
 .../RedeclaredVariable/restprops.js           |   2 -
 .../Declarations/UnusedParameter/restprops.js |   2 -
 .../Expressions/SelfAssignment/jsdoc.js       |   2 -
 .../LanguageFeatures/IllegalInvocation/tst.js |   2 -
 .../query-tests/NodeJS/DubiousImport/m.js     |   2 -
 .../test/query-tests/Performance/ReDoS/tst.js |   2 -
 .../Security/CWE-089/untyped/tst2.js          |   2 -
 14 files changed, 198 insertions(+), 223 deletions(-)

diff --git a/javascript/ql/test/library-tests/PropWrite/tests.expected b/javascript/ql/test/library-tests/PropWrite/tests.expected
index 33eff9b0628..beb4916f397 100644
--- a/javascript/ql/test/library-tests/PropWrite/tests.expected
+++ b/javascript/ql/test/library-tests/PropWrite/tests.expected
@@ -1,55 +1,55 @@
 test_getAPropertyRead
-| tst.js:1:1:1:0 | this | tst.js:23:15:23:29 | this.someMethod |
-| tst.js:1:1:1:0 | this | tst.js:24:36:24:45 | this.state |
-| tst.js:14:5:14:11 | console | tst.js:14:5:14:15 | console.log |
-| tst.js:17:5:17:11 | console | tst.js:17:5:17:15 | console.log |
-| tst.js:23:15:23:29 | this.someMethod | tst.js:23:15:23:34 | this.someMethod.bind |
-| tst.js:24:36:24:45 | this.state | tst.js:24:36:24:50 | this.state.name |
-| tst.js:34:6:34:7 | vv | tst.js:34:6:34:10 | vv.pp |
-| tst.js:35:6:35:8 | vvv | tst.js:35:6:35:12 | vvv.ppp |
-| tst.js:35:6:35:12 | vvv.ppp | tst.js:35:6:35:16 | vvv.ppp.qqq |
-| tst.js:45:3:45:9 | console | tst.js:45:3:45:13 | console.log |
-| tst.js:45:15:45:17 | obj | tst.js:45:15:45:20 | obj[p] |
+| tst.js:1:1:1:0 | this | tst.js:22:15:22:29 | this.someMethod |
+| tst.js:1:1:1:0 | this | tst.js:23:36:23:45 | this.state |
+| tst.js:13:5:13:11 | console | tst.js:13:5:13:15 | console.log |
+| tst.js:16:5:16:11 | console | tst.js:16:5:16:15 | console.log |
+| tst.js:22:15:22:29 | this.someMethod | tst.js:22:15:22:34 | this.someMethod.bind |
+| tst.js:23:36:23:45 | this.state | tst.js:23:36:23:50 | this.state.name |
+| tst.js:33:6:33:7 | vv | tst.js:33:6:33:10 | vv.pp |
+| tst.js:34:6:34:8 | vvv | tst.js:34:6:34:12 | vvv.ppp |
+| tst.js:34:6:34:12 | vvv.ppp | tst.js:34:6:34:16 | vvv.ppp.qqq |
+| tst.js:44:3:44:9 | console | tst.js:44:3:44:13 | console.log |
+| tst.js:44:15:44:17 | obj | tst.js:44:15:44:20 | obj[p] |
 test_getAPropertyReference
 | classes.ts:3:21:3:20 | this | classes.ts:4:3:4:24 | instanc ...  foo(); |
 | classes.ts:8:3:8:2 | this | classes.ts:8:15:8:35 | public  ... erField |
 | classes.ts:12:5:12:4 | this | classes.ts:12:17:12:37 | public  ... erField |
 | classes.ts:16:5:16:4 | this | classes.ts:16:17:16:37 | public  ... erField |
-| tst.js:1:1:1:0 | this | tst.js:23:15:23:29 | this.someMethod |
-| tst.js:1:1:1:0 | this | tst.js:24:36:24:45 | this.state |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:3:5:3:8 | x: 4 |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:4:5:6:5 | func: f ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | tst.js:13:3:15:3 | static  ... x);\\n  } |
-| tst.js:14:5:14:11 | console | tst.js:14:5:14:15 | console.log |
-| tst.js:17:5:17:11 | console | tst.js:17:5:17:15 | console.log |
-| tst.js:21:1:21:1 | C | tst.js:21:1:21:6 | C.prop |
-| tst.js:23:15:23:29 | this.someMethod | tst.js:23:15:23:34 | this.someMethod.bind |
-| tst.js:24:8:24:57 | <div on ... }</div> | tst.js:24:13:24:27 | onClick={click} |
-| tst.js:24:36:24:45 | this.state | tst.js:24:36:24:50 | this.state.name |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | tst.js:27:3:27:26 | get x() ... null; } |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | tst.js:28:3:28:13 | set y(v) {} |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:32:5:32:8 | n: 1 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:33:5:33:10 | [v]: 2 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:34:5:34:14 | [vv.pp]: 3 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:35:5:35:20 | [vvv.ppp.qqq]: 4 |
-| tst.js:34:6:34:7 | vv | tst.js:34:6:34:10 | vv.pp |
-| tst.js:35:6:35:8 | vvv | tst.js:35:6:35:12 | vvv.ppp |
-| tst.js:35:6:35:12 | vvv.ppp | tst.js:35:6:35:16 | vvv.ppp.qqq |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:13:38:15 | "a" |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:18:38:20 | "b" |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:23:38:25 | "c" |
-| tst.js:39:12:39:23 | ["a", , "c"] | tst.js:39:13:39:15 | "a" |
-| tst.js:39:12:39:23 | ["a", , "c"] | tst.js:39:20:39:22 | "c" |
-| tst.js:40:12:40:23 | [, "b", "c"] | tst.js:40:15:40:17 | "b" |
-| tst.js:40:12:40:23 | [, "b", "c"] | tst.js:40:20:40:22 | "c" |
-| tst.js:41:12:41:22 | ["a", "b",] | tst.js:41:13:41:15 | "a" |
-| tst.js:41:12:41:22 | ["a", "b",] | tst.js:41:18:41:20 | "b" |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:13:42:15 | "a" |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:18:42:24 | ...arr3 |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:27:42:29 | "d" |
-| tst.js:45:3:45:9 | console | tst.js:45:3:45:13 | console.log |
-| tst.js:45:15:45:17 | obj | tst.js:45:15:45:20 | obj[p] |
+| tst.js:1:1:1:0 | this | tst.js:22:15:22:29 | this.someMethod |
+| tst.js:1:1:1:0 | this | tst.js:23:36:23:45 | this.state |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:2:5:2:8 | x: 4 |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:3:5:5:5 | func: f ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | tst.js:12:3:14:3 | static  ... x);\\n  } |
+| tst.js:13:5:13:11 | console | tst.js:13:5:13:15 | console.log |
+| tst.js:16:5:16:11 | console | tst.js:16:5:16:15 | console.log |
+| tst.js:20:1:20:1 | C | tst.js:20:1:20:6 | C.prop |
+| tst.js:22:15:22:29 | this.someMethod | tst.js:22:15:22:34 | this.someMethod.bind |
+| tst.js:23:8:23:57 | <div on ... }</div> | tst.js:23:13:23:27 | onClick={click} |
+| tst.js:23:36:23:45 | this.state | tst.js:23:36:23:50 | this.state.name |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | tst.js:26:3:26:26 | get x() ... null; } |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | tst.js:27:3:27:13 | set y(v) {} |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:31:5:31:8 | n: 1 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:32:5:32:10 | [v]: 2 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:33:5:33:14 | [vv.pp]: 3 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:34:5:34:20 | [vvv.ppp.qqq]: 4 |
+| tst.js:33:6:33:7 | vv | tst.js:33:6:33:10 | vv.pp |
+| tst.js:34:6:34:8 | vvv | tst.js:34:6:34:12 | vvv.ppp |
+| tst.js:34:6:34:12 | vvv.ppp | tst.js:34:6:34:16 | vvv.ppp.qqq |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:13:37:15 | "a" |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:18:37:20 | "b" |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:23:37:25 | "c" |
+| tst.js:38:12:38:23 | ["a", , "c"] | tst.js:38:13:38:15 | "a" |
+| tst.js:38:12:38:23 | ["a", , "c"] | tst.js:38:20:38:22 | "c" |
+| tst.js:39:12:39:23 | [, "b", "c"] | tst.js:39:15:39:17 | "b" |
+| tst.js:39:12:39:23 | [, "b", "c"] | tst.js:39:20:39:22 | "c" |
+| tst.js:40:12:40:22 | ["a", "b",] | tst.js:40:13:40:15 | "a" |
+| tst.js:40:12:40:22 | ["a", "b",] | tst.js:40:18:40:20 | "b" |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:13:41:15 | "a" |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:18:41:24 | ...arr3 |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:27:41:29 | "d" |
+| tst.js:44:3:44:9 | console | tst.js:44:3:44:13 | console.log |
+| tst.js:44:15:44:17 | obj | tst.js:44:15:44:20 | obj[p] |
 test_getAPropertySource
 | classes.ts:3:21:3:20 | this | instanceField | classes.ts:4:19:4:23 | foo() |
 | classes.ts:8:3:8:2 | this | parameterField | classes.ts:8:22:8:35 | parameterField |
@@ -57,10 +57,10 @@ test_getAPropertySource
 | classes.ts:12:5:12:4 | this | parameterField | classes.ts:12:41:12:42 | {} |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:24:16:37 | parameterField |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:41:16:42 | {} |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | f | tst.js:7:6:9:5 | () {\\n   ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | func | tst.js:4:11:6:5 | functio ... ;\\n    } |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | func | tst.js:13:14:15:3 | (x) {\\n  ... x);\\n  } |
-| tst.js:24:8:24:57 | <div on ... }</div> | onClick | tst.js:24:22:24:26 | click |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | f | tst.js:6:6:8:5 | () {\\n   ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | func | tst.js:3:11:5:5 | functio ... ;\\n    } |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | func | tst.js:12:14:14:3 | (x) {\\n  ... x);\\n  } |
+| tst.js:23:8:23:57 | <div on ... }</div> | onClick | tst.js:23:22:23:26 | click |
 test_PropWritePropName
 | classes.ts:3:21:3:20 | constructor() {} | constructor |
 | classes.ts:4:3:4:24 | instanc ...  foo(); | instanceField |
@@ -70,123 +70,123 @@ test_PropWritePropName
 | classes.ts:12:17:12:37 | public  ... erField | parameterField |
 | classes.ts:16:5:16:46 | constru ...  {}) {} | constructor |
 | classes.ts:16:17:16:37 | public  ... erField | parameterField |
-| tst.js:3:5:3:8 | x: 4 | x |
-| tst.js:4:5:6:5 | func: f ... ;\\n    } | func |
-| tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } | f |
-| tst.js:12:9:12:8 | constructor() {} | constructor |
-| tst.js:13:3:15:3 | static  ... x);\\n  } | func |
-| tst.js:16:3:18:3 | f(x) {\\n ... x);\\n  } | f |
-| tst.js:21:1:21:6 | C.prop | prop |
-| tst.js:24:13:24:27 | onClick={click} | onClick |
-| tst.js:27:3:27:26 | get x() ... null; } | x |
-| tst.js:28:3:28:13 | set y(v) {} | y |
-| tst.js:32:5:32:8 | n: 1 | n |
+| tst.js:2:5:2:8 | x: 4 | x |
+| tst.js:3:5:5:5 | func: f ... ;\\n    } | func |
+| tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } | f |
+| tst.js:11:9:11:8 | constructor() {} | constructor |
+| tst.js:12:3:14:3 | static  ... x);\\n  } | func |
+| tst.js:15:3:17:3 | f(x) {\\n ... x);\\n  } | f |
+| tst.js:20:1:20:6 | C.prop | prop |
+| tst.js:23:13:23:27 | onClick={click} | onClick |
+| tst.js:26:3:26:26 | get x() ... null; } | x |
+| tst.js:27:3:27:13 | set y(v) {} | y |
+| tst.js:31:5:31:8 | n: 1 | n |
 test_getAPropertyRead2
-| tst.js:1:1:1:0 | this | someMethod | tst.js:23:15:23:29 | this.someMethod |
-| tst.js:1:1:1:0 | this | state | tst.js:24:36:24:45 | this.state |
-| tst.js:14:5:14:11 | console | log | tst.js:14:5:14:15 | console.log |
-| tst.js:17:5:17:11 | console | log | tst.js:17:5:17:15 | console.log |
-| tst.js:23:15:23:29 | this.someMethod | bind | tst.js:23:15:23:34 | this.someMethod.bind |
-| tst.js:24:36:24:45 | this.state | name | tst.js:24:36:24:50 | this.state.name |
-| tst.js:34:6:34:7 | vv | pp | tst.js:34:6:34:10 | vv.pp |
-| tst.js:35:6:35:8 | vvv | ppp | tst.js:35:6:35:12 | vvv.ppp |
-| tst.js:35:6:35:12 | vvv.ppp | qqq | tst.js:35:6:35:16 | vvv.ppp.qqq |
-| tst.js:45:3:45:9 | console | log | tst.js:45:3:45:13 | console.log |
+| tst.js:1:1:1:0 | this | someMethod | tst.js:22:15:22:29 | this.someMethod |
+| tst.js:1:1:1:0 | this | state | tst.js:23:36:23:45 | this.state |
+| tst.js:13:5:13:11 | console | log | tst.js:13:5:13:15 | console.log |
+| tst.js:16:5:16:11 | console | log | tst.js:16:5:16:15 | console.log |
+| tst.js:22:15:22:29 | this.someMethod | bind | tst.js:22:15:22:34 | this.someMethod.bind |
+| tst.js:23:36:23:45 | this.state | name | tst.js:23:36:23:50 | this.state.name |
+| tst.js:33:6:33:7 | vv | pp | tst.js:33:6:33:10 | vv.pp |
+| tst.js:34:6:34:8 | vvv | ppp | tst.js:34:6:34:12 | vvv.ppp |
+| tst.js:34:6:34:12 | vvv.ppp | qqq | tst.js:34:6:34:16 | vvv.ppp.qqq |
+| tst.js:44:3:44:9 | console | log | tst.js:44:3:44:13 | console.log |
 test_getAPropertyReference2
 | classes.ts:3:21:3:20 | this | instanceField | classes.ts:4:3:4:24 | instanc ...  foo(); |
 | classes.ts:8:3:8:2 | this | parameterField | classes.ts:8:15:8:35 | public  ... erField |
 | classes.ts:12:5:12:4 | this | parameterField | classes.ts:12:17:12:37 | public  ... erField |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:17:16:37 | public  ... erField |
-| tst.js:1:1:1:0 | this | someMethod | tst.js:23:15:23:29 | this.someMethod |
-| tst.js:1:1:1:0 | this | state | tst.js:24:36:24:45 | this.state |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | f | tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | func | tst.js:4:5:6:5 | func: f ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | x | tst.js:3:5:3:8 | x: 4 |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | func | tst.js:13:3:15:3 | static  ... x);\\n  } |
-| tst.js:14:5:14:11 | console | log | tst.js:14:5:14:15 | console.log |
-| tst.js:17:5:17:11 | console | log | tst.js:17:5:17:15 | console.log |
-| tst.js:21:1:21:1 | C | prop | tst.js:21:1:21:6 | C.prop |
-| tst.js:23:15:23:29 | this.someMethod | bind | tst.js:23:15:23:34 | this.someMethod.bind |
-| tst.js:24:8:24:57 | <div on ... }</div> | onClick | tst.js:24:13:24:27 | onClick={click} |
-| tst.js:24:36:24:45 | this.state | name | tst.js:24:36:24:50 | this.state.name |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | x | tst.js:27:3:27:26 | get x() ... null; } |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | y | tst.js:28:3:28:13 | set y(v) {} |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | n | tst.js:32:5:32:8 | n: 1 |
-| tst.js:34:6:34:7 | vv | pp | tst.js:34:6:34:10 | vv.pp |
-| tst.js:35:6:35:8 | vvv | ppp | tst.js:35:6:35:12 | vvv.ppp |
-| tst.js:35:6:35:12 | vvv.ppp | qqq | tst.js:35:6:35:16 | vvv.ppp.qqq |
-| tst.js:45:3:45:9 | console | log | tst.js:45:3:45:13 | console.log |
+| tst.js:1:1:1:0 | this | someMethod | tst.js:22:15:22:29 | this.someMethod |
+| tst.js:1:1:1:0 | this | state | tst.js:23:36:23:45 | this.state |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | f | tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | func | tst.js:3:5:5:5 | func: f ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | x | tst.js:2:5:2:8 | x: 4 |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | func | tst.js:12:3:14:3 | static  ... x);\\n  } |
+| tst.js:13:5:13:11 | console | log | tst.js:13:5:13:15 | console.log |
+| tst.js:16:5:16:11 | console | log | tst.js:16:5:16:15 | console.log |
+| tst.js:20:1:20:1 | C | prop | tst.js:20:1:20:6 | C.prop |
+| tst.js:22:15:22:29 | this.someMethod | bind | tst.js:22:15:22:34 | this.someMethod.bind |
+| tst.js:23:8:23:57 | <div on ... }</div> | onClick | tst.js:23:13:23:27 | onClick={click} |
+| tst.js:23:36:23:45 | this.state | name | tst.js:23:36:23:50 | this.state.name |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | x | tst.js:26:3:26:26 | get x() ... null; } |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | y | tst.js:27:3:27:13 | set y(v) {} |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | n | tst.js:31:5:31:8 | n: 1 |
+| tst.js:33:6:33:7 | vv | pp | tst.js:33:6:33:10 | vv.pp |
+| tst.js:34:6:34:8 | vvv | ppp | tst.js:34:6:34:12 | vvv.ppp |
+| tst.js:34:6:34:12 | vvv.ppp | qqq | tst.js:34:6:34:16 | vvv.ppp.qqq |
+| tst.js:44:3:44:9 | console | log | tst.js:44:3:44:13 | console.log |
 test_hasPropertyWrite
 | classes.ts:3:21:3:20 | this | instanceField | classes.ts:4:19:4:23 | foo() |
 | classes.ts:8:3:8:2 | this | parameterField | classes.ts:8:22:8:35 | parameterField |
 | classes.ts:12:5:12:4 | this | parameterField | classes.ts:12:24:12:37 | parameterField |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:24:16:37 | parameterField |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:41:16:42 | {} |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | f | tst.js:7:6:9:5 | () {\\n   ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | func | tst.js:4:11:6:5 | functio ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | x | tst.js:3:8:3:8 | 4 |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | func | tst.js:13:14:15:3 | (x) {\\n  ... x);\\n  } |
-| tst.js:21:1:21:1 | C | prop | tst.js:21:10:21:11 | 56 |
-| tst.js:24:8:24:57 | <div on ... }</div> | onClick | tst.js:24:22:24:26 | click |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | n | tst.js:32:8:32:8 | 1 |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | f | tst.js:6:6:8:5 | () {\\n   ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | func | tst.js:3:11:5:5 | functio ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | x | tst.js:2:8:2:8 | 4 |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | func | tst.js:12:14:14:3 | (x) {\\n  ... x);\\n  } |
+| tst.js:20:1:20:1 | C | prop | tst.js:20:10:20:11 | 56 |
+| tst.js:23:8:23:57 | <div on ... }</div> | onClick | tst.js:23:22:23:26 | click |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | n | tst.js:31:8:31:8 | 1 |
 test_PropWriteBase
 | classes.ts:4:3:4:24 | instanc ...  foo(); | classes.ts:3:21:3:20 | this |
 | classes.ts:8:15:8:35 | public  ... erField | classes.ts:8:3:8:2 | this |
 | classes.ts:12:17:12:37 | public  ... erField | classes.ts:12:5:12:4 | this |
 | classes.ts:16:17:16:37 | public  ... erField | classes.ts:16:5:16:4 | this |
-| tst.js:3:5:3:8 | x: 4 | tst.js:2:11:10:1 | {\\n    x ...     }\\n} |
-| tst.js:4:5:6:5 | func: f ... ;\\n    } | tst.js:2:11:10:1 | {\\n    x ...     }\\n} |
-| tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } | tst.js:2:11:10:1 | {\\n    x ...     }\\n} |
-| tst.js:13:3:15:3 | static  ... x);\\n  } | tst.js:12:1:19:1 | class C ... ;\\n  }\\n} |
-| tst.js:21:1:21:6 | C.prop | tst.js:21:1:21:1 | C |
-| tst.js:24:13:24:27 | onClick={click} | tst.js:24:8:24:57 | <div on ... }</div> |
-| tst.js:27:3:27:26 | get x() ... null; } | tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} |
-| tst.js:28:3:28:13 | set y(v) {} | tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} |
-| tst.js:32:5:32:8 | n: 1 | tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} |
-| tst.js:33:5:33:10 | [v]: 2 | tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} |
-| tst.js:34:5:34:14 | [vv.pp]: 3 | tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} |
-| tst.js:35:5:35:20 | [vvv.ppp.qqq]: 4 | tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} |
-| tst.js:38:13:38:15 | "a" | tst.js:38:12:38:26 | ["a", "b", "c"] |
-| tst.js:38:18:38:20 | "b" | tst.js:38:12:38:26 | ["a", "b", "c"] |
-| tst.js:38:23:38:25 | "c" | tst.js:38:12:38:26 | ["a", "b", "c"] |
-| tst.js:39:13:39:15 | "a" | tst.js:39:12:39:23 | ["a", , "c"] |
-| tst.js:39:20:39:22 | "c" | tst.js:39:12:39:23 | ["a", , "c"] |
-| tst.js:40:15:40:17 | "b" | tst.js:40:12:40:23 | [, "b", "c"] |
-| tst.js:40:20:40:22 | "c" | tst.js:40:12:40:23 | [, "b", "c"] |
-| tst.js:41:13:41:15 | "a" | tst.js:41:12:41:22 | ["a", "b",] |
-| tst.js:41:18:41:20 | "b" | tst.js:41:12:41:22 | ["a", "b",] |
-| tst.js:42:13:42:15 | "a" | tst.js:42:12:42:30 | ["a", ...arr3, "d"] |
-| tst.js:42:18:42:24 | ...arr3 | tst.js:42:12:42:30 | ["a", ...arr3, "d"] |
-| tst.js:42:27:42:29 | "d" | tst.js:42:12:42:30 | ["a", ...arr3, "d"] |
+| tst.js:2:5:2:8 | x: 4 | tst.js:1:11:9:1 | {\\n    x ...     }\\n} |
+| tst.js:3:5:5:5 | func: f ... ;\\n    } | tst.js:1:11:9:1 | {\\n    x ...     }\\n} |
+| tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } | tst.js:1:11:9:1 | {\\n    x ...     }\\n} |
+| tst.js:12:3:14:3 | static  ... x);\\n  } | tst.js:11:1:18:1 | class C ... ;\\n  }\\n} |
+| tst.js:20:1:20:6 | C.prop | tst.js:20:1:20:1 | C |
+| tst.js:23:13:23:27 | onClick={click} | tst.js:23:8:23:57 | <div on ... }</div> |
+| tst.js:26:3:26:26 | get x() ... null; } | tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} |
+| tst.js:27:3:27:13 | set y(v) {} | tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} |
+| tst.js:31:5:31:8 | n: 1 | tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} |
+| tst.js:32:5:32:10 | [v]: 2 | tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} |
+| tst.js:33:5:33:14 | [vv.pp]: 3 | tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} |
+| tst.js:34:5:34:20 | [vvv.ppp.qqq]: 4 | tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} |
+| tst.js:37:13:37:15 | "a" | tst.js:37:12:37:26 | ["a", "b", "c"] |
+| tst.js:37:18:37:20 | "b" | tst.js:37:12:37:26 | ["a", "b", "c"] |
+| tst.js:37:23:37:25 | "c" | tst.js:37:12:37:26 | ["a", "b", "c"] |
+| tst.js:38:13:38:15 | "a" | tst.js:38:12:38:23 | ["a", , "c"] |
+| tst.js:38:20:38:22 | "c" | tst.js:38:12:38:23 | ["a", , "c"] |
+| tst.js:39:15:39:17 | "b" | tst.js:39:12:39:23 | [, "b", "c"] |
+| tst.js:39:20:39:22 | "c" | tst.js:39:12:39:23 | [, "b", "c"] |
+| tst.js:40:13:40:15 | "a" | tst.js:40:12:40:22 | ["a", "b",] |
+| tst.js:40:18:40:20 | "b" | tst.js:40:12:40:22 | ["a", "b",] |
+| tst.js:41:13:41:15 | "a" | tst.js:41:12:41:30 | ["a", ...arr3, "d"] |
+| tst.js:41:18:41:24 | ...arr3 | tst.js:41:12:41:30 | ["a", ...arr3, "d"] |
+| tst.js:41:27:41:29 | "d" | tst.js:41:12:41:30 | ["a", ...arr3, "d"] |
 test_getAPropertyWrite
 | classes.ts:3:21:3:20 | this | classes.ts:4:3:4:24 | instanc ...  foo(); |
 | classes.ts:8:3:8:2 | this | classes.ts:8:15:8:35 | public  ... erField |
 | classes.ts:12:5:12:4 | this | classes.ts:12:17:12:37 | public  ... erField |
 | classes.ts:16:5:16:4 | this | classes.ts:16:17:16:37 | public  ... erField |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:3:5:3:8 | x: 4 |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:4:5:6:5 | func: f ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | tst.js:13:3:15:3 | static  ... x);\\n  } |
-| tst.js:21:1:21:1 | C | tst.js:21:1:21:6 | C.prop |
-| tst.js:24:8:24:57 | <div on ... }</div> | tst.js:24:13:24:27 | onClick={click} |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | tst.js:27:3:27:26 | get x() ... null; } |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | tst.js:28:3:28:13 | set y(v) {} |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:32:5:32:8 | n: 1 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:33:5:33:10 | [v]: 2 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:34:5:34:14 | [vv.pp]: 3 |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | tst.js:35:5:35:20 | [vvv.ppp.qqq]: 4 |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:13:38:15 | "a" |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:18:38:20 | "b" |
-| tst.js:38:12:38:26 | ["a", "b", "c"] | tst.js:38:23:38:25 | "c" |
-| tst.js:39:12:39:23 | ["a", , "c"] | tst.js:39:13:39:15 | "a" |
-| tst.js:39:12:39:23 | ["a", , "c"] | tst.js:39:20:39:22 | "c" |
-| tst.js:40:12:40:23 | [, "b", "c"] | tst.js:40:15:40:17 | "b" |
-| tst.js:40:12:40:23 | [, "b", "c"] | tst.js:40:20:40:22 | "c" |
-| tst.js:41:12:41:22 | ["a", "b",] | tst.js:41:13:41:15 | "a" |
-| tst.js:41:12:41:22 | ["a", "b",] | tst.js:41:18:41:20 | "b" |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:13:42:15 | "a" |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:18:42:24 | ...arr3 |
-| tst.js:42:12:42:30 | ["a", ...arr3, "d"] | tst.js:42:27:42:29 | "d" |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:2:5:2:8 | x: 4 |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:3:5:5:5 | func: f ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | tst.js:12:3:14:3 | static  ... x);\\n  } |
+| tst.js:20:1:20:1 | C | tst.js:20:1:20:6 | C.prop |
+| tst.js:23:8:23:57 | <div on ... }</div> | tst.js:23:13:23:27 | onClick={click} |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | tst.js:26:3:26:26 | get x() ... null; } |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | tst.js:27:3:27:13 | set y(v) {} |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:31:5:31:8 | n: 1 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:32:5:32:10 | [v]: 2 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:33:5:33:14 | [vv.pp]: 3 |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | tst.js:34:5:34:20 | [vvv.ppp.qqq]: 4 |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:13:37:15 | "a" |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:18:37:20 | "b" |
+| tst.js:37:12:37:26 | ["a", "b", "c"] | tst.js:37:23:37:25 | "c" |
+| tst.js:38:12:38:23 | ["a", , "c"] | tst.js:38:13:38:15 | "a" |
+| tst.js:38:12:38:23 | ["a", , "c"] | tst.js:38:20:38:22 | "c" |
+| tst.js:39:12:39:23 | [, "b", "c"] | tst.js:39:15:39:17 | "b" |
+| tst.js:39:12:39:23 | [, "b", "c"] | tst.js:39:20:39:22 | "c" |
+| tst.js:40:12:40:22 | ["a", "b",] | tst.js:40:13:40:15 | "a" |
+| tst.js:40:12:40:22 | ["a", "b",] | tst.js:40:18:40:20 | "b" |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:13:41:15 | "a" |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:18:41:24 | ...arr3 |
+| tst.js:41:12:41:30 | ["a", ...arr3, "d"] | tst.js:41:27:41:29 | "d" |
 test_PropWrite
 | classes.ts:3:21:3:20 | constructor() {} |
 | classes.ts:4:3:4:24 | instanc ...  foo(); |
@@ -196,46 +196,46 @@ test_PropWrite
 | classes.ts:12:17:12:37 | public  ... erField |
 | classes.ts:16:5:16:46 | constru ...  {}) {} |
 | classes.ts:16:17:16:37 | public  ... erField |
-| tst.js:3:5:3:8 | x: 4 |
-| tst.js:4:5:6:5 | func: f ... ;\\n    } |
-| tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } |
-| tst.js:12:9:12:8 | constructor() {} |
-| tst.js:13:3:15:3 | static  ... x);\\n  } |
-| tst.js:16:3:18:3 | f(x) {\\n ... x);\\n  } |
-| tst.js:21:1:21:6 | C.prop |
-| tst.js:24:13:24:27 | onClick={click} |
-| tst.js:27:3:27:26 | get x() ... null; } |
-| tst.js:28:3:28:13 | set y(v) {} |
-| tst.js:32:5:32:8 | n: 1 |
-| tst.js:33:5:33:10 | [v]: 2 |
-| tst.js:34:5:34:14 | [vv.pp]: 3 |
-| tst.js:35:5:35:20 | [vvv.ppp.qqq]: 4 |
+| tst.js:2:5:2:8 | x: 4 |
+| tst.js:3:5:5:5 | func: f ... ;\\n    } |
+| tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } |
+| tst.js:11:9:11:8 | constructor() {} |
+| tst.js:12:3:14:3 | static  ... x);\\n  } |
+| tst.js:15:3:17:3 | f(x) {\\n ... x);\\n  } |
+| tst.js:20:1:20:6 | C.prop |
+| tst.js:23:13:23:27 | onClick={click} |
+| tst.js:26:3:26:26 | get x() ... null; } |
+| tst.js:27:3:27:13 | set y(v) {} |
+| tst.js:31:5:31:8 | n: 1 |
+| tst.js:32:5:32:10 | [v]: 2 |
+| tst.js:33:5:33:14 | [vv.pp]: 3 |
+| tst.js:34:5:34:20 | [vvv.ppp.qqq]: 4 |
+| tst.js:37:13:37:15 | "a" |
+| tst.js:37:18:37:20 | "b" |
+| tst.js:37:23:37:25 | "c" |
 | tst.js:38:13:38:15 | "a" |
-| tst.js:38:18:38:20 | "b" |
-| tst.js:38:23:38:25 | "c" |
-| tst.js:39:13:39:15 | "a" |
+| tst.js:38:20:38:22 | "c" |
+| tst.js:39:15:39:17 | "b" |
 | tst.js:39:20:39:22 | "c" |
-| tst.js:40:15:40:17 | "b" |
-| tst.js:40:20:40:22 | "c" |
+| tst.js:40:13:40:15 | "a" |
+| tst.js:40:18:40:20 | "b" |
 | tst.js:41:13:41:15 | "a" |
-| tst.js:41:18:41:20 | "b" |
-| tst.js:42:13:42:15 | "a" |
-| tst.js:42:18:42:24 | ...arr3 |
-| tst.js:42:27:42:29 | "d" |
+| tst.js:41:18:41:24 | ...arr3 |
+| tst.js:41:27:41:29 | "d" |
 test_getAPropertyWrite2
 | classes.ts:3:21:3:20 | this | instanceField | classes.ts:4:3:4:24 | instanc ...  foo(); |
 | classes.ts:8:3:8:2 | this | parameterField | classes.ts:8:15:8:35 | public  ... erField |
 | classes.ts:12:5:12:4 | this | parameterField | classes.ts:12:17:12:37 | public  ... erField |
 | classes.ts:16:5:16:4 | this | parameterField | classes.ts:16:17:16:37 | public  ... erField |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | f | tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | func | tst.js:4:5:6:5 | func: f ... ;\\n    } |
-| tst.js:2:11:10:1 | {\\n    x ...     }\\n} | x | tst.js:3:5:3:8 | x: 4 |
-| tst.js:12:1:19:1 | class C ... ;\\n  }\\n} | func | tst.js:13:3:15:3 | static  ... x);\\n  } |
-| tst.js:21:1:21:1 | C | prop | tst.js:21:1:21:6 | C.prop |
-| tst.js:24:8:24:57 | <div on ... }</div> | onClick | tst.js:24:13:24:27 | onClick={click} |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | x | tst.js:27:3:27:26 | get x() ... null; } |
-| tst.js:26:2:29:1 | {\\n  get ... v) {}\\n} | y | tst.js:28:3:28:13 | set y(v) {} |
-| tst.js:31:2:36:1 | {\\n    n ... q]: 4\\n} | n | tst.js:32:5:32:8 | n: 1 |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | f | tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | func | tst.js:3:5:5:5 | func: f ... ;\\n    } |
+| tst.js:1:11:9:1 | {\\n    x ...     }\\n} | x | tst.js:2:5:2:8 | x: 4 |
+| tst.js:11:1:18:1 | class C ... ;\\n  }\\n} | func | tst.js:12:3:14:3 | static  ... x);\\n  } |
+| tst.js:20:1:20:1 | C | prop | tst.js:20:1:20:6 | C.prop |
+| tst.js:23:8:23:57 | <div on ... }</div> | onClick | tst.js:23:13:23:27 | onClick={click} |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | x | tst.js:26:3:26:26 | get x() ... null; } |
+| tst.js:25:2:28:1 | {\\n  get ... v) {}\\n} | y | tst.js:27:3:27:13 | set y(v) {} |
+| tst.js:30:2:35:1 | {\\n    n ... q]: 4\\n} | n | tst.js:31:5:31:8 | n: 1 |
 test_PropWriteRhs
 | classes.ts:3:21:3:20 | constructor() {} | classes.ts:3:21:3:20 | () {} |
 | classes.ts:4:3:4:24 | instanc ...  foo(); | classes.ts:4:19:4:23 | foo() |
@@ -246,27 +246,27 @@ test_PropWriteRhs
 | classes.ts:16:5:16:46 | constru ...  {}) {} | classes.ts:16:5:16:46 | constru ...  {}) {} |
 | classes.ts:16:17:16:37 | public  ... erField | classes.ts:16:24:16:37 | parameterField |
 | classes.ts:16:17:16:37 | public  ... erField | classes.ts:16:41:16:42 | {} |
-| tst.js:3:5:3:8 | x: 4 | tst.js:3:8:3:8 | 4 |
-| tst.js:4:5:6:5 | func: f ... ;\\n    } | tst.js:4:11:6:5 | functio ... ;\\n    } |
-| tst.js:7:5:9:5 | f() {\\n  ... ;\\n    } | tst.js:7:6:9:5 | () {\\n   ... ;\\n    } |
-| tst.js:12:9:12:8 | constructor() {} | tst.js:12:9:12:8 | () {} |
-| tst.js:13:3:15:3 | static  ... x);\\n  } | tst.js:13:14:15:3 | (x) {\\n  ... x);\\n  } |
-| tst.js:16:3:18:3 | f(x) {\\n ... x);\\n  } | tst.js:16:4:18:3 | (x) {\\n  ... x);\\n  } |
-| tst.js:21:1:21:6 | C.prop | tst.js:21:10:21:11 | 56 |
-| tst.js:24:13:24:27 | onClick={click} | tst.js:24:22:24:26 | click |
-| tst.js:32:5:32:8 | n: 1 | tst.js:32:8:32:8 | 1 |
-| tst.js:33:5:33:10 | [v]: 2 | tst.js:33:10:33:10 | 2 |
-| tst.js:34:5:34:14 | [vv.pp]: 3 | tst.js:34:14:34:14 | 3 |
-| tst.js:35:5:35:20 | [vvv.ppp.qqq]: 4 | tst.js:35:20:35:20 | 4 |
+| tst.js:2:5:2:8 | x: 4 | tst.js:2:8:2:8 | 4 |
+| tst.js:3:5:5:5 | func: f ... ;\\n    } | tst.js:3:11:5:5 | functio ... ;\\n    } |
+| tst.js:6:5:8:5 | f() {\\n  ... ;\\n    } | tst.js:6:6:8:5 | () {\\n   ... ;\\n    } |
+| tst.js:11:9:11:8 | constructor() {} | tst.js:11:9:11:8 | () {} |
+| tst.js:12:3:14:3 | static  ... x);\\n  } | tst.js:12:14:14:3 | (x) {\\n  ... x);\\n  } |
+| tst.js:15:3:17:3 | f(x) {\\n ... x);\\n  } | tst.js:15:4:17:3 | (x) {\\n  ... x);\\n  } |
+| tst.js:20:1:20:6 | C.prop | tst.js:20:10:20:11 | 56 |
+| tst.js:23:13:23:27 | onClick={click} | tst.js:23:22:23:26 | click |
+| tst.js:31:5:31:8 | n: 1 | tst.js:31:8:31:8 | 1 |
+| tst.js:32:5:32:10 | [v]: 2 | tst.js:32:10:32:10 | 2 |
+| tst.js:33:5:33:14 | [vv.pp]: 3 | tst.js:33:14:33:14 | 3 |
+| tst.js:34:5:34:20 | [vvv.ppp.qqq]: 4 | tst.js:34:20:34:20 | 4 |
+| tst.js:37:13:37:15 | "a" | tst.js:37:13:37:15 | "a" |
+| tst.js:37:18:37:20 | "b" | tst.js:37:18:37:20 | "b" |
+| tst.js:37:23:37:25 | "c" | tst.js:37:23:37:25 | "c" |
 | tst.js:38:13:38:15 | "a" | tst.js:38:13:38:15 | "a" |
-| tst.js:38:18:38:20 | "b" | tst.js:38:18:38:20 | "b" |
-| tst.js:38:23:38:25 | "c" | tst.js:38:23:38:25 | "c" |
-| tst.js:39:13:39:15 | "a" | tst.js:39:13:39:15 | "a" |
+| tst.js:38:20:38:22 | "c" | tst.js:38:20:38:22 | "c" |
+| tst.js:39:15:39:17 | "b" | tst.js:39:15:39:17 | "b" |
 | tst.js:39:20:39:22 | "c" | tst.js:39:20:39:22 | "c" |
-| tst.js:40:15:40:17 | "b" | tst.js:40:15:40:17 | "b" |
-| tst.js:40:20:40:22 | "c" | tst.js:40:20:40:22 | "c" |
+| tst.js:40:13:40:15 | "a" | tst.js:40:13:40:15 | "a" |
+| tst.js:40:18:40:20 | "b" | tst.js:40:18:40:20 | "b" |
 | tst.js:41:13:41:15 | "a" | tst.js:41:13:41:15 | "a" |
-| tst.js:41:18:41:20 | "b" | tst.js:41:18:41:20 | "b" |
-| tst.js:42:13:42:15 | "a" | tst.js:42:13:42:15 | "a" |
-| tst.js:42:18:42:24 | ...arr3 | tst.js:42:18:42:24 | ...arr3 |
-| tst.js:42:27:42:29 | "d" | tst.js:42:27:42:29 | "d" |
+| tst.js:41:18:41:24 | ...arr3 | tst.js:41:18:41:24 | ...arr3 |
+| tst.js:41:27:41:29 | "d" | tst.js:41:27:41:29 | "d" |
diff --git a/javascript/ql/test/library-tests/PropWrite/tst.js b/javascript/ql/test/library-tests/PropWrite/tst.js
index 8b2ad5aa3e2..99e9d5ffb1c 100644
--- a/javascript/ql/test/library-tests/PropWrite/tst.js
+++ b/javascript/ql/test/library-tests/PropWrite/tst.js
@@ -1,4 +1,3 @@
-// semmle-extractor-options: --experimental
 var obj = {
     x: 4,
     func: function() {
diff --git a/javascript/ql/test/library-tests/SpreadRestProperties/tst.js b/javascript/ql/test/library-tests/SpreadRestProperties/tst.js
index cbff84ef9b4..faa017a8bd3 100644
--- a/javascript/ql/test/library-tests/SpreadRestProperties/tst.js
+++ b/javascript/ql/test/library-tests/SpreadRestProperties/tst.js
@@ -1,4 +1,2 @@
 var q = { ...o, x: 42, ...p };
 let { x, ...r } = q, { z } = {};
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TaintTracking/exceptions.js b/javascript/ql/test/library-tests/TaintTracking/exceptions.js
index b8946b5603a..98e3e7ce009 100644
--- a/javascript/ql/test/library-tests/TaintTracking/exceptions.js
+++ b/javascript/ql/test/library-tests/TaintTracking/exceptions.js
@@ -169,5 +169,3 @@ function throwThoughLibrary(xs) {
     sink(e); // OK - doesn't catch exception from event listener
   }
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Templates/templates-revised.js b/javascript/ql/test/library-tests/Templates/templates-revised.js
index 0ca81631fb4..7df488e53f9 100644
--- a/javascript/ql/test/library-tests/Templates/templates-revised.js
+++ b/javascript/ql/test/library-tests/Templates/templates-revised.js
@@ -1,3 +1 @@
 tag `\unvalid escape sequence`;
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/TrailingFunctionCommas/tst.js b/javascript/ql/test/library-tests/TrailingFunctionCommas/tst.js
index 434f0d0ae61..2257a74aa2a 100644
--- a/javascript/ql/test/library-tests/TrailingFunctionCommas/tst.js
+++ b/javascript/ql/test/library-tests/TrailingFunctionCommas/tst.js
@@ -31,5 +31,3 @@ new h2(23, 42,);
 x => x;
 
 function f4(x = 42,) {}
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js b/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
index accf4713d71..39a340ccf83 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
@@ -10,5 +10,3 @@ async () => {
         // ... error checks 
     }
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/restprops.js b/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/restprops.js
index ffab5c80539..44cf825c3cd 100644
--- a/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/restprops.js
+++ b/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/restprops.js
@@ -1,4 +1,2 @@
 var f = ({...p}) => {};
 var g = ({...p}) => {};
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedParameter/restprops.js b/javascript/ql/test/query-tests/Declarations/UnusedParameter/restprops.js
index 2a7d8c0b4e5..43b3b2ebfb2 100644
--- a/javascript/ql/test/query-tests/Declarations/UnusedParameter/restprops.js
+++ b/javascript/ql/test/query-tests/Declarations/UnusedParameter/restprops.js
@@ -1,5 +1,3 @@
 function f({ x, ...ys }) {
   return ys;
 }
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Expressions/SelfAssignment/jsdoc.js b/javascript/ql/test/query-tests/Expressions/SelfAssignment/jsdoc.js
index 0329cdf038d..03bfc0b5573 100644
--- a/javascript/ql/test/query-tests/Expressions/SelfAssignment/jsdoc.js
+++ b/javascript/ql/test/query-tests/Expressions/SelfAssignment/jsdoc.js
@@ -11,5 +11,3 @@ class C extends Q {
     this.arg = this.arg; // NOT OK
   }
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/IllegalInvocation/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/IllegalInvocation/tst.js
index 6a489653379..3ed85a70934 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/IllegalInvocation/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/IllegalInvocation/tst.js
@@ -60,5 +60,3 @@ function invoke(fn) {
 }
 invoke(C);
 invoke(function() {});
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/m.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/m.js
index ac41c9e8511..9e1c24dfecc 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/m.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/m.js
@@ -5,5 +5,3 @@ var props = {
 module.exports = {
   ...props
 };
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
index 9d4e7a7b8de..4839b585eb4 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
@@ -84,5 +84,3 @@ var bad16 = /(.|\n)*!/s;
 
 // GOOD
 var good8 = /([\w.]+)*/;
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst2.js b/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst2.js
index 126745e9444..b28ddabc9ca 100644
--- a/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst2.js
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst2.js
@@ -8,5 +8,3 @@ app.get('/post/:id', async function(req, res) {
   // NOT OK
   new sql.Request().query("select * from mytable where id = '" + req.params.id + "'");
 });
-
-// semmle-extractor-options: --experimental

From 8661de11f2ff9c5651899095b3465f11faaf5216 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Tue, 5 Nov 2019 14:50:28 +0000
Subject: [PATCH 139/232] docs: update ql terminology

---
 docs/language/learn-ql/ql-training.rst        | 52 +++++++++----------
 .../ql-training/cpp/bad-overflow-guard.rst    | 24 ++++-----
 .../ql-training/cpp/control-flow-cpp.rst      |  4 +-
 .../ql-training/cpp/data-flow-cpp.rst         |  4 +-
 .../ql-training/cpp/global-data-flow-cpp.rst  |  4 +-
 .../language/ql-training/cpp/intro-ql-cpp.rst | 38 +++++++-------
 .../cpp/program-representation-cpp.rst        | 10 ++--
 docs/language/ql-training/cpp/snprintf.rst    |  2 +-
 docs/language/ql-training/index.rst           |  4 +-
 .../ql-training/java/apache-struts-java.rst   |  2 +-
 .../java/global-data-flow-java.rst            |  2 +-
 .../ql-training/java/intro-ql-java.rst        | 36 ++++++-------
 .../java/program-representation-java.rst      |  2 +-
 .../ql-training/java/query-injection-java.rst | 20 +++----
 .../slide-snippets/abstract-syntax-tree.rst   | 10 ++--
 .../ql-training/slide-snippets/info.rst       | 33 ------------
 .../slide-snippets/intro-ql-general.rst       | 16 +++---
 17 files changed, 115 insertions(+), 148 deletions(-)
 delete mode 100644 docs/language/ql-training/slide-snippets/info.rst

diff --git a/docs/language/learn-ql/ql-training.rst b/docs/language/learn-ql/ql-training.rst
index 66afa06d754..757de7daed6 100644
--- a/docs/language/learn-ql/ql-training.rst
+++ b/docs/language/learn-ql/ql-training.rst
@@ -1,19 +1,19 @@
-QL training and variant analysis examples
-#########################################
+CodeQL training and variant analysis examples
+=============================================
 
 QL and variant analysis
-=======================
+-----------------------
 
 `Variant analysis <https://semmle.com/variant-analysis>`__ is the process of using a known vulnerability as a seed to find similar problems in your code. Security engineers typically perform variant analysis to identify possible vulnerabilities and to ensure that these threats are properly fixed across multiple code bases.
 
-`QL <https://semmle.com/ql>`__ is Semmle's variant analysis engine, and it is also the technology that underpins LGTM, Semmle's community driven security analysis platform. Together, QL and LGTM provide continuous monitoring and scalable variant analysis for your projects, even if you don’t have your own team of dedicated security engineers. You can read more about using QL and LGTM in variant analysis in the `Semmle blog <https://blog.semmle.com/tags/variant-analysis>`__.
+`CodeQL <https://semmle.com/ql>`__ is the code analysis engine that underpins LGTM, Semmle's community driven security analysis platform. Together, CodeQL and LGTM provide continuous monitoring and scalable variant analysis for your projects, even if you don’t have your own team of dedicated security engineers. You can read more about using CodeQL and LGTM in variant analysis in the `Semmle blog <https://blog.semmle.com/tags/variant-analysis>`__.
 
-The QL language is easy to learn, and exploring code using QL is the most efficient way to perform variant analysis. 
+CodeQL is easy to learn, and exploring code using CodeQL is the most efficient way to perform variant analysis. 
 
 Learning QL for variant analysis
-================================
+--------------------------------
 
-Start learning how to use QL in variant analysis for a specific language by looking at the topics below. Each topic links to a short presentation on the QL language, QL libraries, or an example variant discovered using QL.
+Start learning how to use CodeQL in variant analysis for a specific language by looking at the topics below. Each topic links to a short presentation on CodeQL, its libraries, or an example variant discovered using CodeQL.
 
 .. |arrow-l| unicode:: U+2190
 
@@ -24,7 +24,7 @@ Start learning how to use QL in variant analysis for a specific language by look
 When you have selected a presentation, use |arrow-r| and |arrow-l| to navigate between slides.
 Press **p** to view the additional notes on slides that have an information icon |info| in the top right corner, and press **f** to enter full-screen mode.
 
-The presentations contain a number of QL query examples.
+The presentations contain a number of query examples.
 We recommend that you download `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__ and import the example snapshot for each presentation so that you can find the bugs mentioned in the slides. 
 
 
@@ -32,35 +32,35 @@ We recommend that you download `QL for Eclipse <https://help.semmle.com/ql-for-e
 
    Information
 
-   The presentations listed below are used in QL language and variant analysis training sessions run by Semmle engineers. 
+   The presentations listed below are used in CodeQL and variant analysis training sessions run by Semmle engineers. 
    Therefore, be aware that the slides are designed to be presented by an instructor. 
    If you are using the slides without an instructor, please use the additional notes to help guide you through the examples. 
 
-QL and variant analysis for C/C++
----------------------------------
+CodeQL and variant analysis for C/C++
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-- `Introduction to variant analysis: QL for C/C++ <../ql-training/cpp/intro-ql-cpp.html>`__–an introduction to variant analysis and QL for C/C++ programmers.
+- `Introduction to variant analysis: CodeQL for C/C++ <../ql-training/cpp/intro-ql-cpp.html>`__–an introduction to variant analysis and CodeQL for C/C++ programmers.
 - `Example: Bad overflow guard <../ql-training/cpp/bad-overflow-guard.html>`__–an example of iterative query development to find bad overflow guards in a C++ project.
-- `Program representation: QL for C/C++ <../ql-training/cpp/program-representation-cpp.html>`__–information on how QL analysis represents C/C++ programs. 
-- `Introduction to local data flow <../ql-training/cpp/data-flow-cpp.html>`__–an introduction to analyzing local data flow in C/C++ using QL, including an example demonstrating how to develop a query to find a real CVE.
+- `Program representation: CodeQL for C/C++ <../ql-training/cpp/program-representation-cpp.html>`__–information on how CodeQL analysis represents C/C++ programs. 
+- `Introduction to local data flow <../ql-training/cpp/data-flow-cpp.html>`__–an introduction to analyzing local data flow in C/C++ using CodeQL, including an example demonstrating how to develop a query to find a real CVE.
 - `Exercise: snprintf overflow <../ql-training/cpp/snprintf.html>`__–an example demonstrating how to develop a data flow query.
-- `Introduction to global data flow <../ql-training/cpp/global-data-flow-cpp.html>`__–an introduction to analyzing global data flow in C/C++ using QL.
-- `Analyzing control flow: QL for C/C++  <../ql-training/cpp/control-flow-cpp.html>`__–an introduction to analyzing control flow in C/C++ using QL.
+- `Introduction to global data flow <../ql-training/cpp/global-data-flow-cpp.html>`__–an introduction to analyzing global data flow in C/C++ using CodeQL.
+- `Analyzing control flow: CodeQL for C/C++  <../ql-training/cpp/control-flow-cpp.html>`__–an introduction to analyzing control flow in C/C++ using QL.
 
-QL and variant analysis for Java
---------------------------------
+CodeQL and variant analysis for Java
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-- `Introduction to variant analysis: QL for Java <../ql-training/java/intro-ql-java.html>`__–an introduction to variant analysis and QL for Java programmers.
+- `Introduction to variant analysis: CodeQL for Java <../ql-training/java/intro-ql-java.html>`__–an introduction to variant analysis and CodeQL for Java programmers.
 - `Example: Query injection <../ql-training/java/query-injection-java.html>`__–an example of iterative query development to find unsanitized SPARQL injections in a Java project.
-- `Program representation: QL for Java <../ql-training/java/program-representation-java.html>`__–information on how QL analysis represents Java programs. 
-- `Introduction to local data flow <../ql-training/java/data-flow-java.html>`__–an introduction to analyzing local data flow in Java using QL, including an example demonstrating how to develop a query to find a real CVE.
+- `Program representation: CodeQL for Java <../ql-training/java/program-representation-java.html>`__–information on how CodeQL analysis represents Java programs. 
+- `Introduction to local data flow <../ql-training/java/data-flow-java.html>`__–an introduction to analyzing local data flow in Java using CodeQL, including an example demonstrating how to develop a query to find a real CVE.
 - `Exercise: Apache Struts <../ql-training/java/apache-struts-java.html>`__–an example demonstrating how to develop a data flow query.
-- `Introduction to global data flow <../ql-training/java/global-data-flow-java.html>`__–an introduction to analyzing global data flow in Java using QL.
+- `Introduction to global data flow <../ql-training/java/global-data-flow-java.html>`__–an introduction to analyzing global data flow in Java using CodeQL.
 
 More resources
---------------
+~~~~~~~~~~~~~~
 
-- If you are completely new to QL, look at our introductory topics in :ref:`Getting started <getting-started>`.
-- To find more detailed information about how to write QL queries for specific languages, visit the links in :ref:`Writing QL queries <writing-ql-queries>`.
-- To read more about how QL queries have been used in Semmle's security research, and to read about new QL developments, visit the `Semmle blog <https://blog.semmle.com>`__. 
+- If you are completely new to CodeQL, look at our introductory topics in :doc:`Learning CodeQL <index>`.
+- To find more detailed information about how to write CodeQL queries for specific languages, visit the links in :ref:`Writing CodeQL queries <writing-ql-queries>`.
+- To read more about how CodeQL queries have been used in Semmle's security research, and to read about new CodeQL developments, visit the `Semmle blog <https://blog.semmle.com>`__. 
 - Find more examples of queries written by Semmle's own security researchers in the `Semmle Demos repository <https://github.com/semmle/demos>`__ on GitHub.
diff --git a/docs/language/ql-training/cpp/bad-overflow-guard.rst b/docs/language/ql-training/cpp/bad-overflow-guard.rst
index 12f35440906..5e9fbcfc700 100644
--- a/docs/language/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/language/ql-training/cpp/bad-overflow-guard.rst
@@ -2,7 +2,7 @@
 Example: Bad overflow guard
 ===========================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
@@ -127,13 +127,13 @@ This happens even though the overflow check passed!
 
 .. rst-class:: background2
 
-Developing a QL query
-=====================
+Developing a CodeQL query
+=========================
 
 Finding bad overflow guards
 
-QL query: bad overflow guards
-=============================
+CodeQL query: bad overflow guards
+==================================
 
 Let’s look for overflow guards of the form ``v + b < v``, using the classes
 ``AddExpr``, ``Variable`` and ``RelationalOperation`` from the ``cpp`` library.
@@ -153,10 +153,10 @@ Let’s look for overflow guards of the form ``v + b < v``, using the classes
     - a ``RelationalOperation``: the overflow comparison check.
     - a ``Variable``: used as an argument to both the addition and comparison.
 
-  - The ``where`` part of the query ties these three QL variables together using `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ defined in the `standard QL for C/C++ library <https://help.semmle.com/qldoc/cpp/>`__.
+  - The ``where`` part of the query ties these three variables together using `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ defined in the `standard CodeQL for C/C++ library <https://help.semmle.com/qldoc/cpp/>`__.
 
-QL query: bad overflow guards
-=============================
+CodeQL query: bad overflow guards
+=================================
 
 We want to ensure the operands being added have size less than 4 bytes.
 
@@ -180,8 +180,8 @@ We can get the size (in bytes) of a type using the ``getSize()`` method.
   - We therefore write a helper predicate for small expressions.
   - This predicate effectively represents the set of all expressions in the database where the size of the type of the expression is less than 4 bytes, that is, less than 32-bits.
 
-QL query: bad overflow guards
-=============================
+CodeQL query: bad overflow guards
+==================================
 
 We can ensure the operands being added have size less than 4 bytes, using our new predicate.
 
@@ -216,8 +216,8 @@ Now our query becomes:
     - The “range” part, ``op = a.getAnOperand()``,  restricts ``op`` to being one of the two operands to the addition.
     - The “condition” part, ``isSmall(op)``, says that the ``forall`` holds only if the condition (that the ``op`` is small) holds for everything in the range–that is, both the arguments to the addition.
 
-QL query: bad overflow guards
-=============================
+CodeQL query: bad overflow guards
+=================================
 
 Sometimes the result of the addition is cast to a small type of size less than 4 bytes, preventing automatic widening. We don’t want our query to flag these instances.
 
diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index ea8e2c1b158..a8171a44b5d 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -2,7 +2,7 @@
 Analyzing control flow
 ======================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
@@ -226,7 +226,7 @@ A ``GuardCondition`` is a ``Boolean`` condition that controls one or more basic
 Further materials
 =================
 
-- QL for C/C++: https://help.semmle.com/QL/learn-ql/ql/cpp/ql-for-cpp.html 
+- CodeQL for C/C++: https://help.semmle.com/QL/learn-ql/ql/cpp/ql-for-cpp.html 
 - API reference: https://help.semmle.com/qldoc/cpp 
 
 .. rst-class:: end-slide
diff --git a/docs/language/ql-training/cpp/data-flow-cpp.rst b/docs/language/ql-training/cpp/data-flow-cpp.rst
index 2b020499eb0..5377d8d52d1 100644
--- a/docs/language/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/data-flow-cpp.rst
@@ -86,9 +86,9 @@ Write a query that flags ``printf`` calls where the format argument is not a ``S
 
 .. note::
 
-  This first query is about finding places where the format specifier is not a constant string. In QL for C/C++, constant strings are modeled as ``StringLiteral`` nodes, so we are looking for calls to format functions where the format specifier argument is not a string literal.
+  This first query is about finding places where the format specifier is not a constant string. In CodeQL for C/C++, constant strings are modeled as ``StringLiteral`` nodes, so we are looking for calls to format functions where the format specifier argument is not a string literal.
 
-  The `C/C++ standard libraries <https://help.semmle.com/qldoc/cpp/>`__ include many different formatting functions that may be vulnerable to this particular attack–including ``printf``, ``snprintf``, and others. Furthermore, each of these different formatting functions may include the format string in a different position in the argument list. Instead of laboriously listing all these different variants, we can make use of the QL for C/C++ standard library class ``FormattingFunction``, which provides an interface that models common formatting functions in C/C++.
+  The `C/C++ standard libraries <https://help.semmle.com/qldoc/cpp/>`__ include many different formatting functions that may be vulnerable to this particular attack–including ``printf``, ``snprintf``, and others. Furthermore, each of these different formatting functions may include the format string in a different position in the argument list. Instead of laboriously listing all these different variants, we can make use of the CodeQL for C/C++ standard library class ``FormattingFunction``, which provides an interface that models common formatting functions in C/C++.
 
 Meh...
 ======
diff --git a/docs/language/ql-training/cpp/global-data-flow-cpp.rst b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
index 6033581ffc3..bc048ac59f4 100644
--- a/docs/language/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
@@ -2,7 +2,7 @@
 Introduction to global data flow
 ================================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
@@ -77,7 +77,7 @@ The library class ``SecurityOptions`` provides a (configurable) model of what co
 
 .. note::
 
-  We first define what it means to be a *source* of tainted data for this particular problem. In this case, what we care about is whether the format string can be provided by an external user to our application or service. As there are many such ways external data could be introduced into the system, the standard QL libraries for C/C++ include an extensible API for modeling user input. In this case, we will simply use the predefined set of *user inputs*, which includes arguments provided to command line applications.
+  We first define what it means to be a *source* of tainted data for this particular problem. In this case, what we care about is whether the format string can be provided by an external user to our application or service. As there are many such ways external data could be introduced into the system, the standard CodeQL libraries for C/C++ include an extensible API for modeling user input. In this case, we will simply use the predefined set of *user inputs*, which includes arguments provided to command line applications.
 
 
 Defining sinks (exercise)
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index 82eb62a3ba8..dddc86ca77f 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -2,7 +2,7 @@
 Introduction to variant analysis
 ================================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
@@ -56,14 +56,14 @@ Oops
 
 .. note::
 
-   Here’s a simple (artificial) bug, which we’ll develop a QL query to catch.
+   Here’s a simple (artificial) bug, which we’ll develop a query to catch.
 
    This function writes a value to a given location in an array, first trying to do a bounds check to validate that the location is within bounds. However, the return statement has been commented out, leaving a redundant if statement and no bounds checking.
 
    This case can act as our “patient zero” in the variant analysis game.
 
-A simple QL query
-=================
+A simple CodeQL query
+=====================
 
 .. literalinclude:: ../query-examples/cpp/empty-if-cpp.ql
    :language: ql
@@ -72,9 +72,9 @@ A simple QL query
 
    We are going to write a simple query which finds “if statements” with empty “then” blocks, so we can highlight the results like those on the previous slide. The query can be run in the `query console on LGTM <https://lgtm.com/query>`__, or in your `IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__.
 
-   A `QL query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
+   A `query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
 
-   In our example here, the first line of the query imports the `C/C++ standard QL library <https://help.semmle.com/qldoc/cpp/>`__, which defines concepts like ``IfStmt`` and ``Block``.
+   In our example here, the first line of the query imports the `CodeQL for C/C++ standard library <https://help.semmle.com/qldoc/cpp/>`__, which defines concepts like ``IfStmt`` and ``Block``.
    The query proper starts by declaring two variables–ifStmt and block. These variables represent sets of values in the database, according to the type of each of the variables. For example, ifStmt has the type IfStmt, which means it represents the set of all if statements in the program.
 
    If we simply selected these two variables::
@@ -97,8 +97,8 @@ A simple QL query
 
 
 
-Structure of a QL query
-=======================
+Structure of a query
+====================
 
 A **query file** has the extension ``.ql`` and contains a **query clause**, and optionally **predicates**, **classes**, and **modules**.
 
@@ -110,14 +110,14 @@ Each query library also implicitly defines a module.
 
 .. note::
 
-  QL queries are always contained in query files with the file extension ``.ql``. `Quick queries <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/quick-query.html>`__, run in `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__, are no exception: the quick query window maintains a temporary QL file in the background.
+  Queries are always contained in query files with the file extension ``.ql``. `Quick queries <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/quick-query.html>`__, run in `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__, are no exception: the quick query window maintains a temporary query file in the background.
 
-  Parts of queries can be lifted into `QL library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``qll``. Definitions within such libraries can be brought into scope using ``import`` statements, and similarly QLL files can import each other’s definitions using “import” statements.
+  Parts of queries can be lifted into `library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``qll``. Definitions within such libraries can be brought into scope using ``import`` statements, and similarly QLL files can import each other’s definitions using “import” statements.
 
   Logic can be encapsulated as user-defined `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ and `classes <https://help.semmle.com/QL/ql-handbook/types.html#classes>`__, and organized into `modules <https://help.semmle.com/QL/ql-handbook/modules.html>`__. Each QLL file implicitly defines a module, but QL and QLL files can also contain explicit module definitions, as we will see later.
 
-Predicates in QL
-================
+Predicates
+==========
 
 A predicate allows you to pull out and name parts of a query.
 
@@ -135,14 +135,14 @@ A predicate allows you to pull out and name parts of a query.
 
 .. note::
 
-   A QL predicate takes zero or more parameters, and its body is a condition on those parameters. The predicate may (or may not) hold. Predicates may also be recursive, simply by referring to themselves (directly or indirectly).
+   A `predicate <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ takes zero or more parameters, and its body is a condition on those parameters. The predicate may (or may not) hold. Predicates may also be `recursive <https://help.semmle.com/QL/ql-handbook/predicates.html#recursive-predicates>`__, simply by referring to themselves (directly or indirectly).
 
    You can imagine a predicate to be a self-contained from-where-select statement, that produces an intermediate relation, or table. In this case, the ``isEmpty`` predicate will be the set of all blocks which are empty.
 
-Classes in QL
-=============
+Classes
+=======
 
-A QL class allows you to name a set of values and define (member) predicates on them.
+A class allows you to name a set of values and define (member) predicates on them.
 
 A class has at least one supertype and optionally a **characteristic predicate**; it contains the values that belong to *all* supertypes *and* satisfy the characteristic predicate, if provided.
 
@@ -162,8 +162,8 @@ Member predicates are inherited and can be overridden.
 
   In the example, declaring a variable “EmptyBlock e” will allow it to range over only those blocks that have zero statements.
 
-Classes in QL continued
-=======================
+Classes continued
+=================
 
 .. container:: column-left
 
@@ -198,7 +198,7 @@ Iterative query refinement
 
 .. note::
 
-   QL makes it very easy to experiment with analysis ideas. A common workflow is to start with a simple query (like our “redundant if-statement” example), examine a few results, refine the query based on any patterns that emerge and repeat.
+   CodeQL makes it very easy to experiment with analysis ideas. A common workflow is to start with a simple query (like our “redundant if-statement” example), examine a few results, refine the query based on any patterns that emerge and repeat.
 
    As an exercise, refine the redundant-if query based on the observation that if the if-statement has an “else” clause, then even if the body of the “then” clause is empty, it’s not actually redundant.
 
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 1850e3e5671..b21677fccab 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -2,7 +2,7 @@
 Program representation 
 ======================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
@@ -25,8 +25,8 @@ Agenda
 
 .. resume slides
 
-AST QL classes
-==============
+AST classes
+===========
 
 Important AST classes include:
 
@@ -66,9 +66,9 @@ Working with variables
 Working with functions
 ======================
 
-Functions are represented by the Function QL class. Each declaration or definition of a function is represented by a ``FunctionDeclarationEntry``.
+Functions are represented by the Function class. Each declaration or definition of a function is represented by a ``FunctionDeclarationEntry``.
 
-Calls to functions are modeled by QL class Call and its subclasses:
+Calls to functions are modeled by class Call and its subclasses:
 
 - ``Call.getTarget()`` gets the declared target of the call; undefined for calls through function pointers
 - ``Function.getACallToThisFunction()`` gets a call to this function
diff --git a/docs/language/ql-training/cpp/snprintf.rst b/docs/language/ql-training/cpp/snprintf.rst
index 77e46933fcb..dafebc4a720 100644
--- a/docs/language/ql-training/cpp/snprintf.rst
+++ b/docs/language/ql-training/cpp/snprintf.rst
@@ -2,7 +2,7 @@
 Exercise: ``snprintf`` overflow
 ===============================
 
-QL for C/C++
+CodeQL for C/C++
 
 .. container:: semmle-logo
 
diff --git a/docs/language/ql-training/index.rst b/docs/language/ql-training/index.rst
index 0cc4ca9b024..309fe92c052 100644
--- a/docs/language/ql-training/index.rst
+++ b/docs/language/ql-training/index.rst
@@ -1,5 +1,5 @@
-QL training and variant analysis examples
-=========================================
+CodeQL training and variant analysis examples
+=============================================
 
 .. container:: semmle-logo
 
diff --git a/docs/language/ql-training/java/apache-struts-java.rst b/docs/language/ql-training/java/apache-struts-java.rst
index 7fcd2e003cd..5c27ec73979 100644
--- a/docs/language/ql-training/java/apache-struts-java.rst
+++ b/docs/language/ql-training/java/apache-struts-java.rst
@@ -67,7 +67,7 @@ RCE in Apache Struts
 Finding the RCE yourself
 ========================
 
-#. Create a QL class to find the interface ``org.apache.struts2.rest.handler.ContentTypeHandler``
+#. Create a class to find the interface ``org.apache.struts2.rest.handler.ContentTypeHandler``
 
    **Hint**: Use predicate ``hasQualifiedName(...)``
 
diff --git a/docs/language/ql-training/java/global-data-flow-java.rst b/docs/language/ql-training/java/global-data-flow-java.rst
index 665899f8459..f43c31e0f4f 100644
--- a/docs/language/ql-training/java/global-data-flow-java.rst
+++ b/docs/language/ql-training/java/global-data-flow-java.rst
@@ -2,7 +2,7 @@
 Introduction to global data flow
 ================================
 
-QL for Java
+CodeQL for Java
 
 .. container:: semmle-logo
 
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index 392c18309cb..f80f878492d 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -2,7 +2,7 @@
 Introduction to variant analysis 
 ================================
 
-QL for Java
+CodeQL for Java
 
 .. container:: semmle-logo
 
@@ -56,14 +56,14 @@ Oops
 
 .. note::
 
-   Here’s a simple (artificial) bug, which we’ll develop a QL query to catch.
+   Here’s a simple (artificial) bug, which we’ll develop a query to catch.
 
    This function writes a value to a given location in an array, first trying to do a bounds check to validate that the location is within bounds. However, the return statement has been commented out, leaving a redundant if statement and no bounds checking.
 
    This case can act as our “patient zero” in the variant analysis game.
 
-A simple QL query
-=================
+A simple CodeQL query
+=====================
 
 .. literalinclude:: ../query-examples/java/empty-if-java.ql
    :language: ql
@@ -72,9 +72,9 @@ A simple QL query
 
    We are going to write a simple query which finds “if statements” with empty “then” blocks, so we can highlight the results like those on the previous slide. The query can be run in the `query console on LGTM <https://lgtm.com/query>`__, or in your `IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__.
 
-   A `QL query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
+   A `query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
 
-   In our example here, the first line of the query imports the `Java standard QL library <https://help.semmle.com/qldoc/java/>`__, which defines concepts like ``IfStmt`` and ``Block``.
+   In our example here, the first line of the query imports the `CodeQL for Java library <https://help.semmle.com/qldoc/java/>`__, which defines concepts like ``IfStmt`` and ``Block``.
    The query proper starts by declaring two variables–ifStmt and block. These variables represent sets of values in the database, according to the type of each of the variables. For example, ``ifStmt`` has the type ``IfStmt``, which means it represents the set of all if statements in the program.
 
    If we simply selected these two variables::
@@ -96,8 +96,8 @@ A simple QL query
    Finally, we select a location, at which to report the problem, and a message, to explain what the problem is.
 
 
-Structure of a QL query
-=======================
+Structure of a query
+=====================
 
 A **query file** has the extension ``.ql`` and contains a **query clause**, and optionally **predicates**, **classes**, and **modules**.
 
@@ -109,14 +109,14 @@ Each query library also implicitly defines a module.
 
 .. note::
 
-  QL queries are always contained in query files with the file extension ``.ql``. `Quick queries <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/quick-query.html>`__, run in `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__, are no exception: the quick query window maintains a temporary QL file in the background.
+  Queries are always contained in query files with the file extension ``.ql``. `Quick queries <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/quick-query.html>`__, run in `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__, are no exception: the quick query window maintains a temporary QL file in the background.
 
-  Parts of queries can be lifted into `QL library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``.qll``. Definitions within such libraries can be brought into scope using “import” statements, and similarly QLL files can import each other’s definitions using “import” statements.
+  Parts of queries can be lifted into `library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``.qll``. Definitions within such libraries can be brought into scope using “import” statements, and similarly QLL files can import each other’s definitions using “import” statements.
 
   Logic can be encapsulated as user-defined `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ and `classes <https://help.semmle.com/QL/ql-handbook/types.html#classes>`__, and organized into `modules <https://help.semmle.com/QL/ql-handbook/modules.html>`__. Each QLL file implicitly defines a module, but QL and QLL files can also contain explicit module definitions, as we will see later.
 
-Predicates in QL
-================
+Predicates
+==========
 
 A predicate allows you to pull out and name parts of a query.
 
@@ -134,15 +134,15 @@ A predicate allows you to pull out and name parts of a query.
 
 .. note::
 
-   A `QL predicate <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ takes zero or more parameters, and its body is a condition on those parameters. The predicate may (or may not) hold. Predicates may also be `recursive <https://help.semmle.com/QL/ql-handbook/predicates.html#recursive-predicates>`__, simply by referring to themselves (directly or indirectly).
+   A `predicate <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ takes zero or more parameters, and its body is a condition on those parameters. The predicate may (or may not) hold. Predicates may also be `recursive <https://help.semmle.com/QL/ql-handbook/predicates.html#recursive-predicates>`__, simply by referring to themselves (directly or indirectly).
 
    You can imagine a predicate to be a self-contained from-where-select statement, that produces an intermediate relation, or table. In this case, the ``isEmpty`` predicate will be the set of all blocks which are empty.
 
 
-Classes in QL
-=============
+Classes
+=======
 
-A QL class allows you to name a set of values and define (member) predicates on them.
+A class allows you to name a set of values and define (member) predicates on them.
 
 A class has at least one supertype and optionally a **characteristic predicate**; it contains the values that belong to *all* supertypes *and* satisfy the characteristic predicate, if provided.
 
@@ -162,7 +162,7 @@ Member predicates are inherited and can be overridden.
 
   In the example, declaring a variable “EmptyBlock e” will allow it to range over only those blocks that have zero statements.
 
-Classes in QL continued
+Classes in continued
 =======================
 
 .. container:: column-left
@@ -197,7 +197,7 @@ Iterative query refinement
 
 .. note::
 
-   QL makes it very easy to experiment with analysis ideas. A common workflow is to start with a simple query (like our “redundant if-statement” example), examine a few results, refine the query based on any patterns that emerge and repeat.
+   CodeQL makes it very easy to experiment with analysis ideas. A common workflow is to start with a simple query (like our “redundant if-statement” example), examine a few results, refine the query based on any patterns that emerge and repeat.
 
    As an exercise, refine the redundant-if query based on the observation that if the if-statement has an “else” clause, then even if the body of the “then” clause is empty, it’s not actually redundant.
 
diff --git a/docs/language/ql-training/java/program-representation-java.rst b/docs/language/ql-training/java/program-representation-java.rst
index d090c30aebe..ef078b53562 100644
--- a/docs/language/ql-training/java/program-representation-java.rst
+++ b/docs/language/ql-training/java/program-representation-java.rst
@@ -2,7 +2,7 @@
 Program representation
 ======================
 
-QL for Java
+CodeQL for Java
 
 .. container:: semmle-logo
 
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index 67f7fe21a76..b3ef7d7e182 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -2,7 +2,7 @@
 Example: Query injection
 ========================
 
-QL for Java
+CodeQL for Java
 
 .. container:: semmle-logo
 
@@ -65,13 +65,13 @@ SPARQL injection
 
 .. rst-class:: background2
 
-Developing a QL query
-======================
+Developing a query
+===================
 
 Finding a query concatenation
 
-QL query: find SPARQL methods
-=============================
+CodeQL query: find SPARQL methods
+=================================
 
 Let’s start by looking for calls to methods with names of the form ``sparql*Query``, using the classes ``Method`` and ``MethodAccess`` from the Java library.
 
@@ -88,10 +88,10 @@ Let’s start by looking for calls to methods with names of the form ``sparql*Qu
     - a ``MethodAccess``: the call to a SPARQL query method
     - a ``Method``: the SPARQL query method.
   
-  - The ``where`` part of the query ties these three QL variables   together using `predicates <https://help.semmle.com/QL/  ql-handbook/predicates.html>`__ defined in the `standard QL for   Java library <https://help.semmle.com/qldoc/java/>`__.
+  - The ``where`` part of the query ties these variables together using `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ defined in the `standard CodeQL for   Java library <https://help.semmle.com/qldoc/java/>`__.
 
-QL query: find string concatenation
-===================================
+CodeQL query: find string concatenation
+=======================================
 
 - We now need to define what would make these API calls unsafe.
 - A simple heuristic would be to look for string concatenation used in the query argument. 
@@ -113,8 +113,8 @@ Looking at autocomplete suggestions, we see that we can get the type of an expre
   - We therefore write a helper predicate for finding string concatenation.
   - This predicate effectively represents the set of all ``add`` expressions in the database where the type of the expression is ``TypeString`` - that is, the addition produces a ``String``   value.
 
-QL query: SPARQL injection
-==========================
+CodeQL query: SPARQL injection
+==============================
 
 We can now combine our predicate with the existing query.
 Note that we do not need to specify that the argument of the method access is an ``AddExpr`` - this is implied by the ``isStringConcat`` requirement.
diff --git a/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst b/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
index c640aa7a16a..6a26b5c74a4 100644
--- a/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
+++ b/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
@@ -35,9 +35,9 @@ The basic representation of an analyzed program is an *abstract syntax tree (AST
 
 .. note::
 
-  When writing queries in QL it is important to have in mind the underlying representation of the program which is stored in the database. Typically queries make use of the “AST” representation of the program - a tree structure where program elements are nested within other program elements.
+  When writing queries it is important to have in mind the underlying representation of the program which is stored in the database. Typically queries make use of the “AST” representation of the program - a tree structure where program elements are nested within other program elements.
 
-  The following topics contain overviews of the important AST classes and QL libraries for C/C++, C#, and Java: 
+  The following topics contain overviews of the important AST classes and CodeQL libraries for C/C++, C#, and Java: 
   
   - `Introducing the C/C++ libraries <https://help.semmle.com/QL/learn-ql/cpp/introduce-libraries-cpp.html>`__ 
   - `Introducing the C# libraries <https://help.semmle.com/QL/learn-ql/csharp/introduce-libraries-csharp.html>`__
@@ -47,19 +47,19 @@ The basic representation of an analyzed program is an *abstract syntax tree (AST
 Database representations of ASTs
 ================================
 
-AST nodes and other program elements are encoded in the database as *entity values*. Entities are implemented as integers, but in QL they are opaque - all one can do with them is to check their equality.
+AST nodes and other program elements are encoded in the database as *entity values*. Entities are implemented as integers, but in QL they are opaque---all one can do with them is to check their equality.
 
 Each entity belongs to an entity type. Entity types have names starting with “@” and are defined in the database schema (not in QL).
 
 Properties of AST nodes and their relationships to each other are encoded by database relations, which are predicates defined in the database (not in QL).
 
-Entity types are rarely used directly, the usual pattern is to define a QL class that extends the type and exposes properties of its entities through member predicates.
+Entity types are rarely used directly, the usual pattern is to define a class that extends the type and exposes properties of its entities through member predicates.
 
 .. note::
 
   ASTs are a typical example of the kind of data representation one finds in object-oriented programming, with data-carrying nodes that reference each other. At first glance, QL, which can only work with atomic values, does not seem to be well suited for working with this kind of data. However, ultimately all that we require of the nodes in an AST is that they have an identity. The relationships among nodes, usually implemented by reference-valued object fields in other languages, can just as well (and arguably more naturally) be represented as relations over nodes. Attaching data (such as strings or numbers) to nodes can also be represented with relations over nodes and primitive values. All we need is a way for relations to reference nodes. This is achieved in QL (as in other database languages) by means of *entity values* (or entities, for short), which are opaque atomic values, implemented as integers under the hood.
 
-  It is the job of the extractor to create entity values for all AST nodes and populate database relations that encode the relationship between AST nodes and any values associated with them. These relations are *extensional*, that is, explicitly stored in the database, unlike the relations described by QL predicates, which we also refer to as *intensional* relations. Entity values belong to *entity types*, whose name starts with “@” to set them apart from primitive types and classes.
+  It is the job of the extractor to create entity values for all AST nodes and populate database relations that encode the relationship between AST nodes and any values associated with them. These relations are *extensional*, that is, explicitly stored in the database, unlike the relations described by predicates, which we also refer to as *intensional* relations. Entity values belong to *entity types*, whose name starts with “@” to set them apart from primitive types and classes.
 
   The interface between entity types and extensional relations on the one hand and QL predicates and classes on the other hand is provided by the *database schema*, which defines the available entity types and the schema of each extensional relation, that is, how many columns the relation has, and which entity type or primitive type the values in each column come from. QL programs can refer to entity types and extensional relations just as they would refer to QL classes and predicates, with the restriction that entity types cannot be directly selected in a ``select`` clause, since they do not have a well-defined string representation.
 
diff --git a/docs/language/ql-training/slide-snippets/info.rst b/docs/language/ql-training/slide-snippets/info.rst
deleted file mode 100644
index 583a456207b..00000000000
--- a/docs/language/ql-training/slide-snippets/info.rst
+++ /dev/null
@@ -1,33 +0,0 @@
-Information
-===========
-
-To try the examples in this presentation we recommend you download `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__.
-
-**QL language resources**
-
-- If you are new to QL, try the QL language tutorials at `Learning CodeQL <https://help.semmle.com/QL/learn-ql/>`__.
-- To learn more about the main features of QL, try looking at the `QL language handbook <https://help.semmle.com/QL/ql-handbook/>`__.
-- For further information about writing queries in QL, see `Writing QL queries <https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html>`__.
-
-**QL queries**
-
-The QL queries included in the latest Semmle release are open source. View them in the `semmle/ql repository <https://github.com/semmle/ql>`__.
-
-**Extra information**
-
-.. |arrow-l| unicode:: U+2190
-
-.. |arrow-r| unicode:: U+2192
-
-- Press |arrow-l| and |arrow-r| to navigate between slides
-- Pressing **p** toggles between the slide and any extra notes (where they're available)
-- Pressing **f** toggles full screen viewing on/off
-
-.. note::
-
-   To run the queries featured in this training presentation, we recommend you download the free-to-use `QL for Eclipse plugin <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/getting-started.html>`__.
-
-   This plugin allows you to locally access the latest features of QL, including the standard QL libraries and queries. It also provides standard IDE features such as syntax highlighting, jump-to-definition, and tab completion.
-
-   When you have setup QL for Eclipse we recommend increasing the “Memory for running queries” from the default setting of 4096MB to 8192MB, to ensure that all the queries complete quickly.
-   
\ No newline at end of file
diff --git a/docs/language/ql-training/slide-snippets/intro-ql-general.rst b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
index f0c00c131fc..6fa68c7243e 100644
--- a/docs/language/ql-training/slide-snippets/intro-ql-general.rst
+++ b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
@@ -67,9 +67,9 @@ Complete text of the analysis (nothing left out!):
 
 .. note::
  
-  Once the mission critical bug was discovered on Curiosity, JPL contacted Semmle for help discovering whether variants of the problem might exist elsewhere in the Curiosity control software.  In 20 minutes, research engineers from Semmle produced a QL query and shared it with the JPL team. It finds all functions that are passed an array as an argument whose size is smaller than expected.
+  Once the mission critical bug was discovered on Curiosity, JPL contacted Semmle for help discovering whether variants of the problem might exist elsewhere in the Curiosity control software.  In 20 minutes, research engineers from Semmle produced a CodeQL query and shared it with the JPL team. It finds all functions that are passed an array as an argument whose size is smaller than expected.
 
-  (The goal here is not to fully understand the QL, but to illustrate the power of the language and its standard libraries.)
+  (The goal here is not to fully understand the query, but to illustrate the power of the language and its standard libraries.)
 
 
 Find all instances!
@@ -105,16 +105,16 @@ Analysis overview
 
   Semmle’s analysis works by extracting a queryable database from your project. For compiled languages, Semmle’s tools observe an ordinary build of the source code. Each time a compiler is invoked to process a source file, a copy of that file is made, and all relevant information about the source code (syntactic data about the abstract syntax tree, semantic data like name binding and type information, data on the operation of the C preprocessor, etc.) is collected. For interpreted languages, the extractor gathers similar information by running directly on the source code. Multi-language code bases are analyzed one language at a time.
 
-  Once the extraction finishes, all this information is collected into a single `snapshot database <https://help.semmle.com/QL/learn-ql/ql/snapshot.html>`__, which is then ready to query, possibly on a different machine. A copy of the source files, made at the time the database was created, is also included in the snapshot so analysis results can be displayed at the correct location in the code. The database schema is (source) language specific.
+  Once the extraction finishes, all this information is collected into a single `CodeQL database <https://help.semmle.com/QL/learn-ql/ql/snapshot.html>`__, which is then ready to query, possibly on a different machine. A copy of the source files, made at the time the database was created, is also included in the snapshot so analysis results can be displayed at the correct location in the code. The database schema is (source) language specific.
 
-  Queries are written in `QL <https://semmle.com/ql>`__ and usually depend on one or more of the `standard QL libraries <https://github.com/semmle/ql>`__ (and of course you can write your own custom libraries). They are compiled into an efficiently executable format by the QL compiler and then run on a snapshot database by the QL evaluator, either on a remote worker machine or locally on a developer’s machine.
+  Queries are written in `QL <https://semmle.com/ql>`__ and usually depend on one or more of the `standard CodeQL libraries <https://github.com/semmle/ql>`__ (and of course you can write your own custom libraries). They are compiled into an efficiently executable format by the QL compiler and then run on a CodeQL database by the QL evaluator, either on a remote worker machine or locally on a developer’s machine.
 
   Query results can be interpreted and presented in a variety of ways, including displaying them in an `IDE plugin <https://lgtm.com/help/lgtm/running-queries-ide>`__ such as QL for Eclipse, or in a web dashboard as on `LGTM <https://lgtm.com/help/lgtm/about-lgtm>`__.
 
 Introducing QL
 ==============
 
-QL is the query language running all Semmle analysis.
+QL is the query language running all CodeQL analysis.
 
 QL is:
 
@@ -126,12 +126,12 @@ QL is:
 
 .. note::
 
-  QL is the high-level, object-oriented logic language that underpins all of Semmle’s libraries and analyses. You can learn lots more about QL by visiting `Introduction to the QL language <https://help.semmle.com/QL/learn-ql/ql/introduction-to-ql.html>`__ and `About QL <https://help.semmle.com/QL/learn-ql/ql/about-ql.html>`__.
+  QL is the high-level, object-oriented logic language that underpins all CodeQL libraries and analyses. You can learn lots more about QL by visiting `Introduction to the QL language <https://help.semmle.com/QL/learn-ql/ql/introduction-to-ql.html>`__ and `About QL <https://help.semmle.com/QL/learn-ql/ql/about-ql.html>`__.
   The key features of QL are:
   
   - All common logic connectives are available, including quantifiers like ``exist``, which can also introduce new variables. 
   - The language is declarative–the user focuses on stating what they would like to find, and leaves the details of how to evaluate the query to the engine. 
-  - The object-oriented layer allows Semmle to distribute rich standard libraries for program analysis. These model the common AST node types, control flow and name lookup, and define further layers on top–for example control flow or data flow analysis. The `standard QL libraries and queries <https://github.com/semmle/ql>`__ ship as source and can be inspected by the user, and new abstractions are readily defined.
+  - The object-oriented layer allows Semmle to distribute rich standard libraries for program analysis. These model the common AST node types, control flow and name lookup, and define further layers on top–for example control flow or data flow analysis. The `standard CodeQL libraries and queries <https://github.com/semmle/ql>`__ ship as source and can be inspected by the user, and new abstractions are readily defined.
   - The database generated by Semmle’s tools is treated as read-only; queries cannot insert new data into it, though they can inspect its contents in various ways.
 
-  You can start writing QL and running QL queries on open source projects in the `query console <https://lgtm.com/query>`__ on LGTM.com. You can also download snapshots from LGTM.com to query locally, by `running queries in your IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__ equipped with a QL plugin or extension.
+  You can start writing running queries on open source projects in the `query console <https://lgtm.com/query>`__ on LGTM.com. You can also download snapshots from LGTM.com to query locally, by `running queries in your IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__.

From 69d7baa9bcfc4ac4ce72459e92bc66436197859c Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Tue, 5 Nov 2019 15:35:18 +0000
Subject: [PATCH 140/232] docs: update snapshot terminology

---
 docs/language/ql-training/cpp/bad-overflow-guard.rst      | 8 ++++----
 docs/language/ql-training/cpp/control-flow-cpp.rst        | 6 +++---
 docs/language/ql-training/cpp/data-flow-cpp.rst           | 6 +++---
 docs/language/ql-training/cpp/global-data-flow-cpp.rst    | 6 +++---
 docs/language/ql-training/cpp/intro-ql-cpp.rst            | 6 +++---
 .../ql-training/cpp/program-representation-cpp.rst        | 4 ++--
 docs/language/ql-training/cpp/snprintf.rst                | 6 +++---
 docs/language/ql-training/java/apache-struts-java.rst     | 6 +++---
 docs/language/ql-training/java/data-flow-java.rst         | 6 +++---
 docs/language/ql-training/java/global-data-flow-java.rst  | 6 +++---
 docs/language/ql-training/java/intro-ql-java.rst          | 6 +++---
 docs/language/ql-training/java/query-injection-java.rst   | 6 +++---
 .../ql-training/slide-snippets/abstract-syntax-tree.rst   | 2 +-
 .../{snapshot-note.rst => database-note.rst}              | 2 +-
 .../ql-training/slide-snippets/global-data-flow.rst       | 6 +++---
 .../ql-training/slide-snippets/intro-ql-general.rst       | 6 +++---
 .../ql-training/slide-snippets/local-data-flow.rst        | 4 ++--
 17 files changed, 46 insertions(+), 46 deletions(-)
 rename docs/language/ql-training/slide-snippets/{snapshot-note.rst => database-note.rst} (66%)

diff --git a/docs/language/ql-training/cpp/bad-overflow-guard.rst b/docs/language/ql-training/cpp/bad-overflow-guard.rst
index 5e9fbcfc700..6937e9a1a4f 100644
--- a/docs/language/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/language/ql-training/cpp/bad-overflow-guard.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `ChakraCore snapshot <https://downloads.lgtm.com/snapshots/cpp/microsoft/chakracore/ChakraCore-revision-2017-April-12--18-13-26.zip>`__
+- `ChakraCore database <https://downloads.lgtm.com/snapshots/cpp/microsoft/chakracore/ChakraCore-revision-2017-April-12--18-13-26.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can query the project in `the query console <https://lgtm.com/query/project:2034240708/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
@@ -233,4 +233,4 @@ The final query
 .. literalinclude:: ../query-examples/cpp/bad-overflow-guard-3.ql
    :language: ql
 
-This query finds a single result in our historic snapshot, which was `a genuine bug in ChakraCore <https://github.com/Microsoft/ChakraCore/commit/2500e1cdc12cb35af73d5c8c9b85656aba6bab4d>`__.
+This query finds a single result in our historic database, which was `a genuine bug in ChakraCore <https://github.com/Microsoft/ChakraCore/commit/2500e1cdc12cb35af73d5c8c9b85656aba6bab4d>`__.
diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index a8171a44b5d..4e6ebbf4292 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -18,7 +18,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `ChakraCore snapshot <https://downloads.lgtm.com/snapshots/cpp/microsoft/chakracore/ChakraCore-revision-2017-April-12--18-13-26.zip>`__
+- `ChakraCore database <https://downloads.lgtm.com/snapshots/cpp/microsoft/chakracore/ChakraCore-revision-2017-April-12--18-13-26.zip>`__
 
 .. note::
 
@@ -26,9 +26,9 @@ For this example you should download:
 
    You can query the project in `the query console <https://lgtm.com/query/project:2034240708/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/cpp/data-flow-cpp.rst b/docs/language/ql-training/cpp/data-flow-cpp.rst
index 5377d8d52d1..cb7ed7b5133 100644
--- a/docs/language/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/data-flow-cpp.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `dotnet/coreclr snapshot <http://downloads.lgtm.com/snapshots/cpp/dotnet/coreclr/dotnet_coreclr_fbe0c77.zip>`__
+- `dotnet/coreclr database <http://downloads.lgtm.com/snapshots/cpp/dotnet/coreclr/dotnet_coreclr_fbe0c77.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can query the project in `the query console <https://lgtm.com/query/projects:1505958977333/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/cpp/global-data-flow-cpp.rst b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
index bc048ac59f4..5a5e93aafda 100644
--- a/docs/language/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `dotnet/coreclr snapshot <http://downloads.lgtm.com/snapshots/cpp/dotnet/coreclr/dotnet_coreclr_fbe0c77.zip>`__
+- `dotnet/coreclr database <http://downloads.lgtm.com/snapshots/cpp/dotnet/coreclr/dotnet_coreclr_fbe0c77.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can query the project in `the query console <https://lgtm.com/query/projects:1505958977333/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index dddc86ca77f..e7d4b318b25 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `exiv2 snapshot <http://downloads.lgtm.com/snapshots/cpp/exiv2/Exiv2_exiv2_b090f4d.zip>`__
+- `exiv2 database <http://downloads.lgtm.com/snapshots/cpp/exiv2/Exiv2_exiv2_b090f4d.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:1506532406873/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index b21677fccab..077b36520f6 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -107,7 +107,7 @@ Working with macros
     #define square(x) x*x
     y = square(y0), z = square(z0)
 
-is represented in the snapshot database as:
+is represented in the CodeQL database database as:
 
 - A Macro entity representing the text of the *head* and *body* of the macro
 - Assignment nodes, representing the two assignments after preprocessing
@@ -121,4 +121,4 @@ Useful predicates on ``Element``: ``isInMacroExpansion()``, ``isAffectedByMacro(
 
 .. note::
 
-  The snapshot also contains information about macro definitions, which are represented by class ``Macro``. These macro definitions are related to the AST nodes resulting from their uses by the class ``MacroAccess``.
\ No newline at end of file
+  The CodeQL database also contains information about macro definitions, which are represented by class ``Macro``. These macro definitions are related to the AST nodes resulting from their uses by the class ``MacroAccess``.
\ No newline at end of file
diff --git a/docs/language/ql-training/cpp/snprintf.rst b/docs/language/ql-training/cpp/snprintf.rst
index dafebc4a720..26c54708c0a 100644
--- a/docs/language/ql-training/cpp/snprintf.rst
+++ b/docs/language/ql-training/cpp/snprintf.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `rsyslog snapshot <https://downloads.lgtm.com/snapshots/cpp/rsyslog/rsyslog/rsyslog-all-revision-2018-April-27--14-12-31.zip>`__
+- `rsyslog database <https://downloads.lgtm.com/snapshots/cpp/rsyslog/rsyslog/rsyslog-all-revision-2018-April-27--14-12-31.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:1506087977050/lang:cpp/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/java/apache-struts-java.rst b/docs/language/ql-training/java/apache-struts-java.rst
index 5c27ec73979..73d0122b7ea 100644
--- a/docs/language/ql-training/java/apache-struts-java.rst
+++ b/docs/language/ql-training/java/apache-struts-java.rst
@@ -20,7 +20,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `Apache Struts snapshot <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
+- `Apache Struts database <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
 
 .. note::
 
@@ -28,9 +28,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:1878521151/lang:java/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/java/data-flow-java.rst b/docs/language/ql-training/java/data-flow-java.rst
index be9ba98456e..0b9026aadfb 100644
--- a/docs/language/ql-training/java/data-flow-java.rst
+++ b/docs/language/ql-training/java/data-flow-java.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `VIVO Vitro snapshot <http://downloads.lgtm.com/snapshots/java/vivo-project/Vitro/vivo-project_Vitro_java-srcVersion_47ae42c01954432c3c3b92d5d163551ce367f510-dist_odasa-lgtm-2019-04-23-7ceff95-linux64.zip>`__
+- `VIVO Vitro database <http://downloads.lgtm.com/snapshots/java/vivo-project/Vitro/vivo-project_Vitro_java-srcVersion_47ae42c01954432c3c3b92d5d163551ce367f510-dist_odasa-lgtm-2019-04-23-7ceff95-linux64.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:14040005/lang:java/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/java/global-data-flow-java.rst b/docs/language/ql-training/java/global-data-flow-java.rst
index f43c31e0f4f..062ce30b04c 100644
--- a/docs/language/ql-training/java/global-data-flow-java.rst
+++ b/docs/language/ql-training/java/global-data-flow-java.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `Apache Struts snapshot <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
+- `Apache Struts database <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:1878521151/lang:java/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index f80f878492d..393e35cf5a8 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `Apache Struts snapshot <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
+- `Apache Struts database <https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:1878521151/lang:java/>`__ on LGTM.com.
 
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index b3ef7d7e182..dc345d3b39c 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -16,7 +16,7 @@ Setup
 For this example you should download:
 
 - `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/install-plugin-free.html>`__
-- `VIVO Vitro snapshot <http://downloads.lgtm.com/snapshots/java/vivo-project/Vitro/vivo-project_Vitro_java-srcVersion_47ae42c01954432c3c3b92d5d163551ce367f510-dist_odasa-lgtm-2019-04-23-7ceff95-linux64.zip>`__
+- `VIVO Vitro database <http://downloads.lgtm.com/snapshots/java/vivo-project/Vitro/vivo-project_Vitro_java-srcVersion_47ae42c01954432c3c3b92d5d163551ce367f510-dist_odasa-lgtm-2019-04-23-7ceff95-linux64.zip>`__
 
 .. note::
 
@@ -24,9 +24,9 @@ For this example you should download:
 
    You can also query the project in `the query console <https://lgtm.com/query/project:14040005/lang:java/>`__ on LGTM.com.
    
-   .. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
+   .. insert database-note.rst to explain differences between database available to download and the version available in the query console.
 
-   .. include:: ../slide-snippets/snapshot-note.rst
+   .. include:: ../slide-snippets/database-note.rst
 
    .. resume slides
 
diff --git a/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst b/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
index 6a26b5c74a4..aaa2cd23d71 100644
--- a/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
+++ b/docs/language/ql-training/slide-snippets/abstract-syntax-tree.rst
@@ -63,7 +63,7 @@ Entity types are rarely used directly, the usual pattern is to define a class th
 
   The interface between entity types and extensional relations on the one hand and QL predicates and classes on the other hand is provided by the *database schema*, which defines the available entity types and the schema of each extensional relation, that is, how many columns the relation has, and which entity type or primitive type the values in each column come from. QL programs can refer to entity types and extensional relations just as they would refer to QL classes and predicates, with the restriction that entity types cannot be directly selected in a ``select`` clause, since they do not have a well-defined string representation.
 
-  For example, the database schemas for C/++, C#, and Java snapshot databases are here: 
+  For example, the database schemas for C/++, C#, and Java CodeQL databases are here: 
   
   - https://github.com/Semmle/ql/blob/master/cpp/ql/src/semmlecode.cpp.dbscheme 
   - https://github.com/Semmle/ql/blob/master/csharp/ql/src/semmlecode.csharp.dbscheme 
diff --git a/docs/language/ql-training/slide-snippets/snapshot-note.rst b/docs/language/ql-training/slide-snippets/database-note.rst
similarity index 66%
rename from docs/language/ql-training/slide-snippets/snapshot-note.rst
rename to docs/language/ql-training/slide-snippets/database-note.rst
index 4a32243211b..af6dce23728 100644
--- a/docs/language/ql-training/slide-snippets/snapshot-note.rst
+++ b/docs/language/ql-training/slide-snippets/database-note.rst
@@ -1 +1 @@
-Note that results generated in the query console are likely to differ to those generated in the QL plugin as LGTM.com analyzes the most recent revisions of each project that has been added–the snapshot available to download above is based on an historical version of the codebase.
\ No newline at end of file
+Note that results generated in the query console are likely to differ to those generated in the QL plugin as LGTM.com analyzes the most recent revisions of each project that has been added–the CodeQL database available to download above is based on an historical version of the codebase.
\ No newline at end of file
diff --git a/docs/language/ql-training/slide-snippets/global-data-flow.rst b/docs/language/ql-training/slide-snippets/global-data-flow.rst
index f18dc22d178..6cb52af0f84 100644
--- a/docs/language/ql-training/slide-snippets/global-data-flow.rst
+++ b/docs/language/ql-training/slide-snippets/global-data-flow.rst
@@ -17,15 +17,15 @@ Global data flow and taint tracking
 
 - Recap:
 
-  - Local (“intra-procedural”) data flow models flow within one function; feasible to compute for all functions in a snapshot
-  - Global (“inter-procedural”) data flow models flow across function calls; not feasible to compute for all functions in a snapshot
+  - Local (“intra-procedural”) data flow models flow within one function; feasible to compute for all functions in a CodeQL database
+  - Global (“inter-procedural”) data flow models flow across function calls; not feasible to compute for all functions in a CodeQL database
 
 - For global data flow (and taint tracking), we must therefore provide restrictions to ensure the problem is tractable.
 - Typically, this involves specifying the *source* and *sink*.
 
 .. note::
 
-  As we mentioned in the previous slide deck, while local data flow is feasible to compute for all functions in a snapshot, global data flow is not. This is because the number of paths becomes exponentially larger for global data flow.
+  As we mentioned in the previous slide deck, while local data flow is feasible to compute for all functions in a CodeQL database, global data flow is not. This is because the number of paths becomes exponentially larger for global data flow.
 
   The global data flow (and taint tracking) avoids this problem by requiring that the query author specifies which ``sources`` and ``sinks`` are applicable. This allows the implementation to compute paths between the restricted set of nodes, rather than the full graph.
 
diff --git a/docs/language/ql-training/slide-snippets/intro-ql-general.rst b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
index 6fa68c7243e..d559c5bbeb7 100644
--- a/docs/language/ql-training/slide-snippets/intro-ql-general.rst
+++ b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
@@ -105,7 +105,7 @@ Analysis overview
 
   Semmle’s analysis works by extracting a queryable database from your project. For compiled languages, Semmle’s tools observe an ordinary build of the source code. Each time a compiler is invoked to process a source file, a copy of that file is made, and all relevant information about the source code (syntactic data about the abstract syntax tree, semantic data like name binding and type information, data on the operation of the C preprocessor, etc.) is collected. For interpreted languages, the extractor gathers similar information by running directly on the source code. Multi-language code bases are analyzed one language at a time.
 
-  Once the extraction finishes, all this information is collected into a single `CodeQL database <https://help.semmle.com/QL/learn-ql/ql/snapshot.html>`__, which is then ready to query, possibly on a different machine. A copy of the source files, made at the time the database was created, is also included in the snapshot so analysis results can be displayed at the correct location in the code. The database schema is (source) language specific.
+  Once the extraction finishes, all this information is collected into a single `CodeQL database <https://help.semmle.com/QL/learn-ql/database.html>`__, which is then ready to query, possibly on a different machine. A copy of the source files, made at the time the database was created, is also included in the CodeQL database so analysis results can be displayed at the correct location in the code. The database schema is (source) language specific.
 
   Queries are written in `QL <https://semmle.com/ql>`__ and usually depend on one or more of the `standard CodeQL libraries <https://github.com/semmle/ql>`__ (and of course you can write your own custom libraries). They are compiled into an efficiently executable format by the QL compiler and then run on a CodeQL database by the QL evaluator, either on a remote worker machine or locally on a developer’s machine.
 
@@ -121,7 +121,7 @@ QL is:
 - a **logic** language based on first-order logic
 - a **declarative** language without side effects
 - an **object-oriented** language
-- a **query** language working on a read-only snapshot database
+- a **query** language working on a read-only CodeQL database database
 - equipped with rich standard libraries **for program analysis**
 
 .. note::
@@ -134,4 +134,4 @@ QL is:
   - The object-oriented layer allows Semmle to distribute rich standard libraries for program analysis. These model the common AST node types, control flow and name lookup, and define further layers on top–for example control flow or data flow analysis. The `standard CodeQL libraries and queries <https://github.com/semmle/ql>`__ ship as source and can be inspected by the user, and new abstractions are readily defined.
   - The database generated by Semmle’s tools is treated as read-only; queries cannot insert new data into it, though they can inspect its contents in various ways.
 
-  You can start writing running queries on open source projects in the `query console <https://lgtm.com/query>`__ on LGTM.com. You can also download snapshots from LGTM.com to query locally, by `running queries in your IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__.
+  You can start writing running queries on open source projects in the `query console <https://lgtm.com/query>`__ on LGTM.com. You can also download CodeQL databases from LGTM.com to query locally, by `running queries in your IDE <https://lgtm.com/help/lgtm/running-queries-ide>`__.
diff --git a/docs/language/ql-training/slide-snippets/local-data-flow.rst b/docs/language/ql-training/slide-snippets/local-data-flow.rst
index 8a0eeac6374..068dfc9170a 100644
--- a/docs/language/ql-training/slide-snippets/local-data-flow.rst
+++ b/docs/language/ql-training/slide-snippets/local-data-flow.rst
@@ -61,8 +61,8 @@ Data flow graphs
 Local vs global data flow
 =========================
 
-- Local (“intra-procedural”) data flow models flow within one function; feasible to compute for all functions in a snapshot
-- Global (“inter-procedural”) data flow models flow across function calls; not feasible to compute for all functions in a snapshot
+- Local (“intra-procedural”) data flow models flow within one function; feasible to compute for all functions in a CodeQL database
+- Global (“inter-procedural”) data flow models flow across function calls; not feasible to compute for all functions in a CodeQL database
 - Different APIs, so discussed separately
 - This slide deck focuses on the former
 

From 2d00ca5773b7773184b3beabbd3799876d3fc06b Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Fri, 4 Oct 2019 09:18:19 +0100
Subject: [PATCH 141/232] docs: semmle logo

(cherry picked from commit 4a8e8fa0de4470aaeed94357f70b54b68c0b84a7)
---
 .../static/theme/css/default.css              |  18 +--
 .../_static-training/title-slide.svg          | 149 +-----------------
 .../ql-training/cpp/bad-overflow-guard.rst    |   4 -
 .../ql-training/cpp/control-flow-cpp.rst      |   4 -
 .../ql-training/cpp/data-flow-cpp.rst         |   4 -
 .../ql-training/cpp/global-data-flow-cpp.rst  |   4 -
 .../language/ql-training/cpp/intro-ql-cpp.rst |   4 -
 .../cpp/program-representation-cpp.rst        |   4 -
 docs/language/ql-training/cpp/snprintf.rst    |   4 -
 docs/language/ql-training/index.rst           |   4 -
 .../ql-training/java/apache-struts-java.rst   |   4 -
 .../ql-training/java/data-flow-java.rst       |   4 -
 .../java/global-data-flow-java.rst            |   4 -
 .../ql-training/java/intro-ql-java.rst        |   4 -
 .../java/program-representation-java.rst      |   4 -
 .../ql-training/java/query-injection-java.rst |   4 -
 docs/language/ql-training/template.rst        |   4 -
 17 files changed, 4 insertions(+), 223 deletions(-)

diff --git a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
index 2c05ea5e93b..4f706120747 100644
--- a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
+++ b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
@@ -1300,13 +1300,13 @@ aside.gdbar img {
 .title-slide hgroup h1 {
   font-size: 2em;
   line-height: 1.4;
-  /*letter-spacing: -3px;*/
   color: white;
   margin: auto;
   display: block;
   position: absolute;
   top: 0;
   bottom: 10%;
+  left: 1.25em;
   height: 0;
 }
 /* line 898, ../scss/default.scss */
@@ -1430,31 +1430,19 @@ hgroup .pre {
   color: #5c31ff;
 }
 
-/* title slide (deck title, subtitle, semmle logo)*/
+/* title slide (deck title, subtitle)*/
 
 .title-slide {
   background-image: url("../../title-slide.svg");
   background-size: cover;
 }
 
-.semmle-logo sup {
-  vertical-align: super;
-  font-size: 0.3em;
-  font-weight: 100;
-}
-
-.title-slide .semmle-logo {
-  color: white;
-  font-size: 1.2em;
-  position: absolute;
-  top: 10%;
-}
-
 .title-slide p {
   color: white;
   font-size: 1em;
   position: absolute;
   bottom: 30%;
+  left: 2.6em;
 }
 
 .title-slide hgroup .pre {
diff --git a/docs/language/ql-training/_static-training/title-slide.svg b/docs/language/ql-training/_static-training/title-slide.svg
index 6f9a19f4a1b..13eb2d34fef 100644
--- a/docs/language/ql-training/_static-training/title-slide.svg
+++ b/docs/language/ql-training/_static-training/title-slide.svg
@@ -1,148 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:xlink="http://www.w3.org/1999/xlink"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   version="1.1"
-   viewBox="0.0 0.0 960.0 540.0"
-   fill="none"
-   stroke="none"
-   stroke-linecap="square"
-   stroke-miterlimit="10"
-   id="svg3783"
-   sodipodi:docname="semmle-template.svg"
-   inkscape:version="0.92.4 (5da689c313, 2019-01-14)">
-  <metadata
-     id="metadata3789">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <defs
-     id="defs3787" />
-  <sodipodi:namedview
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1"
-     objecttolerance="10"
-     gridtolerance="10"
-     guidetolerance="10"
-     inkscape:pageopacity="0"
-     inkscape:pageshadow="2"
-     inkscape:window-width="1366"
-     inkscape:window-height="705"
-     id="namedview3785"
-     showgrid="false"
-     inkscape:zoom="0.94074074"
-     inkscape:cx="480"
-     inkscape:cy="270"
-     inkscape:window-x="-8"
-     inkscape:window-y="-8"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="svg3783" />
-  <clipPath
-     id="g3a04b465b0_0_0.0">
-    <path
-       d="m0 0l960.0 0l0 540.0l-960.0 0l0 -540.0z"
-       clip-rule="nonzero"
-       id="path3752" />
-  </clipPath>
-  <g
-     clip-path="url(#g3a04b465b0_0_0.0)"
-     id="g3781">
-    <path
-       fill="#ffffff"
-       d="m0 0l960.0 0l0 540.0l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3755" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m-2.6246718E-7 0l960.0 0l0 539.99945l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3757" />
-    <g
-       transform="matrix(0.5 0.0 0.0 0.49999947506561676 -2.624671916010499E-7 0.0)"
-       id="g3764">
-      <clipPath
-         id="g3a04b465b0_0_0.1">
-        <path
-           d="m0 0l1920.0 0l0 1080.0l-1920.0 0z"
-           clip-rule="evenodd"
-           id="path3759" />
-      </clipPath>
-      <image
-         clip-path="url(#g3a04b465b0_0_0.1)"
-         fill="#000"
-         width="1920.0"
-         height="1080.0"
-         x="0.0"
-         y="0.0"
-         preserveAspectRatio="none"
-         xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAQ4B4ADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDxaiiivYJCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiirC2crqGG3BGetNRctgK9FWfsM3+z+dH2Gb/Z/Oq9nPsFytRT5Ymhba2M4zxTKlpp2YBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArYg/wCPeP8A3RWPWxB/x7x/7orpw27EySiiiuwRm3/+vH+7/U1Vq1f/AOvH+7/U1VrzqvxspBRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa0MiCCMF1ztHesmitKdTkdwaNnzY/76/nR5sf99fzrGorb6y+wrFm+YNOCpBG3t+NVqKK55S5ncYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFWrXTby9jMlvAZFB2kgjrU/9g6p/z6N/30P8a0VKpJXUX9wGdRWj/YOqf8+jf99D/GobrTLyyjElxAY0J2gkjrQ6NRK7i/uAqUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABWvB4X1i5gSeK0Zo3GVORyKyK9V0XXtKg0W0ilvokkWIBlJ6Gt6FOE21J2A8wurWayuXt502SocMvpUNaviS4iutfu5oHDxs+Qw6GsqspJKTSAKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA7Hwj/yDZv+ux/kK6Cuf8I/8g2b/rsf5Cugr6XB/wACJD3CsHxb/wAgqP8A67D+RrerB8W/8gqP/rsP5Gni/wCBL0BbnGUUUV8yWFFa2haQNSnZpCRDH97Hc+ldcuk2Cx7Bax7fcV20MDUrR5r2Qmzzuiug8QaIlkoubYERE4ZfSufrnrUpUpckhhRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHY+ET/wAS2b/rsf5Ct/I9RXmAZl6MR9DS+Y/99vzr06OY+zpqHLt5isenZHqKwfFh/wCJVH/12H8jXH+Y/wDfb86QszDBYn6mitmPtKbhy7+YWEooorzBnXeEpUNrNFn5w2ce1dHXmtpeTWU4mgbaw/I1vr4vcR/NaqX9jxXs4THU401CeliWjU8SSpHo8iseXICj3rhauahqdxqUu+Y8D7qjoKp1wYuuq1TmjsNKwUUUVyjCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAqVLaWRQyrkH3qKtW0/49k/GtaUFOVmDKP2Of+5+tI9rMilmXAHXmtaobr/j2f6VvLDxSbFcyaKKK4xhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFSpazP0Qgep4ppN7ARUVcXT2P3nA+gqQafH3djWioTfQV0Z9FaX2GH1b86Q2EXqw/Gq+rzC5nUVfbTx/DIfxFQvYyr0w30NQ6M10HcrUU5o3Q4dSPqKbWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAqKZHVFGWY4Art9N8PWttCrTxiWYjkt0FcfYSLFfwO/3Q4zXpAIYAg5B6V6uW0oSvKSu0JmZe6DZXURCRLFJ2Za4a4ge2uHhkGGQ4Nem159rcqTavcMhyu7GR3qsyowjFTSsxIz6KKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtW0/49k/GsqpkupY0CqwwPataU1CV2DNaobr/AI9n+lUfts/94fkKa91LIhVmGD14reWIi00KxDRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKlgt3nPHC9yaaTbsgIgCxwBknsKuRWLNzIdo9B1q3FAkI+Uc9yetS1108OlrIVyOOCOL7qgH171JRRXQklsIKKKKYBRRRQAUUUUAIQCMEZHvVaWyjflfkPt0q1RUyhGW4GRLbyQn5hx6jpUVbZAIwRkVSuLIHLRdf7tctTDtaxGmUaKCCDgjBormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVtaf4kuLKIRSKJYx0yeRWLRWlOrOm+aDsBv3vii4uIjHBGIgRgtnJrAJycmiiirWnVd5u4BRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU6ON5XCRoWY9ABk1v2XhWeUB7qQRKf4Rya1pUalV2grhc56iu7g8OadCOYTIfVzmrQ0qwAwLOH/AL4FdscsqPdoXMedUV6DJomnSjm0jH+6MfyrMuvCcDgm2laM+jcipnltaOqswucjRVy+0u709v30fy9nXkGqdcMoyi7SVmMKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAorqND8F3WpxrcXLm3t25Xj5mH9K6dfAOkKmCZ2P94vXRDDVJq9gPOLa2Mx3Nwg/WtJVCKFUYArqtQ8GtBEXsJDIFH+rbr+BrmGVkYqwIYHBB7V1Qo+zViWJRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAV7m2WYZHDjv61mMpVirDBHatuq11biVdyj5x+tc9ajze8twTMyijp1oriKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1YWE2oXAhhH1Y9AKgiieeVYoxlmOAK9A0vTo9NtFjUAueXb1NdeDwrry12Qm7CadpVvpsQEa7pCPmc9TV+iivoYQjBcsVZEhRRRVAFFFFADZI0lQpIoZSOQa5HW/D5tQ1zaAmLqyd1+ntXYUhAIIIyDWFfDwrRtLcE7Hl9FbPiDSvsFz5sQ/cSHj/ZPpWNXzlWnKnNwl0LCiiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACGkpqutKJVzDCPMcevoPzrArt/hyy/ab1f49gI+ma2oRUqiTA9AAAGAAAKWiivaAK4zxhpyxSx3sa4Eh2vj17Guzrn/GDKNGAPUyDFTNXiJnB0UUVzCCiiigAooooAKKKKACiiigAooooAKKKKACit/TfCl3exrLOwt4zyMjLH8K1j4KtduBdS7vXAxVqEmFjzq+g2nzVHB61TrtdX8L3VjEzjE8HdlHI+orjJEMchQ9Qa8/EU+SV+40NooornGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFXtN0e+1aXZZ27OB1c8KPqaaTbsgKNFehab8PYEAfUbhpG7xxcL+fU/pXTWeh6ZYgfZ7KFCP4iuW/M811Qwc5b6AePRWN3OMw2s0n+5GT/KrH9iaqRn+zLz/vy3+Fe04A6CitlgV1YHiEmnX0IzLZXEY/24mH9KrV7xgVUutLsL4EXNpDL7sgz+dKWB7SA8Sor0nUfAFhOC1lK9s/ZT8y/rz+tcZq3hzUtHJNxDui7Sx8r/APW/GuWph6lPVrQDJooorEArW0nQptR/eOfLgz97HJ+lQaPp51HUEiP+rHzOfavQI0WNFRFCqowAO1ejgsIqvvz2E2UbbRLC1UbYFZv7z8mrRtbcrgwR4/3RU1Fe1GnCKskSZF54dsbpSUTyX7Mn+FcjqOmz6bNslGVP3XHQ16LVW/so7+0eCQdfun0PrXJicDCpG8FZjTPOKKfPC9vO8Mgw6MVNMr59qzsygooooAKKKKAOk8KWIkmku3HCfKn1rrazdBgEGjwDHLDcfxrSr6XCU1ToxXzIYUUUV0gFFFFABRRRQAUUUUAVNSs1vrCWBupGVPoe1edMpRirDBBwRXqFef67ALfWJ1AwGO4fjXk5pT0VReg4mdRRRXjlBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUVdtNIvb3Bigbb/ebgVsweEXIBuLgL7IK3p4WrU1jELnM0V2ieFbBR87SP/wACxUv/AAjOmf8APN/++zXSstrPsK6OGortJPCtgw+RpE/4FmqM/hFwCYLgH2cVEsvrx6XC6OZoq7d6Re2eTLA23+8vIqlXJKEou0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVreHNUbSNZinwTGx2SAdwayas2Sbp89lGaunfnVgPbIZo54llicMjDII70+vM9O1m90w4gkyh6o3INbS+NptvzWiFvZjivZVRdRXOyJAGScAVwPijVlv7tYIWzDDnnszVBqPiS+1BDGWEUR6rHxn6msionO+iE2FFFFZgFFFFABRRRQAUUUUAFFFFABRRRQAV0PhTTEvLxriVd0cPQHoWrnq7jwZt/syXH3vM5q4K8gR0lFFFdBQEBgQRkHqDXlnjPSV07UxJEuIpRkD0r1OuN8fIr21uv8AHyRWGJhzU2B5zRRRXjAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRS7W2btp25xntmkoAKKKKACiiigAooooAKKKKACiiigAooooAKACTgDJNA5OBXofhHwosCJqN/GDKeYo2H3fc+9aUqUqkrICh4d8ENchLvVAyRHlYehb6+legQW8NrCsMEaxxrwFUYAqSivXpUY01aIBRRRWoBRRRQAUUUUAFIyq6lWUMpGCD0NLRQBxXiHwPFOr3OlARy9TB/C309K8+likhlaKVGR1OGVhgg17tXN+J/DEWsQGeBQl6g4P98ehrhxGFT96G4HL+EIQLa4mxyzhPyGf610tc94V3RQXVrIpWWOXLKeo4x/Suhr0sFb2EbEPcKKKK6gCiiigDiPFEIi1gsB/rEDf0/pWLW34qlD6uFB/wBXGFP6n+tYlfM4q3tpW7lrYKKKK5wCjvRRQB6VZALYW4HaJf5VPVXTZBLpls4/55gfkMVar6yDvFNEBRRRVAFFFFABRRRQAUUUUAFcV4rUDVlPrEP5mu1rh/E8gfWCB/AgWuDMn+5+Y1uY1FFFeAUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVq6NosmpSb3ylup5b19hV06cqkuWK1Aq2Gm3Ooy7IE4H3nPQV12neHrSyAeQedL/AHmHA+grTt7eK1hWKFAiL0AqWvdw+BhS1lqyWxAABgDA9qWiiu4QUUUUAFFFFACEAjBGR71kah4etL0F4x5Mv95RwfqK2KKipThUVpq4HnN/ptzp0uydOD0cdDVSvTLi3iuoWimQOjdQa4jWdFk02TemXt2PDensa8TF4F0vehqvyKTMqiiivPGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFX9PX5Hb1OKoVp2QxbD3JrbDq8xMs0UUV3iCiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACuqLZXrQSttimwMnoG7VgUU07O4HrnUZorz/AE3xTeWKCKQCeIdAxwR+Nax8bQ7eLOTd6Fhit1Uix3OpZgqlmIAHJJrzrxFqS6lqRMZzDGNqH19TS6n4jvNSUx8QwnqiHr9TWRWc530QmzFddsjL6HFNqW5GLl/rUVePJWbRQUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdFG80qxoMsxwB702um8LabuZr6ReB8sefXua2oUXWqKCBmm2hxHQ/sQA8wDcG/264h42jkMbAhlOCD616fXJ+JtO8u4S+jX5XIEmOx9a9PH4VcinBbfkSmUV8L6y6BlsJCGGQcVlSRvDI0cg2upwQexr2C213SltIVN/ACEUEb/avJ9SdZNTuXRgytIxBHfmvPr0oQScXcoq0UUVzAFFFFABRRRQAUUUUAFFFT2VpJfXsNtEMvIwUUJXdkB0/grw+L+5/tC5TNvCfkU9Hb/wCtXpVVrCyi0+xhtYRhI1A+p7mrNe1QpKnCwBRRRWwBRRRQAUUUUAFFFFABRRRQAUUUUAc5renra3Y1aFcAjZcgd17N+H8qiBDAEHIPQiumdFkjZHGVYYIPcV53c3snhzVpNPuQz2md0Ld1U0QrRou0tn+DE0b9FVre/tbpA0M6NntnmrBIAyTgV2qSaumSLUN1cx2ds88pwqDP19qrXmsWVkpMkys3ZV5Jrj9W1ibU5OfkhX7qD+tcmJxkKMbJ3Y0rlO6uHu7qSd/vOxNQ0UV88227soKKKKQBRRRQB2vhe6E2mGEn5omx+B/ya3K4DQ9Q/s/UFZj+6f5X/wAa74EMAQcg9DX0OArKpSS6rQli0UUV2iCiiigAooooAKKKKAEZgqlj0Aya83v7j7VfzT9nc4+naut8S6iLWyNujfvZhj6L3riq8XM6yclTXQqIUUUV5YwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAp0cTzSBI0Z2PQAZqS1tpLy5SCIZdzj6V3um6XBpsIWNQZD95yOSa68LhJV3fZCbscrB4Y1CVQzhIx6Meakk8KXyLlHjf2ziu0or1FltG1tRXZ5rc2dxZvsuImQ9s9DUFel3FtDdQmKZA6Hsa4XWNLfTLrby0L8o39K87FYJ0VzR1Q07mdRRRXCMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVVLsFUZZjgAd6AL2kaY+p3Yj5ES8yN6Cu+hhjt4ViiUKijAAqrpOnrp1ikWB5h+aQ+pq9X0WDwyowu93uQ3cKKKK7ACiiigAooooAKKKKACiiigAqOaGO4haKVQyMMEGpKKGr6MDz3V9MfTLwx8mJuY29RVCvQ9W09dRsXiwPMHzIfQ156ysjlWGGU4IPY187jcP7GemzKTEooorjGFFFFABRRRQAUUUUAFFFFABRRRQAVqWf8Ax7J+P86y607I5th7E1vh/jEyzRRRXcIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAMq7/AOPp6gqW5Obl/rUVeZP4mUFFFFSAUUUUAFFFFAGvaeHLy8tUuI5IQjjIDMc/yqf/AIRK/wD+etv/AN9H/Cui0H/kCWv+6f5mtGvcpYCjKCk+qJucZ/wiV/8A89bf/vo/4Vnalpc+lvGk7RsXBI2En+leiVyXi/8A4+bX/cb+YrLF4KlSpOcdwTOboooryCgooooAKKKKACigDJwKCCpwQQR1BoAsWNo99eR26dWPJ9B616JBCltAkMYwiDAFY3hnTfs1qbqRf3so4z2Wt6vfy/D+zp873ZLYVFc26XVtJBIMq4walorvaTVmI81vLV7O7kgkHzIcfX3qCuw8T6b59uLyNf3kXD47rXH18ziaDo1HHp0LTuFFFFc4BRRRQAUUUUAFFFFABXZ/D7TxLfTXzjIhXav1P/1q4yvVvBNqLbw5E+PmmYuf5f0rpwkOap6AdFRRVuCxeX5n+Vf1r1pSUdWBUAJOBU8dnNJ0TA9TWpHbxQj5VGfWpa55V+xVjOXTW/ikA+lPGmJ3kb8qvUVHtZ9wsUTpq9pD+VRtprj7rg1pUUKrPuFjFktpo/vIceoqGugqCW0il6rg+orSNfuKxjUVYntJIefvL6iq9bppq6EFFFFMArjviBp4m06K+UfPC21j/sn/AOvXY1R1m1F5o13ARndGcfWs60OeDQHiysynKkg+xp5nmIwZZMf7xqOivETaADyeaKKKQBRRRQAUUUUAFFFFABXU+HdbG1bK5bBHEbn+RrlqM4PFbUK8qM+aINHqNFcfpXiV7cLDeZkjHAcdR/jXVW93Bdx74JVdfY9K+goYmnWXuvXsQ1YmoooroAKKKQkAZJwPU0ALVTUNQh062Msp5/hXuxqhqPiK1tAUhImm9AeB9TXIXl7PfTmWdyzHoOw+lcGKx0aa5YasaQl5dy3ty88pyzHp6D0qCiivBbcndlBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6rwjaDy57thyT5a+3c/0rp6xPCxB0YY7SNn9K26+lwcVGhGxD3CiiiukArM160F1pE3HzxjzFP06/pmtOoLwgWU5boI2z+VRVipQcX2A81ooor5QsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK2/DFkLjUTOwykAz/wI9P61iV3Hhi28nSFkI+aZix+nQfyrswNL2lZX6aiZs0UUV9ESFFFFABRRRQAUUUUAFFFFABRRRQAUUVZ0+IS3iKeg5pN2VwL9lpi7BJOMk9F9KpapYxQXG9IkCyc8L3710NUtVi8yyLd0INcsajc7sprQ46+0SyvUOYljk7Ogwf8A69cTf2Mun3TQSjkdD2Ir0iuf8V26vYJPj5o2xn2NY47CwlTdSKs0JM46iiivCKCiiigAooooAKKKKACiiigAq/p7fI6+hzVCrNk+2fHZhitKLtNAzTooor0SQooooAKKt2WmXN9kxJ8o/ibgVZuNAvIIy4CyAdQvWrUJNXSEZdFBGDg9aKgYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUlLUVy+yBz7YFKTsrgZTtukZvU5ptFFeWUFFFFABRRRQAUUUUAegaD/yBLX/AHT/ADNaNYui6hZw6RbxyXUKOFOVaQAjk1f/ALU0/wD5/bf/AL+ivpqNSCpx1WyIZbrkvF//AB82v+438xXRf2pp/wDz+2//AH9Fcx4puYLme3ME0coCnJRgcflWGPnF0Gk+w1uYFFFFeAUFFFFABRRRQBZ0+7+w30Vz5YfYc7T34xWrEP8AhItdEvk+XCoG8ZzkD1+tYIBJAAyT2rvtE04afYKrD96/zOff0rvwUJVXyP4VqxM0gAoAAwB0paKK98kKKKKAEZQ6lWGQRgg9xXn2saedOv3jA/dt8yH2r0KsvXtO/tCwbaP30fzJ7+orjxuH9rTut0NM4KigjBxRXzpQUUUUAFFFFABRR16VZg069uf9VbSsPXbx+dOMXJ2SArV7VokPl6NZRqP+WS4H1Ga8ui8MalIRlET/AHm/wr3bRNFe3062MrLvESjjtwK7aClQvKorXBajLWyWMB5BlvT0q5Vv7Cf+en6UfYT/AHx+VOVVSd2y7FSirJsn7MppjWso/hz9DS549wIaKcyMvVSPwptUAUUUUAFFFFAAQCMGs67ssZkiHHda0aKqMnF3QHP0VfvrXbmVBx3FUK7IyUldEBSOu5GX1BFLRVAeHXqeXf3Cf3ZWH61BVvVDnVrzH/PZ/wCZqpXgPdgFFFFIAooooAKKKKACiiigAooooAKfFNJC4eKRkYd1OKZRQnbVAa8HiXUYRgyLIP8AbH9atDxddY5t4T+f+Nc9RXRHF1o6KTCxuyeK75xhEiT3Az/Os251O8u/9dcOw/u5wPyqpRUzxFWekpMLBRRRWIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAdL4TvVSWWzc43/On17/AOfausrzCOR4pFkjYq6nII7Gu10nxBBeosc7COcDnPAb6V7OX4qPL7Kb16EtG1RRRXqiCsfxJei10t4gf3k3yAe3erWoara6fGWlcF+yDqf8K4bUL+XUbpp5T7Ko6KPSuDHYqNODhF6saRVooorwCgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr0mxi8mwt4v7saj9K82AyQK9QAwMV62VLWT9CZC0UUV7AgooooAKKKKACiiigAooooAKKKKACrWnyCK9QnoeKq0Dg5pNXVgOsqO4TfbyL6qRVGy1NHQRznaw43djWiGVlyCCPauFxcXqXucpWB4ruFTT0gz80j5x7CtG+1ezsUYySqzjoinJNcPqN/LqN0ZpOB0VfQUsdiYxpuCerJSKlFFFeCUFFFFABRT/Jl/wCeb/8AfJo8mX/nm/8A3yafK+wDKKf5Mv8Azzf/AL5NNKlThgQfQihpoBKKKKQBSqxVgw6g5pKKANpGDorDoRmnVRsJsgxE+4q9XpU5c0bkhSqNzAepxSUVYHfWsKQW0caDChRUtZWl6tDc26JI4SVRgg8Zq7Pe29vGXklUAdgck16UZRcboRy+vQJBqTbBgOA2PesyrOoXZvbx5iMA8AegqtXnzacm0AUUUVIwooooAKKKKACiiigAooooAKKKKACqGoScrGPqauuwRCx6CseRzJIXPUmufETtHl7ghtFFFcRQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFPghe4nSGMZdzgChK7sgNrw1pv2q7+0yL+6hPGe7V2lVrCzSxs47dP4RyfU9zVmvpsLQ9jTUevUhsKKKK6ACiiigAooooA4nxJpv2S98+NcRTc8dj3FYlejajZJf2UkDdSMqfQ9q88lieGV4pBhkOCDXz+Pw/sqnMtmUmMoqzZWFzfy7LeMt6t2H1NdXp/hm2tsPc4nl9CPlH4d6yoYWpW+FadxtnL2el3l8f3ELFf75GF/Ot+08JRrhruYsf7qcD866VVCqFUAAdABQzBVJYgAdya9all1KGstWTcq22l2VoB5Nsin1IyfzNW6yrrxDp9tkeb5rDtHz+vSsmXxZNI4S1tVBJwC7ZJ/CtZYnD0vdTXyFZndaXa+dN5jD5E/U16RZNvsom/wBmvK7S8u4rONGlw2MttGOa6/w7eyT6eUeRi0bY5PaufG0pTipFwfQ6yisne394/nRvYfxH86832XmaXNaissTSDpIfzqRbuUdSD9RS9kwuaFRPbxP1XB9RxUK3o/iT8qnSeN+jDPoanllECs9kRyjZ9jVdkZDhlINatIyqwwwBHvVKo1uFjJoq5LZ94z+BqoylThhg1rGSewhKKKKoBCAwIPINY1zD5ExX+E8itqqt9F5kG4feXmtKUuWQmZNMlbZC7eik0+srxJeCy0C7lzhthVfqeBXVJ8qbJPIbmTzbqaT++7N+ZqKiivBAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo6UUUAXINVvrddsVzIF9M8U+TWtRlXa11Jj2OKoUVoqtRK3MwFZmdtzEknuaSiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr09GDxq46MAa8wr0TSJvtGkWr5yfLCn6jg/wAq9XK5e9KIpF2iiivZJCiiigAooooAKKKKACiiigAooooAKKKKACkeQxxs2ThQTS1S1eb7PpN1JnB8sqPqeB/OpnLli5dgPOySTknJooor5MsKKKKACiiigDaX7o+lOpq/dH0p1eqtiArKvf8Aj6b6CtWsq9/4+m+grnxPwFIgop8MMlxMsUSlnY4AFdXY+FYEQNeOzueqqcAVjRw1Ss/cQ2zkaK7t/DmmMuBAUPqrnP61z+reHpLBDPAxlhHXPVa1q4GtTjzbryFcxUco4ZeoNa8UgljDj8R6Vj1NbTmB+funqKxo1OR2ewNGtRSKwZQQcg0td4goJJ6kmiigAooooAKKKKACiiigAooooAKKKKACiiigAooqtdXHlLtXlyPypSkoq7Agvp9x8pTwOtU6OvWivNnNyd2UFFFFSAVv6Foi39rPPOCFYFIj7/3vw/xrIsbR768jt4+rnk+g7mvRYIUtoEhiGEQbQK9DAYZVZOclohNnm08D207wyjDoxUio66rxVpu5Vv415XCy49Ox/p+VcrXNiKLo1HBjTCiiisACiiigAooooAKKKKACiiigArqfC2m4BvpF5Pyx5/U1gadZPf3scC5wTlj6DvXpNlZMyLBbp8qKB6ACvSy+hzS9rLZfmJjaKlntpbZgsq4z0PY1FXuJp6okKKKVVZ2CqCSewoASitO30S4lAMhEY9+tXo9Ct1Hzs7H64rKVaC6jsznqK6b+xbP+63/fVQyaDC3+rkZT781KxEA5Wc/WbqPhQXlwl/JlIjw6jq3oa7WDw5LbfvZgJMdAO31qeSNZEaNxwRgisqtSnVXLuhpM5CC3itohFDGEQdgKe8iRoXkYKo5JJwBVXW9Rg0V2jlO+b+FB1Pv7Vw+oardajJmZyE7RqeBSr42nRXLHV9hJHRah4qhizHZp5rf324Uf41zV3qV3fMTPMzD+6OAPwqrRXjVsVVq/E9OxVgrU8P232nV4gRlU+c/hWfBF50uzOOK63wppwSS4l3Z4CiqwlJzqRb2E2dBWx4du/Iv/ACmOFlGPx7VnfZ/9qnJCUcMr4IORX0FRKcXFkp2O+oqtYXQu7VJM/N0b61ZrxmmnZmwUUUUgCiiigCWO4kj6HI9DVuK6STg/K3oaz6KiUEwNemSRJKMMOfWqUNy0fDfMv8qvI6yLuU5FYuLiMz5oGhPPK+tRVrEBgQRkGqNxbmP5l5X+VaQqX0YWK9BAIIPQ0UVqIwpU2Ssvoa4D4hakMQacjc/6yT+ld9rdzFp6zXUzbY0XcTXh+pX0mpajNdy/ekbIHoOwqsVVtTUerIKtFFFeaAUUUUAFFFFABRRUkVtPcNthhkkPoik0AR0Ve/sTVcZ/s28x6+S3+FVprae3OJoZIz6OpFNxa3QEVFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK67wldb7Wa1J+aNty/Q//AF/51yNXtIvvsGoxTE/Jna/0NdGEq+yqqT2BnodFICGAIOQRkEUtfTEBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeLbrZaw2oPzSNub6D/AOv/ACruLfQLq4tknV4wrDIya8x8ULMmv3EUxBMeFXb0x2rz8diIqk4xer0GkY9FFFeCUFFFFABRRRQBtL90fSnVjedL/wA9H/76NHnS/wDPR/8Avo11/WV2FY2ayr3/AI+m+gqPzpf+ej/99GmlixyxJPqTWdWspxtYEjqvCdmoiku2GWJ2r7DvXTVh+FpFbSdg6o5z+Nble9g4pUI2Je4UjKHUqwyCMEHvS0V0gedaraiy1KaEfdByv0qnWr4jkWTWpdp+6Ap+orKr5aslGpJLa5aLFtcmE7W5Q/pWkrB1DKcg1i1LBcPAeOV7g1VKty6PYTRr0VFFOkw+U89wetS12ppq6EFFFFMAooooAKKKKACiiigAooooAKKKTrQBBc3KwjA5c9vStjw9pSyWktzdLuNwCqg/3fWqum6THf3qxlMr9529q7lbeJECKgVQMADsK1w1Fynzz2WwHlt/ZvYXslu/8J+U+o7Gn2CK3mblB6dRXZeJNEW9tPtEXEsI/Ne9cpawNAXDYIOMEVyTwzpVtNh30JvKj/uL+VHlR/3F/Kn1e0mxN9eqjD90vzP9PT8a2ULuyRJraJpqW1i100aiSUDHHRf/AK9aNWpgBCQBgCqterSioRsgGSRpNE0ci7kcFSD3FeealYvp99JbtkgHKn1Xsa9GrF8R6b9ssfOjXM0IyMd17j+tcuPw/tafMt0NM4iiiivnygooooAKKKKACiiigAooooAtWWoXOnszWzhS3BJUH+ddR4e8XTRmWG8uVQsQVcoAPoeK42it6WInTas9O3QLHaeIfF0sixw2dyrsG3M4QEfTpWD/AMJLqn/Pcf8Aftf8KyamtLWS8uo7eIZdzgVUsVWnL3Xa/RBY3dM1DXNUuRFDMAo+85jXCj8q7yxaWyiAEgeTHLlBk/pVPTNOh0yzSCIc/wATd2NXK9mhSlGP7xtsi5b/ALSuv+eg/wC+RR/aV1/z0H/fIqpRWvJHsF2W/wC0rr/noP8AvkVq2D3IUSzP8x+6u0cVn6daea3nSD5B0Hqa2K56rj8KRSLH2yf+/wDoKwtdvJ2hdLOVUu8cMVBA+tT3975IMUZ/eHqfSsYkk5PWlSordg2eYazcahPeldROZ04yVAJ/LrWdXo3iHRl1OzLxqBcxjKn19q86ZSrFSMEHBFeXi6Mqc9Xe4ISiiiuUZZsf+PkfQ13Xhgf6HMf9v+lcLY/8fI+hruvDDf6JMvo+f0r1MASzcooor1RF7TL42VxzzE3DD+tdUrK6hlOVPIIrh61NL1Q2pEMxJhPQ/wB2uXEUeb3o7lRlbQ6WikVldQykFT0Ipa4DQKKKKACiiigAp8cjRtlTTKKLXA04pllXI4I6ipCMjB6VlI5jYMpwRWjDKJUyOvcVzzhbVDKlxB5Z3L90/pVetZgGUhuneuL8Ram0DG0tidrDmQenoK3w8ZVXyoT0OF+JmstcXcNjA37hV3OR/E2a8/roPFrZ1CEekf8AU1z9YYpctVx7EXuFFFFc4BRRRQAVpaPoV7rU+y2jwgPzytwq1P4c0CXXb7ZylvHzK47D0HvXrFpaQWNslvbRiOJBgAV1YfDOp70tgMHS/BOl2Cq06fa5h1aQfL+C/wCOa6OOKOFAkSKijoqjAFOor04U4wVooAprxpKhSRFdT1DDINOoqwOd1TwXpWoKzRR/ZZj0aIcfivT8sV59rPh++0SXFwm6Jj8sqfdP+Br2Oorm2hvLd4LiNZInGGVq5quFhNXWjA8Morc8TeHpNDvPky9rIcxue3sfesOvKlFxfKwCiiipAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAfDBLcOUiQuwUsQPQDJpldp4Z037LZ/aZF/ezDjPZe359fyrA1/Tf7PvyUXEEuWT29RXXUwkoUVVfX+kK+plUUUVyDCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDsPDOqieAWUrfvIx8hPdfT8K6GvMYpXglWWNirqcgiu70jVo9Tt+SFnUfOn9RXuYDFKcfZy3RLRp0UUV6QgooooAKKKKACiiigAorTtNBvLpQ5AiQ9C/U/hVxvC0wXK3KE+hXFZOvTTs2OzMCirN5p9zYtiePAPRhyDWJq+rR6ZbnkNOw+RP6mqlVhGHO3oI6SfxnpWl2MNjLJJ5wX5wq5wK8w8RX0Opa3PdW5YxPjGRg9KzppXnlaWRizsckmmV83Wr+0uktL3LCiiisACilVSzBVBJPQDvVkaZfEAiznx/1zNNJvYCrRVv+y7//AJ8rj/v2aa+n3salntZlUdyhFHK+wFaiiikAUUUUAamiar/Zt18+TC/Dgdveu5hmjnjEkTh0PIINeZVPb3lzaHMEzx+wPB/Cu/C450VyyV0Jq56VWbq2rw6bAfmDTkfKgP6muQfXdTkXa12+PYAfyFUfnmk5JZ2PUnJNdFXM01amtRWJ44nvHllY/Mec+pqsQQSD1FbMUYijCDt39ao30O1xIBw3X61wVKNoc3XqNMqUUUVzjAEqcg4I7irkV8y8SDcPUdap0VUZyjsBtg5AI6Glpsf+rX6U6vTRAUUUUDCiiigAopD0qGB5ZcswCrngDvScrOwE9FFFMAoorV0Kw+13nmOMxRcn3PYVUYuTshG5oth9isgzjEsnzN7DsK0qKK9GMVFWQARkYNcXq9j9hvWCj90/zJ/hXaVS1WxF9ZMgH7xfmQ+/pWdWHPEDiepwK7TSLH7DZKrD96/zP9fT8Kw9A08z3ZnkX5IT0I6t/wDWrq9pY4XqelZ4eFveYEc3+qNQxQyTNiNCx9q1oNNdhm6x/uitBI0jXaihR6AVs6yjohpGRFo8jcyuF9hyatJpFsv3tzfU1forJ1ZvqOyON1DwvpltckraLsf5h8x49R1qk3h/S2H/AB6gfRj/AI1295bC6t2T+IcqfeubIIJBGCOoq6VOlKOsV9wmYM3hSycfupJYz9cism68K3kILQMsy+g4NdpRSqYGhPpb0C7PMZYZYHKSxsjDswxTK9KurO3vI9lxErj36j6GuT1Xw3LaBprXMsI5I/iX/GvLxGAnT96OqGmYNFFFcAwooooAKKKKACux8GaeAkt+45J2J9O5rjq9R0a3FrpFrFjBCAn6nrXdl9Pmqcz6CZeooor2yQqa2gNxOqDp3PoKhrc0638m33EfO/P4VnUnyxGlctIiogVRgDgCoLy6FtFkffPCirDMEUsxwBya566nNzOXPToB6CuenDmepTdiJmLsWY5J6mkoorsICvP/ABZp4tNT85BiOcbvoe9egVz/AIwtxLo4lx80Tg59j1/pXLjKfPSflqNHC2tu93dw20eN8rhFz6k4r0mLwDpC2gjkMzzY5lD4OfYdK81t53tbmK4iIEkTh1J9Qc16NF8QdMNoHlhuFnA5jVQRn2OeleXhvZa+0KOLudOfSddnsnbcYujeoIyD+RFdJ4YlxNPEe4BFczPqEmq63NeyqFaXnaOwAwB+QFa2kXH2fUomJwrHafxrowrSd1tclna0UUV6wgooooAu2OpTWTYHzxnqh/pXR2t/BeL+7f5u6nrXH0oJU5UkEdxWFWhGeuzGpWO4orlY9eurUKHxKvo3X860IPE1nJxKkkR+mRXJLDVFsrlqSNqiqSatYSD5bqP/AIEdv86l+3Wf/P3B/wB/B/jWThJbod0WKKqPqljH967i/Bs/yqnN4jsYx8heU/7K4H61SpTeyC6Neo5dQh04ebNIFHp3P4Vy914lupQVgRYV9eprHklkmcvI7Ox6ljmuiGClL4yXPsdvcayb+IeQSsLfmfrWVeWwuoCn8XVT71laXdeVL5Ln5HPHsa23YIjOegGav2XsXaIXueNeJZC2tzIf+WeEI9x1rIrpvF9kTdf2gg4lOJPr2NczXkYqMo1pcwIKKKK5wCnRxtLIkaLud2CqB3JptdD4KsheeI4mYZWBTIfr0H86qEeaSiB6LoWlR6PpUVqgG/G6Rv7zHrWlRRXuxioqyAKKKKYBRRRQAUUUUAUdY0yLVtMltJAMsMox/hbsa8Ynhe3nkhkXa8bFWB7EV7rXlvjqyFr4gMqjC3CCT8eh/lmuHG0/dUwOZooorzQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKnsvs/2uM3RIhBywAyT7VBRTTs7gdsPFGmgYBlA/3KpatrOl6lYPDmQSD5oyU6NXLUV2zzCrOLjJKzFYKKKK4RhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVJBPLbTLLC5R1PBFR0U02ndAdvpPiCG+URTkRT+/RvpW1Xl2SDkVs6f4jurMBJf30Q7N1H0Neth8x+zV+8lo7iisyz16wuwAJfLc/wvxWkrKwypBHqDXqQqRmrxdxC0UUVYBW94e01Z3N1KuUQ4UHuawa7bRAqaRARgZBJ+tc2Km409Oo4q7NGioJLyGP+LcfQVQmvpJchflX9a86NOUjS5Y1CWF4HgZQ5YY+leE+IbS4stauIbh2ds5Vj3XtXslec/ERFXU7Vx95ojn8DU4qnal6CONooorzRBRRRQBp+Hv8AkYtP/wCu6/zr2WvGvD3/ACMWn/8AXdf517LXpYH4GAVXv/8AkHXP/XJ/5GrFV7//AJB1z/1yf+RrtlsB4g33j9aSlb7x+tJXgAFFFFABRRRQAVesYesrD2WqkMRmlCDv1PoK2FUKoUDAA4row8LvmYmxaZIgkQo3Q0+iu1q4jFdDG5RuoptaF9DuQSqOR1+lZ9ebUhySsUgoooqANqP/AFa/SnU2P/Vr9KdXqLYgKKKKYwooooASjoMClooAKKKKAFRGkkVEGWY4AHeu5sLNbGzSEdRyx9T3rh45HikDxsVYdCO1WP7Tvf8An5k/OtaVSMNWI7miuG/tO9/5+ZPzo/tO9/5+ZPzrf6zHsB3NFcN/ad7/AM/Mn50f2ne/8/Mn50fWY9gOi1Oa9spY/sccZjlPTbzv/wDr1rafNdW8QeYxtMRzheB9KztIhuBbCW6lZ3fkK38IrSrSMb6vr0Asy6lclcjZkf7NV/7Xuv8AY/75pKqSrskI7dq0jCPYLsuf2vdf7H/fNH9r3X+x/wB81Qoq/Zx7Bdl/+17r/Y/75qnLK00rSMAGbk4plFNRS2QBRRRTAKKKKAOb13QFlVrq0XEg5eMd/cVyRGDg16jXJeJdIETG9gXCMf3ijsfWvIx+DVvaw+Y0zm6KKK8goKKKKAAdRXrkQxCgHTaK8jr1exlE9hBKDkPGD+leplr1kvQUixRRRXqklizh8+5VT90cn6V0FZ2kxbYWlPVjgfStAkAEnoK5KsrysWtjO1W42oIVPLct9KyaluJTPO8h7nj6VFXRCPLGxDdwoooqwCsrxIAfD93n+6P5itWsXxVMItBmBP8ArCFH55/pWVZ2py9GCPOqKKK+bLLNj/x8j6GtMcHIrMsf+PkfQ1p13Yb4CWdtpd2LyxjfPzAbW+tXa47Rb/7Fd7XP7qThvY+tdiCCMjkV61KfNEQUUUVqAUUUUAQ3H3R9ar1YuPuj61XrSOwBRRRTAKswafd3IzFA7D1xxWroOkLcD7XcLmMH5FPf3rqAAoAAAA7CuOtilB8sdSlG5w0ukX0K7mt3wOpHNUiCDgjBr0esjWNHju4WmhULOozx/F7VNPGXdpobj2OPHByK07jUBLpyoD+8bhqyJ5kt4XllO1UGSTXM6TrT3GvSCQ4jnG1R6Y6VtWqwjOMZbtkI6K9tVvbOW3fo64z6HtXnEkbRStG4wynBFen1xPii0+z6n5qjCTLu/HvXHmdK8VUXQcTEooorxSgrtvhygN3fv3VEA/En/CuJrs/h1MF1G8hPV4ww/A//AF63w38VAei0UUV7IBRRRQAUUUUAFFFFABXBfEdADp8nc71/LH+Nd7Xn/wARpgZ7GHuqs/5nH9K58X/CYHD0UUV44BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBseGdJh1nVfss7sqbC2V68V2P/AAr3Tv8An4n/AErnvAX/ACMf/bFq9Qr0cLRhOneSA5A/D3TgP+Pif9K86uYxDdSxKchHZRn2Ne6HofpXh19/yELn/rq38zWeMpwglyoCCiiiuIAooooAKKKKACiiigAooooAKnhvLmA5inkT6GoKKabWqA1I/EOpRj/X7v8AeGal/wCEo1LH34/++BWNRWqxNZfaf3hY1JPEOpSD/X7f90Yrt/A+uve2UljcTM08Z3LuPJU15pU1pdzWVylxbyFJUOQRVQxM1NSk2wPcqK4zS/H9rLGqajG0Ug6ugyp/DtWpJ4z0NE3C7Ln+6qHP616Ua9Nq9wN4kAEkgAc15L4t1RdT1yRojmKIeWp9cdTWhr/jabUImtrFGggbhnJ+Zh/SuSrixWIU/djsAUUUVxAFFFFAF7RZ47bWrOeZtsccqszegr1MeKdEIz/aMP45rx6it6OIlSVkgPYf+Eo0T/oIw/mar33ifRWsZ0XUImZo2UAZOSRXk1FavGzfRAKeWP1pKKK4wCiiigAooqe1h86bn7q8mnGLk7IC3ZQ+XFvI+Zv0FWqKK9OMVFWRIUUUUwEIBBB6GsieIwyle3UfStiq93D5sWQPmXkVjWp80dN0CMuiiiuAo2o/9Wv0p1V0uoQgBfnHpS/a4f7/AOlekpxtuST0VB9rh/v/AKUfa4f7/wClP2ke4E9FQfa4f7/6U5LiJ2Cq2SaOePcCWiiiqAKKKKACiiigAooooAK0dFsvtl6CwzHH8zf0FZ1dhoVr9n05WI+aT5j/AErWjDmkI0+lFFFd4BUFwOFP4VPUc4/dGmtwKtFFFaAFFFFABRRRQAUUUUAFMliSeJ4pBlHGCKfRQ1fQDzjULNrG9kgb+E8H1HaqtdX4stN0UV2o5U7G/pXKV8ziqXsqrj0LQUUUVzgFd/4RvRcaT5BPzwHb+HauArT0LUzpeorIT+6f5ZB7etdOEq+yqpvZiZ6ZRTUdZEV0IKsMgirFqnmXUa+rV77dlck3oI/KgRPQCodQl8q0bHVvlFWqytXf5o4/bca44LmmW9jMooortICiiigArjfGt6Gkgs1P3fnf69q6q9vIrC0kuJThUH5n0ry+9upL28luJD8ztn6VwY+sow5FuxogoopUUu4VepNeKUWLH/j5H0NadV2i8mFTGMsg/P1qr9vk/urXbGSorlkTuaVdHoerAhbS4bkfcY9/auK+3yf3VoGoSg5AGa0hi4wd0Fj1WiuP0fxYTtt73A7LJ/jXTLcllDLtIPQivUo1Y1o3gxWLVFVvtDego+0N6CtuVgPuPuj61Xp7yFwAaZVJWQBRRRTA9As4hDZQxr0VAP0qeqWlXK3WmwuDyFCt9RV2vDmmpNM1WwUEgDJ6UjMqLuY4ArJvtQXy3O7ZCgJZj6CiMHIGzyjxvqJfW7qxh+WCOQk47k8/1rmIZWhmSVDhkIYVY1W8/tDVbq7HSWQsvsM8fpVSuKrUlOfM2SemwSrPBHKv3XUMPxrH8U2/m6WJQPmicH8Dwf6VL4bn8/RowTzGxQ/z/rV7UIftGn3EWMlkOPrX0Ev3+H9URszzeiiivmiwrX8MX407xBbSscRsfLf6H/6+KyKKqMnFpoD3jqKK53whri6tpiwyv/pUACuD1Ydmroq9yE1OKkgCiiiqAKKKKACiiigAryPxdqA1DxDOyHMcX7pfw6/rmu+8Va4uj6WwRv8ASpgVjA6j1b8K8lJJJJ6mvPxtTaCAKKKK88AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooqSCCW5lEcMbO57Cmk27ICOiuht/CdzIoM8yR/7IGTU7+EPl+S6591rpWCrtX5RXRy9FaV9od7YAu6b4x/GnOPrWbXPOEoO0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG/4Pv7bTtb8+6lEcflsNx9a7/wD4SzRP+f5K8horopYmVOPKkB66fFmiYP8ApyV5Rdusl7O6nKtIxB9RmoaKVavKra4BRRRWABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW34Xt4LjUX85VYom5FbpnPWsSnRSyQyCSJ2R16MpwRWlGahUUmr2A7HxPa250wzFFWVWARgME+35ZNcZU9ze3N4VNxO8m3puPAqCtMVWjWqc0VYEFFFFc4AATnA6daK7HQ9GjXSZPtKfPdLyO6r2/x/KuVvLWSyu5LeT7yHGfUdjXRVw06UIzfULkFFFFc4BRRRQAVagu1gj2iPJ7nPWqtFVGTi7oC9/aA/wCeZ/76o/tAf88z/wB9VRoq/b1O4rIvf2gP+eZ/76o/tAf88z/31VGij29TuFkXv7QH/PM/99Uf2gP+eZ/76qjRR7ep3CyHSMryFlXaD2ptFFZPXUYUUUUAFFFFABU1pxdJ9T/KoafE2yZG9CKqLtJMDZpwikYZEbEHuBTa9J8PEf2Daf7p/ma9WMeZknmxUqcMCD6EUVseKf8AkPz/AEX+QrHpNWdgCiiikAUUUUAPhj82eOP+8wFd8ihI1UcADFcVpKb9Ut1/2s/pXb114ZaNiCiiiukAqOb/AFRqSorg/IB6mmtwK1FFFaAFFFFABRRRQAUUUUAFFFFAFLVoBcaVcR452Fh+HNed16e670ZT0IxXmUg2yuPRjXjZpH3oyHEbRRRXlFBRRRQB03hzxF9j22d237gn5HP8H/1q9E0krLdK6kMu0kEV4rXcfDi7vJNWa0Vy0OzJVv4RntXo4bFSt7KQrHqkNtLcHEa5Hr2qpfaHLLcljMowAMYzXSwTQLGEX5AO1VJnVp3wQeacK81LTQuyOTudHurdS2BIo7rWfXc1zXiCG3sh9rLpHGTh8nABrso4jmdpEOPYy6iubmG0gaadwiL1JrCv/F1lbArbAzydiOF/OuP1HVbvU5d9xIdo+6g6Cpr42nTVo6sSRa13XJNWuNq5W3Q/Ivr7msiiivGnOU5c0tygq/Yw4BlYdeFqpBEZpQg6dz6CtcAKAAMAdK2w8LvmYmLWVdw+VLkD5W5FatRTxCaIr36j61vVhzxEmZFFBBBIPBFFeeUFaWna3daeQqtvi7o39KzaKuE5QfNF2YHd2XiCyvAAz+VIf4X/AMa1QwYZUgj1Bry+rNvqF3an9zcOvtnivSpZm1pUVxcp6RRXEReKNQj4fy3HuKsr4vuB1toz+JrrWY0Hu7CszrqK5BvF1yR8ttGPxNVZvEuoyjCusY/2RzSlmNBbXYWZ6Lp+rnSZC7MPJb76scfiK2ovGmi3IxBeRmT+6xxivDZrq4uDmaZ3Puairz62MjUldRKV0e233iTT41L3F/CAOihv5CvP/E/jBtUjazsQyWp++54L+3sK5KisamKlKPKtEAUUUVzAdX4QkzDcxejBh/n8K6auQ8Iti8uF9UB/Wuvr6LAO+HiS9zzO5j8q6lj/ALrkfrUVXNWXbq10P+mhqnXz81aTRQUUUVIFrT9QuNMvUurZ9sifkR6H2r1fQvENprluDGwS4UfPCTyPp6ivHqfDNLbyrLDI0cinKspwRW9CvKk/ID3WivOtL+IFzAqx6jB56j/lpHw34jof0rp7XxjolyB/pflN/dlUrj8elelDEU59QN6is7+39Hxn+07T/v8AL/jVO58YaJbKf9MErf3YlLZ/HpWjqQW7A3aytb1600S2LzMGlI+SIHlv8B71yWqfEGaVWj0238kH/lrLy34DoP1rjbi4mupmmnlaSRjksxyTXJVxkUrQ1YFjU9TuNWvnurlsu3QDoo9BVOiivObbd2AUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorT0/w9qmpx+ba2jNH/fYhQfpnrTUXJ2SAzKKuahpN9pbhLy2eLPQnkH6EcVToaadmAUUUUgCiiigAooooAKKKKACiiigAooooAkt4JLm4SCIZdzgV3+m6ZDptuEjALn77nqTXP8AhG2D3M9yw/1ahV+p/wD1V11e3l1BKHtXuyWwooor0xCEAjBGQexrj/EWjLaN9rt1xCxw6j+E/wCFdjUN3brdWksD9HUj6Vz4mgq0Gnv0BM80ooIKsQeoOKK+ZLCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKtXunz2HleeuPNQMPb2+tX/AA5pv22+86Rcwwncc927Cuo1nThqOnvGB+9X5oz7+n413UME6lFz69BN6nn1FKQVJBGCDgg9qSuEYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFamg6d/aF+N4zDF8z+/oPxrMVSzBVBJJwAO9eg6Pp406wSIgeY3zSH3/8ArdK7MDh/bVLvZCbL9c/4o03z7YXka/vIR8+O6/8A1q6CkZQylWAIPBB7171akqsHBknl9FX9Y086dqDxAfum+aM+3/1qoV8vODhJxluiwoooqQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA17eTzIFbvjB+tTiRwMB2A9AazLGba5jJ4bp9a0a9GlPmjclgSWOSST6miiitACiiigAooooAv6Jxq0H1P8AKu0rhtNk8rUrdv8AbA/Piu5rsw3wsQUUUV0AFVp2y+PSp3YIpNUycnJqorqAUUUVYBRRRQAUUUUAFFFFABRRRQAV5lcHNxJ/vGvSZ38uCRz/AAqT+leZudzsfUk15Gav4V6jiJTkjeVwkalmPQAZJptdF4SERu5i2PMC/Ln0715tCl7WooXtcpmLcWN1aqGngdFPcjioUjeQ4VSa9IvYIpdPn88Dy9p61x6qqLhRgV11sCqcrJ6CuZwsZT1wK774XWpi1W+d8ZEK4/OuUrqPAl4LXW2DHCyR7T+dEaEU7rcE9T1SsW4Yi5kwSPmNbQOeRWLdjF1J9a2obstkfmP/AH2/OsLxeok8M3m/naoYZ9c1t1x3j3VEh09dPRsyzEFgOyitKzUabbJPOKKKK8UAooqe0h82XJHyryacYuTsgLlnD5cW4j5m5qzRRXpxioqyJCiiimBn30O1hKo4PX61TradBIhRuhFY8iGOQo3UVw14cr5l1GhtFFW7O3EgZ3GV6CsoRcnZDKlFPljMUhQ9uh9aZSas7MAp8cTythBn3pYIjNIFHTua1URY1CqMCtaVLn1ewmyomnjHzufwp5sIv7zfnVuiutUYLoK5nSWDqMo27271UIIJBGDW5Ve5txMuQMOOnvWNTDq14jTMuigjBwetFcgwooooA6Dwl/yEJv8Arn/WuxrkvCCf6Tcv6IB+tdbX0OXr9wvmS9zzzWf+Qzd/9dDVGreqNv1S6b1kb+dVK8Gq71JerKCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALWm263ep2tu5+SSVVb6E817XFEkMSxRqFRRhQBwBXhkUjwzJLGcOjBlPoRXp2leNtMurZftkv2acD5gwJBPqCK7sHUhG6luBra9ZRX2iXcUqggRs6k9iBkGvGehrv8AxN4ytZbGSy01zI0o2vLggBe4GetcBUYucZSXKAUUUVyAFFFFABRRRQAUUUUAFFFFABRRRQB1nhBgYLpO4ZT+h/wrpa4Tw9fiy1ICQ4jlGxj6Hsa7uvoMvqKVFLsS9woooruEFB6UVma7frY6bIQf3sg2IPr3qak1CLk+gHCTMHnkYdCxI/OmUUV8m9SwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdHG8sixxqWdjgAdzTa6bwrpu52v5F4X5Ys+vc/0rahRdaooIGdBptimn2MduuCQMufVu5q3RRX08YqKUVsiDjfE+m/Z7oXka/u5j82Ozf/AF/8awK9JvbWO9tJLeT7rjGfQ9jXnVxBJa3EkEow6HBrwsww/s5862f5lJkdFFFeeMKKKKACiiigAooooAKKKKACiiigAooooAns7prO6S4WNHZOQHyRn1rY/wCEtvv+eNv/AN8t/jWBRWtOvUpq0HYLG/8A8Jbff88bf/vlv8aP+Etvv+eNv/3y3+NYFFafXK/8zCyNLUdan1SJEnhhBQ5VkByP1rNopQpY4UEn2rGc5VJc0ndgJRTzDIoyUYD6Uypaa3AKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAA4Oa1LW4EyYP3x196y6VHZGDKcEVpTqODBo26Kr290swAbh/T1qxXoRkpK6JCiiimAU6OKSZtsaMx9AKnsbN766WFeB1J9BXZ2tnDZxBIkAx1Pc1rTpOevQRyC6ZfxkSC2fg5FdnCxeCNyCCVBwRT60rNI7u2aFx86/dPeumMVSVw3M2inyxtDKyN1FMrYBkkfmY5ximC3UdSTU1FO7Aj8lPSl8pP7tPoouwI/JT0pDbqehIqWii7Arm3bsc1GyMvUGrlFNSYFGirTQq3sfaoHiZPcetUmmAyiiimBma/cfZ9ImOcM42D8a4Gui8V3okuY7VTxGMt9TXO18/mFXnrWXTQpBUlu8kc6NE7I+eGBwRUdT2Yzcr7VxwV5IZuS3tzPEsc0zOo7E1BRRXqNt7khWloMmzVoh/eBX9P/AK1ZtTWcvkXkMv8AdcGnF2kmI9TsNae3URzgug6EdRUGqa/pkFzmS42FkDYKn/PaqA5Ga5/xPBmOCcDoSprqqU1G847j5mT6p4/tIo2TT42ll7O4wo/xrz+7u5765e4uJC8jnJJqOQYkYe9Nrw6tadR+8UFFFFZAABJwOprXgiEMQXv1P1rIBIOQcEdxT/Ol/wCej/8AfRrWlUUHdoTNmisbzpf+ej/99Gjzpf8Ano//AH0a3+srsFjZorG86X/no/8A30aPOl/56P8A99Gj6yuwWNmqd9DuTzAOV6/SqXnS/wDPR/8Avo0GWQjBkfH+8aideMo2aCwkcZlkVB1NbCIEQKvQVWsYdieYR8zdPpVutaFPljd9RMq3sPmR7wPmX+VZtblZN1D5Mpx908is8RD7SGi5Ypth3d2NWqhtv+PZMelTV0U1aKQgoooqwCiiigDLvE2Tkjo3NV6u6h95PoapV51VWmykFFFFZgdd4Ri22dxL/ek2j8B/9euiYhVJPQDNZ2g2/wBn0eBSMFhvP41Lq8/2fSrmTODsIH1PFfS0F7LDq/RX/Uh7nnsrmSZ5D/Exb86bRRXzW5YUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFdNo3iQRItvek7RwsnoPeuZorWjWnRlzQBo9NininQNFIrg91OakrzFJZIzlHZT7HFPa8uXGGnkI92r01mqtrHX1J5Tur/WrOxQ7pBJJ2RDk/wD1q4rUNQm1G5M0p9lUdFFVM5OT1orixGMnX0eiGlYKKKK5BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUoYgcE/nSUUALub+8fzo3N/eP50lFFwF3N/eP50mc9aKKACiiigAoord0XSFlQXVyuVP3EPf3NaUqUqkuWIGPFa3E4zFDI49QvFLLaXEIzLBIo9SvFdyAFGAAAOwpSARgjI967vqEbbk8x5/RXQazpCLG11bLtxy6Dpj1Fc/XDVpSpy5ZFJhRRRWYBRRRQAUUUUAFFFFACqrOwVVLMegAq5/ZGobN/wBklx/u11uhaTHY2iSugNxINzE/w+wrXr1qOWc0bzdmK55rFbO8xRlK4+9kdK0kjSNcIMCuu1DTI7uzeVUAnUEhgOuO1cpU/VlQdtxXuFVri1WVSyjD+3erNFEoqSswMMjBwetFT3ahblgO/NQV5klZtFBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKADvVqG9dOH+YfrVWiqjJxd0BrJcxSdGwfQ1LkHpWJTg7L0YiuiOJfVCsd54YjG2eT+LIWuhrhfCd+63j2zOf3gyufUV3CqVHJya9fCzU6SaJY6praY286uOnf6VDRW7V1YC/qe1pY5F5DrmqFZX9up/ahtXb9yPlVvQ1rAEjIGRU02rWXQGJRRjHWirAKKKKACiiigAooooAKKKKAIpIQeV4NZuo3iafaSTSdRwo9T2rVd1jQu7BVUZJNcTrt3/a0u0ZEafc/wAazrVnCDtv0A5uaV55nlkOWckk0ynSRtE5Vhg02vm3e+pYVLbNsuEJ6ZxUVFCdncDcoqG3kMsIY9elTV6ad1dEhRRRTA7jTLj7Tp0Mmcnbtb6jim6tb/adMmQDLBdw+o5rK8M3X+ttWPX51/r/AErcnkwNo6nrXoU/3kBHk7HLE+9JWhrdl9h1ORAMRv8AOn0NZ9fOTg4ScXuiwoooqQCiiigAooooAKKKKACpbeHzpQP4RyairVtYfJi5+8eTWtGHPLyBk2MDFLRRXoEhUNzD50RH8Q5FTUUmk1ZgV7QOsO11IIPerFFFEVyqwBRRRTAKKKr3NwIUwD856D0pSkoq7Ap3r758DovFV6CcnJ60V5spczbKCp7K3N3eQwL1dgPw71BXS+E7LdNJeMOE+RPr3rTD0va1VAGdWqhECqMADAFc94tudlnFbA8yNuP0FdFXA6/efbNVkKnKR/Iv4df1r2sfU5KLXfQlblD7PPjPkyY/3TUdevDUtL/svb9pt93k4xkZztryGvFrUlTtZ3uUFFFFYgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAORd8ir/eIFd5GixxqijCqAAK4JWKsGHUHIru4JlngSVDlXUGvRwFveJZJRTlRnJCqTgE8elNr0RCMAylSMgjBFcJPH5VxJH/dYj9a7qSRYomkc4VRkmuDlcyzPIerMTXn4+1ojiNooorzSgooooAKKKKACgHBBoooA9OjdZIkdDlWAIPtT65DRPEK2kQtbvJjH3HHOPY10H9s6ds3fa4sfXmvpaOKp1IJ3syLGrFIqRMWOAoyfpXCE5Yn3qxrHiQTIYLLIQ/ec9x6VmxXsbj5ztb36Vx4jE05z5YvYdi1SVGbiEDPmL+BqpcXm8FI+AeprnnVjFXuFiC4fzJ2YdKioorz27u5QUUUUgCiiigAooooAKKKKACiiigAooooA6/wPpVjqTXf2y3WbYF27ieK7H/hFdD/6B0X5n/Gua+HP3776LXe16uGhF0k2gMf/AIRXQ/8AoHRfmf8AGvP/ABjY22n615NpCsUflg7R616xXmHj3/kYf+2S1OLhFU7pActRRRXmAFKqlmCgZJpK0bODYvmMPmPT2q6cHOVgZNaxfZQGU4k67hXU2PiJNgS7BDD+Md65uivUpydPSJJ2h1nTwuftC/TBzWVqPiHzEaK0BAPBc9fwrAorSVeTVhATk5PWvV/DF0v9iWizqrfJwxHPXvXlFTJe3UaBEnkVR0AY8VkrdRp2PStW2/2jJtxjjp9KpVxlprN3ayZLmVT1Vzmuis9atLsAb/Lk/uvxXZSqRaSEzRooByOKK3AKKKKACiikZlUEsQAO5NAC0yaaO3jMkrhVHUmsy91+2twVh/fSe3QfjXN3l/cX0m6Z8jso6CsZ1ox23At6rq73zeXHlYAendvrWXRRXHKTk7sCGeATJj+IdDWU6lGKsMEVt1UvIPMTeo+YdfeuWvS5lzLcaZnUUUVxFGraY+zLip6pWMw2mMnnqKu16NJpwViWFFFISFBJOAK0ENTUm068ikQZZTk/TvXbRyrNGsqHcrjcD615pPJ5szN27V1PhbUfMhaxkb5k+aPPcdxTwWJ/euD2ew2tC14j077ZYebGuZYfmHuO4riK9Rrhdf0s6feGSNf3Epyvse4p5lh/+XsfmCZkUUUV5BQUUUUAFFFFABRRSohdwqjJNAFiyh8yTeR8q/qa06jijEUYQduvvUlejShyRsSwooorQAooooAKKKKACiiigArPubRgTIhLDuD1rQoqJ01NWYGHRV67tesiD6iqNcE4ODsyh8ML3EyRRjLucAV6LY2iWNlHbp/COT6nuawvC+l7F+3zL8zDEQPp6101e1l2H5Ie0lu/yJbKGsXwsNOklBw5+VPqa89znk9a2fEWo/bb7yo2zDD8ox3Pc1jV5+Or+1q2WyGkFFFFcQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiit7R/Dy6hZ/aZpmRWJCBB6dzWlKlOrLlgtQMGirOoWbWF9LbMwbYRhh3BGRVaolFxbi90AUVp2Wg316Awj8uM/wAT8VtQeEYVAM1wzH0UYFdFPB1qiukK5yVFdsPC2nYwRL/33UUvhO0Yfu5ZEPvzWzy6uuwXRx1Fbd54YvLcFoSsy/7PX8qxXRo2KupVh1BrkqUp03aasMSiiiswCiiigAooooAK1dJ1c2X7mUFoSeMdVrKrR0XTjqOoLGw/dJ80h9vT8a1oOftFybgz0vQoomtftIZWMo49l/8Ar1lausOm3DeZIqRt8yEnt6VZACgADAHYVna3p39o6eyqMzR/NGff0/GvoKlOUYNx1ZBy+rax9rHkQZEPcnq3/wBasiggg4PBor52pUlUlzSLCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorV0HRH128kt0mWIom/LDPfFOMXJ2QGVRXSa54Qm0XT/tb3SSDeE2gHv8A/qrm6c4Sg7SAKKKKkAooooAKKKKAO6+HJAa+yey13u4eorwpJHj+47Ln0OKd9om/57Sf99Guyli/ZwUbAe57h6ivMPHvPiH/ALZLXN/aJv8AntJ/30aYzs5yzFj6k5pVsV7WPLYBKKKK5AJrWHzZRn7o5NatQWkXlwjPVuTVivQow5YksKKKK1AKKKKACiiigAooooAs2+o3dtjyp3A9CcitCPxLdrxJHG/6VjUVanJbMR0A8UHvaj8H/wDrUN4ob+G1H4v/APWrn6Kr20+4GvL4jvX4QRxj2GTWdPd3FyczTO/sTx+VQ0VDnKW7AKKKKkYUUUUAFFFFAGVdw+VLkfdbkVBWrdRebCR3HIrKrz60OWQ0AJU5BwRVyO/IGJFz7iqdFRGcobDNE38YHCsTVWe6ebjovoKgoqpVZyVmFgqS3nktbhJojh0ORUdFQm07oD0fT72PULRJ4+/DL6HuKde2cV9avBKPlYcHuD61xGjaq2mXWWyYH4df6iu9jkSWNZI2DIwyCO4r6LC144inaW/Uhqx5xe2UthdPBMMEdD2I9ar16FqulxanbbG+WVeUf0P+FcHdWstncNDMm11/WvHxeFdCV18LKTuQ0UUVyDCiiigArSs4PLTew+Zv0FU7WLzZgD0HJrVrqw8L+8xMWitvwvZW9/qMkVzEJEERYAnvkV1v/COaT/z5p/30f8a7owbVxWPN6K9I/wCEc0n/AJ80/wC+j/jVTU9B0yDS7qWO1VXSJmU5PBxT9mwscFRRRWYBRRRQAUUUUAFFFFACU/TtCN7e+YwxaqcsfU+lW9N02TUJsD5Yl++/pXYR20cNsIIlwqjitaeHVRpzWiFcrKoRQqgBQMADsKxvEOqixtDDG37+UYGP4R3NaGoX0WnWrTSnkcKvdj6V59d3Ut5cvPKcsx/L2rTHYpUo8kd3+A0iGiiivBKCiiigAooooAKKKKACiiigAooooAKKKKAADPSitXSLXObhxx0UH9TVO/tvs1yQB8jcrWroyUFMCtRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVp6drt3psLQxiN4ycgODwfbmsyirhUlTfNB2YFh2uNSvSxBknlPYV12k+HobJVluAJZ/fotLoGkCxthNKv+kSDJz/CPStqvZwmDUf3lXWTJbCiiivSEFFFFABVDUdJttRjIkXbJ2kA5FX6KmcIzXLJXQHnOo6dPptx5co4P3WHRhVSvR9QsYtQtWglH+63dT6157dW0lpcyQSjDocGvAxmF9hK6+FlJ3IqKKK4hhRRRQAVoWGsXOmxMlusXzHLFlyTWfRVQnKDvF2YG3/wlWo/9Mf8Avj/69H/CVaj/ANMf++P/AK9YlFbfWq/8zCyJLidrm4eZlVWc5IUYGajoorBu7uwCiiikAUUUUASQW81y+yGJpG64UZNWP7J1D/nyn/74Nb/gD/kPP/1yNem12UMKqkOZsDxaHRNRmmSMWcwLHGSh4rqT4QtYIAk6TCQj75OOfYV6CjFHDDqDWH4z1+2tPsxkVy5U4UDrXXSoUqT/AHmq7voDPKr+0axvJLdjnYeD6iq9WL27a9vJLhxguenoKr15U+XmfLsAUUUVIBRRRQAUUUUAFFFFABW54W1qDQ9QluJ0d1ePYAnXqKw+hoqoycZcyA7HxL4ts9Z0n7LBDKr+YGy2MYGf8a46iinUqSqO8gCiiioAKKKKACiiigAooooAKKKKACpIE8yZV7Z5qOrmnpl2f0GKunHmkkDL9LRRXpEhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVkXEflzsvbqK16oagnKP+FYYiN4X7AilRRRXCUFFFT2dq95dxwJ1c4z6U0m3ZAFrZXF7JsgiZz3I6CtdPCl6Vy0kan0611dnZw2NusMKgADk9zVivapZbTUf3mrJucBe6FfWSl3j3oP4k5xVnQtbNg4t5yTbMeD/cP+FdqQCCCMiuN8SaUtpKLmFcRSHkDsayrYWWG/fUXsF7nZKyugZSCpGQR3qlqWlwanBskGHH3HHUVyuja7Jp7CGbL2x7d1+ldpDPHcRLLC4dG6EGu6jXp4qFn80LY89v8ATrjTpvLmXg/dcdGqpXplxbw3ULRTIHQ9Qa5PU/DM1uTLZ5li/ufxD/GvMxOXyp+9T1X4lJnP0UEFSQQQR1Bo6mvOGaVjHth3d2NWqZEu2JV9BT69OEeWKRJ0fgz/AJC03/XE/wAxXc1w3gz/AJC03/XE/wAxXc100/hGgqjrP/IFvf8Ari/8jV6qOs/8gW9/64v/ACNW9hnmNFFFcpIUUUUAFFFPihknkCRIzsewFADK0tM0eW+YO+UgB5bufpWnp3h5Y8S3mGbqIweB9fWt0AKAAMAdAK6adC+shDIII7aFYolCovQCm3V1FaQNLK2FH5n6Uy9vobCHfK3J+6o6muPv7+a/m3yHCj7qjoK1qVVBWW4Gbrt7LfX3mPwn8C9gKy60NQXMat6Gs+vCr39o2y0FFFFYgFFFFACorO4VQSxOAB3rUfw5qSQeaYgcDJUMM/lUGjTRQarBJNgIG6ntXoDSIkZkZ1CAZ3Z4xXoYPCU60XKTE3Y8xIIOD1oqe+kSW+nkj+4zkioK4GrNoYUUUUgCiip7K1a8vIrdOrnGfQd6aTbsgJ9O0q41KTEQwg+856CuosvCVnuVZS8rHqc4ArVtbaK0t0hiXCKPzrVtItke8/eb+Ve7SwNOlG81dk3uU/7AsRGEjRkAGBg1g674clFqzRfvAvzKcciuyoIyMHpWk6UZR5WB4uRg4NFdH4u0gWF+LmFcQT5OP7rd65yvAqU3Tk4soKKKKgAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiipEgmk+5E7D1C00m9gI6KsjT7o/8ALFqa1lcr1gf8Bmq9nPsBBRSsrKcMCD6EUlQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU5YpG+6jH6ChK+wDaKl+yzH/lmaQ28w6xt+VVyS7AR0UEEHBBB96KkAooooAKKKKACiiigAooooAK1vDtiLzU1ZxmOEb29z2FZNdj4TgCadJNj5pJP0H+TXVgqaqVkntuJnQUUUV9ISFFFFABRRRQAUUUUAFcz4ssQ0Ud6g5U7H+nY101VNSgFzptxERndGcfUcisMTTVSk4gjzmiiivmCwors9C0myOlxTSQRzSSjJZ13Y56D0rn9fsobHVGjg4RlDbf7ue1dVTCTp0lUb3FczKKKK5RhRRRQAUUUUAFFFFABRRRQB1fgD/kPP/1yNem15N4R1O10rVmnu3KxmMrkDPNdx/wmuif8/D/98V6eEqQjTs2B0NcB8Rv9fZf7p/nW9/wmuif8/D/98VyPjPWbLV5bZrOQuIwQ2RiniakJU2kwOWooorywCiiigAoopQpY4AJPoKAEoqwtjdsMrazke0Z/wqOS3niGZIZEH+0pFOzAjqzYXK2d9DcNH5io2SvrVaiiLcWmugF7Vr9NRv2uEi8tSoGD1OO5qjRQBk4HWnOTnJye7AKKnWzmYZ2gfU1E8bxth1waHGSV2gG0UUVIBRRRQAUUUUAFFFFABRRRQAVpWK4gz6ms2tW0GLZK3w698TJ6KKK7hBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVWvlzbk+hBqzUNyM27j2qKivFgZNFFFeaUFbvhRFbU2Y9VQ4rCrQ0S8FlqccjHCN8rfQ1vhpKNaLfcGeg0UgIYAg5B6UtfTkBWV4iVW0abPbBH1rVrnPFV8qWy2in53O5h6CufFSUaMm+wLc5Grunapc6bLuibKE/Mh6GqVFfNxnKD5ouzLPQNO1m11JAEbZL3jY8/h61o15erMjBlJDA8EHpW/p/iieDEd2pmT+8PvD/ABr18PmSfu1dPMlo6K+0ez1AEyx4k7OvBrnLrwtdwSBrdlmTPTo35V09nqVpfLmCZWPdScMPwq4v3h9a6qmGo11zfihXaOLkikhbbIjIw7MMU2vQJIY5l2yxq49GGaz5tAsZclUaM/7Df0rKWHfRgc/o+qtpF086RCQsmzBOO4P9K2v+E2m/58k/7+H/AAqtJ4X/AOeVz+DLVZvDd4PuvE30JqOSpHoO5pf8JtN/z5J/38P+FQXfi6W7s5rc2iKJUKEh+mR9KoHw/fj+BD/wIUo8PX56rGP+BUrVOwXMqitpPDN0335YlH4mrUXhiMf624ZvZVxQqM30Ec3U0FpcXLYhhd/cDj8666DRbCDBEAZvVzmryqFGFAAHYCtI4Z9WBztp4aY4a7kwP7idfzrdt7SC0TZBGqD26n8amrPvNYtLPIL+Y/8AcTn/APVW6jCmrgaHSsfUdehtsx2+JZfUfdWsW+1q5vcoD5cR/hXv9TWdWM8R0iBJPcS3Mplmcux7mo6KK5hle8GbZvqKy61bv/j2asquHEfENBRRRXOMKKKKACnmWQpsMjFP7ueKZRQAUUUUAFFFFABW94UjDao7nqsZx+YrBrX8NXIg1dFY8SqU/Ht/KujCtKtFvuDO/t4vNlGfujk1pVFBF5UQH8R5NS19BJ3ZIUUUVAGN4ntkudIKN/eGD6V5lIjRSMjDDKcGvTPEU4W3jgB+Zm3H6CuI1e1yBcKORw39DXnY6lze8ug0ZFFFFeWMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVEaRwiAlj0AoAQDJwK0bbSZJQGmPlr6dzV6y09LYB3w0vr6fSrtd9HCLeYmyvDZW8H3Ixn1PJqxRRXYoqKskIKKKKYDXjSRcOqsPQjNUZ9JhkyYiY29OorQoqZ04z+JAcxPbS2zbZFx6EdDUVdVJGkqFHUMp6g1hX1g1qd6ZaI9/T6159bDOGsdhplKiiiuUYUUUUAFFFFABRRSqpdgqjJPagBKtQ2LvzIdo9O9Wbe1WEbm5f19Ks1108P1kK5FHbxR/dQZ9TzUtFFdKSWwgooopgNZVcYZQR7iq0tjG3KHaf0q3RUyhGW6AxpYXhbDj6HsaZW0yK6lWGQazbm2MJ3Lyh/SuOrRcdVsNMr0UUVgMKKKKACiiigArvPDgA0K3x33f+hGuDruPDEgfRkX/nm7Kfzz/WvRyx/vn6f5CZs0UUV7pIUUUUAFFFFABRRRQAUhGQQelLUdxIIbaWU9EQt+QobsrsDzM8MaSg9aK+RLL1lrF7YRGOCbCE52kA4PtVSaaW4maWZy8jHJY96ZRVOcmlFvRAFFFFSAUUUUAFFFFABRRRQAUUUUAFFKi7nVfUgV6Cvw7tWRW+3y8jP3B/jWlOlOp8IHntFSTxiG4kjByEYjNR1mAUUUUAFS29tNdzrDBG0kjdFUUtpaTX11HbQIWkkOAK9Z8P+HrfRLUAAPcsP3kpHP0HtW9Cg6r8gOe0jwAoVZdTkJPXykPT6muttNI0+yQLb2kSD12jNXaK9SFGEFogECgDAAH0FNeGKQYeNGHuAafRWoGFqPhHSdQUnyBDIf44uK4PXPCd7o+ZVHn23/PRRyPqK9ZpGVXUqwDKRgg9656uGhPyYHhFW7CMM7Oe3Sul8XeFhYFr+xT/AEcn94g/gPqPauXtJhDId33T+lecoOnUSmDNSoLqMPA2eo5FTBgRkHIqreTqsZjU5Y9cdq66jXK7kmdRRRXmlBRRRQAUUUUAFFFFABRRRQAVr23/AB7p9KyK1rU5tk+ldGG+JiZNRRRXaIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1Z6fc3zYhj+Xu54Aq9pGjG7xPcAiHsO7f/AFq6mONIkCIoVRwAO1dFOi5avYRi23hqBADcSNI3ovA/xrQj0qwjGBaxn/eGf51corpVOK2QFY6dZEYNpD/3wKpXegWE8LgRmMkdUb/IrWpknEbfSm4RejQHA33he5twXtmE6D+HGGH+NYTKysVYEMOCD1FeoVl6tokGpRlgBHcAfK4HX2PrXDiMtVual9w0zgqKluLeW1naGZSrqeRUVeO007Mo3NK8Ry2SCGdTLEOhzyK308Saa65MrL7Fa4Siuulj61Ncu68xWOuvfFcKoVtELuf4mGAK5WeeS4maWVizsckmo6KyrYmpWfvsaVgooorAAooooAVWZGDKxUjoQa17PxJf2pUO4mQdn6/nWPRV06s6bvB2A9EtvEtrKo86N4if+BCtKHULSf8A1dxGfbOD+Vef2r77dT3HBqavYhiZNJsg9DBBGQciiuASeaP7krr9GIqddVv06XUv4tmtViV1QHcUVxY1rUR/y8n/AL5H+FIdZ1A/8vLfgB/hT+sR7AdrSM6oMswA9zXDPqV6/wB66l/BiKgeR3PzuzfU5pPErogO0m1axg+9cIT6Kcn9KzbjxNGMi3gLH+85wPyrm6KzlXk9gLt1q15dZDylV/upwKpUUVi23uAUUUUhhRRRQBVvmxBj1NZtXL98uqenNU64K7vMaCiiisRhRRRQAUUUUAFFFFABRRRQAVo6Rbl5/tB4EZ+X/eqhHG0sixoMsxwK6aCFYIVjXoo6+tdWFpc8uZ7ITOu0zVI7uMRyMFmHUH+L6VpVwYJBBBwfar8OsXkK7RJuH+0M166n3EdbUF1dw2cReVvovc1zj65euMBlX6LVCSWSZ90jlmPc03U7ASXd095cNK/foPQVXZQ6FWGVIwRS0Vk9QOZuoDbXDRnoOh9RUNb2p2vn2+9R88fP1HesGvIr0vZzt0KQUUUViAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW7ptn5EQlcfvGH5Cs7Tbfz7oFhlE+Y/0roK7sJSv77E2FFFFdwgooooAKKKKACiiigApGVXUqwyp4INLRQBzd7am1nK9UPKn2qvXRahb/aLVgB86/Mtc7XlYil7OemzKQUUUVgAUUUUAFaVpb+Wm9h87fpVS0i82YZ+6vJrVrqw9O/vMTCiiiusQUUUUAFFFFABRRRQAUjAMpUjIPWlooAyLiEwyY/hPQ1FWrdRebCcfeHIrKrz6sOSWmw0FFFFZDCiiigAro/CV2EuJrVj/rBuX6jr/n2rnKltp3tbmOeM4dGyK2oVfZVFMGemVftNMknAeQ7EP5moPD/lapAl4OYvT/a9K6SvoJ1tPcJSKkem2qD/AFe7605tPtWGPKA+lWaKw55dyrGPc6QVBaA5/wBk1lkFSQRgjsa6yszVbMNGZ0HzL97HcVvTqu9pCaMaiiiugkKxvEt2LfSmjB+eY7B9O/8An3rYJCqSTgDkk1wWuaj/AGjflkP7mP5U9/euPHVlTpNdXoNIzKKKK+dKCiiigAooooAKKKKACiiigAooooAKKKKAFRtrq3oc13S/EUKgX+zugx/rP/rVwlFaU6s6fwsB88nnTySYxuYtj0plFFZgFFFS2sBuruG3XrI4QficUAeg+BNGFvZnUpV/ezcR57L/APXrsqitoUtraKFAAsahQPpUte5SgoQUUAUUUVoAUUUUAFFFSLBK/wB2Nj+FJuwEEsSTwvFIoZHBVge4rx3X9LbSNXmtudmd0Z9VPSvbRZXB/gx9TXHePfDt1dW1tdwxBpI2KNgjkHkf1rlxUFUj7u4HmAYjoTRV2XSNQh+/aSfgM/yqmysjbWUqR2IxXmShKPxKwCUUVIlvK4yqHHrSSb2AjoqVraVBkoce1RUNNbgFFFFIAooooAKKKKACtKxbNvj0JrNq7p78un41tQdpiZfooorvEFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABV/SLA392Aw/dJy5/pVCuy0W1Frp0ZI+eT52/Hp+la0oc0tRGgqhFCqAAOAB2paKK7wCiiigAqOc4iPvUlQXB6LTW4EFFFFaAY3iDShfWhmjX/AEiIZGP4h6Vw9eo1wOvWYstVkVRhJPnX8ev65rx8yoJWqr5jTMyiiivJKCiiigAooooAKKKKACiiigC5YSYYxnvyK0KxFYowYdQa14pBLGGHeuzDzuuUTJKKKK6RBRRRQAUUUUAFFFFABRRRQAUUUUAFISACT2pap3s21PLHU9fpUzkoxuwKUsnmSs3r0plFFea3d3KCgAk4AyT0Aore8M6b9puzdSL+6hPy57t/9b/CrpUnVmoLqBgkEHBord8Tab9lvPtMa/upjzjs3f8APr+dYVFWk6U3B9ACiiiswCiiigAooooAfFM8D7422t64zU/9pXf/AD2P/fI/wqrRVKco6JgWv7Su/wDnsf8Avkf4Uf2ld/8APY/98j/CqtFP2s/5mFi1/aV3/wA9j/3yP8KP7Su/+ex/75H+FVaKPaz/AJmFi1/aV3/z2P8A3yP8KP7Su/8Ansf++R/hVWij2s/5mFi1/aV3/wA9v/HRVUnJJPeiik5Slu7gFFFFSAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG7pEWy0393bP4Dj/ABq/UNouyzhH+wKmr2aUeWCRIUUUVYBRRRQAUUUUAFFFFABRRRQAVzV5F5N3Ig6A5H0PNdLWHrC4vAf7yCuXGRvC40Z9FFFeaMKKKKANKxTbBu7satVHAMQRj/ZFSV6VNWikSFFFFWAUUUUAFFFFABRRRQAUUUUAFY86eXO69s8VsVm34xcA+q1z4lXjcaKtFFFcQwooooAKKKKAPS/C0p03S7dcZSRd7j3POa7COVJow6MCp9K4rS3EmlWrDp5Sj8hitG3upbZ8xtx3B6GvpVRTpx5eyJTOmorPg1aGQASfu2/SryyI4yrqR7GsXFx3RQ6kZQylT0IwaWkZlUZLAfWpA5aRdkjJ/dJFMJCgknAHUms/U/ENhbTykS+axY4VOe9cpqWvXWoZQHyof7inr9TWtbG0qS3uybF7X9eE4a0tG/d9Hcfxew9q5yiivCrVpVpc0ikrBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa/haMS+JrFT/fJ/IE1kVq+GZRD4ksXPTzMfmCP61dP416gex0UUV7oBRRU1vbvcNgcKOppNpK7AiVWdgFBJPYVeh04nmU49hVyG3SBcKOe57mpa5p1m/hKsRR28UX3UH1qWiism29xhWbryhtImP8Adwf1rSrM199mkSg/xED9f/rVdL+JH1E9ji6gns7e5XbNCjj3FT0Dk4r2Wk1ZmRjSeEbdsy27FG7I3IrKurOezfZNGV9D2Nd2BgAUyaGO4jMcqB1PY1xyw0PsKwXOAqpdWwZS6DDDr710WqaI9pmaDLw9SO61j1x1aX2ZDMSinSDbKw9DTa8p6FBRRRQAUUUUAFS20nlzqe3Q1FRTTs7gblFQ20vmwqe44NTV6cXdXRIUUUUwCiiigAooooAKKKKACiiigAooooAKKKKAHwR+bPHH/eYCu/ACgADAHArhtOx/aVtn/nqv867quvDbNiCiiiukAooooAKqStukNWZG2IT+VU6uKAKKKKoArmPF8IMdtNjkEof5/wBK6esDxbj+y4v+uw/ka5car0JAtzjaKKK+bLCiiigAooooAKKKKACijqcCus0bw4iItxfJuc8rEeg+tbUKE60uWIN2OcttOvLzmC3kcf3scfn0rTttD1WFubcbT1HmL/jXaABVAAAA4AFLXr08thHVydybnIT2dzbDM0LoPUjj86hruUkAGxxlDwQRWRquhoUa4s1wRy0Y6H6U6mHcdUI52iiiuYYUUUUAFFFFABRRRQAUUVFNOkK5Y89hSbSV2ATTLChY9ewrJdy7lmPJqZHNxdx+ZyC4GPbNd0NE03/nzjrKFGeKvyuyQ9jz6ivQf7E03/nzj/Kj+xNN/wCfOP8AKtP7Lqd0HMcFBC9zOkMQy7kKBXotjaJY2cdvH0Qcn1Pc1paL4e0+Im6+yRhuQhx27mo7tFS7lVRhQ3ArrwWHVGTvqxMoX9ml/ZSW7/xDg+h7GvOpoXt5nhkGHQ7SPevTq5fxVpuQt/GvTCy4/Q/0/KpzHD88PaLdfkCZy1FFFeGUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHT25zaxH/YH8qlqrpz+ZYxH0G38qtV7UHeKZIUUUVQBRRRQAUUUUAFFFFABRRRQAViayf8ASkH+x/U1t1z+qPvvnH90Ba5sW7UwRTooorzCgooooA2YuYU/3RT6gtG3WyewxU9enB3imSFFFFUAUUUUAFFFFABRRRQAUUUUAFZ2of65f92tGsq8bdct7ACsMQ/cBEFFFFcJQUUUUAFFFFAHXeFb8PbtZOfnQlk9x3ro68ygnktplliYq6nIIrtNL8QW96ipMwin7gng/SvbwOLi4qnN6olo2aUMV6Ej6GmggjIORS16Yh/ny/8APV/++jWZrmpGy052MhMjjagJ70t/q9pp6EySBn7IpyTXEajqE2o3JllOB0VR0UVwYzFRpRcY/F+Q0ipRRRXgFBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVoWWi31/F5sMYEfZmOM/SqhCU3aKuBn0VNdWs9nOYZ4yjjse9Q0mmnZgFFFFIAp8MrQTxzJ95GDD6g5plFAHuFhdJe2MFzGcrIgYVYrgvAeuKA2lTvjktCT+o/rXfKpdgqjJJwK9ujUU4KQEtvA08m0cKOprYjjWJAqjAFNghEEQQde59TUlYVJ8z8ikgooorMYUUUUAFc54ouRiG2B5++39P61vzzpbwPLIcKoya4O9umvLuSd+rHgegrrwlPmnzdETJ6EFFFFemZlxG3KCKdVSOQofUVYWRG71m0A8gEEEZBrlNd0sWYa6hH7k/eX+6f8K6kyIBywqB0+3H7Nt3LJ8pB7is6lPniBxfhvTRdXEl7OgMakqoI4LHr+VZmr6edOv3iwfLb5oz6r/nivRH01NKVbWIYiUfIfUVka9pv9oWB2DM0XzJ7+o/GuOpgk8OlH4lr/AJjvqcHRRRXilBRRRQAUUUUAWLOby5dp+61alYdadpP5se0n5l/WurD1PssTLNFFOh2edH5n3Nw3fTvXWIPKk8vzPLbZ/e28fnTa78+T9n52eTt/4Dt/wrgpNvmvs+5k7fp2rWpT5LaiG0UUVkMKKKKACiiigAooooAKKKKAHwSeVcRyf3WB/Ku/BDAEcg157XZ6LdC602PJ+eP5G/Dp+ldOGlq0I0KKKK6wCiio5X2LgdTQtQIpn3NgdBUVFXtKiSS6+cA7RkA1bfKrgUirDqCPrSV088UckDq6jGPyrmDwSKmnU5wasFcx4vmAitoc8lix/Dj+tdPXA6/eC81WQqcpH8i/h1/XNcuYVFGi13GtzMooq3pmny6pqMNnD96RsE/3R3P4CvASbdkUKdLuhpI1Py/9GMnl7vf1+nb61Tr2o6TaHR/7L2f6N5fl47/X655+teP6lYS6ZqE1nMPnibGfUdiPqOa3r0HSSYFWiiiucAooooA2/DNgLq+M0gzHDzz3btXbVg+FIwulu/dpDn8AK3q+iwNNQop99SXuFFFFdggpySMnTp6U2igDmdbijtr8MvyrMNwHv3qhWp4tjBsIX7rJj8CDXKR3Esf3WOPQ14mJqKlVcWtBpGvRWeuoN/EgP0NSi/jPVWFQq0H1Cxboqr9ui/2vypragn8KMfrT9tDuFi5SMwUZYgD3rOe/kb7oC/rVd5Hc5ZifrWcsTFbBYuzXwHEXJ9TVFmZ2LMcmkorlnUlPcqxLbf8AH1D/AL6/zr0sdBXmlt/x9Q/76/zr0sdBXq5VtL5EyFooor1hF5dWnRAqpEABgDB/xridV8UX8WqXKKkGFcjlT/jXUV55rP8AyGLr/roa87HydKCdPR3GtS//AMJZqH9y3/75P+NMl8T3s0TxSRW7I42kFDyPzrForyniqz+0yrIKKKK5wCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDV0abBeAnr8w/r/SteuWhlaGVZF6qc10sMqzxLIh4YV6WEqc0eV9BMkooorqEFFFFABRRRQAUUUUAFFFFADZJFiiaRuijJrl3cySM7dWJJrU1a66W6H3f+grJrzcXU5pcq6DQUUUVyjCiiigC7p8nLRn6ir9YqOY3DDqDWvG4kQOp4NduHnePL2JY+iiiugAooooAKKKKACiiigAooooAa7BELHoBmsZmLMWPUnNXb6b/lkp92qjXFiJ3lZdBoKKKK5xhRRRQAUUUUAFFFFAFmLULyAYiuZFHsadJqt/KuHupSP96qlFX7SdrXYASWOWJJ9TRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAV6Fo88M+lwGEjCqFIHY157Tklkiz5bsmeu04rqwuJ9hJu17iaudB4snhe5hjQgyIPmx29q52gkk5PJorKtV9rUc+40FFFFZAFFFFADo5HhlWSNirqcqwPINexeBtdGr2m66AS4Q7AT0c+orxuvRtLtvsOnwQjhlXJI/vdTXfgKUqkpK9lYG7HqVFclY+Ip7cBJx5qDv3FbcGu2E4H73YfRxiuieHqQ6DUkzSoqFby2YZFxF/30Kjk1GziGXuY/zzWXLLsUWqZLLHBGZJHCoOpNY114lt4wRbo0jep4Fc9eajcXz5mfjso6CuinhZy+LREuSRa1fV2v5PLjysCngevuay6KK9KEFBcqM73CiiiqAKKKKACrVjdR2js7Rl2PAOegqrR1pNJqzAs6vqqvYvItszPENwAbqO9ch/wmEX/Pm/8A32P8K7OHSL24TK27bT3bjNef6z4V1TTbqfNm5hViQy8gDtXnYurOkl7F+vUaV9zJvp4rm8kmhiMSOd2wnOD3qvQRg4PWivEk3J3ZQUUUUgCiiigAp0btG4ZTyKbRRsBsQzLMgYfiPSpKxopWhfcv4j1rVimWZMqfqPSu+lVU1Z7ktE3mSeX5e9tn93PH5U2iitgCiiigAooooAKKKKACiiigAooooAK0NH1D7Bd5Y/un4f296z6KcW4u6EehKQyhlIIPII70tcro+tG1xb3BJh/hbuv/ANaun85DGJFYMpHBB616FOamtAFdwi5NVGYsxJpXcu2TTa3SsAU6OR4nDo2GHem05I3kOERmPoozTfmBZl1K4mjKEgA9cDrVSpfstx/zwl/74NZ+p3UunxHbazSzH7qLGT+fHFQ5QgrhqUtf1UWFoYo2/wBIlGFx/CPWuGqxfPdSXTSXiusrc4dSOPp6VXr53FYh1ql3sikrBXpXgXRfsdgdRmXE9yPkz/DH/wDX6/lXE+H9Oi1LVooriVI7dfnlZ2C5UdufWvWl1CwVQq3lsABgASLwK0wdNX52MtVx/jvRftdiNShXM1uMSY/iT1/D+Wa6f+0bH/n9t/8Av6v+NNa/090ZGu7ZlYYIMq4I/Ou6pGM4uLYHiVFaWvafHpurSwwSpJbsd8TIwb5T2+o6Vm14sk4uzAKKKKQHYeEpg1hNDnlJN34Ef/Wroa8/0TUf7Ov1dj+6f5X+nrXfqyuoZSCpGQR3r6DL6qnSUeqJYtFFFdwgooprusaM7sFVRkk9qAOd8XTAW0EGfmZ934Af/Xrkqv6vqB1G/eUf6sfKg9qoV81i6qq1nJbFLYKKKK5hhRRRQAUUUUAFFFFAEtt/x9Q/76/zr0sdBXmMbmOVHAyVIOK6uDxDdOAZLaNR6ZOa9PLq0KfMpdRM6UKWOAM1KtuT944rAHiWZRgW8Y/E0f8ACTz/APPvH+Zr0niYEnRiFB2z9a4jVYYv7VuTsXO89q1P+Enn/wCfeP8AM1kXM5ubmSZgAXOcCuevUjUSQFfyo/7i/lTGtoW6xj8Kmorm5U+gyo9hGfusV/WqslpLHzjcPUVq0VlKhB+QXMOitWa1jmGcYb1FZ0sDwthhx2NctSlKHoVcjooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACrlhem1k2tzE3X296p0VUJOD5kB1asHUMpBB6EUtc7aX8lqcfej7qf6VuQXUVyuY2ye6nqK9SlXjUXmS0TUUUVsAUUUUAFFFBIAyTgUAFU76+W1TauDKRwPT3NQXeqogKW/zN/e7CsdnZ2LMSWPUmuSviUlyw3GkDMWYsxyTySaSiivOGFFFFABRRRQAVPa3Hktg/cPX2qCinGTi7oDbBDAEEEHvS1kwXLwnHVfStKKZJhlD+Heu+nVU/UmxJRRRWoBRRRQAUUUhOBk9KAFqvc3IhXA5c9B6VHPequVi5Pr2FUGJYkk5J7muarXS0iNIQkkkk5JooorjGFFFFABRRRQAUUUUAFFFFABRRRQAUUVKltLJ0XA9TTSb2AiqeyUPfQKwBBkUEHvzUq6e38TgfSrdjYIt9Ad5OJB2961jQm3sFz1H+w9K/6B9t/37FH9h6V/0D7b/v2K0KK9jkj2A858e2NrZy2YtreOHcrbti4zXG13nxEjd5LIqpIAbOPwrg8Y615GJVqrAKKKKwAKKKKALNhaPfXkcCfxHk+g71p+IdIWxeOaBcQsNp9jWv4a037LafaZF/eyjjPZa1r21S9tJIJBww4Poa9ejgVLDu/xPUm+p5tRUtzA9rcPDIMMhwairyWmnZlBRRRSAKKKKACiiigAooooAKKKKALWmQ/aNTtoyMgyDP0HJr0euE8Nru1yE/3Qx/Q13de5lcbU2/MlhRRRXpCCiiigAooooAKKKKACiiigAooooAK6nQtISOFbqdQ0jcop/hFc1AgkuI0PRmA/WvQgAoAHAHQVx4yo4pRXUqCFrM1JMTK3ZlrTqhqY+WM+5rhpP3y2ec+MfDEUltJqVlGEljG6VFHDDufrXnle7SKrxsjDKsMEHuK8OuYxDdTRDojso/A1z4ymoyUl1JIqKKK4wCiiigAooooAKdHI0bblODTaKL22A04LtJeD8relWaw6sw3rx8P8y/rXXTxHSQrGnRUUdxHKPlbn0NS10pp6oQUUUUwCiiigAooooAKKKKACiopJ44h8zc+gqlNeu/CfKP1rOdWMdwsWp7pIRgct6VHaaze2cm6OXKnqjcqfwrPPNFcjrz5rp2HY7C18V2sgAuY2ib1HzD/GtSPV9PlGVvIv+BNt/nXndFdcMyqxVpWYcp6OdRsVGTeW/wD38FW9H1uwN5Ikc3mMI84Qe479K8trf8Jf8hKb/rkf5it6WPlWmqbWjFax6HcavLICsS+WPXqazySxJJyT3NJRXqRio7COK8V/8hdf+uS/zNYddHr9lPfa6sVuhZvJUn0AyazL7Rr3T4xJNGDH/eU5Ar57FUpurOSWlykZ9FFFcgwooooAKKKKACiiigArZ0jxBLp4EMwMtv2HdfpWNRWlOrKnLmg9QPRbXVLK8UGG4Qk/wk4b8jVyvLqXc2Mbjj0zXpRzRpe9H8Rcp6Hd6tZWaky3Cbh/Apy35CuS1fXpdS/dRgx2/wDd7t9f8KyKK5q+OqVVy7IEgoooriGFFFFABRRRQAUUUUAFHXpRV2yt8/vWH+6KuEHN2QElrahAHcfN2HpVuiivQhBRVkSFFFFUAUUUUAFFFFABRRRQAU10WRSrDIp1FDVwMm4tzC3qp6Goa2ZEWRCrDg1kyxGKQqa4K1Lkd1sNMZRRRWIwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAClVirAqSCO4NJRQBeh1W4jwHxIPfr+dXE1mE/fjdT7c1i0VvHEVI9Qsb41W1P8bD/gNNbV7YdN7fRawqKv63UFY1ZdZPSKLHux/pVCe7nuD+8kJHoOBUNFYzrTnux2CiiiswCiiigAooooAKKKKACiiigAoBIOQcH2oooAsx3sqcNhh71OuoRn7yMPpzWfRWsa011Cxp/bYfU/lSG+hHTcfwrNoqvrExWLr6gf4E/Emq0k8kv32JHp2qOis5VJS3Y7BRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAVPDaPLyflX1NT21p0eQfQVdrppUL6yE2RRW8cQ4XJ9TU1FFdaSWiEFSW7iO4jduisCajopiO+/4S7S/Wb/vj/69H/CXaX6zf98f/XrgaK09pIdze8S6tbao9ubbf8gOdwxXOSQRyj5l59RUtFZy97cDLns3j5X5lqvW5VO5tAwLxjDdx61yVKFtYjTM+p7MwLdRtc7vKBywAyTUB4ODRXMnZ3GdqPFOnKAAJQB0+Sj/AISrT/SX/vmuKoru/tKt5CsbGu31lqEiT2+8S4w25cZFY9FFcdSo6knJ7sYUVdsY0kV96g4PerX2eH/nmv5VpCg5K9xXMilVWdgqgljwAO9a32eH/nmv5V0PhvTICXu2iXKnanHT3rWng5TklcLmNaeFbqZA88iw5/h6mnXHhO4jQtBMshH8JGCa7zy0/uijy0/uivS+o0OW1hXZ5LLE8MjRyKVdeCDTK7/xHpkEluLoRLvQ4Y46iuX+zw/881/KvNqYNwlZMdzIorX+zw/881/KshvvH61hUpOG40zX8MkDW4h6q38q7qvPdEl8nWbVj3fb+fH9a9Cr2Msd6TXmSwooor0RBRRRQAUUUUAFFFFABRRRQAUUUUAKjFHVx1ByK9Btp0ureOZD8rjP0rz2tPStYk09tjAvCTkr6fSubE0XUjeO6Ki7HaVR1M/JGPc0sGrWU65WdQfRuDWN4h8SaXp5QTXSlgpYIvJP+cV50U4SvLQtvQj1K9j07Tp7qU4WNCcep7CvE5HMkjO3LMSTW74k8Tza5II0BitEOVTPLH1NYFcmKrKpKy2RIUUUVzAFFFFABRRRQAUUUUAFFFFAB0qaO7lT+LI9DUNFNScdgL6agP40I+lSreQt/Fj6isuitliJoVjYE8R6OtL5sf8AfX86xqKr6y+wWNgzRDq60xryFf4s/Ssqtvw/4buddmJB8q2Q/PKR+g9TTjXnN8sUFim+oKPuIT9aryXcsn8WB7V6pZ+ENGtIwv2QTN3eU5J/pS3fhHRbtCptFibs8R2kf0raWHrSWrHY8nihedvl/Emri2CAfMxJ9q39V8OyaJjafMt2OFkx39DWZUxw6j8W5LZSewGPkY59DVJ42jYqwwa627trCPS4ZYZ91w2Ny7s9ueO1Yl1CJIScfMvIorYdJe6NMy6KK6PQvB95rMIuXkFtbH7rsuS30HpXHCEpu0UM5ytPQ9Sh0y7eWZXZWTaAgGeo9TXSXvw6lSEvZ3olkA/1cibc/Q5ri5oZLeZ4ZUZJEJVlbqDWvLUoSUragdf/AMJbY/8APG4/75X/ABo/4S2x/wCeNx/3yv8AjXG0Vv8A2jX7r7hWR2+mavaX+ozGMMjMigB8AnGf8an124hh0mYSkZddqr6muBBIIIOCO4pzyPIcu7MfVjmrWYy9m4Nav9QsNooorzhhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBF5soXt3rXACgAdBVSwj2xlz1PFXK7qELRv3JYUUUVuAUUUUAFFFFABRRRQAUUUUAFFFFABVa8h8yLcB8y81qWGnT6hJtjGFH3nPQV0ltoNlAo8xPObuW6flVqg6qt0EeaUV6S+mWKsV+xwY/65iqF34csLlTsQwv2ZP8ACsZZZUSvFplcxwtFX9S0m40yTEg3Rn7rjoaoV584Sg+WSsxhRRRUgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRSqpdgoHJPFAFmyh3ybyPlX+dF7Dsk3gfK386vRRiKMIO360SxiWMoe/6V2+x/d8vUm+pj0UrKUYqRyDzSVxFBRRRQAUUUUAFFFFABRRRQAUUUUAFXbO2ziVx9BVe2h86UD+EcmtYAAYHSumhTv7zE2LRRRXYIKKKKACiiigAooooAKKKKACiiigCleW2QZEHI6iqFbdZd3D5UvH3W5Fcdenb3kNMgooormGFFFFAF/T/uP9RV2qWn/cf6irtehR+BEvcK6rw3IrWDRj7ysc1ytW9Ov30+4Ei8qeGX1FdNKfLK7EdxRVO21O0ukBSZQf7rHBFPn1G1t0LSTJ9Ack13cyte4FbXZFTS5AerkAVx1X9U1NtQmGAViX7q/1qhXFVmpS0AKxG+8frW3WI33j9a4MV0KQI5jkV1OGU5H1r0u3mW4topl+66hhXmddj4VvfOsmtWPzxHK/7p/+vW+WVeWo4PqEjoKKKK9wkKKKKACiiigAooooAKKKKACiiigAooooAK4DXrn7TrE7A5VDsH4f/XzXZ6neCx0+Wcn5gMJ7seledEliSTkk15OaVdFTXqOIUUAFjgAk+1SG3nAyYZMeu015CTZRHRRjFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAVFLuqKMljgD3r2vSrCPTNMgtIgMIoyfU9zXjFrIIbuGVuiOrH8DXuMbB41YEEEAgiu/Ape8wHUUUV6IFe9tUvbOW3kGVdcfQ9jXlsiGORkPVSQa9aJABJOAK8ou5BLeTSL0ZyR+dY1egmRU1vuHPpTqq3kwjjKA/M3FYTkoq7EZ6KHmVScBmAJ9K9ziiSCFIo1CoihVUdgOleFV6b4c8YWd3Zx29/OsF0gClpDhZPfPTNY4OcYtp9Sjq68y+IEEcWvRSIAGlgDPjuQSM/kB+VdzeeItJsYDJLfQtgZCRuHY/QCvLNb1aTWtUlvHXap+VEz91R0H9a1xlSPJy9QM6iirFnYXN9Jst4i57nsPqa86MXJ2SAr1JDBNcPshieRvRVzXV2HhWCIB7x/Nf+4pwo/qa3oYYoECQxpGo7KMCvRo5bOWs3YVzjbbwtfzYMpjgX/aOT+QrVg8JWqf66eWQ/7OFH9a6CqU+safbZEl3HkdlO4/pXcsHhqSvL8WK7Io/D+mRdLVWPqzE1ZXTbFPu2VuP+2Y/wAKy5fFlinEcc0nvgAfqaqt4wX+CyJ+smP6Ue3wkNrfcFmdD9itMf8AHrB/37FMbTbF/vWVuf8AtmP8K57/AITB/wDnyX/v5/8AWp6+MF/jsiPpJn+lH1zCvr+H/ACzNWTw/pkvW1VT6qxFUZ/CVq/+pnljP+1hh/SnxeLLF+JI5o/fAI/Q1oQaxp9zgR3ceT2Y7T+tPlwlXa35Bqcvc+Fr+HJiMc6/7JwfyNZE0E1u+yaJ429GXFemUyaGKdCk0aSKezDIrGplkH8DsFzzKiuvv/CsEoL2b+U/9xjlT/UVzF5YXNjJsuIih7Hsfoa8ythatH4lp3KTK9FFFc4BRRRQAUUUUAFFFFABRRTohulQepFC1YGvEuyJV9BT6Slr1UrKxIUUUUAFFFFABRRRQAVoadpE9/8AP/q4v7xHX6VFptn9tvUi/h6t9K7ZEWNFRAAqjAArejS59XsIzYfD9jGvzI0h9Wb/AApZdAsJFwIyh9VY1p0V1ezh2A5DUdEmsgZEPmReo6j61Qtbd7q5jhTq5x9K70gMCCMg9QayLHTFtNYmdR8mzKe2T/8AWrCdBcytsBpW1tHaQLDEuFUfmamoorqStoBXuByDUNWbgfux9arVpHYCG5toru3eCZQyMPy9688vrR7G8kt36oeD6jsa9JrkvF0IW5t5gOXUqfw//XXnZlRUqftOqGjm6KKK8MoKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACr1jD1lYey1UhjMsoQd+vsK2FAVQoGAOldGHhd8zE2LRRRXaIo30PSVR7NVGttlDKVIyD1rHmjMUpQ9unuK4sRCz5kNDKKKK5xhRRRQAUUUUAFFFFABRRTo13yKvqaANGzj8uEE9W5qzSAYAFLXpxjyqxIUUUVQBRRRQAUUUUAFFFFABRRRQAUUUUAFQXUfmQn1HIqekpSV1ZgYlFSTp5czL71HXmNWdigrUsNAvL9Q4AjjP8T96k8Paat9eF5RmKLkj1PYV3AAAAAwB0Ar0cHglVXPPYTZhWfhQpG3+kgsT/d4qte6Tc2I3Ou5P7y9K6+36NUrKrqVYAg8EGvQeGglaOhJ57RV/V7EWN6VX/Vv8y1QrjaadmAUUUUhhRRRQAViN94/WtusRvvH61y4roNCVa069fT76O4XkA4Yeo71VorljJxakt0M9OhlSeFJY23I4yCKfXG+HdZ+ySC0uG/cuflY/wn/CuxByMivpsNXjXhzLfqQ1YWiiitwCiiigAooooAKKKKACiiigAoorC8QayLOI2sDfv3HJH8A/xrOrVjSg5yAx/Eupi7uxbxNmKE8kfxN3qjpemS6ncbE+VB99/SqPWu+0K0W00uLj53G5jXiUIPF13Ke39aFPRE1npVpYxhYolLd2YZJq5tBGMDHpilor3YwjFWirEmbf6LaX6HMYSTs6jFcTfWUthctBKOR0PYivSKwvFFos2nicD54j19q4MdhYyg6kVZoaZxdFFFeEUFFFFABRRRQAUUUUAFFFdj4B8LRa9eyXV4pNnbkAr/fb0+lVGLk7IDlIrW4mGYoJHHqqk1EyMjbXUqfQjFfScFvDbRLFBEkUajAVFAArF8R+FrHxBZSK8SJdAHy51GCD7+orZ0NNGOx4LRUlxBJa3MtvKu2SNirD0IpgBYgAZJOAK5/IRYsbGfULgQwLk9Sx6KPU17J4UkgisYbG6k8yeJdqu/RhXKaRpyadYrGAPMYbpG9TV8cHI617uHwKhT95+8yebU9GCgDAAA9qa8Mcg+dFP4VxcGt38C7Vn3KOgcZon1y/nXaZtoP9wYpfU6l9yudB40upLHTJYtOPmTMMOByUXvXla6g2PmTJ9q9EJJOSck1xPiTTVsrwTRLiKbJwOgbv/jWeMozpxVSLvbcV7me9+5GEUD3qqzFjljkmkoryZTlLdjCiiipAKAMnAp0UbzSLHGpZ2OAoHJrtNG0COwCz3AElz+ifT3966MPhp15WW3cG7GZpXhl5gs19lE6iIcMfr6fzrqoYYreJY4UVEHRVGKkPAya53VfE8cBaGy2ySdDIfuj6ete1GNDCQu/+CyNWblzd29nF5lxKsa+56/Qd65y98W9Usof+2kn9BXOXFzNdSmWeRpHPdjUVedWzGpPSGi/EpItXWo3l4T59w7g/w5wPyHFVaKK8+UnJ3k7jCiiikAUUUUAFFFFAFq11G8syPIuHQD+HOR+R4resvFvRL2H/ALaR/wBRXL0VvSxNWl8LCx6XbXdveReZbyrIvsen1HanTQxXETRzIroeqsM15vb3M1rKJYJGjcd1NdVpXieOcrDe7Y5OgkH3T9fSvWoZhCr7tTR/gS0U9V8MvCGmscunUxHlh9PX+dc4Rg4NeojkZFYms6BHfhp7cCO5/R/r7+9ZYrL0/fpfd/kCZxNaP9iXZ0L+19v+j+ZsxjnH976Z4pNM0i41HWI9P2sjlv3mR9xR1Neviwthp32Dyh9m8vytn+zjFcNDDupdv+mUeIUVe1jTJNI1Sazkydhyjf3lPQ1RrmaadmAUUUUgCpIP9en1qOnxHEqH/aFOO6A2aKKK9QkKKKKACiiigAooooA3/DCAyTv3AArpK5Xw5cCK9eJjjzF4+orqq7qD9wQUUUVsAUmVDY/iP+f60tYuq6mLTUrYA5CcuB6H/OamclFXYG1RTUdZEV0IKsMginVQEc/+qP1qrVm4P7v8arVpHYArlfGEgL2sfcBm/PH+FdQzKiF2IVQMkntXn2r339oajJMPuD5U+grgzGoo0uTqxoo0UUV4JQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVPaw+bLyPlXk04pydkBbs4fLi3EfM38qtUUV6cYqKsiQooopgFVbyHzItwHzL/KrVFTKKkrMDDoqe6h8qXgfK3IqCvNknF2ZQUUUUgCiiigAooooAKsWa5uR7DNV6tWH+uJ9qukrzQM0qKKK9IkKKKKACiiigAooooAKKKKACiiigAooooAKKKKAM2/XE4PqKq1d1D7yfSqVedWVpspbHYeEgosJiOpfmuhrjPDGoLbXTW8hwkvQn1rs697AzUqCS6EvcsW/RqmqG36NU1dEtxHPeJwNsB75Nc7Wnrt6t3e7UOUjG0H1PesyvOqtObaAKKKKzGFFFFABWI33j9a26raXo8upzMc7IVPzP/hWFaEpuMYrUaMyiu8h8O6dEgUw7z6sc1VvvC9rNGWtcxSdh1BqpZbWUb6BzI42ui0TxCbcLbXhJi6K/dfr7VgzwSW0zRSrtdTgio65KVWdGd47j3PT0dZEDIwZTyCO9Orz/TdZutObCNvi7xt0/D0rrLDXrK+AG/ypP7j8fka92hjadXR6Mlo1KKKK7BBRRRQAUUUUAFFVLzUrSxUmeZQf7o5J/CuW1PxLPdBorYGGI9T/ABGuavi6dFavXsCRr6z4gjs1aC2IefoSOif/AF6415GkdndizMcknvTTycmivCxGJnXleW3YtKwV6TYur2MDL0KD+VebV1/hjUllt/scjYkT7me4rpy2oo1HF9RM6KiilX76/WvdJDa390/lWbrwK6LcZU8jA471v1zXiG/WRhaxnIU5cj19K568/wB20+oHD+VJ/cb8qPKk/uN+VbNFeJ9WXcq5jeVJ/cb8qPKk/uN+VbNFH1ZdwuYxjcDJRsfSm1sTf6l/901j1jVp8jsCdwooorIYV658K5o20C6hBAkS4JYexUYP6H8q8jrX8OeIbnw5qQuoBvRhtliJ4cf4+9aU5KMrsaPoGiuStPiN4euIA8txJbvjJR4ySPxHBrB8TfEqCS0ktNFDlpAVNww27R/sg85rqc4pXuO5xHieaO48T6lLDgxtcPgjvz1qDRIhNrVqjdN+78hn+lUCSTk9TV/RJRDrVq56b9v5jH9a5qTTqxb7r8yWehUUUV9SQFFFFABWN4niEmiux6xurD88f1rZrH8TyiPRZFPWRlUfnn+lYYm3sZX7MEcNRRRXzBYU5EaR1RFLMxwAOpNNrr/Dej+REL2df3rj92D/AAr6/U1vh6Eq0+VA3Yt6JoqabF5kgDXLj5j/AHfYVqSypDE0kjhUUZLHoKV3WNGd2CqoySegFcPresvqUxjjJW2Q/KP73ua9urVp4SmlFeiI3JNZ1+S+LQW5Mdt0PYv9fb2rEoorwatWVWXNNlhRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG3o2vyWJWC4Jktug7lPp7e1dnFKk0SyRuGRhkMOhrzGtfRNZfTZhHIS1s5+Yf3fcV6WDxrg1Cpt+Qmj1XStPsIoGvHmt0vZFxkuAQo6A/wA/ypH1fTI3KPqNorKcEGdQQfzrDR1kRXRgysMgjoRXP+JNH8+I3sC/vUH7wD+JfX6iu+vCcIucNQTNPxommappwure/s3urfoqzKS69x1/H8/WvPaKK8KrU9pLmtYYUUUVmAVpaRpMupznB2RJ99/6D3rNr0LRrVbTS4EA5Zdze5NdmCw6rVPe2QmzRtNNs7eJfLhUnH3mGTU0lpbzLtkgjYe6ii3bKlfSpq9zlS0sSczq2hi3Rri1yUH3kPOPpWFXoZAYEEZBGCK4S/gFtfTRDorHH0rkr01HVAV6KKK5xhRRRQA6N2ikV0OGU5BrsNM1WK+jCsQs4HKnv9K42gEqQQSCO9aU6jgxHodFcXDrV/CoUTlh/tDNOl1y/lXHnbR/sgCuj6xEDpdQ1OGwiJYhpSPlQHmuNnme4meWQ5Zjk0xnZ2LMxZj1JNJWFSo5sDV0rWXsf3UoLwfqtdPb3dvdJuhlVh7HkVwdAYocqSCO4pwrOOjA7u4PIFUri9t7RN88yIPc8muBn1K7eVsXU+3oB5hqozs7bmYsT3JzWcszSVoxHym3rOvtfgwW4KQdyer/AP1qw6KK8yrVnVlzTZQUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAAZOB1rWt4fJhC/xHk/WqljDufzCOF6fWtGuzD07LmYmFFFFdIgooooAKKKKAIbiHzoSv8Q5H1rJIwcHrW5WdfQ7X8wDhuv1rmxFO65kNFSiiiuMYUUUUAFFFFABVqwOJyPUVVqa1bbcL78VdN2mmDNaiiivSJCiiigAooooAKKKKACiiigAooooAKKKKACiiigDP1A/vEHtVOrF6264I9Biq9edVd5spACQcjg1v6f4omt0EdynmoOjDrWBRRSrTpO8HYDvbTxPZvGxCSZHbFVb/XprpTHEvlRnrzya5vT/ALj/AFFXa9OOIqVIXZLQUUUVIBRRRQAUUUUAFdRpNuttpsKKOo3H3Jrl66TRbtbvTYyD8yfKw9K6cK17TXewjRooor0AOT8W26rNDOBgsNp965quh8V3ay3Uduhz5Yy31rnq+bxrTry5SlsFFFFcoy7a6tfWeBFcMFH8J5H5Vqw+LrhQBNBG/uODXO0VvDE1aekZBY61fF8JHzWrj6Nn+lKfF1uBxbSH/gQrkaK2/tCv3/AVkdNL4vkI/dWqj/fbNZlz4g1G5BBm8tT2Tisyisp4utPeQ7IVmZySxJPqTSUUVzgFFFFABTo5HicOjFWByCKbRQB0tl4rdECXcW/H8a9a0V8U2G5cCUnI421xNOj/ANan+8K7YY+vFWvcVkdpe+IZZkKW6+Wp6sTzWKSSck5NJS11Sm5askKKKKkYUVPY2wvL6C2LbRI4XdjOM10lz4OS3tZZvtrHy0LY8vrgZ9apRb2A5Cb/AFL/AO6ax62Jv9S/+6ax64cTuhoKKKK5hhRRRQAUVpWWhX19B58SKEP3S7Y3fSqE0MlvM0MqFJEOCp7Vcqc4pSa0YDKASrAg4IOQaKKgD0LSdRTUbFJQR5ijbIvoav15vY38+n3AmgbB6FT0YehrsbHxFY3agSOIJO6uePwPSvfwuNhUiozdpfmS0a9FNV0ddyMrD1BzUFxf2lqpM9xGmOxbn8utdzkkrtiLNcT4k1Jby8EETZihyMjoW71Pq3iVrhGgsgyRnhpDwSPb0rna8bHYyM17Ont1KSCiilVS7BVBJJwAO9eWM1vD+mfb73fIuYIsFs/xHsK7qqWl2K6fp8cAxvxucjux6/4VDrmpf2dYEof30nyx+3qfwr6HD044WjzS33ZL1ZieJdXMshsYG/dof3pH8R9Pw/z0rnKCSTknJNFeHWrSrTc5FIKKKKyAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDo/DWrmKQWM7fu3P7on+E+n4/56111eXAkHIOCK77Q9S/tGwBc/vo/lk9/Q/jXs5dieZeyl02JaOY8QaZ9gvd8a4glyVx/Ce4rIr0TVLFdQ0+SA4343IT2YdP8K88ZSjFWBBBwQe1ceOoeyqXWzGmJRRRXEMK9G02ZZ9Nt5FPBQfnXnNb3h/Wlsj9muDiBjlW/un/Cu7AV40qlpbMTR2sbbHB7d6uCs9HWRA6MGUjIIOQaswSfwn8K96SvqiSeuH1SUTanO6nI3YBroNX1iO2iaGBg05GCR/D/APXrlCc1w4iafuoAooormGFFFFABRRRQAUUUUAFFFFABVa7m8uLA+83FTu4RCzHgVkzSmaQsfwFY16nLGy3BEdFFFcBQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFORC7hV6mm1fsYcKZWHJ4H0q6cOeVgZajQRxhB0FPoor0kraEBRRRQMKKKKACiiigApkiCSMoehp9FDV9AMV0KOVbqKbV++hyolUcjg/SqFebUhySsUgoooqACiiigApQSrAjsaSigDaRg6Kw7inVSsJcqYz1HIq7XpU5c0bkhRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUjEKpJ6AUtVL6XbHsHVqmcuWNwKDtvdmPc02iivMKCiiigBQxHQkfSje394/nSUUALvb+8fzo3t/eP50lFF2Au9v7x/Oje394/nSU5Udvuqx+gp6gJvb+8fzo3t/eP508wSj/AJZP/wB8mmEEHBBH1FGoBvb+8fzq1p+oz6dP5kLcH7ynoaqUU4ylF3T1A7CHxZasg82KRG9uRVW+8Vl4ylpEVJ/jbtXM0V1Sx9dxtcVkK7tI5dySx5JPekoorjGFFFFABRRRQAUUUUAFFFFABRRRQAVp6LpB1WdwzlIowNxHU56AfkazK0dH1Z9KndgnmRyABlzjp0I/WtaHs/aL2mwMta3oK6ZEk8MjPETtIbqDWJWzrOutqkawpF5cSnccnJJrGqsT7L2j9lsCCnR/61P94U2nR/61P94VitwNmlpKWvUJCiiigCxY3Is76C5K7hG4baDjOK6S58Yx3FrLCLNgZEK58zpkY9K5OiqUmtgI5v8AUv8A7prHrYm/1L/7prHrhxO6GgooormGFFFFAHaaRrdiNMhilmWKSJArK3fHcVzWs3kd/qck8Q/d8KpI6471Qorqq4udWmqctkKwUUUVyjCiiigAooooAKKKmtLV7u4WGMcnqfQU0m3ZAMihkncJEhZj2FdV4a8MTS363E5ULD82MZ57f4/hVqzsYbKIJGvPdu5Ndbo8PlWIcjmQ7vw7V6lHCRhaUtxXGnS+OJP0rgPEtrd3F+8ijzIYxtTb6dz+dekahP8AZ7KRwcMRtX6muUrqrRdaHJJi2PPyMHBorp9X0hZkaeBcSjkgfxVzFeLWoypSsykwooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtPQb77DqaFjiKT5H/HofzrMoq6c3CSkugHqNcR4msvs2p+cowk43f8AAu/+P411GjXf23SoZScuBtf6jj/69VfE1r5+ktIB80LBx9Oh/wAfwr3sXFVsPzL1JW5w9FFFfPFBRRRQBPb3t1a/6i4kjHorcflUsurX8y7Xu5SPQNj+VU6KtVJpWTdgNK2uhINrnD/zq1WHnBq7Be4wsvP+1XRSr9JCaL9FNVg4ypBHtTq6iQooooGFFFFABRRRQAU1mCKWY4AqOW4jhHJy3oKzprh5jycDsBWNSsoeoWHXNyZmwOEHQVBRRXDKTk7soKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBEZpQvbv9K1wAAABwKr2kPlRZI+ZuTVmu+hT5Y3e7JYUVcstLur7mNMJ/fbgVrJ4XGPnujn/ZT/AOvXVGnOWqQjnaK3LjwzMikwTLJ/ssNprGlhkgkMcqFHHUGlKEo7oBlFFFQMKKKKACiiigBCAQQRwayJ4jDKV7dvpWxVa7h82LIHzLyKxr0+aN1ugRmUUUVwFBRRRQAUUUUAOjcxuGHUVrxyCVAy9DWNU1tcGF+funqK2o1OR2ewmjWopqsHUMpyDTq7yQooooGFFFFABRRRQAUUUUAFFFISACScAUCEdxGhZjwKyJZDLIWP4VLdXBmbav3B+tV64a1TmdlsUkFFFFYDCiiigAooooAK09N0O61HDAeXF/fb+lX9B0H7QFurpf3X8CH+L/61dcqhVCqAAOgHavTwmA51z1NuwmzJtPDlhbAF085/V+n5VppDFEMRxov+6oFSUV68KUIK0VYkOtQTWVtOCJYI2+q1PRVtJ6MDnr3wrbygtasYn/unkVy95Y3FjL5c8ZU9j2Nek1BdWkN7AYp0DKfzH0rgxGX05q8NH+A0zzWitDVtKk0y42n5om+4/rWfXhzhKEnGW5QUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU6P/Wp/vCm06PAkUn1FNbgbNLUfnRf89F/Ojzov+ei/nXp8y7kklFR+dF/z0X86POi/wCei/nRzLuBJRUfnRf89F/Ojzov+ei/nRzLuATf6l/901j1qyzRmFwHUnae9ZVcmJabVhoKKKK5hhRRQAT0GaACiiigAooooAKKKKACiiigArpvDtqEtWuCPmkOB9BXM12mlADS7fH9yuzBRTqX7CZdUFmAHUnFdjEgiiSMdFAArlrBPMv4F/2wfy5rq69USMXXpf8AVQj3Y/yH9axav6xJv1Fx2UBf0z/WqFMTCuP1m2FtqLhRhXG8f1rsK53xMB5tue+DXJjIp0r9howaKKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6nwhccXNsT6SKP0P8ASukniE9vJC3R1Kn8RXE+GpfL1uJe0isp/LP9K7qvoMvlz0LPpoS9zy9lKOVYYKnBpKu6vF5Or3SdP3hP58/1qlXgzjyycexQUUUVIBRRRQAUUUUAPSV4zlGIq1HfnpIv4iqVFXGpKOzCxqrdwt/Hj61IJYz0dfzrGorZYmXVCsbW9P7y/nTTPEvWRfzrHoo+svsFjSe+iX7uWqrJeyPwPlHtVeis5Vpy6jsB560UUVkAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVi0h82XJHyryargEkAck1rwRCGIL37/WtqMOaV3shMlrR0fT/ALfdfP8A6pOW9/as6uu8PxCPTA3d2JNepSjzS1JNREVECIAqjgAdqWiiu8AqjqenR39uRgCVR8jf0q9RSaTVmB566FHKMMMDgikrS12IRapJjowDVm150lZtAFFFFSMKKKKACiiigDLu4fKlyB8rciq9a88QmiK9+31rIIIJB4IrgrQ5ZXWzGgooorEYUUUUAFFFFAE0Fw0J9V7itKOVJVyp/CselV2RsqSDW1Os4aPYTRt0VQiv+0g/EVbSaOT7rg12RqxlsxElFFFWAUUUUAFFRvLHGPmYCqst+OkY/E1EqkY7sC28ixruY4rNuLppjgcJ6etRPI0jZc5NNrjqVnPRbDSCiiisRhRRRQAUUUUAFaeiad/aN8FYfuk+Z/8ACsyu58N2gttKVyPnmO4/TtXXgqPtaqT2Woma6qFUKoAAGAB2paKK+jJCiiigAooooAKKKKAKuoWUeoWbwSDqPlPoa87mhe3neGQYZDg16dXH+K7QR3cdyo4lGG+orzMyopw9ot0NM56iiivEKCirem2DaleLbrIEyCSxGentTL+0awvZLZnDlCPmHfIz/Wr9nLk57abAV6KKKgAooooAKKKKACrdlpt1fti3iLAdWPAH41a0PSTqdwWfIt4/vkd/YV3MUUcESxxIERRgADpXoYTAusueeiE2ctF4QkK/vrtVPoq5/wAKJfCEoX9zdKx9GXb/AI11lFel/Z+Hta34sV2ecXum3Vg2LiIqD0Ycg/jVWvTpoY54mjlQOjDBBFcLreknTLgFMmCT7hPb2Nebi8C6K546oadzLooorzxhRRRQAUUUUAFFFFABRRRQAUUUUAFegeCPD8ZsJr+8iDfaVMcasP4OhP4/y+tcloGkvrOrRWoyI/vSsP4VHX/D8a9jjjSGJIo1CogCqo6ADoK7cHR5nzsDxnW9Lk0fVZrR8lQd0bH+JD0P+e9Z9epeNNF/tPSjcxLm5tgWGOrJ3H9f/wBdeW1hXpeznboAU+KJpm2qPxplatrGI4R6nk0qVPnlYGyJbBAPmYk+1JJYLj5GIPoau0V2exha1ibmK6NGxVhgim1o30YaLf3Ws6uKpDklYpBXW6DOJdNVM/NGSprkqv6Tfmxust/q34YVphaip1LvZiZ3+jjOpRn0BP6V01c1oTrJeo6EFShIIrpa9kSOTvm3X85/2yKr1Nd/8fk//XRv51DTEFcr4hnEt+IweI1wfrW/qF8ljblyRvI+VfU1xkjtLIzscsxyTXBjaqUeRDQ2iiivMKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALmkvs1e0P/AE1UfmcV6LXm+n/8hO0x/wA9k/mK9Ir2srfuS9SZHCeJV265Mf7yqf0A/pWTWz4o/wCQy3+4tY1eZif40vVlLYKKKKwAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopdrbQ2DtJwDjg/5yKAEooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiinRoZJAg6mhK+gFqxhy3msOBwPrWhTUQRoEXoBTq9KnDkjYkK67w/KJNMC90Yg1yNaOj6h9guvn/ANU/De3vXRSlyy1EdlRSI6yIHRgykZBHelrvAKKKo6nqMdhbk5BlYfIv9aTaSuwOc12US6pJjooC1m0ruXcuxyxOSaSvOk7tsAoooqRhRRRQAUUUUAFZ99DhvNUcHg/WtCmugkQo3QioqQ542AxaKdIhjkKHqKbXmvTQoKKKKACiiigAooooAKKKKAHrNIvR2qQXcw/j/SoKKpTktmBP9rmP8f6Uxp5W6u1R0UOcnuwDOeTRRRUgFFFFABRRRQAUUUUAFFFFACqMsB6mvTIIxFbxRj+FAv6V5pHxKn1FenZyM16+VL4n6EyFooor1xBRRRQAUUUUAFFFFABWJ4piD6Rv/wCebg/0/rW3WT4kIGhze5X+YrDEq9GV+wI4SiiivmCxUd43DozKw6FTgihmZ2LMSzE5JPJNJRR5AFFFFABRRRQAUUUDqKAPQ9HtBZ6XBGBhioZvqf8AOKvUi42jHTHFLX1kIqMVFdCAoooqgCqGs2gvNLnjxllXev1H+cVfpr42NnpjmpnFSi4vqB5hRRRXyZYUUUUAFFFFABRRRQAUUUUAFFFOikaGVJUxuRgwyMjI9j1oA9U8H6L/AGTpIllXFzc4d8jlR2X/AD3NdFXk/wDwmuv/APP6v/flP8KP+E11/wD5/V/78p/hXpQxdKEVFJgesV5N4u0X+yNXZolxa3GXjx0U91/D+RFL/wAJrr//AD+r/wB+U/wqnqPiHUtWtxBezrIituA8tQQfqBWVfEU6sbWdwMutiFg0KkelY9WrW58r5H+7/KsKE1GWomaVFNV1YZVgRSPIkYyzAV3XVriIrxgtu3vxWXU9zcGd+OFHSoK4K01KWg0FFFFZDOi8JanNbaxFDndG4YYP0J/pXo8eoQuPmypryPSJfJ1e1fp+8A/Pj+teiV7WXWnSafRksytS1Ozhv7hWmGRITisi68QxqCLdCzerVR8SxeXrUp7SKrD8sf0rIrlr4qpGbgtLDSJbi5luZTJKxYmoqKK4G23djCiiikAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBc0lN+r2g/6aqfyOa9FrhfDUXma3E3aNWY/lj+td1XuZZG1JvzJZwniVt2uTD+6qj9Af61k1d1eXztXun6/vCPy4/pVKvIry5qsn5spBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAPhhe4mSGMZdztA967W50ON9DWyjA8yMbkb1fv+f+elUPCum4DX8i9crFn9T/T866ivawOFXsnKa+L8iWzy8qVYqwIIOCD2pK6DxRpv2e5F5Gv7uY/Pjs3/ANeufryq1J0puDKCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtCxh2p5hHLdPpVS3i86UL/AAjk/StYDAwOldOHhd8zExaKKK7BBRRRQBcstUurHiJ8p/cbkVrJ4oG357Xn/Zf/AOtXO0VpGpOOiYjcn8TTOCIIVj/2mO41jSzSTyGSVy7nqSaZRSlOUt2AUUUVAwooooAKKKKACiiigAooooAp30O5PMA5Xr9Kz62yMjB6Vk3EXkylf4TyPpXHiIWfMhoiooormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAADgg16RYTC4sIJQc7kGfr3rzeuu8KXwktntHPzRncv0r0ctqKNVxfUTOjooor3SQooooAKKKKACiiigArn/Fk4SwjhzzI+fwH+RXQVwniK9F5qbKpzHENg+veuLH1FCi11eg1uZNFFFfPFBRRRQAUUUUAFFFFABRRRQB6Fo12LzS4ZAcsq7H+o/zmr9cFourNplyd+WgfhwO3uK7mGeO4iWWJw6N0INfR4PEKrTS6ohqxJRRWt4etUuNS3SDKxLvAPc9q6ZyUIuTBakcGhX9xGHEQRT03nBP4Vj+JorjRdMmeeMqXGyNgcgk+/wCtemM6opZjgD1rn9aii1m0ltJlzC6lRnsex+tef9Yq1E0i+VI8IopXQo7Ieqkg0leGAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACgkdCRSEk9TmiigAooooAKKKKAFVijhlOCpyK9MglE9vHMvR1DD8RXmVdx4ZuvP0lYyfmhYofp1H+H4V6eWVLTcO4pFDxfb8W1yB6xsf1H9a5avQtZtPtulTxAZcDcn1HP/1q89rPMafLW5u4IKKKK4BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB1PhC34ubkj0jU/qf6V0k8ogt5Jm6IpY/gKqaNafYtKhiIw5G5/qef8A61VfE115GktGD80zBB9Op/w/GvoqS+r4a76IndnEMxdyzHJY5NJRRXzpQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABUttGktzGkkgjjJ+Zz2FRUU1owO+i1fSYYkijuolRAFUDPAp/9uab/wA/kf6159RXorM6i05ULlO6vNR0m9tJLeS7j2uMZ54PY1wzrsdlDBsEjI6GkormxGJddpyVmhpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigByuyZ2sRn0NL50v/PR/wDvqmUU7sB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76pGdnxuYnHqabRRdgFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKns7uSyuknjPKnp6j0qCimm4u6A9JsryK+tlniOQRyPQ+lWK880zVJtMn3p80Z+8h6Gu3sdSttQiDwuN3dD1FfQ4XFxrKz0kQ1YuUUUV2AFFFFABRRWLq2vw2KtHCRJP6Dov1qKlWNOPNNgLr+rCxtjDG37+QYGP4R61w55OTUk88lxM0srFnY5JNR187icQ68+bp0LSsFFFFcwBRRRQAUUUUAFFFFABRRRQAVZs9QurF91vKy56r1B/Cq1FOMnF3i7AdHF4vnVcS20bn1Viv+NamiePDZ6ojS2yxwONkjbixUHv09cVxFFdLxldqzldBY95+1/bI1lWUSRsMqynII9qyde1u30XT3ld1M7KRDHnlj9PSvJLe/vLRSttdzwg9RHIVz+RqGWWSaQySyNI56s5yT+NaPG+7aKswGkkkknJPWiiiuEAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtrwze/ZtT8ljhJxt/4F2/w/GsWlVijBlJBByCO1aUqjpzU10A9QrgdesfsOpuFGIpPnT8eo/OvSPB0Uev2y3cv3IxtkUd39Pp3/EV2VzYxSWpjSJBt+6oUY+levjJ060VFetxRTPnKivQfGfhi2WyfUrKJYpIuZUQYDD1x2Irz6vIq0nTlysYUUUVmAUUUqqWOACT7UAJRVhLKVuuFHvUo0/1k/IVoqU30C5Soq8dP9JP0qJ7GVemG+lDozXQLlailZWQ4YEH3pKzAKKKKACiiigAooooAKKKKACtPQbH7dqaBhmKP53/DoPzrMAJOAMk132h6b/Z1gA4/fSfNJ7eg/CuvBUPa1ddkJs064jxNe/adT8lTlIBt/wCBd/8AD8K6rVL5dP0+Sc4342oD3Y9P8a88Zi7FmJJJySe9d2Z1rRVJddxISiiivGKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACit/SdFimgW4uQWDcqmccepq3d6DayxHyF8qQdCCcH611RwlSUeYVzlaKVlKOVYYYHBFJXKMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKfFLJDIHidkYdCpxTKKL22A37TxVdQgLcIsw9ehrVi8VWDj5xJGfdc/yri6K7KePrwVr39RWR3J8TaYB/rXP/AAA1Wn8W2yg+TDI57Z4FcfRVyzKu9rILI1b3xDe3gKhvKjP8Kf41lHk5NFFcc6k6jvN3GFFFFQAUUUUASW9vNdTLDAheRugFWL3SrzT1VriLajHAYEEZ9OKt+HL6Cy1FmnIVZEKBz2OQf6Vs+ItUs30x7eKaOWSQjGxt2MHOc/hXZToUpUHUlLVCvqcfRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA9J+FupRwx3lkzAMXEmD3BGM/hgfnXp9fNtpeXFhdJc20rRyochh/nmvS/D3xEuLyP7JdQQ/aVHyMCQHH09a7KElO0Oo07G7442Wnhy+nxxJGY8f7Tcf/XrxGvWdRvptUJFyVZCCPLA+UA9eK891vRn02YyRgtbOflP932NbYzDVIxU3rYV7syKKKs2lv5rbm+4P1rz4xcnZAJb2rS/MeE/nWhHEkQwq4p4AAwKWu+nSjD1JuFFFFaAFFFFADHjSQYZQRWfcWjRZZOV/lWnSdazqUozWoXMSirV3beWd6D5T1HpVWuCUXF2ZQUUUVIBRRRQAUUVr6Joz6lMJJAVtkPzH+97Crp05VJKMdwLnhrSDLIL6df3aH90D/EfX8P89K66moixoqIoVVGAB0Arn/EmsCCI2UDfvXH7wj+FfT6mvoIxhg6Ov/Dsjcx/EGp/b73ZG2YIshcfxHuayKKK+fqVJVJuct2WFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB2ek3CT6bDtPKKEYehFW3dY0LuwVVGST2rhYLia2ffDIyH2PWpLi/urpds0zMvp0H6V6MMclCzWorEdzKJrqWUDAdyw/E1HRRXnt3dxhRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKANHRdGm1u8a2gkjRgpbL5xitDV/CF5o9gbuaeB0DBcJnPP4VH4U1e20bVHuLrfsMZUbFyc1t+JvFem6tozWtsJvMLhvnQAYH410wjSdJtvUDh6KKK5gCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigApyO0bq6MVZTkEdQabRQB3Wia0mpReXIQtyg+Yf3vcVqSxJNE0ciBkYYKnoa8zikeGRZI2KupyGB5Fdpo2vx34WC4Ijuf0f6e/tXuYPGqovZ1N/wAyWjF1bw9LaSeZbAyW5P1KfX296ZGgjQKOgrvYFyxJ6CszUfD6TEy2mI37ofun6elE8HGEnKmK5zFFPmglt5DHNGyMOxFMrEYUUUUgCiiigAooooAayh1KnoayJUMchQ9jWzVDUE+ZX9eDXPiIXjfsCKVFFFcRQUVLb2011KIoI2kc9lFdVpXhiOAia9xJJ1EY+6Pr61vQw1Ss/dWncG7GXo2gSXxWe4Bjtuo7F/p7e9dnFEkMSxxoFRRgKOgp44GBWJrOvx2AaC3Ikuf0T6+/tXt06dLCU7v7yNyTW9aTTYvLjIa5cfKP7vua4d3aR2d2LMxySepNEsjzSNJIxZ2OSxPJpteNicTKvK726FpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopVVnYKoJZjgAd6AEorrLnw6q6CqIoN1FmQkfxHuP8+lcnW1ahOi0pdQTCiiisQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACgHByKKKAOv0DxC6Q+XekuucCTuPr611sUsc8YkidXQ9CDXmlgf3B+taVreXFnJvgkK+o7H6ivZw+IkoLm1JZ29xbQ3UeyeNXX3HT6VhXfhrq1pL/AMAk/wAams/EcMmFuk8tv7y8r/iK2Ypo5kDxSK6+qnNddqdURw9xYXVqT50DqP72Mj8+lV69DqpNpdlcEmS2TJ7qNp/SspYbswOHorqpPDdm3KPKn4gj+VV28Lj+G7I+sf8A9es3QmBztFdB/wAIu/8Az9j/AL4/+vTl8Lj+K7J+kf8A9el7GfYDnarXwzb59DXZx+G7NeXeV/xAH8qsnS7GCP5LaPPqw3H9abwspqz0C551a6deXhHkW7uD/FjA/M8VvWXhLo97N/2zj/qa6imTTRQRl5pFjQd2OBV08upU9Z6/kO422tLezi8u3iWNfYdfqe9Ommit4mkmdUQdWY4rBv8AxVBEClmnmv8A32GFH9TXMXl/c30m+4lLnsOw+gorY+lSXLT1/ILG3qvid5g0NjlE6GU8Mfp6fzrnCcnJoorxq1adaXNNlWCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArovC+m+dcG9kX5IjhM929fwrCtbaS7uY4Ihl3OB7e9ejWltHZ2sdvEPkQY+vvXoZfh/aT53svzE2TVw3iLTfsV95sa4hm+YY7HuK7mqep2K6jYyQNgN1Q+jdq9XF0PbU7LdbEp2POqKdIjRSNG6lXUkEHsabXzRYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAXdPfl0/Gr9Y8EnlTK3bvWuCCMiu7DyvG3Yli0+KaWB98UjI3qpxTKK3A14PEV5FgSBJR/tDB/MVoxeJrZv9bDIh9sMK5eitVWmuojtI9a0+TpcBfZgRU639m3S6hP/bQVwlFWsRLsB3v2u2/5+Iv++xTWv7Net1CP+2grhKKf1l9gO0k1rT4+twG9lBNZOo+K7aFQsUEkjH1wo/rWBWVcy+bMSOg4FYV8ZOEfd0Y0jVufFN/NkRCOBf8AZGT+ZrImnmuH3zSvI3qzZqOivMqVqlT43coKKKKzAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA0dI1OPS5XlNt50jDap37do79jWv/wAJj/04f+Rv/sa5eiuini61OPLB2XogsdR/wmP/AE4f+Rv/ALGj/hMf+nD/AMjf/Y1y9FafX8R/N+C/yFZFzVL2PULs3CW/kswG4bt2T69BVOiiuWUnOTk92MKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq/ZXGR5THkdKoUAkHI61cJuDugNyiqdveBgFkOG9fWrlehGakrokKKKKoAooooAKKKq3F2sYKoct/KplJRV2Al5cbF8tT8x6+wrOpWJYkk5JpK8+pNzdykFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVNFdSRcZyvoahopqTi7oDRS/jb7wKmpRcwn/AJaCsmitliJrcVjWNzCP+WgqN76NfugsazaKbxEugWJ5buSXjO1fQVBRRWEpOWrGFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD//2Q=="
-         id="image3762" />
-    </g>
-    <path
-       fill="#130f45"
-       fill-opacity="0.7308"
-       d="m0 0.503937l960.0 0l0 540.0l-960.0 0z"
-       fill-rule="evenodd"
-       id="path3766" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 47.711285l157.23622 0l0 62.895016l-157.23622 0z"
-       fill-rule="evenodd"
-       id="path3768" />
-    <g
-       transform="matrix(0.31447244094488186 0.0 0.0 0.3144750656167979 50.824146981627294 47.71128608923885)"
-       id="g3775">
-      <clipPath
-         id="g3a04b465b0_0_0.2">
-        <path
-           d="m2.842171E-14 0l500.0 0l0 200.0l-500.0 0z"
-           clip-rule="evenodd"
-           id="path3770" />
-      </clipPath>
-      <image
-         clip-path="url(#g3a04b465b0_0_0.2)"
-         fill="#000"
-         width="500.0"
-         height="200.0"
-         x="0.0"
-         y="0.0"
-         preserveAspectRatio="none"
-         xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAYAAAAeGRPoAAAOPklEQVR42u3dbZHqwLqA0S0BCUhAQiQgAQlIQAISkIAEJCABCTjoc3ZVuGcuNWxC+u1OJ6xUrT/7Y4av9JN0QvInpfQHAJg3LwIACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgexEAQNABAEEHAAQdABB0ABB0AEDQAQBBBwAEHQAEHQAQdABA0AEAQQcAQQcABB0AEHQAQNABQNABAEEHgAG6/zqMtPvxc9Y//nyf+ZhWT79H0Bux7j8w2xcfiH3/950VCxjp71gydum8dqOXy9OGQdTr+vyYBH3irb3LyA/I9b9O/ZbfykAFCPosg37J2AlMgj6dTR/he4pfzv3evUELEPR6U+7PO2Xvpty7oNf2JOjTfRAuqc5ye/rwAAh6vdd0SA9S5l76+sV7JOiFj4vXCvlvU/JWQEDQ2w96+nCG9STode1TG8vBCgcIevNBv2XunQt6Aav+eHZLy8WJc4CgNx30NPBw6UnQ68X8mtpcrqIO4iPoTQf9lvF/Bf1LYi7qgKC3GfTug730y1P8O0Ev45zmsVysgCA+gt5M0H8L9ZD/txP0ZZ8A50Q5QNDnF/TnP9sP2Dv/I+hlvpp2T/NbNlZEEHRBbyLoz8G+Px0efTUtL+jBTmmei6l3EB9Bbyfo63/MpF5ejN2CHrx3PufFCgqCbrxoI+jPO4iPvfTdP94HQQ90DA7svd/6OvziXGBq3146CLqgtxP0553Ec3+8/NWYLeiBbkFhvaXh11/fBE/zr62QIOiC3kTQ3x3G7QS9jE1QUA8Zvz/ie+97KyQIuqA3E/T1BzOqgh5k30hMc/fWz1ZIEHRBbybor96nTtDbPX4eefw6Z0/9ZoUEQRf0poK+ejpn6pLxswR9gEtm0LeBjyX3bHsrJQi6oLcT9D99Ix4nRa8Fve2gRz+es6ADgr6YoP+p/LMEvYHp9p9v7GEkKyUIuqAj6I5bsyCrfuDuDODFrX+8zhtBR9DnO+W++vKB7HF86PLmpL5b/2+O/bcCNpUf5yczHd2HP3vfHyp59fyv/d/vU5nrBXQ/3oP7gI3QGo9lqE8ew+bH87z9Y9bs7zdGdgXWzVX/eT8OHDeuBR/LXIL++DycB7xml/7fHWx0CPpUQT98YcT3Kea787d+wOsqDCqfLKeBP3PsZ+cS8JzX/ePMvergNQ2/GFKJ0Az53bs0/uJPp4ANly7F3Fb5HPhZbzXoj0ucRt2G+lxog4iFBv2Q+YG7p++4SltOwIbGfddI0O9vQhr1OlxGzFQ8Ql7i9d9OsD6d3pwdfAt6fqcRUeiCNlwj3vfWgx61gfmvdfKYXBFT0N/YBnzYrgv+oJUOeY2wdyMex+bFnmKJAeuQ6mx8lgpfzmN8tfF0KhSFIRstq8A9zH8t+zT/oK9S/TtVHuyxC/q/PpA1B4s5nVR1TNMtl8CNpC5gsD1NGNJV5Y2qa8aAOSY0m6fnep0wpJvAWYGowzutBn1fcI+81owSCwt67ne/fzvmM/e99dqDWumNpDFBv1SM+b9CWiNwkVEfE5rDBM/19OJzP0WgTmleQa81gzFkOQqtoJeYdv9tJZ1j2HepvSX3WvndyN97mGCW4tRAzH9GvUZobul/Z0LXXHYNxHxsmKYK+mbiz+SrjW9T8IL+/9wKDtBzCXuLMc+dmswJ+pSDe9fIwFkzNFMsu36D/t7AY9mmtoO+aeR1ipxRYqFBLz3oR35l5dtinrunPregt7Z0ablBb2m5fxCl2kFvOeaiLujVzqz97UPX2vcqdzMa9MacAS/o+VOagl5nqfGNh0+Dvp5BzCNm8lhY0Gses2zle5WbGa2sj9ft09dM0OttSAl6nb30mkG/zuw1zD3nhoUEfaqt0Usqd1GVVjZgptpjFPS6r7mg19lLrxX04wxfv2+52JegN77X+jjbt9Z0/KHAivS4FvNfP+8DfE6xJx5+sgEk6DHLJgl6rXGghaCXWG8e93M49OvwLv3v2yTX4N8jwoLexNcz7hXCvg5eebYfDBKXoNdolaYN+uOwyfbHIPm4y9m+8ufncROQ7sfr0qXY62of03RBf2zs/ryj2eMuZ8dU77oJtd7zbZo+6NfA927oeUPr/vWN2KFygxdBb+oCCvdU7uYvp6AVdexKE/FVoaGvTYmgD/3d+8KfkaEXMuoCold6z/HVOjD0cq2lT2odupEd8Z6f0rRB3wW9d2OPZ68DNijspQt6c5c4zA1nqb3z3Gt+RxzauKX6Qb+nz2+sUepbBLtU//yQdaoX9DFfQyp1Dfja7/ktTRv0iI2/iFsk576f9tIF/eVgOPXlDo9B0/C5K0nkV0Nyoz5k7y0y6F2abkZkzAxBdGh2qU7Qbxmf9ejp96ne8/VEQc+9cmb098GvjYxVgr7AJ1X77mO/rSw5W76rzICWmMbKmaI8Vwx6zuGP6HMWproq4rvj6IeJIxo9IzLle76dKOg5Oy73FLNnHvU63oVY0IcOGlOeNLeZYLD75ES0mpGpEfRbwHO/NhC73K8ivduYiAj6OfP5Rd5Bccr3/DBB0HNfu1J3QDs0+JgE3R775FHPmQYsecGGXcHARQT9MPGgFDlD0mV+7ko/x4g9vOsC3vPzBEHfTvzZLLGXbtpd0Ed94E6p7slzY6I+9vHdCr9+q4IDb0TQIy5UEXFXv93Er3VKZYN+Dfo8HRfwnl8mCPqx0M+d8jbX1yTGgp4xWNacjv/kqkjrzIH2UNitwMAXEfSoASFiwyLqkEepKf/coEd9TfOwgPf8PkHQrxmPtfT4kDMTKsiCHnIGd9RFEiKmurZpmcs9lQ1pVGRWld7nIS6FgpAb0qi9vN1C3vPaQV/q4utrgh5+jLjksfYhx7eXfFnOkkGPHAxylmNaftBbuR3ytpH3vGbQNwseH6a4V4agf4HHsfYSe6nvpmOPC15hu4KD+7qRwT1yUGox6JHnaSzlPa8Z9CXf86DUFTcFnf+bijtW/tBeFrzClgz6n0YG98iZghaDHnlIYSnvec2g7xY8PhyT5gh6pT32qNDe0vcGfVtocL81NLhHXrCjxaBHfr2o5Ffzlhr0JR+Sc113Qa9+vfjSYVty0A+FBvfLDAb3pQQ9clp06e+5oAu6oDcuYsrrKOiCLuiCLuiCLujz31O/CrqgC7qgC7qgC3obroUGAUEXdEEX9C6VPewn6IJe3djlltqfen918tRpwSvsNgm6oAt6zvu35K+tCbqgv1xWjT++b5xS65KgC7qgC/rvixu0LDzoOdPa28YfX/T3TOe+dSvogi7ow96/lndyEPQiA9qp8cdX4tKOK0EXdEFffNDH3iDJPccFfVK5x5PXMwx6zuCyE3RBF/TFB33suHgWPEGf89fDSu+llzqefG5kkBN0QRf09oKec0LuWvQEfSoRdxbqCj22bcHHlbMhsxV0QRf0RQd9nfFz7aUL+qRy71N+L7RVeik48K8zn+9K0AVd0Bcb9DmcMIygF/te9i3F3jTjEPB43v2Oc8bPvxaK+qZ/7mMIuqALelzQc6bd78Hj4cMqY3xwKOBLgh71vct7ijlpLOJ2qkOmvXKn9C/BUd9kzJZcDe6CLuihQV9lzl5GR32VOWsg6F906ddbilsuI6ectoGPY1fpeV+DVtpt5uCxM7gLuqCHBj1ipvDvOr0PeO3WmTF3QZkvC/ouxS+3/oO0fRG9Tf93x+ANivTBnnPU8z6N3AJeZ079Dz28IOiCLuifBz13L/3naznm5OHHFHvuY9gkIf66m7NER3Wq5VxxUP/td+/exH3d/5tz0O/cGdwFXdCLBD36UtHXfo998ybi234nIWJjwt75lwZ9Kdcw/nRLeFPwsVyelPj5BndBF/Sy48S10PhwfRofoneqSn0DSdBn4pjmvYwdhOZ4w5ZPV1ZBF3RBHxf0zUzHw30S4K8Oeu6ZlHMKXMmp9xrLzuAu6IJebSZvN7PxYc5XtRT0QOugYzdz2xqd08bMyeAu6N7zqkGPumZHjeWW3PlN0FPMd6LnEri5bsxcDO6C7j2fJOhziHqpi9ow46DPKeqnAs+71T31nCvUCbqgC3p+0FuOupgL+mzjViLmLU+/nzKn0QRd0AU9JugtnkAcffltFhj0R9xa3CI9VHjuxwU9V0EXdEGPC/rjRLkWZjGjL0PNgoNe4tKsuVui3Zc878jnKuiCLuixQX+cdzPlN2QOSWQFPWNvPeJShGOPDx0m2hKt/bxLPFdBF3RBjw/6z731mhv+l+SiMYIeGLh9pQ/wbcKQ/7Y1XjLs936av8SKKuiCLujlgl4r7OfKM5R8QdCfB43oG6z8Ddvjxi6tbtBEXo/9cQ34VeH3SdAFXdDLBv3nax91PfbHTo09ckGvvge76wM/9NrEt/7fHtP7Gxe0Gvdtv8INec6P53vo/98q1Z1dGGMX/FgOGaL3psY+jvWbwXzsz+2854Pf867Q+1fi20L7fsP93Ubkvf83p/T+Rk8I+uTB/7avVnTJGajA6zFRtAUdABB0AEDQAUDQAQBBBwAEHQAQdAAQdABA0AEAQQcABB0ABB0AEHQAQNABAEEHALwIACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agu5FAABBBwAm9x+vDo6+g0o7jgAAAABJRU5ErkJggg=="
-         id="image3773" />
-    </g>
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 232.3622l751.43304 0l0 69.60631l-751.43304 0z"
-       fill-rule="evenodd"
-       id="path3777" />
-    <path
-       fill="#000000"
-       fill-opacity="0.0"
-       d="m50.824146 305.27505l362.74014 0l0 52.125977l-362.74014 0z"
-       fill-rule="evenodd"
-       id="path3779" />
-  </g>
-  <rect
-     style="fill:#120f45;fill-opacity:1"
-     id="rect3791"
-     width="148.53281"
-     height="54.267715"
-     x="59.527557"
-     y="56.338581" />
-</svg>
+<svg version="1.1" viewBox="0.0 0.0 960.0 540.0" fill="none" stroke="none" stroke-linecap="square" stroke-miterlimit="10" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><clipPath id="g3a04b465b0_0_0.0"><path d="m0 0l960.0 0l0 540.0l-960.0 0l0 -540.0z" clip-rule="nonzero"/></clipPath><g clip-path="url(#g3a04b465b0_0_0.0)"><path fill="#ffffff" d="m0 0l960.0 0l0 540.0l-960.0 0z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m-2.6246718E-7 0l960.0 0l0 539.99945l-960.0 0z" fill-rule="evenodd"/><g transform="matrix(0.5 0.0 0.0 0.49999947506561676 -2.624671916010499E-7 0.0)"><clipPath id="g3a04b465b0_0_0.1"><path d="m0 0l1920.0 0l0 1080.0l-1920.0 0z" clip-rule="evenodd"/></clipPath><image clip-path="url(#g3a04b465b0_0_0.1)" fill="#000" width="1920.0" height="1080.0" x="0.0" y="0.0" preserveAspectRatio="none" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAQ4B4ADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDxaiiivYJCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiirC2crqGG3BGetNRctgK9FWfsM3+z+dH2Gb/Z/Oq9nPsFytRT5Ymhba2M4zxTKlpp2YBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArYg/wCPeP8A3RWPWxB/x7x/7orpw27EySiiiuwRm3/+vH+7/U1Vq1f/AOvH+7/U1VrzqvxspBRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa0MiCCMF1ztHesmitKdTkdwaNnzY/76/nR5sf99fzrGorb6y+wrFm+YNOCpBG3t+NVqKK55S5ncYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFWrXTby9jMlvAZFB2kgjrU/9g6p/z6N/30P8a0VKpJXUX9wGdRWj/YOqf8+jf99D/GobrTLyyjElxAY0J2gkjrQ6NRK7i/uAqUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABWvB4X1i5gSeK0Zo3GVORyKyK9V0XXtKg0W0ilvokkWIBlJ6Gt6FOE21J2A8wurWayuXt502SocMvpUNaviS4iutfu5oHDxs+Qw6GsqspJKTSAKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA7Hwj/yDZv+ux/kK6Cuf8I/8g2b/rsf5Cugr6XB/wACJD3CsHxb/wAgqP8A67D+RrerB8W/8gqP/rsP5Gni/wCBL0BbnGUUUV8yWFFa2haQNSnZpCRDH97Hc+ldcuk2Cx7Bax7fcV20MDUrR5r2Qmzzuiug8QaIlkoubYERE4ZfSufrnrUpUpckhhRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHY+ET/wAS2b/rsf5Ct/I9RXmAZl6MR9DS+Y/99vzr06OY+zpqHLt5isenZHqKwfFh/wCJVH/12H8jXH+Y/wDfb86QszDBYn6mitmPtKbhy7+YWEooorzBnXeEpUNrNFn5w2ce1dHXmtpeTWU4mgbaw/I1vr4vcR/NaqX9jxXs4THU401CeliWjU8SSpHo8iseXICj3rhauahqdxqUu+Y8D7qjoKp1wYuuq1TmjsNKwUUUVyjCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAqVLaWRQyrkH3qKtW0/49k/GtaUFOVmDKP2Of+5+tI9rMilmXAHXmtaobr/j2f6VvLDxSbFcyaKKK4xhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFSpazP0Qgep4ppN7ARUVcXT2P3nA+gqQafH3djWioTfQV0Z9FaX2GH1b86Q2EXqw/Gq+rzC5nUVfbTx/DIfxFQvYyr0w30NQ6M10HcrUU5o3Q4dSPqKbWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAqKZHVFGWY4Art9N8PWttCrTxiWYjkt0FcfYSLFfwO/3Q4zXpAIYAg5B6V6uW0oSvKSu0JmZe6DZXURCRLFJ2Za4a4ge2uHhkGGQ4Nem159rcqTavcMhyu7GR3qsyowjFTSsxIz6KKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtW0/49k/GsqpkupY0CqwwPataU1CV2DNaobr/AI9n+lUfts/94fkKa91LIhVmGD14reWIi00KxDRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKlgt3nPHC9yaaTbsgIgCxwBknsKuRWLNzIdo9B1q3FAkI+Uc9yetS1108OlrIVyOOCOL7qgH171JRRXQklsIKKKKYBRRRQAUUUUAIQCMEZHvVaWyjflfkPt0q1RUyhGW4GRLbyQn5hx6jpUVbZAIwRkVSuLIHLRdf7tctTDtaxGmUaKCCDgjBormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVtaf4kuLKIRSKJYx0yeRWLRWlOrOm+aDsBv3vii4uIjHBGIgRgtnJrAJycmiiirWnVd5u4BRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU6ON5XCRoWY9ABk1v2XhWeUB7qQRKf4Rya1pUalV2grhc56iu7g8OadCOYTIfVzmrQ0qwAwLOH/AL4FdscsqPdoXMedUV6DJomnSjm0jH+6MfyrMuvCcDgm2laM+jcipnltaOqswucjRVy+0u709v30fy9nXkGqdcMoyi7SVmMKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAorqND8F3WpxrcXLm3t25Xj5mH9K6dfAOkKmCZ2P94vXRDDVJq9gPOLa2Mx3Nwg/WtJVCKFUYArqtQ8GtBEXsJDIFH+rbr+BrmGVkYqwIYHBB7V1Qo+zViWJRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAV7m2WYZHDjv61mMpVirDBHatuq11biVdyj5x+tc9ajze8twTMyijp1oriKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1YWE2oXAhhH1Y9AKgiieeVYoxlmOAK9A0vTo9NtFjUAueXb1NdeDwrry12Qm7CadpVvpsQEa7pCPmc9TV+iivoYQjBcsVZEhRRRVAFFFFADZI0lQpIoZSOQa5HW/D5tQ1zaAmLqyd1+ntXYUhAIIIyDWFfDwrRtLcE7Hl9FbPiDSvsFz5sQ/cSHj/ZPpWNXzlWnKnNwl0LCiiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACGkpqutKJVzDCPMcevoPzrArt/hyy/ab1f49gI+ma2oRUqiTA9AAAGAAAKWiivaAK4zxhpyxSx3sa4Eh2vj17Guzrn/GDKNGAPUyDFTNXiJnB0UUVzCCiiigAooooAKKKKACiiigAooooAKKKKACit/TfCl3exrLOwt4zyMjLH8K1j4KtduBdS7vXAxVqEmFjzq+g2nzVHB61TrtdX8L3VjEzjE8HdlHI+orjJEMchQ9Qa8/EU+SV+40NooornGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFXtN0e+1aXZZ27OB1c8KPqaaTbsgKNFehab8PYEAfUbhpG7xxcL+fU/pXTWeh6ZYgfZ7KFCP4iuW/M811Qwc5b6AePRWN3OMw2s0n+5GT/KrH9iaqRn+zLz/vy3+Fe04A6CitlgV1YHiEmnX0IzLZXEY/24mH9KrV7xgVUutLsL4EXNpDL7sgz+dKWB7SA8Sor0nUfAFhOC1lK9s/ZT8y/rz+tcZq3hzUtHJNxDui7Sx8r/APW/GuWph6lPVrQDJooorEArW0nQptR/eOfLgz97HJ+lQaPp51HUEiP+rHzOfavQI0WNFRFCqowAO1ejgsIqvvz2E2UbbRLC1UbYFZv7z8mrRtbcrgwR4/3RU1Fe1GnCKskSZF54dsbpSUTyX7Mn+FcjqOmz6bNslGVP3XHQ16LVW/so7+0eCQdfun0PrXJicDCpG8FZjTPOKKfPC9vO8Mgw6MVNMr59qzsygooooAKKKKAOk8KWIkmku3HCfKn1rrazdBgEGjwDHLDcfxrSr6XCU1ToxXzIYUUUV0gFFFFABRRRQAUUUUAVNSs1vrCWBupGVPoe1edMpRirDBBwRXqFef67ALfWJ1AwGO4fjXk5pT0VReg4mdRRRXjlBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUVdtNIvb3Bigbb/ebgVsweEXIBuLgL7IK3p4WrU1jELnM0V2ieFbBR87SP/wACxUv/AAjOmf8APN/++zXSstrPsK6OGortJPCtgw+RpE/4FmqM/hFwCYLgH2cVEsvrx6XC6OZoq7d6Re2eTLA23+8vIqlXJKEou0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVreHNUbSNZinwTGx2SAdwayas2Sbp89lGaunfnVgPbIZo54llicMjDII70+vM9O1m90w4gkyh6o3INbS+NptvzWiFvZjivZVRdRXOyJAGScAVwPijVlv7tYIWzDDnnszVBqPiS+1BDGWEUR6rHxn6msionO+iE2FFFFZgFFFFABRRRQAUUUUAFFFFABRRRQAV0PhTTEvLxriVd0cPQHoWrnq7jwZt/syXH3vM5q4K8gR0lFFFdBQEBgQRkHqDXlnjPSV07UxJEuIpRkD0r1OuN8fIr21uv8AHyRWGJhzU2B5zRRRXjAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRS7W2btp25xntmkoAKKKKACiiigAooooAKKKKACiiigAooooAKACTgDJNA5OBXofhHwosCJqN/GDKeYo2H3fc+9aUqUqkrICh4d8ENchLvVAyRHlYehb6+legQW8NrCsMEaxxrwFUYAqSivXpUY01aIBRRRWoBRRRQAUUUUAFIyq6lWUMpGCD0NLRQBxXiHwPFOr3OlARy9TB/C309K8+likhlaKVGR1OGVhgg17tXN+J/DEWsQGeBQl6g4P98ehrhxGFT96G4HL+EIQLa4mxyzhPyGf610tc94V3RQXVrIpWWOXLKeo4x/Suhr0sFb2EbEPcKKKK6gCiiigDiPFEIi1gsB/rEDf0/pWLW34qlD6uFB/wBXGFP6n+tYlfM4q3tpW7lrYKKKK5wCjvRRQB6VZALYW4HaJf5VPVXTZBLpls4/55gfkMVar6yDvFNEBRRRVAFFFFABRRRQAUUUUAFcV4rUDVlPrEP5mu1rh/E8gfWCB/AgWuDMn+5+Y1uY1FFFeAUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVq6NosmpSb3ylup5b19hV06cqkuWK1Aq2Gm3Ooy7IE4H3nPQV12neHrSyAeQedL/AHmHA+grTt7eK1hWKFAiL0AqWvdw+BhS1lqyWxAABgDA9qWiiu4QUUUUAFFFFACEAjBGR71kah4etL0F4x5Mv95RwfqK2KKipThUVpq4HnN/ptzp0uydOD0cdDVSvTLi3iuoWimQOjdQa4jWdFk02TemXt2PDensa8TF4F0vehqvyKTMqiiivPGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFX9PX5Hb1OKoVp2QxbD3JrbDq8xMs0UUV3iCiiigAooooAKKKKACiiigAooooAKKKKACiiigArf8ACuqLZXrQSttimwMnoG7VgUU07O4HrnUZorz/AE3xTeWKCKQCeIdAxwR+Nax8bQ7eLOTd6Fhit1Uix3OpZgqlmIAHJJrzrxFqS6lqRMZzDGNqH19TS6n4jvNSUx8QwnqiHr9TWRWc530QmzFddsjL6HFNqW5GLl/rUVePJWbRQUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdFG80qxoMsxwB702um8LabuZr6ReB8sefXua2oUXWqKCBmm2hxHQ/sQA8wDcG/264h42jkMbAhlOCD616fXJ+JtO8u4S+jX5XIEmOx9a9PH4VcinBbfkSmUV8L6y6BlsJCGGQcVlSRvDI0cg2upwQexr2C213SltIVN/ACEUEb/avJ9SdZNTuXRgytIxBHfmvPr0oQScXcoq0UUVzAFFFFABRRRQAUUUUAFFFT2VpJfXsNtEMvIwUUJXdkB0/grw+L+5/tC5TNvCfkU9Hb/wCtXpVVrCyi0+xhtYRhI1A+p7mrNe1QpKnCwBRRRWwBRRRQAUUUUAFFFFABRRRQAUUUUAc5renra3Y1aFcAjZcgd17N+H8qiBDAEHIPQiumdFkjZHGVYYIPcV53c3snhzVpNPuQz2md0Ld1U0QrRou0tn+DE0b9FVre/tbpA0M6NntnmrBIAyTgV2qSaumSLUN1cx2ds88pwqDP19qrXmsWVkpMkys3ZV5Jrj9W1ibU5OfkhX7qD+tcmJxkKMbJ3Y0rlO6uHu7qSd/vOxNQ0UV88227soKKKKQBRRRQB2vhe6E2mGEn5omx+B/ya3K4DQ9Q/s/UFZj+6f5X/wAa74EMAQcg9DX0OArKpSS6rQli0UUV2iCiiigAooooAKKKKAEZgqlj0Aya83v7j7VfzT9nc4+naut8S6iLWyNujfvZhj6L3riq8XM6yclTXQqIUUUV5YwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAp0cTzSBI0Z2PQAZqS1tpLy5SCIZdzj6V3um6XBpsIWNQZD95yOSa68LhJV3fZCbscrB4Y1CVQzhIx6Meakk8KXyLlHjf2ziu0or1FltG1tRXZ5rc2dxZvsuImQ9s9DUFel3FtDdQmKZA6Hsa4XWNLfTLrby0L8o39K87FYJ0VzR1Q07mdRRRXCMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVVLsFUZZjgAd6AL2kaY+p3Yj5ES8yN6Cu+hhjt4ViiUKijAAqrpOnrp1ikWB5h+aQ+pq9X0WDwyowu93uQ3cKKKK7ACiiigAooooAKKKKACiiigAqOaGO4haKVQyMMEGpKKGr6MDz3V9MfTLwx8mJuY29RVCvQ9W09dRsXiwPMHzIfQ156ysjlWGGU4IPY187jcP7GemzKTEooorjGFFFFABRRRQAUUUUAFFFFABRRRQAVqWf8Ax7J+P86y607I5th7E1vh/jEyzRRRXcIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAMq7/AOPp6gqW5Obl/rUVeZP4mUFFFFSAUUUUAFFFFAGvaeHLy8tUuI5IQjjIDMc/yqf/AIRK/wD+etv/AN9H/Cui0H/kCWv+6f5mtGvcpYCjKCk+qJucZ/wiV/8A89bf/vo/4Vnalpc+lvGk7RsXBI2En+leiVyXi/8A4+bX/cb+YrLF4KlSpOcdwTOboooryCgooooAKKKKACigDJwKCCpwQQR1BoAsWNo99eR26dWPJ9B616JBCltAkMYwiDAFY3hnTfs1qbqRf3so4z2Wt6vfy/D+zp873ZLYVFc26XVtJBIMq4walorvaTVmI81vLV7O7kgkHzIcfX3qCuw8T6b59uLyNf3kXD47rXH18ziaDo1HHp0LTuFFFFc4BRRRQAUUUUAFFFFABXZ/D7TxLfTXzjIhXav1P/1q4yvVvBNqLbw5E+PmmYuf5f0rpwkOap6AdFRRVuCxeX5n+Vf1r1pSUdWBUAJOBU8dnNJ0TA9TWpHbxQj5VGfWpa55V+xVjOXTW/ikA+lPGmJ3kb8qvUVHtZ9wsUTpq9pD+VRtprj7rg1pUUKrPuFjFktpo/vIceoqGugqCW0il6rg+orSNfuKxjUVYntJIefvL6iq9bppq6EFFFFMArjviBp4m06K+UfPC21j/sn/AOvXY1R1m1F5o13ARndGcfWs60OeDQHiysynKkg+xp5nmIwZZMf7xqOivETaADyeaKKKQBRRRQAUUUUAFFFFABXU+HdbG1bK5bBHEbn+RrlqM4PFbUK8qM+aINHqNFcfpXiV7cLDeZkjHAcdR/jXVW93Bdx74JVdfY9K+goYmnWXuvXsQ1YmoooroAKKKQkAZJwPU0ALVTUNQh062Msp5/hXuxqhqPiK1tAUhImm9AeB9TXIXl7PfTmWdyzHoOw+lcGKx0aa5YasaQl5dy3ty88pyzHp6D0qCiivBbcndlBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6rwjaDy57thyT5a+3c/0rp6xPCxB0YY7SNn9K26+lwcVGhGxD3CiiiukArM160F1pE3HzxjzFP06/pmtOoLwgWU5boI2z+VRVipQcX2A81ooor5QsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK2/DFkLjUTOwykAz/wI9P61iV3Hhi28nSFkI+aZix+nQfyrswNL2lZX6aiZs0UUV9ESFFFFABRRRQAUUUUAFFFFABRRRQAUUVZ0+IS3iKeg5pN2VwL9lpi7BJOMk9F9KpapYxQXG9IkCyc8L3710NUtVi8yyLd0INcsajc7sprQ46+0SyvUOYljk7Ogwf8A69cTf2Mun3TQSjkdD2Ir0iuf8V26vYJPj5o2xn2NY47CwlTdSKs0JM46iiivCKCiiigAooooAKKKKACiiigAq/p7fI6+hzVCrNk+2fHZhitKLtNAzTooor0SQooooAKKt2WmXN9kxJ8o/ibgVZuNAvIIy4CyAdQvWrUJNXSEZdFBGDg9aKgYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUlLUVy+yBz7YFKTsrgZTtukZvU5ptFFeWUFFFFABRRRQAUUUUAegaD/yBLX/AHT/ADNaNYui6hZw6RbxyXUKOFOVaQAjk1f/ALU0/wD5/bf/AL+ivpqNSCpx1WyIZbrkvF//AB82v+438xXRf2pp/wDz+2//AH9Fcx4puYLme3ME0coCnJRgcflWGPnF0Gk+w1uYFFFFeAUFFFFABRRRQBZ0+7+w30Vz5YfYc7T34xWrEP8AhItdEvk+XCoG8ZzkD1+tYIBJAAyT2rvtE04afYKrD96/zOff0rvwUJVXyP4VqxM0gAoAAwB0paKK98kKKKKAEZQ6lWGQRgg9xXn2saedOv3jA/dt8yH2r0KsvXtO/tCwbaP30fzJ7+orjxuH9rTut0NM4KigjBxRXzpQUUUUAFFFFABRR16VZg069uf9VbSsPXbx+dOMXJ2SArV7VokPl6NZRqP+WS4H1Ga8ui8MalIRlET/AHm/wr3bRNFe3062MrLvESjjtwK7aClQvKorXBajLWyWMB5BlvT0q5Vv7Cf+en6UfYT/AHx+VOVVSd2y7FSirJsn7MppjWso/hz9DS549wIaKcyMvVSPwptUAUUUUAFFFFAAQCMGs67ssZkiHHda0aKqMnF3QHP0VfvrXbmVBx3FUK7IyUldEBSOu5GX1BFLRVAeHXqeXf3Cf3ZWH61BVvVDnVrzH/PZ/wCZqpXgPdgFFFFIAooooAKKKKACiiigAooooAKfFNJC4eKRkYd1OKZRQnbVAa8HiXUYRgyLIP8AbH9atDxddY5t4T+f+Nc9RXRHF1o6KTCxuyeK75xhEiT3Az/Os251O8u/9dcOw/u5wPyqpRUzxFWekpMLBRRRWIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAdL4TvVSWWzc43/On17/AOfausrzCOR4pFkjYq6nII7Gu10nxBBeosc7COcDnPAb6V7OX4qPL7Kb16EtG1RRRXqiCsfxJei10t4gf3k3yAe3erWoara6fGWlcF+yDqf8K4bUL+XUbpp5T7Ko6KPSuDHYqNODhF6saRVooorwCgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr0mxi8mwt4v7saj9K82AyQK9QAwMV62VLWT9CZC0UUV7AgooooAKKKKACiiigAooooAKKKKACrWnyCK9QnoeKq0Dg5pNXVgOsqO4TfbyL6qRVGy1NHQRznaw43djWiGVlyCCPauFxcXqXucpWB4ruFTT0gz80j5x7CtG+1ezsUYySqzjoinJNcPqN/LqN0ZpOB0VfQUsdiYxpuCerJSKlFFFeCUFFFFABRT/Jl/wCeb/8AfJo8mX/nm/8A3yafK+wDKKf5Mv8Azzf/AL5NNKlThgQfQihpoBKKKKQBSqxVgw6g5pKKANpGDorDoRmnVRsJsgxE+4q9XpU5c0bkhSqNzAepxSUVYHfWsKQW0caDChRUtZWl6tDc26JI4SVRgg8Zq7Pe29vGXklUAdgck16UZRcboRy+vQJBqTbBgOA2PesyrOoXZvbx5iMA8AegqtXnzacm0AUUUVIwooooAKKKKACiiigAooooAKKKKACqGoScrGPqauuwRCx6CseRzJIXPUmufETtHl7ghtFFFcRQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFPghe4nSGMZdzgChK7sgNrw1pv2q7+0yL+6hPGe7V2lVrCzSxs47dP4RyfU9zVmvpsLQ9jTUevUhsKKKK6ACiiigAooooA4nxJpv2S98+NcRTc8dj3FYlejajZJf2UkDdSMqfQ9q88lieGV4pBhkOCDXz+Pw/sqnMtmUmMoqzZWFzfy7LeMt6t2H1NdXp/hm2tsPc4nl9CPlH4d6yoYWpW+FadxtnL2el3l8f3ELFf75GF/Ot+08JRrhruYsf7qcD866VVCqFUAAdABQzBVJYgAdya9all1KGstWTcq22l2VoB5Nsin1IyfzNW6yrrxDp9tkeb5rDtHz+vSsmXxZNI4S1tVBJwC7ZJ/CtZYnD0vdTXyFZndaXa+dN5jD5E/U16RZNvsom/wBmvK7S8u4rONGlw2MttGOa6/w7eyT6eUeRi0bY5PaufG0pTipFwfQ6yisne394/nRvYfxH86832XmaXNaissTSDpIfzqRbuUdSD9RS9kwuaFRPbxP1XB9RxUK3o/iT8qnSeN+jDPoanllECs9kRyjZ9jVdkZDhlINatIyqwwwBHvVKo1uFjJoq5LZ94z+BqoylThhg1rGSewhKKKKoBCAwIPINY1zD5ExX+E8itqqt9F5kG4feXmtKUuWQmZNMlbZC7eik0+srxJeCy0C7lzhthVfqeBXVJ8qbJPIbmTzbqaT++7N+ZqKiivBAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo6UUUAXINVvrddsVzIF9M8U+TWtRlXa11Jj2OKoUVoqtRK3MwFZmdtzEknuaSiiswCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr09GDxq46MAa8wr0TSJvtGkWr5yfLCn6jg/wAq9XK5e9KIpF2iiivZJCiiigAooooAKKKKACiiigAooooAKKKKACkeQxxs2ThQTS1S1eb7PpN1JnB8sqPqeB/OpnLli5dgPOySTknJooor5MsKKKKACiiigDaX7o+lOpq/dH0p1eqtiArKvf8Aj6b6CtWsq9/4+m+grnxPwFIgop8MMlxMsUSlnY4AFdXY+FYEQNeOzueqqcAVjRw1Ss/cQ2zkaK7t/DmmMuBAUPqrnP61z+reHpLBDPAxlhHXPVa1q4GtTjzbryFcxUco4ZeoNa8UgljDj8R6Vj1NbTmB+funqKxo1OR2ewNGtRSKwZQQcg0td4goJJ6kmiigAooooAKKKKACiiigAooooAKKKKACiiigAooqtdXHlLtXlyPypSkoq7Agvp9x8pTwOtU6OvWivNnNyd2UFFFFSAVv6Foi39rPPOCFYFIj7/3vw/xrIsbR768jt4+rnk+g7mvRYIUtoEhiGEQbQK9DAYZVZOclohNnm08D207wyjDoxUio66rxVpu5Vv415XCy49Ox/p+VcrXNiKLo1HBjTCiiisACiiigAooooAKKKKACiiigArqfC2m4BvpF5Pyx5/U1gadZPf3scC5wTlj6DvXpNlZMyLBbp8qKB6ACvSy+hzS9rLZfmJjaKlntpbZgsq4z0PY1FXuJp6okKKKVVZ2CqCSewoASitO30S4lAMhEY9+tXo9Ct1Hzs7H64rKVaC6jsznqK6b+xbP+63/fVQyaDC3+rkZT781KxEA5Wc/WbqPhQXlwl/JlIjw6jq3oa7WDw5LbfvZgJMdAO31qeSNZEaNxwRgisqtSnVXLuhpM5CC3itohFDGEQdgKe8iRoXkYKo5JJwBVXW9Rg0V2jlO+b+FB1Pv7Vw+oardajJmZyE7RqeBSr42nRXLHV9hJHRah4qhizHZp5rf324Uf41zV3qV3fMTPMzD+6OAPwqrRXjVsVVq/E9OxVgrU8P232nV4gRlU+c/hWfBF50uzOOK63wppwSS4l3Z4CiqwlJzqRb2E2dBWx4du/Iv/ACmOFlGPx7VnfZ/9qnJCUcMr4IORX0FRKcXFkp2O+oqtYXQu7VJM/N0b61ZrxmmnZmwUUUUgCiiigCWO4kj6HI9DVuK6STg/K3oaz6KiUEwNemSRJKMMOfWqUNy0fDfMv8qvI6yLuU5FYuLiMz5oGhPPK+tRVrEBgQRkGqNxbmP5l5X+VaQqX0YWK9BAIIPQ0UVqIwpU2Ssvoa4D4hakMQacjc/6yT+ld9rdzFp6zXUzbY0XcTXh+pX0mpajNdy/ekbIHoOwqsVVtTUerIKtFFFeaAUUUUAFFFFABRRUkVtPcNthhkkPoik0AR0Ve/sTVcZ/s28x6+S3+FVprae3OJoZIz6OpFNxa3QEVFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK67wldb7Wa1J+aNty/Q//AF/51yNXtIvvsGoxTE/Jna/0NdGEq+yqqT2BnodFICGAIOQRkEUtfTEBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeLbrZaw2oPzSNub6D/AOv/ACruLfQLq4tknV4wrDIya8x8ULMmv3EUxBMeFXb0x2rz8diIqk4xer0GkY9FFFeCUFFFFABRRRQBtL90fSnVjedL/wA9H/76NHnS/wDPR/8Avo11/WV2FY2ayr3/AI+m+gqPzpf+ej/99GmlixyxJPqTWdWspxtYEjqvCdmoiku2GWJ2r7DvXTVh+FpFbSdg6o5z+Nble9g4pUI2Je4UjKHUqwyCMEHvS0V0gedaraiy1KaEfdByv0qnWr4jkWTWpdp+6Ap+orKr5aslGpJLa5aLFtcmE7W5Q/pWkrB1DKcg1i1LBcPAeOV7g1VKty6PYTRr0VFFOkw+U89wetS12ppq6EFFFFMAooooAKKKKACiiigAooooAKKKTrQBBc3KwjA5c9vStjw9pSyWktzdLuNwCqg/3fWqum6THf3qxlMr9529q7lbeJECKgVQMADsK1w1Fynzz2WwHlt/ZvYXslu/8J+U+o7Gn2CK3mblB6dRXZeJNEW9tPtEXEsI/Ne9cpawNAXDYIOMEVyTwzpVtNh30JvKj/uL+VHlR/3F/Kn1e0mxN9eqjD90vzP9PT8a2ULuyRJraJpqW1i100aiSUDHHRf/AK9aNWpgBCQBgCqterSioRsgGSRpNE0ci7kcFSD3FeealYvp99JbtkgHKn1Xsa9GrF8R6b9ssfOjXM0IyMd17j+tcuPw/tafMt0NM4iiiivnygooooAKKKKACiiigAooooAtWWoXOnszWzhS3BJUH+ddR4e8XTRmWG8uVQsQVcoAPoeK42it6WInTas9O3QLHaeIfF0sixw2dyrsG3M4QEfTpWD/AMJLqn/Pcf8Aftf8KyamtLWS8uo7eIZdzgVUsVWnL3Xa/RBY3dM1DXNUuRFDMAo+85jXCj8q7yxaWyiAEgeTHLlBk/pVPTNOh0yzSCIc/wATd2NXK9mhSlGP7xtsi5b/ALSuv+eg/wC+RR/aV1/z0H/fIqpRWvJHsF2W/wC0rr/noP8AvkVq2D3IUSzP8x+6u0cVn6daea3nSD5B0Hqa2K56rj8KRSLH2yf+/wDoKwtdvJ2hdLOVUu8cMVBA+tT3975IMUZ/eHqfSsYkk5PWlSordg2eYazcahPeldROZ04yVAJ/LrWdXo3iHRl1OzLxqBcxjKn19q86ZSrFSMEHBFeXi6Mqc9Xe4ISiiiuUZZsf+PkfQ13Xhgf6HMf9v+lcLY/8fI+hruvDDf6JMvo+f0r1MASzcooor1RF7TL42VxzzE3DD+tdUrK6hlOVPIIrh61NL1Q2pEMxJhPQ/wB2uXEUeb3o7lRlbQ6WikVldQykFT0Ipa4DQKKKKACiiigAp8cjRtlTTKKLXA04pllXI4I6ipCMjB6VlI5jYMpwRWjDKJUyOvcVzzhbVDKlxB5Z3L90/pVetZgGUhuneuL8Ram0DG0tidrDmQenoK3w8ZVXyoT0OF+JmstcXcNjA37hV3OR/E2a8/roPFrZ1CEekf8AU1z9YYpctVx7EXuFFFFc4BRRRQAVpaPoV7rU+y2jwgPzytwq1P4c0CXXb7ZylvHzK47D0HvXrFpaQWNslvbRiOJBgAV1YfDOp70tgMHS/BOl2Cq06fa5h1aQfL+C/wCOa6OOKOFAkSKijoqjAFOor04U4wVooAprxpKhSRFdT1DDINOoqwOd1TwXpWoKzRR/ZZj0aIcfivT8sV59rPh++0SXFwm6Jj8sqfdP+Br2Oorm2hvLd4LiNZInGGVq5quFhNXWjA8Morc8TeHpNDvPky9rIcxue3sfesOvKlFxfKwCiiipAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAfDBLcOUiQuwUsQPQDJpldp4Z037LZ/aZF/ezDjPZe359fyrA1/Tf7PvyUXEEuWT29RXXUwkoUVVfX+kK+plUUUVyDCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDsPDOqieAWUrfvIx8hPdfT8K6GvMYpXglWWNirqcgiu70jVo9Tt+SFnUfOn9RXuYDFKcfZy3RLRp0UUV6QgooooAKKKKACiiigAorTtNBvLpQ5AiQ9C/U/hVxvC0wXK3KE+hXFZOvTTs2OzMCirN5p9zYtiePAPRhyDWJq+rR6ZbnkNOw+RP6mqlVhGHO3oI6SfxnpWl2MNjLJJ5wX5wq5wK8w8RX0Opa3PdW5YxPjGRg9KzppXnlaWRizsckmmV83Wr+0uktL3LCiiisACilVSzBVBJPQDvVkaZfEAiznx/1zNNJvYCrRVv+y7//AJ8rj/v2aa+n3salntZlUdyhFHK+wFaiiikAUUUUAamiar/Zt18+TC/Dgdveu5hmjnjEkTh0PIINeZVPb3lzaHMEzx+wPB/Cu/C450VyyV0Jq56VWbq2rw6bAfmDTkfKgP6muQfXdTkXa12+PYAfyFUfnmk5JZ2PUnJNdFXM01amtRWJ44nvHllY/Mec+pqsQQSD1FbMUYijCDt39ao30O1xIBw3X61wVKNoc3XqNMqUUUVzjAEqcg4I7irkV8y8SDcPUdap0VUZyjsBtg5AI6Glpsf+rX6U6vTRAUUUUDCiiigAopD0qGB5ZcswCrngDvScrOwE9FFFMAoorV0Kw+13nmOMxRcn3PYVUYuTshG5oth9isgzjEsnzN7DsK0qKK9GMVFWQARkYNcXq9j9hvWCj90/zJ/hXaVS1WxF9ZMgH7xfmQ+/pWdWHPEDiepwK7TSLH7DZKrD96/zP9fT8Kw9A08z3ZnkX5IT0I6t/wDWrq9pY4XqelZ4eFveYEc3+qNQxQyTNiNCx9q1oNNdhm6x/uitBI0jXaihR6AVs6yjohpGRFo8jcyuF9hyatJpFsv3tzfU1forJ1ZvqOyON1DwvpltckraLsf5h8x49R1qk3h/S2H/AB6gfRj/AI1295bC6t2T+IcqfeubIIJBGCOoq6VOlKOsV9wmYM3hSycfupJYz9cism68K3kILQMsy+g4NdpRSqYGhPpb0C7PMZYZYHKSxsjDswxTK9KurO3vI9lxErj36j6GuT1Xw3LaBprXMsI5I/iX/GvLxGAnT96OqGmYNFFFcAwooooAKKKKACux8GaeAkt+45J2J9O5rjq9R0a3FrpFrFjBCAn6nrXdl9Pmqcz6CZeooor2yQqa2gNxOqDp3PoKhrc0638m33EfO/P4VnUnyxGlctIiogVRgDgCoLy6FtFkffPCirDMEUsxwBya566nNzOXPToB6CuenDmepTdiJmLsWY5J6mkoorsICvP/ABZp4tNT85BiOcbvoe9egVz/AIwtxLo4lx80Tg59j1/pXLjKfPSflqNHC2tu93dw20eN8rhFz6k4r0mLwDpC2gjkMzzY5lD4OfYdK81t53tbmK4iIEkTh1J9Qc16NF8QdMNoHlhuFnA5jVQRn2OeleXhvZa+0KOLudOfSddnsnbcYujeoIyD+RFdJ4YlxNPEe4BFczPqEmq63NeyqFaXnaOwAwB+QFa2kXH2fUomJwrHafxrowrSd1tclna0UUV6wgooooAu2OpTWTYHzxnqh/pXR2t/BeL+7f5u6nrXH0oJU5UkEdxWFWhGeuzGpWO4orlY9eurUKHxKvo3X860IPE1nJxKkkR+mRXJLDVFsrlqSNqiqSatYSD5bqP/AIEdv86l+3Wf/P3B/wB/B/jWThJbod0WKKqPqljH967i/Bs/yqnN4jsYx8heU/7K4H61SpTeyC6Neo5dQh04ebNIFHp3P4Vy914lupQVgRYV9eprHklkmcvI7Ox6ljmuiGClL4yXPsdvcayb+IeQSsLfmfrWVeWwuoCn8XVT71laXdeVL5Ln5HPHsa23YIjOegGav2XsXaIXueNeJZC2tzIf+WeEI9x1rIrpvF9kTdf2gg4lOJPr2NczXkYqMo1pcwIKKKK5wCnRxtLIkaLud2CqB3JptdD4KsheeI4mYZWBTIfr0H86qEeaSiB6LoWlR6PpUVqgG/G6Rv7zHrWlRRXuxioqyAKKKKYBRRRQAUUUUAUdY0yLVtMltJAMsMox/hbsa8Ynhe3nkhkXa8bFWB7EV7rXlvjqyFr4gMqjC3CCT8eh/lmuHG0/dUwOZooorzQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKnsvs/2uM3RIhBywAyT7VBRTTs7gdsPFGmgYBlA/3KpatrOl6lYPDmQSD5oyU6NXLUV2zzCrOLjJKzFYKKKK4RhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVJBPLbTLLC5R1PBFR0U02ndAdvpPiCG+URTkRT+/RvpW1Xl2SDkVs6f4jurMBJf30Q7N1H0Neth8x+zV+8lo7iisyz16wuwAJfLc/wvxWkrKwypBHqDXqQqRmrxdxC0UUVYBW94e01Z3N1KuUQ4UHuawa7bRAqaRARgZBJ+tc2Km409Oo4q7NGioJLyGP+LcfQVQmvpJchflX9a86NOUjS5Y1CWF4HgZQ5YY+leE+IbS4stauIbh2ds5Vj3XtXslec/ERFXU7Vx95ojn8DU4qnal6CONooorzRBRRRQBp+Hv8AkYtP/wCu6/zr2WvGvD3/ACMWn/8AXdf517LXpYH4GAVXv/8AkHXP/XJ/5GrFV7//AJB1z/1yf+RrtlsB4g33j9aSlb7x+tJXgAFFFFABRRRQAVesYesrD2WqkMRmlCDv1PoK2FUKoUDAA4row8LvmYmxaZIgkQo3Q0+iu1q4jFdDG5RuoptaF9DuQSqOR1+lZ9ebUhySsUgoooqANqP/AFa/SnU2P/Vr9KdXqLYgKKKKYwooooASjoMClooAKKKKAFRGkkVEGWY4AHeu5sLNbGzSEdRyx9T3rh45HikDxsVYdCO1WP7Tvf8An5k/OtaVSMNWI7miuG/tO9/5+ZPzo/tO9/5+ZPzrf6zHsB3NFcN/ad7/AM/Mn50f2ne/8/Mn50fWY9gOi1Oa9spY/sccZjlPTbzv/wDr1rafNdW8QeYxtMRzheB9KztIhuBbCW6lZ3fkK38IrSrSMb6vr0Asy6lclcjZkf7NV/7Xuv8AY/75pKqSrskI7dq0jCPYLsuf2vdf7H/fNH9r3X+x/wB81Qoq/Zx7Bdl/+17r/Y/75qnLK00rSMAGbk4plFNRS2QBRRRTAKKKKAOb13QFlVrq0XEg5eMd/cVyRGDg16jXJeJdIETG9gXCMf3ijsfWvIx+DVvaw+Y0zm6KKK8goKKKKAAdRXrkQxCgHTaK8jr1exlE9hBKDkPGD+leplr1kvQUixRRRXqklizh8+5VT90cn6V0FZ2kxbYWlPVjgfStAkAEnoK5KsrysWtjO1W42oIVPLct9KyaluJTPO8h7nj6VFXRCPLGxDdwoooqwCsrxIAfD93n+6P5itWsXxVMItBmBP8ArCFH55/pWVZ2py9GCPOqKKK+bLLNj/x8j6GtMcHIrMsf+PkfQ1p13Yb4CWdtpd2LyxjfPzAbW+tXa47Rb/7Fd7XP7qThvY+tdiCCMjkV61KfNEQUUUVqAUUUUAQ3H3R9ar1YuPuj61XrSOwBRRRTAKswafd3IzFA7D1xxWroOkLcD7XcLmMH5FPf3rqAAoAAAA7CuOtilB8sdSlG5w0ukX0K7mt3wOpHNUiCDgjBr0esjWNHju4WmhULOozx/F7VNPGXdpobj2OPHByK07jUBLpyoD+8bhqyJ5kt4XllO1UGSTXM6TrT3GvSCQ4jnG1R6Y6VtWqwjOMZbtkI6K9tVvbOW3fo64z6HtXnEkbRStG4wynBFen1xPii0+z6n5qjCTLu/HvXHmdK8VUXQcTEooorxSgrtvhygN3fv3VEA/En/CuJrs/h1MF1G8hPV4ww/A//AF63w38VAei0UUV7IBRRRQAUUUUAFFFFABXBfEdADp8nc71/LH+Nd7Xn/wARpgZ7GHuqs/5nH9K58X/CYHD0UUV44BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBseGdJh1nVfss7sqbC2V68V2P/AAr3Tv8An4n/AErnvAX/ACMf/bFq9Qr0cLRhOneSA5A/D3TgP+Pif9K86uYxDdSxKchHZRn2Ne6HofpXh19/yELn/rq38zWeMpwglyoCCiiiuIAooooAKKKKACiiigAooooAKnhvLmA5inkT6GoKKabWqA1I/EOpRj/X7v8AeGal/wCEo1LH34/++BWNRWqxNZfaf3hY1JPEOpSD/X7f90Yrt/A+uve2UljcTM08Z3LuPJU15pU1pdzWVylxbyFJUOQRVQxM1NSk2wPcqK4zS/H9rLGqajG0Ug6ugyp/DtWpJ4z0NE3C7Ln+6qHP616Ua9Nq9wN4kAEkgAc15L4t1RdT1yRojmKIeWp9cdTWhr/jabUImtrFGggbhnJ+Zh/SuSrixWIU/djsAUUUVxAFFFFAF7RZ47bWrOeZtsccqszegr1MeKdEIz/aMP45rx6it6OIlSVkgPYf+Eo0T/oIw/mar33ifRWsZ0XUImZo2UAZOSRXk1FavGzfRAKeWP1pKKK4wCiiigAooqe1h86bn7q8mnGLk7IC3ZQ+XFvI+Zv0FWqKK9OMVFWRIUUUUwEIBBB6GsieIwyle3UfStiq93D5sWQPmXkVjWp80dN0CMuiiiuAo2o/9Wv0p1V0uoQgBfnHpS/a4f7/AOlekpxtuST0VB9rh/v/AKUfa4f7/wClP2ke4E9FQfa4f7/6U5LiJ2Cq2SaOePcCWiiiqAKKKKACiiigAooooAK0dFsvtl6CwzHH8zf0FZ1dhoVr9n05WI+aT5j/AErWjDmkI0+lFFFd4BUFwOFP4VPUc4/dGmtwKtFFFaAFFFFABRRRQAUUUUAFMliSeJ4pBlHGCKfRQ1fQDzjULNrG9kgb+E8H1HaqtdX4stN0UV2o5U7G/pXKV8ziqXsqrj0LQUUUVzgFd/4RvRcaT5BPzwHb+HauArT0LUzpeorIT+6f5ZB7etdOEq+yqpvZiZ6ZRTUdZEV0IKsMgirFqnmXUa+rV77dlck3oI/KgRPQCodQl8q0bHVvlFWqytXf5o4/bca44LmmW9jMooortICiiigArjfGt6Gkgs1P3fnf69q6q9vIrC0kuJThUH5n0ry+9upL28luJD8ztn6VwY+sow5FuxogoopUUu4VepNeKUWLH/j5H0NadV2i8mFTGMsg/P1qr9vk/urXbGSorlkTuaVdHoerAhbS4bkfcY9/auK+3yf3VoGoSg5AGa0hi4wd0Fj1WiuP0fxYTtt73A7LJ/jXTLcllDLtIPQivUo1Y1o3gxWLVFVvtDego+0N6CtuVgPuPuj61Xp7yFwAaZVJWQBRRRTA9As4hDZQxr0VAP0qeqWlXK3WmwuDyFCt9RV2vDmmpNM1WwUEgDJ6UjMqLuY4ArJvtQXy3O7ZCgJZj6CiMHIGzyjxvqJfW7qxh+WCOQk47k8/1rmIZWhmSVDhkIYVY1W8/tDVbq7HSWQsvsM8fpVSuKrUlOfM2SemwSrPBHKv3XUMPxrH8U2/m6WJQPmicH8Dwf6VL4bn8/RowTzGxQ/z/rV7UIftGn3EWMlkOPrX0Ev3+H9URszzeiiivmiwrX8MX407xBbSscRsfLf6H/6+KyKKqMnFpoD3jqKK53whri6tpiwyv/pUACuD1Ydmroq9yE1OKkgCiiiqAKKKKACiiigAryPxdqA1DxDOyHMcX7pfw6/rmu+8Va4uj6WwRv8ASpgVjA6j1b8K8lJJJJ6mvPxtTaCAKKKK88AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooqSCCW5lEcMbO57Cmk27ICOiuht/CdzIoM8yR/7IGTU7+EPl+S6591rpWCrtX5RXRy9FaV9od7YAu6b4x/GnOPrWbXPOEoO0lYYUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG/4Pv7bTtb8+6lEcflsNx9a7/wD4SzRP+f5K8horopYmVOPKkB66fFmiYP8ApyV5Rdusl7O6nKtIxB9RmoaKVavKra4BRRRWABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW34Xt4LjUX85VYom5FbpnPWsSnRSyQyCSJ2R16MpwRWlGahUUmr2A7HxPa250wzFFWVWARgME+35ZNcZU9ze3N4VNxO8m3puPAqCtMVWjWqc0VYEFFFFc4AATnA6daK7HQ9GjXSZPtKfPdLyO6r2/x/KuVvLWSyu5LeT7yHGfUdjXRVw06UIzfULkFFFFc4BRRRQAVagu1gj2iPJ7nPWqtFVGTi7oC9/aA/wCeZ/76o/tAf88z/wB9VRoq/b1O4rIvf2gP+eZ/76o/tAf88z/31VGij29TuFkXv7QH/PM/99Uf2gP+eZ/76qjRR7ep3CyHSMryFlXaD2ptFFZPXUYUUUUAFFFFABU1pxdJ9T/KoafE2yZG9CKqLtJMDZpwikYZEbEHuBTa9J8PEf2Daf7p/ma9WMeZknmxUqcMCD6EUVseKf8AkPz/AEX+QrHpNWdgCiiikAUUUUAPhj82eOP+8wFd8ihI1UcADFcVpKb9Ut1/2s/pXb114ZaNiCiiiukAqOb/AFRqSorg/IB6mmtwK1FFFaAFFFFABRRRQAUUUUAFFFFAFLVoBcaVcR452Fh+HNed16e670ZT0IxXmUg2yuPRjXjZpH3oyHEbRRRXlFBRRRQB03hzxF9j22d237gn5HP8H/1q9E0krLdK6kMu0kEV4rXcfDi7vJNWa0Vy0OzJVv4RntXo4bFSt7KQrHqkNtLcHEa5Hr2qpfaHLLcljMowAMYzXSwTQLGEX5AO1VJnVp3wQeacK81LTQuyOTudHurdS2BIo7rWfXc1zXiCG3sh9rLpHGTh8nABrso4jmdpEOPYy6iubmG0gaadwiL1JrCv/F1lbArbAzydiOF/OuP1HVbvU5d9xIdo+6g6Cpr42nTVo6sSRa13XJNWuNq5W3Q/Ivr7msiiivGnOU5c0tygq/Yw4BlYdeFqpBEZpQg6dz6CtcAKAAMAdK2w8LvmYmLWVdw+VLkD5W5FatRTxCaIr36j61vVhzxEmZFFBBBIPBFFeeUFaWna3daeQqtvi7o39KzaKuE5QfNF2YHd2XiCyvAAz+VIf4X/AMa1QwYZUgj1Bry+rNvqF3an9zcOvtnivSpZm1pUVxcp6RRXEReKNQj4fy3HuKsr4vuB1toz+JrrWY0Hu7CszrqK5BvF1yR8ttGPxNVZvEuoyjCusY/2RzSlmNBbXYWZ6Lp+rnSZC7MPJb76scfiK2ovGmi3IxBeRmT+6xxivDZrq4uDmaZ3Puairz62MjUldRKV0e233iTT41L3F/CAOihv5CvP/E/jBtUjazsQyWp++54L+3sK5KisamKlKPKtEAUUUVzAdX4QkzDcxejBh/n8K6auQ8Iti8uF9UB/Wuvr6LAO+HiS9zzO5j8q6lj/ALrkfrUVXNWXbq10P+mhqnXz81aTRQUUUVIFrT9QuNMvUurZ9sifkR6H2r1fQvENprluDGwS4UfPCTyPp6ivHqfDNLbyrLDI0cinKspwRW9CvKk/ID3WivOtL+IFzAqx6jB56j/lpHw34jof0rp7XxjolyB/pflN/dlUrj8elelDEU59QN6is7+39Hxn+07T/v8AL/jVO58YaJbKf9MErf3YlLZ/HpWjqQW7A3aytb1600S2LzMGlI+SIHlv8B71yWqfEGaVWj0238kH/lrLy34DoP1rjbi4mupmmnlaSRjksxyTXJVxkUrQ1YFjU9TuNWvnurlsu3QDoo9BVOiivObbd2AUUUUgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorT0/w9qmpx+ba2jNH/fYhQfpnrTUXJ2SAzKKuahpN9pbhLy2eLPQnkH6EcVToaadmAUUUUgCiiigAooooAKKKKACiiigAooooAkt4JLm4SCIZdzgV3+m6ZDptuEjALn77nqTXP8AhG2D3M9yw/1ahV+p/wD1V11e3l1BKHtXuyWwooor0xCEAjBGQexrj/EWjLaN9rt1xCxw6j+E/wCFdjUN3brdWksD9HUj6Vz4mgq0Gnv0BM80ooIKsQeoOKK+ZLCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKtXunz2HleeuPNQMPb2+tX/AA5pv22+86Rcwwncc927Cuo1nThqOnvGB+9X5oz7+n413UME6lFz69BN6nn1FKQVJBGCDgg9qSuEYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFamg6d/aF+N4zDF8z+/oPxrMVSzBVBJJwAO9eg6Pp406wSIgeY3zSH3/8ArdK7MDh/bVLvZCbL9c/4o03z7YXka/vIR8+O6/8A1q6CkZQylWAIPBB7171akqsHBknl9FX9Y086dqDxAfum+aM+3/1qoV8vODhJxluiwoooqQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA17eTzIFbvjB+tTiRwMB2A9AazLGba5jJ4bp9a0a9GlPmjclgSWOSST6miiitACiiigAooooAv6Jxq0H1P8AKu0rhtNk8rUrdv8AbA/Piu5rsw3wsQUUUV0AFVp2y+PSp3YIpNUycnJqorqAUUUVYBRRRQAUUUUAFFFFABRRRQAV5lcHNxJ/vGvSZ38uCRz/AAqT+leZudzsfUk15Gav4V6jiJTkjeVwkalmPQAZJptdF4SERu5i2PMC/Ln0715tCl7WooXtcpmLcWN1aqGngdFPcjioUjeQ4VSa9IvYIpdPn88Dy9p61x6qqLhRgV11sCqcrJ6CuZwsZT1wK774XWpi1W+d8ZEK4/OuUrqPAl4LXW2DHCyR7T+dEaEU7rcE9T1SsW4Yi5kwSPmNbQOeRWLdjF1J9a2obstkfmP/AH2/OsLxeok8M3m/naoYZ9c1t1x3j3VEh09dPRsyzEFgOyitKzUabbJPOKKKK8UAooqe0h82XJHyryacYuTsgLlnD5cW4j5m5qzRRXpxioqyJCiiimBn30O1hKo4PX61TradBIhRuhFY8iGOQo3UVw14cr5l1GhtFFW7O3EgZ3GV6CsoRcnZDKlFPljMUhQ9uh9aZSas7MAp8cTythBn3pYIjNIFHTua1URY1CqMCtaVLn1ewmyomnjHzufwp5sIv7zfnVuiutUYLoK5nSWDqMo27271UIIJBGDW5Ve5txMuQMOOnvWNTDq14jTMuigjBwetFcgwooooA6Dwl/yEJv8Arn/WuxrkvCCf6Tcv6IB+tdbX0OXr9wvmS9zzzWf+Qzd/9dDVGreqNv1S6b1kb+dVK8Gq71JerKCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALWm263ep2tu5+SSVVb6E817XFEkMSxRqFRRhQBwBXhkUjwzJLGcOjBlPoRXp2leNtMurZftkv2acD5gwJBPqCK7sHUhG6luBra9ZRX2iXcUqggRs6k9iBkGvGehrv8AxN4ytZbGSy01zI0o2vLggBe4GetcBUYucZSXKAUUUVyAFFFFABRRRQAUUUUAFFFFABRRRQB1nhBgYLpO4ZT+h/wrpa4Tw9fiy1ICQ4jlGxj6Hsa7uvoMvqKVFLsS9woooruEFB6UVma7frY6bIQf3sg2IPr3qak1CLk+gHCTMHnkYdCxI/OmUUV8m9SwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKdHG8sixxqWdjgAdzTa6bwrpu52v5F4X5Ys+vc/0rahRdaooIGdBptimn2MduuCQMufVu5q3RRX08YqKUVsiDjfE+m/Z7oXka/u5j82Ozf/AF/8awK9JvbWO9tJLeT7rjGfQ9jXnVxBJa3EkEow6HBrwsww/s5862f5lJkdFFFeeMKKKKACiiigAooooAKKKKACiiigAooooAns7prO6S4WNHZOQHyRn1rY/wCEtvv+eNv/AN8t/jWBRWtOvUpq0HYLG/8A8Jbff88bf/vlv8aP+Etvv+eNv/3y3+NYFFafXK/8zCyNLUdan1SJEnhhBQ5VkByP1rNopQpY4UEn2rGc5VJc0ndgJRTzDIoyUYD6Uypaa3AKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAA4Oa1LW4EyYP3x196y6VHZGDKcEVpTqODBo26Kr290swAbh/T1qxXoRkpK6JCiiimAU6OKSZtsaMx9AKnsbN766WFeB1J9BXZ2tnDZxBIkAx1Pc1rTpOevQRyC6ZfxkSC2fg5FdnCxeCNyCCVBwRT60rNI7u2aFx86/dPeumMVSVw3M2inyxtDKyN1FMrYBkkfmY5ximC3UdSTU1FO7Aj8lPSl8pP7tPoouwI/JT0pDbqehIqWii7Arm3bsc1GyMvUGrlFNSYFGirTQq3sfaoHiZPcetUmmAyiiimBma/cfZ9ImOcM42D8a4Gui8V3okuY7VTxGMt9TXO18/mFXnrWXTQpBUlu8kc6NE7I+eGBwRUdT2Yzcr7VxwV5IZuS3tzPEsc0zOo7E1BRRXqNt7khWloMmzVoh/eBX9P/AK1ZtTWcvkXkMv8AdcGnF2kmI9TsNae3URzgug6EdRUGqa/pkFzmS42FkDYKn/PaqA5Ga5/xPBmOCcDoSprqqU1G847j5mT6p4/tIo2TT42ll7O4wo/xrz+7u5765e4uJC8jnJJqOQYkYe9Nrw6tadR+8UFFFFZAABJwOprXgiEMQXv1P1rIBIOQcEdxT/Ol/wCej/8AfRrWlUUHdoTNmisbzpf+ej/99Gjzpf8Ano//AH0a3+srsFjZorG86X/no/8A30aPOl/56P8A99Gj6yuwWNmqd9DuTzAOV6/SqXnS/wDPR/8Avo0GWQjBkfH+8aideMo2aCwkcZlkVB1NbCIEQKvQVWsYdieYR8zdPpVutaFPljd9RMq3sPmR7wPmX+VZtblZN1D5Mpx908is8RD7SGi5Ypth3d2NWqhtv+PZMelTV0U1aKQgoooqwCiiigDLvE2Tkjo3NV6u6h95PoapV51VWmykFFFFZgdd4Ri22dxL/ek2j8B/9euiYhVJPQDNZ2g2/wBn0eBSMFhvP41Lq8/2fSrmTODsIH1PFfS0F7LDq/RX/Uh7nnsrmSZ5D/Exb86bRRXzW5YUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFdNo3iQRItvek7RwsnoPeuZorWjWnRlzQBo9NininQNFIrg91OakrzFJZIzlHZT7HFPa8uXGGnkI92r01mqtrHX1J5Tur/WrOxQ7pBJJ2RDk/wD1q4rUNQm1G5M0p9lUdFFVM5OT1orixGMnX0eiGlYKKKK5BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUoYgcE/nSUUALub+8fzo3N/eP50lFFwF3N/eP50mc9aKKACiiigAoord0XSFlQXVyuVP3EPf3NaUqUqkuWIGPFa3E4zFDI49QvFLLaXEIzLBIo9SvFdyAFGAAAOwpSARgjI967vqEbbk8x5/RXQazpCLG11bLtxy6Dpj1Fc/XDVpSpy5ZFJhRRRWYBRRRQAUUUUAFFFFACqrOwVVLMegAq5/ZGobN/wBklx/u11uhaTHY2iSugNxINzE/w+wrXr1qOWc0bzdmK55rFbO8xRlK4+9kdK0kjSNcIMCuu1DTI7uzeVUAnUEhgOuO1cpU/VlQdtxXuFVri1WVSyjD+3erNFEoqSswMMjBwetFT3ahblgO/NQV5klZtFBRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKADvVqG9dOH+YfrVWiqjJxd0BrJcxSdGwfQ1LkHpWJTg7L0YiuiOJfVCsd54YjG2eT+LIWuhrhfCd+63j2zOf3gyufUV3CqVHJya9fCzU6SaJY6praY286uOnf6VDRW7V1YC/qe1pY5F5DrmqFZX9up/ahtXb9yPlVvQ1rAEjIGRU02rWXQGJRRjHWirAKKKKACiiigAooooAKKKKAIpIQeV4NZuo3iafaSTSdRwo9T2rVd1jQu7BVUZJNcTrt3/a0u0ZEafc/wAazrVnCDtv0A5uaV55nlkOWckk0ynSRtE5Vhg02vm3e+pYVLbNsuEJ6ZxUVFCdncDcoqG3kMsIY9elTV6ad1dEhRRRTA7jTLj7Tp0Mmcnbtb6jim6tb/adMmQDLBdw+o5rK8M3X+ttWPX51/r/AErcnkwNo6nrXoU/3kBHk7HLE+9JWhrdl9h1ORAMRv8AOn0NZ9fOTg4ScXuiwoooqQCiiigAooooAKKKKACpbeHzpQP4RyairVtYfJi5+8eTWtGHPLyBk2MDFLRRXoEhUNzD50RH8Q5FTUUmk1ZgV7QOsO11IIPerFFFEVyqwBRRRTAKKKr3NwIUwD856D0pSkoq7Ap3r758DovFV6CcnJ60V5spczbKCp7K3N3eQwL1dgPw71BXS+E7LdNJeMOE+RPr3rTD0va1VAGdWqhECqMADAFc94tudlnFbA8yNuP0FdFXA6/efbNVkKnKR/Iv4df1r2sfU5KLXfQlblD7PPjPkyY/3TUdevDUtL/svb9pt93k4xkZztryGvFrUlTtZ3uUFFFFYgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAORd8ir/eIFd5GixxqijCqAAK4JWKsGHUHIru4JlngSVDlXUGvRwFveJZJRTlRnJCqTgE8elNr0RCMAylSMgjBFcJPH5VxJH/dYj9a7qSRYomkc4VRkmuDlcyzPIerMTXn4+1ojiNooorzSgooooAKKKKACgHBBoooA9OjdZIkdDlWAIPtT65DRPEK2kQtbvJjH3HHOPY10H9s6ds3fa4sfXmvpaOKp1IJ3syLGrFIqRMWOAoyfpXCE5Yn3qxrHiQTIYLLIQ/ec9x6VmxXsbj5ztb36Vx4jE05z5YvYdi1SVGbiEDPmL+BqpcXm8FI+AeprnnVjFXuFiC4fzJ2YdKioorz27u5QUUUUgCiiigAooooAKKKKACiiigAooooA6/wPpVjqTXf2y3WbYF27ieK7H/hFdD/6B0X5n/Gua+HP3776LXe16uGhF0k2gMf/AIRXQ/8AoHRfmf8AGvP/ABjY22n615NpCsUflg7R616xXmHj3/kYf+2S1OLhFU7pActRRRXmAFKqlmCgZJpK0bODYvmMPmPT2q6cHOVgZNaxfZQGU4k67hXU2PiJNgS7BDD+Md65uivUpydPSJJ2h1nTwuftC/TBzWVqPiHzEaK0BAPBc9fwrAorSVeTVhATk5PWvV/DF0v9iWizqrfJwxHPXvXlFTJe3UaBEnkVR0AY8VkrdRp2PStW2/2jJtxjjp9KpVxlprN3ayZLmVT1Vzmuis9atLsAb/Lk/uvxXZSqRaSEzRooByOKK3AKKKKACiikZlUEsQAO5NAC0yaaO3jMkrhVHUmsy91+2twVh/fSe3QfjXN3l/cX0m6Z8jso6CsZ1ox23At6rq73zeXHlYAendvrWXRRXHKTk7sCGeATJj+IdDWU6lGKsMEVt1UvIPMTeo+YdfeuWvS5lzLcaZnUUUVxFGraY+zLip6pWMw2mMnnqKu16NJpwViWFFFISFBJOAK0ENTUm068ikQZZTk/TvXbRyrNGsqHcrjcD615pPJ5szN27V1PhbUfMhaxkb5k+aPPcdxTwWJ/euD2ew2tC14j077ZYebGuZYfmHuO4riK9Rrhdf0s6feGSNf3Epyvse4p5lh/+XsfmCZkUUUV5BQUUUUAFFFFABRRSohdwqjJNAFiyh8yTeR8q/qa06jijEUYQduvvUlejShyRsSwooorQAooooAKKKKACiiigArPubRgTIhLDuD1rQoqJ01NWYGHRV67tesiD6iqNcE4ODsyh8ML3EyRRjLucAV6LY2iWNlHbp/COT6nuawvC+l7F+3zL8zDEQPp6101e1l2H5Ie0lu/yJbKGsXwsNOklBw5+VPqa89znk9a2fEWo/bb7yo2zDD8ox3Pc1jV5+Or+1q2WyGkFFFFcQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiit7R/Dy6hZ/aZpmRWJCBB6dzWlKlOrLlgtQMGirOoWbWF9LbMwbYRhh3BGRVaolFxbi90AUVp2Wg316Awj8uM/wAT8VtQeEYVAM1wzH0UYFdFPB1qiukK5yVFdsPC2nYwRL/33UUvhO0Yfu5ZEPvzWzy6uuwXRx1Fbd54YvLcFoSsy/7PX8qxXRo2KupVh1BrkqUp03aasMSiiiswCiiigAooooAK1dJ1c2X7mUFoSeMdVrKrR0XTjqOoLGw/dJ80h9vT8a1oOftFybgz0vQoomtftIZWMo49l/8Ar1lausOm3DeZIqRt8yEnt6VZACgADAHYVna3p39o6eyqMzR/NGff0/GvoKlOUYNx1ZBy+rax9rHkQZEPcnq3/wBasiggg4PBor52pUlUlzSLCiiioAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorV0HRH128kt0mWIom/LDPfFOMXJ2QGVRXSa54Qm0XT/tb3SSDeE2gHv8A/qrm6c4Sg7SAKKKKkAooooAKKKKAO6+HJAa+yey13u4eorwpJHj+47Ln0OKd9om/57Sf99Guyli/ZwUbAe57h6ivMPHvPiH/ALZLXN/aJv8AntJ/30aYzs5yzFj6k5pVsV7WPLYBKKKK5AJrWHzZRn7o5NatQWkXlwjPVuTVivQow5YksKKKK1AKKKKACiiigAooooAs2+o3dtjyp3A9CcitCPxLdrxJHG/6VjUVanJbMR0A8UHvaj8H/wDrUN4ob+G1H4v/APWrn6Kr20+4GvL4jvX4QRxj2GTWdPd3FyczTO/sTx+VQ0VDnKW7AKKKKkYUUUUAFFFFAGVdw+VLkfdbkVBWrdRebCR3HIrKrz60OWQ0AJU5BwRVyO/IGJFz7iqdFRGcobDNE38YHCsTVWe6ebjovoKgoqpVZyVmFgqS3nktbhJojh0ORUdFQm07oD0fT72PULRJ4+/DL6HuKde2cV9avBKPlYcHuD61xGjaq2mXWWyYH4df6iu9jkSWNZI2DIwyCO4r6LC144inaW/Uhqx5xe2UthdPBMMEdD2I9ar16FqulxanbbG+WVeUf0P+FcHdWstncNDMm11/WvHxeFdCV18LKTuQ0UUVyDCiiigArSs4PLTew+Zv0FU7WLzZgD0HJrVrqw8L+8xMWitvwvZW9/qMkVzEJEERYAnvkV1v/COaT/z5p/30f8a7owbVxWPN6K9I/wCEc0n/AJ80/wC+j/jVTU9B0yDS7qWO1VXSJmU5PBxT9mwscFRRRWYBRRRQAUUUUAFFFFACU/TtCN7e+YwxaqcsfU+lW9N02TUJsD5Yl++/pXYR20cNsIIlwqjitaeHVRpzWiFcrKoRQqgBQMADsKxvEOqixtDDG37+UYGP4R3NaGoX0WnWrTSnkcKvdj6V59d3Ut5cvPKcsx/L2rTHYpUo8kd3+A0iGiiivBKCiiigAooooAKKKKACiiigAooooAKKKKAADPSitXSLXObhxx0UH9TVO/tvs1yQB8jcrWroyUFMCtRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVp6drt3psLQxiN4ycgODwfbmsyirhUlTfNB2YFh2uNSvSxBknlPYV12k+HobJVluAJZ/fotLoGkCxthNKv+kSDJz/CPStqvZwmDUf3lXWTJbCiiivSEFFFFABVDUdJttRjIkXbJ2kA5FX6KmcIzXLJXQHnOo6dPptx5co4P3WHRhVSvR9QsYtQtWglH+63dT6157dW0lpcyQSjDocGvAxmF9hK6+FlJ3IqKKK4hhRRRQAVoWGsXOmxMlusXzHLFlyTWfRVQnKDvF2YG3/wlWo/9Mf8Avj/69H/CVaj/ANMf++P/AK9YlFbfWq/8zCyJLidrm4eZlVWc5IUYGajoorBu7uwCiiikAUUUUASQW81y+yGJpG64UZNWP7J1D/nyn/74Nb/gD/kPP/1yNem12UMKqkOZsDxaHRNRmmSMWcwLHGSh4rqT4QtYIAk6TCQj75OOfYV6CjFHDDqDWH4z1+2tPsxkVy5U4UDrXXSoUqT/AHmq7voDPKr+0axvJLdjnYeD6iq9WL27a9vJLhxguenoKr15U+XmfLsAUUUVIBRRRQAUUUUAFFFFABW54W1qDQ9QluJ0d1ePYAnXqKw+hoqoycZcyA7HxL4ts9Z0n7LBDKr+YGy2MYGf8a46iinUqSqO8gCiiioAKKKKACiiigAooooAKKKKACpIE8yZV7Z5qOrmnpl2f0GKunHmkkDL9LRRXpEhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVkXEflzsvbqK16oagnKP+FYYiN4X7AilRRRXCUFFFT2dq95dxwJ1c4z6U0m3ZAFrZXF7JsgiZz3I6CtdPCl6Vy0kan0611dnZw2NusMKgADk9zVivapZbTUf3mrJucBe6FfWSl3j3oP4k5xVnQtbNg4t5yTbMeD/cP+FdqQCCCMiuN8SaUtpKLmFcRSHkDsayrYWWG/fUXsF7nZKyugZSCpGQR3qlqWlwanBskGHH3HHUVyuja7Jp7CGbL2x7d1+ldpDPHcRLLC4dG6EGu6jXp4qFn80LY89v8ATrjTpvLmXg/dcdGqpXplxbw3ULRTIHQ9Qa5PU/DM1uTLZ5li/ufxD/GvMxOXyp+9T1X4lJnP0UEFSQQQR1Bo6mvOGaVjHth3d2NWqZEu2JV9BT69OEeWKRJ0fgz/AJC03/XE/wAxXc1w3gz/AJC03/XE/wAxXc100/hGgqjrP/IFvf8Ari/8jV6qOs/8gW9/64v/ACNW9hnmNFFFcpIUUUUAFFFPihknkCRIzsewFADK0tM0eW+YO+UgB5bufpWnp3h5Y8S3mGbqIweB9fWt0AKAAMAdAK6adC+shDIII7aFYolCovQCm3V1FaQNLK2FH5n6Uy9vobCHfK3J+6o6muPv7+a/m3yHCj7qjoK1qVVBWW4Gbrt7LfX3mPwn8C9gKy60NQXMat6Gs+vCr39o2y0FFFFYgFFFFACorO4VQSxOAB3rUfw5qSQeaYgcDJUMM/lUGjTRQarBJNgIG6ntXoDSIkZkZ1CAZ3Z4xXoYPCU60XKTE3Y8xIIOD1oqe+kSW+nkj+4zkioK4GrNoYUUUUgCiip7K1a8vIrdOrnGfQd6aTbsgJ9O0q41KTEQwg+856CuosvCVnuVZS8rHqc4ArVtbaK0t0hiXCKPzrVtItke8/eb+Ve7SwNOlG81dk3uU/7AsRGEjRkAGBg1g674clFqzRfvAvzKcciuyoIyMHpWk6UZR5WB4uRg4NFdH4u0gWF+LmFcQT5OP7rd65yvAqU3Tk4soKKKKgAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiipEgmk+5E7D1C00m9gI6KsjT7o/8ALFqa1lcr1gf8Bmq9nPsBBRSsrKcMCD6EUlQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU5YpG+6jH6ChK+wDaKl+yzH/lmaQ28w6xt+VVyS7AR0UEEHBBB96KkAooooAKKKKACiiigAooooAK1vDtiLzU1ZxmOEb29z2FZNdj4TgCadJNj5pJP0H+TXVgqaqVkntuJnQUUUV9ISFFFFABRRRQAUUUUAFcz4ssQ0Ud6g5U7H+nY101VNSgFzptxERndGcfUcisMTTVSk4gjzmiiivmCwors9C0myOlxTSQRzSSjJZ13Y56D0rn9fsobHVGjg4RlDbf7ue1dVTCTp0lUb3FczKKKK5RhRRRQAUUUUAFFFFABRRRQB1fgD/kPP/1yNem15N4R1O10rVmnu3KxmMrkDPNdx/wmuif8/D/98V6eEqQjTs2B0NcB8Rv9fZf7p/nW9/wmuif8/D/98VyPjPWbLV5bZrOQuIwQ2RiniakJU2kwOWooorywCiiigAoopQpY4AJPoKAEoqwtjdsMrazke0Z/wqOS3niGZIZEH+0pFOzAjqzYXK2d9DcNH5io2SvrVaiiLcWmugF7Vr9NRv2uEi8tSoGD1OO5qjRQBk4HWnOTnJye7AKKnWzmYZ2gfU1E8bxth1waHGSV2gG0UUVIBRRRQAUUUUAFFFFABRRRQAVpWK4gz6ms2tW0GLZK3w698TJ6KKK7hBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVWvlzbk+hBqzUNyM27j2qKivFgZNFFFeaUFbvhRFbU2Y9VQ4rCrQ0S8FlqccjHCN8rfQ1vhpKNaLfcGeg0UgIYAg5B6UtfTkBWV4iVW0abPbBH1rVrnPFV8qWy2in53O5h6CufFSUaMm+wLc5Grunapc6bLuibKE/Mh6GqVFfNxnKD5ouzLPQNO1m11JAEbZL3jY8/h61o15erMjBlJDA8EHpW/p/iieDEd2pmT+8PvD/ABr18PmSfu1dPMlo6K+0ez1AEyx4k7OvBrnLrwtdwSBrdlmTPTo35V09nqVpfLmCZWPdScMPwq4v3h9a6qmGo11zfihXaOLkikhbbIjIw7MMU2vQJIY5l2yxq49GGaz5tAsZclUaM/7Df0rKWHfRgc/o+qtpF086RCQsmzBOO4P9K2v+E2m/58k/7+H/AAqtJ4X/AOeVz+DLVZvDd4PuvE30JqOSpHoO5pf8JtN/z5J/38P+FQXfi6W7s5rc2iKJUKEh+mR9KoHw/fj+BD/wIUo8PX56rGP+BUrVOwXMqitpPDN0335YlH4mrUXhiMf624ZvZVxQqM30Ec3U0FpcXLYhhd/cDj8666DRbCDBEAZvVzmryqFGFAAHYCtI4Z9WBztp4aY4a7kwP7idfzrdt7SC0TZBGqD26n8amrPvNYtLPIL+Y/8AcTn/APVW6jCmrgaHSsfUdehtsx2+JZfUfdWsW+1q5vcoD5cR/hXv9TWdWM8R0iBJPcS3Mplmcux7mo6KK5hle8GbZvqKy61bv/j2asquHEfENBRRRXOMKKKKACnmWQpsMjFP7ueKZRQAUUUUAFFFFABW94UjDao7nqsZx+YrBrX8NXIg1dFY8SqU/Ht/KujCtKtFvuDO/t4vNlGfujk1pVFBF5UQH8R5NS19BJ3ZIUUUVAGN4ntkudIKN/eGD6V5lIjRSMjDDKcGvTPEU4W3jgB+Zm3H6CuI1e1yBcKORw39DXnY6lze8ug0ZFFFFeWMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKVEaRwiAlj0AoAQDJwK0bbSZJQGmPlr6dzV6y09LYB3w0vr6fSrtd9HCLeYmyvDZW8H3Ixn1PJqxRRXYoqKskIKKKKYDXjSRcOqsPQjNUZ9JhkyYiY29OorQoqZ04z+JAcxPbS2zbZFx6EdDUVdVJGkqFHUMp6g1hX1g1qd6ZaI9/T6159bDOGsdhplKiiiuUYUUUUAFFFFABRRSqpdgqjJPagBKtQ2LvzIdo9O9Wbe1WEbm5f19Ks1108P1kK5FHbxR/dQZ9TzUtFFdKSWwgooopgNZVcYZQR7iq0tjG3KHaf0q3RUyhGW6AxpYXhbDj6HsaZW0yK6lWGQazbm2MJ3Lyh/SuOrRcdVsNMr0UUVgMKKKKACiiigArvPDgA0K3x33f+hGuDruPDEgfRkX/nm7Kfzz/WvRyx/vn6f5CZs0UUV7pIUUUUAFFFFABRRRQAUhGQQelLUdxIIbaWU9EQt+QobsrsDzM8MaSg9aK+RLL1lrF7YRGOCbCE52kA4PtVSaaW4maWZy8jHJY96ZRVOcmlFvRAFFFFSAUUUUAFFFFABRRRQAUUUUAFFKi7nVfUgV6Cvw7tWRW+3y8jP3B/jWlOlOp8IHntFSTxiG4kjByEYjNR1mAUUUUAFS29tNdzrDBG0kjdFUUtpaTX11HbQIWkkOAK9Z8P+HrfRLUAAPcsP3kpHP0HtW9Cg6r8gOe0jwAoVZdTkJPXykPT6muttNI0+yQLb2kSD12jNXaK9SFGEFogECgDAAH0FNeGKQYeNGHuAafRWoGFqPhHSdQUnyBDIf44uK4PXPCd7o+ZVHn23/PRRyPqK9ZpGVXUqwDKRgg9656uGhPyYHhFW7CMM7Oe3Sul8XeFhYFr+xT/AEcn94g/gPqPauXtJhDId33T+lecoOnUSmDNSoLqMPA2eo5FTBgRkHIqreTqsZjU5Y9cdq66jXK7kmdRRRXmlBRRRQAUUUUAFFFFABRRRQAVr23/AB7p9KyK1rU5tk+ldGG+JiZNRRRXaIKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq1Z6fc3zYhj+Xu54Aq9pGjG7xPcAiHsO7f/AFq6mONIkCIoVRwAO1dFOi5avYRi23hqBADcSNI3ovA/xrQj0qwjGBaxn/eGf51corpVOK2QFY6dZEYNpD/3wKpXegWE8LgRmMkdUb/IrWpknEbfSm4RejQHA33he5twXtmE6D+HGGH+NYTKysVYEMOCD1FeoVl6tokGpRlgBHcAfK4HX2PrXDiMtVual9w0zgqKluLeW1naGZSrqeRUVeO007Mo3NK8Ry2SCGdTLEOhzyK308Saa65MrL7Fa4Siuulj61Ncu68xWOuvfFcKoVtELuf4mGAK5WeeS4maWVizsckmo6KyrYmpWfvsaVgooorAAooooAVWZGDKxUjoQa17PxJf2pUO4mQdn6/nWPRV06s6bvB2A9EtvEtrKo86N4if+BCtKHULSf8A1dxGfbOD+Vef2r77dT3HBqavYhiZNJsg9DBBGQciiuASeaP7krr9GIqddVv06XUv4tmtViV1QHcUVxY1rUR/y8n/AL5H+FIdZ1A/8vLfgB/hT+sR7AdrSM6oMswA9zXDPqV6/wB66l/BiKgeR3PzuzfU5pPErogO0m1axg+9cIT6Kcn9KzbjxNGMi3gLH+85wPyrm6KzlXk9gLt1q15dZDylV/upwKpUUVi23uAUUUUhhRRRQBVvmxBj1NZtXL98uqenNU64K7vMaCiiisRhRRRQAUUUUAFFFFABRRRQAVo6Rbl5/tB4EZ+X/eqhHG0sixoMsxwK6aCFYIVjXoo6+tdWFpc8uZ7ITOu0zVI7uMRyMFmHUH+L6VpVwYJBBBwfar8OsXkK7RJuH+0M166n3EdbUF1dw2cReVvovc1zj65euMBlX6LVCSWSZ90jlmPc03U7ASXd095cNK/foPQVXZQ6FWGVIwRS0Vk9QOZuoDbXDRnoOh9RUNb2p2vn2+9R88fP1HesGvIr0vZzt0KQUUUViAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABW7ptn5EQlcfvGH5Cs7Tbfz7oFhlE+Y/0roK7sJSv77E2FFFFdwgooooAKKKKACiiigApGVXUqwyp4INLRQBzd7am1nK9UPKn2qvXRahb/aLVgB86/Mtc7XlYil7OemzKQUUUVgAUUUUAFaVpb+Wm9h87fpVS0i82YZ+6vJrVrqw9O/vMTCiiiusQUUUUAFFFFABRRRQAUjAMpUjIPWlooAyLiEwyY/hPQ1FWrdRebCcfeHIrKrz6sOSWmw0FFFFZDCiiigAro/CV2EuJrVj/rBuX6jr/n2rnKltp3tbmOeM4dGyK2oVfZVFMGemVftNMknAeQ7EP5moPD/lapAl4OYvT/a9K6SvoJ1tPcJSKkem2qD/AFe7605tPtWGPKA+lWaKw55dyrGPc6QVBaA5/wBk1lkFSQRgjsa6yszVbMNGZ0HzL97HcVvTqu9pCaMaiiiugkKxvEt2LfSmjB+eY7B9O/8An3rYJCqSTgDkk1wWuaj/AGjflkP7mP5U9/euPHVlTpNdXoNIzKKKK+dKCiiigAooooAKKKKACiiigAooooAKKKKAFRtrq3oc13S/EUKgX+zugx/rP/rVwlFaU6s6fwsB88nnTySYxuYtj0plFFZgFFFS2sBuruG3XrI4QficUAeg+BNGFvZnUpV/ezcR57L/APXrsqitoUtraKFAAsahQPpUte5SgoQUUAUUUVoAUUUUAFFFSLBK/wB2Nj+FJuwEEsSTwvFIoZHBVge4rx3X9LbSNXmtudmd0Z9VPSvbRZXB/gx9TXHePfDt1dW1tdwxBpI2KNgjkHkf1rlxUFUj7u4HmAYjoTRV2XSNQh+/aSfgM/yqmysjbWUqR2IxXmShKPxKwCUUVIlvK4yqHHrSSb2AjoqVraVBkoce1RUNNbgFFFFIAooooAKKKKACtKxbNvj0JrNq7p78un41tQdpiZfooorvEFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABV/SLA392Aw/dJy5/pVCuy0W1Frp0ZI+eT52/Hp+la0oc0tRGgqhFCqAAOAB2paKK7wCiiigAqOc4iPvUlQXB6LTW4EFFFFaAY3iDShfWhmjX/AEiIZGP4h6Vw9eo1wOvWYstVkVRhJPnX8ev65rx8yoJWqr5jTMyiiivJKCiiigAooooAKKKKACiiigC5YSYYxnvyK0KxFYowYdQa14pBLGGHeuzDzuuUTJKKKK6RBRRRQAUUUUAFFFFABRRRQAUUUUAFISACT2pap3s21PLHU9fpUzkoxuwKUsnmSs3r0plFFea3d3KCgAk4AyT0Aore8M6b9puzdSL+6hPy57t/9b/CrpUnVmoLqBgkEHBord8Tab9lvPtMa/upjzjs3f8APr+dYVFWk6U3B9ACiiiswCiiigAooooAfFM8D7422t64zU/9pXf/AD2P/fI/wqrRVKco6JgWv7Su/wDnsf8Avkf4Uf2ld/8APY/98j/CqtFP2s/5mFi1/aV3/wA9j/3yP8KP7Su/+ex/75H+FVaKPaz/AJmFi1/aV3/z2P8A3yP8KP7Su/8Ansf++R/hVWij2s/5mFi1/aV3/wA9v/HRVUnJJPeiik5Slu7gFFFFSAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG7pEWy0393bP4Dj/ABq/UNouyzhH+wKmr2aUeWCRIUUUVYBRRRQAUUUUAFFFFABRRRQAVzV5F5N3Ig6A5H0PNdLWHrC4vAf7yCuXGRvC40Z9FFFeaMKKKKANKxTbBu7satVHAMQRj/ZFSV6VNWikSFFFFWAUUUUAFFFFABRRRQAUUUUAFY86eXO69s8VsVm34xcA+q1z4lXjcaKtFFFcQwooooAKKKKAPS/C0p03S7dcZSRd7j3POa7COVJow6MCp9K4rS3EmlWrDp5Sj8hitG3upbZ8xtx3B6GvpVRTpx5eyJTOmorPg1aGQASfu2/SryyI4yrqR7GsXFx3RQ6kZQylT0IwaWkZlUZLAfWpA5aRdkjJ/dJFMJCgknAHUms/U/ENhbTykS+axY4VOe9cpqWvXWoZQHyof7inr9TWtbG0qS3uybF7X9eE4a0tG/d9Hcfxew9q5yiivCrVpVpc0ikrBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFa/haMS+JrFT/fJ/IE1kVq+GZRD4ksXPTzMfmCP61dP416gex0UUV7oBRRU1vbvcNgcKOppNpK7AiVWdgFBJPYVeh04nmU49hVyG3SBcKOe57mpa5p1m/hKsRR28UX3UH1qWiism29xhWbryhtImP8Adwf1rSrM199mkSg/xED9f/rVdL+JH1E9ji6gns7e5XbNCjj3FT0Dk4r2Wk1ZmRjSeEbdsy27FG7I3IrKurOezfZNGV9D2Nd2BgAUyaGO4jMcqB1PY1xyw0PsKwXOAqpdWwZS6DDDr710WqaI9pmaDLw9SO61j1x1aX2ZDMSinSDbKw9DTa8p6FBRRRQAUUUUAFS20nlzqe3Q1FRTTs7gblFQ20vmwqe44NTV6cXdXRIUUUUwCiiigAooooAKKKKACiiigAooooAKKKKAHwR+bPHH/eYCu/ACgADAHArhtOx/aVtn/nqv867quvDbNiCiiiukAooooAKqStukNWZG2IT+VU6uKAKKKKoArmPF8IMdtNjkEof5/wBK6esDxbj+y4v+uw/ka5car0JAtzjaKKK+bLCiiigAooooAKKKKACijqcCus0bw4iItxfJuc8rEeg+tbUKE60uWIN2OcttOvLzmC3kcf3scfn0rTttD1WFubcbT1HmL/jXaABVAAAA4AFLXr08thHVydybnIT2dzbDM0LoPUjj86hruUkAGxxlDwQRWRquhoUa4s1wRy0Y6H6U6mHcdUI52iiiuYYUUUUAFFFFABRRRQAUUVFNOkK5Y89hSbSV2ATTLChY9ewrJdy7lmPJqZHNxdx+ZyC4GPbNd0NE03/nzjrKFGeKvyuyQ9jz6ivQf7E03/nzj/Kj+xNN/wCfOP8AKtP7Lqd0HMcFBC9zOkMQy7kKBXotjaJY2cdvH0Qcn1Pc1paL4e0+Im6+yRhuQhx27mo7tFS7lVRhQ3ArrwWHVGTvqxMoX9ml/ZSW7/xDg+h7GvOpoXt5nhkGHQ7SPevTq5fxVpuQt/GvTCy4/Q/0/KpzHD88PaLdfkCZy1FFFeGUFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHT25zaxH/YH8qlqrpz+ZYxH0G38qtV7UHeKZIUUUVQBRRRQAUUUUAFFFFABRRRQAViayf8ASkH+x/U1t1z+qPvvnH90Ba5sW7UwRTooorzCgooooA2YuYU/3RT6gtG3WyewxU9enB3imSFFFFUAUUUUAFFFFABRRRQAUUUUAFZ2of65f92tGsq8bdct7ACsMQ/cBEFFFFcJQUUUUAFFFFAHXeFb8PbtZOfnQlk9x3ro68ygnktplliYq6nIIrtNL8QW96ipMwin7gng/SvbwOLi4qnN6olo2aUMV6Ej6GmggjIORS16Yh/ny/8APV/++jWZrmpGy052MhMjjagJ70t/q9pp6EySBn7IpyTXEajqE2o3JllOB0VR0UVwYzFRpRcY/F+Q0ipRRRXgFBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVoWWi31/F5sMYEfZmOM/SqhCU3aKuBn0VNdWs9nOYZ4yjjse9Q0mmnZgFFFFIAp8MrQTxzJ95GDD6g5plFAHuFhdJe2MFzGcrIgYVYrgvAeuKA2lTvjktCT+o/rXfKpdgqjJJwK9ujUU4KQEtvA08m0cKOprYjjWJAqjAFNghEEQQde59TUlYVJ8z8ikgooorMYUUUUAFc54ouRiG2B5++39P61vzzpbwPLIcKoya4O9umvLuSd+rHgegrrwlPmnzdETJ6EFFFFemZlxG3KCKdVSOQofUVYWRG71m0A8gEEEZBrlNd0sWYa6hH7k/eX+6f8K6kyIBywqB0+3H7Nt3LJ8pB7is6lPniBxfhvTRdXEl7OgMakqoI4LHr+VZmr6edOv3iwfLb5oz6r/nivRH01NKVbWIYiUfIfUVka9pv9oWB2DM0XzJ7+o/GuOpgk8OlH4lr/AJjvqcHRRRXilBRRRQAUUUUAWLOby5dp+61alYdadpP5se0n5l/WurD1PssTLNFFOh2edH5n3Nw3fTvXWIPKk8vzPLbZ/e28fnTa78+T9n52eTt/4Dt/wrgpNvmvs+5k7fp2rWpT5LaiG0UUVkMKKKKACiiigAooooAKKKKAHwSeVcRyf3WB/Ku/BDAEcg157XZ6LdC602PJ+eP5G/Dp+ldOGlq0I0KKKK6wCiio5X2LgdTQtQIpn3NgdBUVFXtKiSS6+cA7RkA1bfKrgUirDqCPrSV088UckDq6jGPyrmDwSKmnU5wasFcx4vmAitoc8lix/Dj+tdPXA6/eC81WQqcpH8i/h1/XNcuYVFGi13GtzMooq3pmny6pqMNnD96RsE/3R3P4CvASbdkUKdLuhpI1Py/9GMnl7vf1+nb61Tr2o6TaHR/7L2f6N5fl47/X655+teP6lYS6ZqE1nMPnibGfUdiPqOa3r0HSSYFWiiiucAooooA2/DNgLq+M0gzHDzz3btXbVg+FIwulu/dpDn8AK3q+iwNNQop99SXuFFFFdggpySMnTp6U2igDmdbijtr8MvyrMNwHv3qhWp4tjBsIX7rJj8CDXKR3Esf3WOPQ14mJqKlVcWtBpGvRWeuoN/EgP0NSi/jPVWFQq0H1Cxboqr9ui/2vypragn8KMfrT9tDuFi5SMwUZYgD3rOe/kb7oC/rVd5Hc5ZifrWcsTFbBYuzXwHEXJ9TVFmZ2LMcmkorlnUlPcqxLbf8AH1D/AL6/zr0sdBXmlt/x9Q/76/zr0sdBXq5VtL5EyFooor1hF5dWnRAqpEABgDB/xridV8UX8WqXKKkGFcjlT/jXUV55rP8AyGLr/roa87HydKCdPR3GtS//AMJZqH9y3/75P+NMl8T3s0TxSRW7I42kFDyPzrForyniqz+0yrIKKKK5wCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDV0abBeAnr8w/r/SteuWhlaGVZF6qc10sMqzxLIh4YV6WEqc0eV9BMkooorqEFFFFABRRRQAUUUUAFFFFADZJFiiaRuijJrl3cySM7dWJJrU1a66W6H3f+grJrzcXU5pcq6DQUUUVyjCiiigC7p8nLRn6ir9YqOY3DDqDWvG4kQOp4NduHnePL2JY+iiiugAooooAKKKKACiiigAooooAa7BELHoBmsZmLMWPUnNXb6b/lkp92qjXFiJ3lZdBoKKKK5xhRRRQAUUUUAFFFFAFmLULyAYiuZFHsadJqt/KuHupSP96qlFX7SdrXYASWOWJJ9TRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAV6Fo88M+lwGEjCqFIHY157Tklkiz5bsmeu04rqwuJ9hJu17iaudB4snhe5hjQgyIPmx29q52gkk5PJorKtV9rUc+40FFFFZAFFFFADo5HhlWSNirqcqwPINexeBtdGr2m66AS4Q7AT0c+orxuvRtLtvsOnwQjhlXJI/vdTXfgKUqkpK9lYG7HqVFclY+Ip7cBJx5qDv3FbcGu2E4H73YfRxiuieHqQ6DUkzSoqFby2YZFxF/30Kjk1GziGXuY/zzWXLLsUWqZLLHBGZJHCoOpNY114lt4wRbo0jep4Fc9eajcXz5mfjso6CuinhZy+LREuSRa1fV2v5PLjysCngevuay6KK9KEFBcqM73CiiiqAKKKKACrVjdR2js7Rl2PAOegqrR1pNJqzAs6vqqvYvItszPENwAbqO9ch/wmEX/Pm/8A32P8K7OHSL24TK27bT3bjNef6z4V1TTbqfNm5hViQy8gDtXnYurOkl7F+vUaV9zJvp4rm8kmhiMSOd2wnOD3qvQRg4PWivEk3J3ZQUUUUgCiiigAp0btG4ZTyKbRRsBsQzLMgYfiPSpKxopWhfcv4j1rVimWZMqfqPSu+lVU1Z7ktE3mSeX5e9tn93PH5U2iitgCiiigAooooAKKKKACiiigAooooAK0NH1D7Bd5Y/un4f296z6KcW4u6EehKQyhlIIPII70tcro+tG1xb3BJh/hbuv/ANaun85DGJFYMpHBB616FOamtAFdwi5NVGYsxJpXcu2TTa3SsAU6OR4nDo2GHem05I3kOERmPoozTfmBZl1K4mjKEgA9cDrVSpfstx/zwl/74NZ+p3UunxHbazSzH7qLGT+fHFQ5QgrhqUtf1UWFoYo2/wBIlGFx/CPWuGqxfPdSXTSXiusrc4dSOPp6VXr53FYh1ql3sikrBXpXgXRfsdgdRmXE9yPkz/DH/wDX6/lXE+H9Oi1LVooriVI7dfnlZ2C5UdufWvWl1CwVQq3lsABgASLwK0wdNX52MtVx/jvRftdiNShXM1uMSY/iT1/D+Wa6f+0bH/n9t/8Av6v+NNa/090ZGu7ZlYYIMq4I/Ou6pGM4uLYHiVFaWvafHpurSwwSpJbsd8TIwb5T2+o6Vm14sk4uzAKKKKQHYeEpg1hNDnlJN34Ef/Wroa8/0TUf7Ov1dj+6f5X+nrXfqyuoZSCpGQR3r6DL6qnSUeqJYtFFFdwgooprusaM7sFVRkk9qAOd8XTAW0EGfmZ934Af/Xrkqv6vqB1G/eUf6sfKg9qoV81i6qq1nJbFLYKKKK5hhRRRQAUUUUAFFFFAEtt/x9Q/76/zr0sdBXmMbmOVHAyVIOK6uDxDdOAZLaNR6ZOa9PLq0KfMpdRM6UKWOAM1KtuT944rAHiWZRgW8Y/E0f8ACTz/APPvH+Zr0niYEnRiFB2z9a4jVYYv7VuTsXO89q1P+Enn/wCfeP8AM1kXM5ubmSZgAXOcCuevUjUSQFfyo/7i/lTGtoW6xj8Kmorm5U+gyo9hGfusV/WqslpLHzjcPUVq0VlKhB+QXMOitWa1jmGcYb1FZ0sDwthhx2NctSlKHoVcjooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACrlhem1k2tzE3X296p0VUJOD5kB1asHUMpBB6EUtc7aX8lqcfej7qf6VuQXUVyuY2ye6nqK9SlXjUXmS0TUUUVsAUUUUAFFFBIAyTgUAFU76+W1TauDKRwPT3NQXeqogKW/zN/e7CsdnZ2LMSWPUmuSviUlyw3GkDMWYsxyTySaSiivOGFFFFABRRRQAVPa3Hktg/cPX2qCinGTi7oDbBDAEEEHvS1kwXLwnHVfStKKZJhlD+Heu+nVU/UmxJRRRWoBRRRQAUUUhOBk9KAFqvc3IhXA5c9B6VHPequVi5Pr2FUGJYkk5J7muarXS0iNIQkkkk5JooorjGFFFFABRRRQAUUUUAFFFFABRRRQAUUVKltLJ0XA9TTSb2AiqeyUPfQKwBBkUEHvzUq6e38TgfSrdjYIt9Ad5OJB2961jQm3sFz1H+w9K/6B9t/37FH9h6V/0D7b/v2K0KK9jkj2A858e2NrZy2YtreOHcrbti4zXG13nxEjd5LIqpIAbOPwrg8Y615GJVqrAKKKKwAKKKKALNhaPfXkcCfxHk+g71p+IdIWxeOaBcQsNp9jWv4a037LafaZF/eyjjPZa1r21S9tJIJBww4Poa9ejgVLDu/xPUm+p5tRUtzA9rcPDIMMhwairyWmnZlBRRRSAKKKKACiiigAooooAKKKKALWmQ/aNTtoyMgyDP0HJr0euE8Nru1yE/3Qx/Q13de5lcbU2/MlhRRRXpCCiiigAooooAKKKKACiiigAooooAK6nQtISOFbqdQ0jcop/hFc1AgkuI0PRmA/WvQgAoAHAHQVx4yo4pRXUqCFrM1JMTK3ZlrTqhqY+WM+5rhpP3y2ec+MfDEUltJqVlGEljG6VFHDDufrXnle7SKrxsjDKsMEHuK8OuYxDdTRDojso/A1z4ymoyUl1JIqKKK4wCiiigAooooAKdHI0bblODTaKL22A04LtJeD8relWaw6sw3rx8P8y/rXXTxHSQrGnRUUdxHKPlbn0NS10pp6oQUUUUwCiiigAooooAKKKKACiopJ44h8zc+gqlNeu/CfKP1rOdWMdwsWp7pIRgct6VHaaze2cm6OXKnqjcqfwrPPNFcjrz5rp2HY7C18V2sgAuY2ib1HzD/GtSPV9PlGVvIv+BNt/nXndFdcMyqxVpWYcp6OdRsVGTeW/wD38FW9H1uwN5Ikc3mMI84Qe479K8trf8Jf8hKb/rkf5it6WPlWmqbWjFax6HcavLICsS+WPXqazySxJJyT3NJRXqRio7COK8V/8hdf+uS/zNYddHr9lPfa6sVuhZvJUn0AyazL7Rr3T4xJNGDH/eU5Ar57FUpurOSWlykZ9FFFcgwooooAKKKKACiiigArZ0jxBLp4EMwMtv2HdfpWNRWlOrKnLmg9QPRbXVLK8UGG4Qk/wk4b8jVyvLqXc2Mbjj0zXpRzRpe9H8Rcp6Hd6tZWaky3Cbh/Apy35CuS1fXpdS/dRgx2/wDd7t9f8KyKK5q+OqVVy7IEgoooriGFFFFABRRRQAUUUUAFHXpRV2yt8/vWH+6KuEHN2QElrahAHcfN2HpVuiivQhBRVkSFFFFUAUUUUAFFFFABRRRQAU10WRSrDIp1FDVwMm4tzC3qp6Goa2ZEWRCrDg1kyxGKQqa4K1Lkd1sNMZRRRWIwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAClVirAqSCO4NJRQBeh1W4jwHxIPfr+dXE1mE/fjdT7c1i0VvHEVI9Qsb41W1P8bD/gNNbV7YdN7fRawqKv63UFY1ZdZPSKLHux/pVCe7nuD+8kJHoOBUNFYzrTnux2CiiiswCiiigAooooAKKKKACiiigAoBIOQcH2oooAsx3sqcNhh71OuoRn7yMPpzWfRWsa011Cxp/bYfU/lSG+hHTcfwrNoqvrExWLr6gf4E/Emq0k8kv32JHp2qOis5VJS3Y7BRRRUAFFFFABRRRQAUUUUAFFFFABRRRQAVPDaPLyflX1NT21p0eQfQVdrppUL6yE2RRW8cQ4XJ9TU1FFdaSWiEFSW7iO4jduisCajopiO+/4S7S/Wb/vj/69H/CXaX6zf98f/XrgaK09pIdze8S6tbao9ubbf8gOdwxXOSQRyj5l59RUtFZy97cDLns3j5X5lqvW5VO5tAwLxjDdx61yVKFtYjTM+p7MwLdRtc7vKBywAyTUB4ODRXMnZ3GdqPFOnKAAJQB0+Sj/AISrT/SX/vmuKoru/tKt5CsbGu31lqEiT2+8S4w25cZFY9FFcdSo6knJ7sYUVdsY0kV96g4PerX2eH/nmv5VpCg5K9xXMilVWdgqgljwAO9a32eH/nmv5V0PhvTICXu2iXKnanHT3rWng5TklcLmNaeFbqZA88iw5/h6mnXHhO4jQtBMshH8JGCa7zy0/uijy0/uivS+o0OW1hXZ5LLE8MjRyKVdeCDTK7/xHpkEluLoRLvQ4Y46iuX+zw/881/KvNqYNwlZMdzIorX+zw/881/KshvvH61hUpOG40zX8MkDW4h6q38q7qvPdEl8nWbVj3fb+fH9a9Cr2Msd6TXmSwooor0RBRRRQAUUUUAFFFFABRRRQAUUUUAKjFHVx1ByK9Btp0ureOZD8rjP0rz2tPStYk09tjAvCTkr6fSubE0XUjeO6Ki7HaVR1M/JGPc0sGrWU65WdQfRuDWN4h8SaXp5QTXSlgpYIvJP+cV50U4SvLQtvQj1K9j07Tp7qU4WNCcep7CvE5HMkjO3LMSTW74k8Tza5II0BitEOVTPLH1NYFcmKrKpKy2RIUUUVzAFFFFABRRRQAUUUUAFFFFAB0qaO7lT+LI9DUNFNScdgL6agP40I+lSreQt/Fj6isuitliJoVjYE8R6OtL5sf8AfX86xqKr6y+wWNgzRDq60xryFf4s/Ssqtvw/4buddmJB8q2Q/PKR+g9TTjXnN8sUFim+oKPuIT9aryXcsn8WB7V6pZ+ENGtIwv2QTN3eU5J/pS3fhHRbtCptFibs8R2kf0raWHrSWrHY8nihedvl/Emri2CAfMxJ9q39V8OyaJjafMt2OFkx39DWZUxw6j8W5LZSewGPkY59DVJ42jYqwwa627trCPS4ZYZ91w2Ny7s9ueO1Yl1CJIScfMvIorYdJe6NMy6KK6PQvB95rMIuXkFtbH7rsuS30HpXHCEpu0UM5ytPQ9Sh0y7eWZXZWTaAgGeo9TXSXvw6lSEvZ3olkA/1cibc/Q5ri5oZLeZ4ZUZJEJVlbqDWvLUoSUragdf/AMJbY/8APG4/75X/ABo/4S2x/wCeNx/3yv8AjXG0Vv8A2jX7r7hWR2+mavaX+ozGMMjMigB8AnGf8an124hh0mYSkZddqr6muBBIIIOCO4pzyPIcu7MfVjmrWYy9m4Nav9QsNooorzhhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBF5soXt3rXACgAdBVSwj2xlz1PFXK7qELRv3JYUUUVuAUUUUAFFFFABRRRQAUUUUAFFFFABVa8h8yLcB8y81qWGnT6hJtjGFH3nPQV0ltoNlAo8xPObuW6flVqg6qt0EeaUV6S+mWKsV+xwY/65iqF34csLlTsQwv2ZP8ACsZZZUSvFplcxwtFX9S0m40yTEg3Rn7rjoaoV584Sg+WSsxhRRRUgFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRSqpdgoHJPFAFmyh3ybyPlX+dF7Dsk3gfK386vRRiKMIO360SxiWMoe/6V2+x/d8vUm+pj0UrKUYqRyDzSVxFBRRRQAUUUUAFFFFABRRRQAUUUUAFXbO2ziVx9BVe2h86UD+EcmtYAAYHSumhTv7zE2LRRRXYIKKKKACiiigAooooAKKKKACiiigCleW2QZEHI6iqFbdZd3D5UvH3W5Fcdenb3kNMgooormGFFFFAF/T/uP9RV2qWn/cf6irtehR+BEvcK6rw3IrWDRj7ysc1ytW9Ov30+4Ei8qeGX1FdNKfLK7EdxRVO21O0ukBSZQf7rHBFPn1G1t0LSTJ9Ack13cyte4FbXZFTS5AerkAVx1X9U1NtQmGAViX7q/1qhXFVmpS0AKxG+8frW3WI33j9a4MV0KQI5jkV1OGU5H1r0u3mW4topl+66hhXmddj4VvfOsmtWPzxHK/7p/+vW+WVeWo4PqEjoKKKK9wkKKKKACiiigAooooAKKKKACiiigAooooAK4DXrn7TrE7A5VDsH4f/XzXZ6neCx0+Wcn5gMJ7seledEliSTkk15OaVdFTXqOIUUAFjgAk+1SG3nAyYZMeu015CTZRHRRjFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAVFLuqKMljgD3r2vSrCPTNMgtIgMIoyfU9zXjFrIIbuGVuiOrH8DXuMbB41YEEEAgiu/Ape8wHUUUV6IFe9tUvbOW3kGVdcfQ9jXlsiGORkPVSQa9aJABJOAK8ou5BLeTSL0ZyR+dY1egmRU1vuHPpTqq3kwjjKA/M3FYTkoq7EZ6KHmVScBmAJ9K9ziiSCFIo1CoihVUdgOleFV6b4c8YWd3Zx29/OsF0gClpDhZPfPTNY4OcYtp9Sjq68y+IEEcWvRSIAGlgDPjuQSM/kB+VdzeeItJsYDJLfQtgZCRuHY/QCvLNb1aTWtUlvHXap+VEz91R0H9a1xlSPJy9QM6iirFnYXN9Jst4i57nsPqa86MXJ2SAr1JDBNcPshieRvRVzXV2HhWCIB7x/Nf+4pwo/qa3oYYoECQxpGo7KMCvRo5bOWs3YVzjbbwtfzYMpjgX/aOT+QrVg8JWqf66eWQ/7OFH9a6CqU+safbZEl3HkdlO4/pXcsHhqSvL8WK7Io/D+mRdLVWPqzE1ZXTbFPu2VuP+2Y/wAKy5fFlinEcc0nvgAfqaqt4wX+CyJ+smP6Ue3wkNrfcFmdD9itMf8AHrB/37FMbTbF/vWVuf8AtmP8K57/AITB/wDnyX/v5/8AWp6+MF/jsiPpJn+lH1zCvr+H/ACzNWTw/pkvW1VT6qxFUZ/CVq/+pnljP+1hh/SnxeLLF+JI5o/fAI/Q1oQaxp9zgR3ceT2Y7T+tPlwlXa35Bqcvc+Fr+HJiMc6/7JwfyNZE0E1u+yaJ429GXFemUyaGKdCk0aSKezDIrGplkH8DsFzzKiuvv/CsEoL2b+U/9xjlT/UVzF5YXNjJsuIih7Hsfoa8ythatH4lp3KTK9FFFc4BRRRQAUUUUAFFFFABRRTohulQepFC1YGvEuyJV9BT6Slr1UrKxIUUUUAFFFFABRRRQAVoadpE9/8AP/q4v7xHX6VFptn9tvUi/h6t9K7ZEWNFRAAqjAArejS59XsIzYfD9jGvzI0h9Wb/AApZdAsJFwIyh9VY1p0V1ezh2A5DUdEmsgZEPmReo6j61Qtbd7q5jhTq5x9K70gMCCMg9QayLHTFtNYmdR8mzKe2T/8AWrCdBcytsBpW1tHaQLDEuFUfmamoorqStoBXuByDUNWbgfux9arVpHYCG5toru3eCZQyMPy9688vrR7G8kt36oeD6jsa9JrkvF0IW5t5gOXUqfw//XXnZlRUqftOqGjm6KKK8MoKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACr1jD1lYey1UhjMsoQd+vsK2FAVQoGAOldGHhd8zE2LRRRXaIo30PSVR7NVGttlDKVIyD1rHmjMUpQ9unuK4sRCz5kNDKKKK5xhRRRQAUUUUAFFFFABRRTo13yKvqaANGzj8uEE9W5qzSAYAFLXpxjyqxIUUUVQBRRRQAUUUUAFFFFABRRRQAUUUUAFQXUfmQn1HIqekpSV1ZgYlFSTp5czL71HXmNWdigrUsNAvL9Q4AjjP8T96k8Paat9eF5RmKLkj1PYV3AAAAAwB0Ar0cHglVXPPYTZhWfhQpG3+kgsT/d4qte6Tc2I3Ou5P7y9K6+36NUrKrqVYAg8EGvQeGglaOhJ57RV/V7EWN6VX/Vv8y1QrjaadmAUUUUhhRRRQAViN94/WtusRvvH61y4roNCVa069fT76O4XkA4Yeo71VorljJxakt0M9OhlSeFJY23I4yCKfXG+HdZ+ySC0uG/cuflY/wn/CuxByMivpsNXjXhzLfqQ1YWiiitwCiiigAooooAKKKKACiiigAoorC8QayLOI2sDfv3HJH8A/xrOrVjSg5yAx/Eupi7uxbxNmKE8kfxN3qjpemS6ncbE+VB99/SqPWu+0K0W00uLj53G5jXiUIPF13Ke39aFPRE1npVpYxhYolLd2YZJq5tBGMDHpilor3YwjFWirEmbf6LaX6HMYSTs6jFcTfWUthctBKOR0PYivSKwvFFos2nicD54j19q4MdhYyg6kVZoaZxdFFFeEUFFFFABRRRQAUUUUAFFFdj4B8LRa9eyXV4pNnbkAr/fb0+lVGLk7IDlIrW4mGYoJHHqqk1EyMjbXUqfQjFfScFvDbRLFBEkUajAVFAArF8R+FrHxBZSK8SJdAHy51GCD7+orZ0NNGOx4LRUlxBJa3MtvKu2SNirD0IpgBYgAZJOAK5/IRYsbGfULgQwLk9Sx6KPU17J4UkgisYbG6k8yeJdqu/RhXKaRpyadYrGAPMYbpG9TV8cHI617uHwKhT95+8yebU9GCgDAAA9qa8Mcg+dFP4VxcGt38C7Vn3KOgcZon1y/nXaZtoP9wYpfU6l9yudB40upLHTJYtOPmTMMOByUXvXla6g2PmTJ9q9EJJOSck1xPiTTVsrwTRLiKbJwOgbv/jWeMozpxVSLvbcV7me9+5GEUD3qqzFjljkmkoryZTlLdjCiiipAKAMnAp0UbzSLHGpZ2OAoHJrtNG0COwCz3AElz+ifT3966MPhp15WW3cG7GZpXhl5gs19lE6iIcMfr6fzrqoYYreJY4UVEHRVGKkPAya53VfE8cBaGy2ySdDIfuj6ete1GNDCQu/+CyNWblzd29nF5lxKsa+56/Qd65y98W9Usof+2kn9BXOXFzNdSmWeRpHPdjUVedWzGpPSGi/EpItXWo3l4T59w7g/w5wPyHFVaKK8+UnJ3k7jCiiikAUUUUAFFFFAFq11G8syPIuHQD+HOR+R4resvFvRL2H/ALaR/wBRXL0VvSxNWl8LCx6XbXdveReZbyrIvsen1HanTQxXETRzIroeqsM15vb3M1rKJYJGjcd1NdVpXieOcrDe7Y5OgkH3T9fSvWoZhCr7tTR/gS0U9V8MvCGmscunUxHlh9PX+dc4Rg4NeojkZFYms6BHfhp7cCO5/R/r7+9ZYrL0/fpfd/kCZxNaP9iXZ0L+19v+j+ZsxjnH976Z4pNM0i41HWI9P2sjlv3mR9xR1Neviwthp32Dyh9m8vytn+zjFcNDDupdv+mUeIUVe1jTJNI1Sazkydhyjf3lPQ1RrmaadmAUUUUgCpIP9en1qOnxHEqH/aFOO6A2aKKK9QkKKKKACiiigAooooA3/DCAyTv3AArpK5Xw5cCK9eJjjzF4+orqq7qD9wQUUUVsAUmVDY/iP+f60tYuq6mLTUrYA5CcuB6H/OamclFXYG1RTUdZEV0IKsMginVQEc/+qP1qrVm4P7v8arVpHYArlfGEgL2sfcBm/PH+FdQzKiF2IVQMkntXn2r339oajJMPuD5U+grgzGoo0uTqxoo0UUV4JQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUVPaw+bLyPlXk04pydkBbs4fLi3EfM38qtUUV6cYqKsiQooopgFVbyHzItwHzL/KrVFTKKkrMDDoqe6h8qXgfK3IqCvNknF2ZQUUUUgCiiigAooooAKsWa5uR7DNV6tWH+uJ9qukrzQM0qKKK9IkKKKKACiiigAooooAKKKKACiiigAooooAKKKKAM2/XE4PqKq1d1D7yfSqVedWVpspbHYeEgosJiOpfmuhrjPDGoLbXTW8hwkvQn1rs697AzUqCS6EvcsW/RqmqG36NU1dEtxHPeJwNsB75Nc7Wnrt6t3e7UOUjG0H1PesyvOqtObaAKKKKzGFFFFABWI33j9a26raXo8upzMc7IVPzP/hWFaEpuMYrUaMyiu8h8O6dEgUw7z6sc1VvvC9rNGWtcxSdh1BqpZbWUb6BzI42ui0TxCbcLbXhJi6K/dfr7VgzwSW0zRSrtdTgio65KVWdGd47j3PT0dZEDIwZTyCO9Orz/TdZutObCNvi7xt0/D0rrLDXrK+AG/ypP7j8fka92hjadXR6Mlo1KKKK7BBRRRQAUUUUAFFVLzUrSxUmeZQf7o5J/CuW1PxLPdBorYGGI9T/ABGuavi6dFavXsCRr6z4gjs1aC2IefoSOif/AF6415GkdndizMcknvTTycmivCxGJnXleW3YtKwV6TYur2MDL0KD+VebV1/hjUllt/scjYkT7me4rpy2oo1HF9RM6KiilX76/WvdJDa390/lWbrwK6LcZU8jA471v1zXiG/WRhaxnIU5cj19K568/wB20+oHD+VJ/cb8qPKk/uN+VbNFeJ9WXcq5jeVJ/cb8qPKk/uN+VbNFH1ZdwuYxjcDJRsfSm1sTf6l/901j1jVp8jsCdwooorIYV658K5o20C6hBAkS4JYexUYP6H8q8jrX8OeIbnw5qQuoBvRhtliJ4cf4+9aU5KMrsaPoGiuStPiN4euIA8txJbvjJR4ySPxHBrB8TfEqCS0ktNFDlpAVNww27R/sg85rqc4pXuO5xHieaO48T6lLDgxtcPgjvz1qDRIhNrVqjdN+78hn+lUCSTk9TV/RJRDrVq56b9v5jH9a5qTTqxb7r8yWehUUUV9SQFFFFABWN4niEmiux6xurD88f1rZrH8TyiPRZFPWRlUfnn+lYYm3sZX7MEcNRRRXzBYU5EaR1RFLMxwAOpNNrr/Dej+REL2df3rj92D/AAr6/U1vh6Eq0+VA3Yt6JoqabF5kgDXLj5j/AHfYVqSypDE0kjhUUZLHoKV3WNGd2CqoySegFcPresvqUxjjJW2Q/KP73ua9urVp4SmlFeiI3JNZ1+S+LQW5Mdt0PYv9fb2rEoorwatWVWXNNlhRRRWYBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAG3o2vyWJWC4Jktug7lPp7e1dnFKk0SyRuGRhkMOhrzGtfRNZfTZhHIS1s5+Yf3fcV6WDxrg1Cpt+Qmj1XStPsIoGvHmt0vZFxkuAQo6A/wA/ypH1fTI3KPqNorKcEGdQQfzrDR1kRXRgysMgjoRXP+JNH8+I3sC/vUH7wD+JfX6iu+vCcIucNQTNPxommappwure/s3urfoqzKS69x1/H8/WvPaKK8KrU9pLmtYYUUUVmAVpaRpMupznB2RJ99/6D3rNr0LRrVbTS4EA5Zdze5NdmCw6rVPe2QmzRtNNs7eJfLhUnH3mGTU0lpbzLtkgjYe6ii3bKlfSpq9zlS0sSczq2hi3Rri1yUH3kPOPpWFXoZAYEEZBGCK4S/gFtfTRDorHH0rkr01HVAV6KKK5xhRRRQA6N2ikV0OGU5BrsNM1WK+jCsQs4HKnv9K42gEqQQSCO9aU6jgxHodFcXDrV/CoUTlh/tDNOl1y/lXHnbR/sgCuj6xEDpdQ1OGwiJYhpSPlQHmuNnme4meWQ5Zjk0xnZ2LMxZj1JNJWFSo5sDV0rWXsf3UoLwfqtdPb3dvdJuhlVh7HkVwdAYocqSCO4pwrOOjA7u4PIFUri9t7RN88yIPc8muBn1K7eVsXU+3oB5hqozs7bmYsT3JzWcszSVoxHym3rOvtfgwW4KQdyer/AP1qw6KK8yrVnVlzTZQUUUVmAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAAZOB1rWt4fJhC/xHk/WqljDufzCOF6fWtGuzD07LmYmFFFFdIgooooAKKKKAIbiHzoSv8Q5H1rJIwcHrW5WdfQ7X8wDhuv1rmxFO65kNFSiiiuMYUUUUAFFFFABVqwOJyPUVVqa1bbcL78VdN2mmDNaiiivSJCiiigAooooAKKKKACiiigAooooAKKKKACiiigDP1A/vEHtVOrF6264I9Biq9edVd5spACQcjg1v6f4omt0EdynmoOjDrWBRRSrTpO8HYDvbTxPZvGxCSZHbFVb/XprpTHEvlRnrzya5vT/ALj/AFFXa9OOIqVIXZLQUUUVIBRRRQAUUUUAFdRpNuttpsKKOo3H3Jrl66TRbtbvTYyD8yfKw9K6cK17TXewjRooor0AOT8W26rNDOBgsNp965quh8V3ay3Uduhz5Yy31rnq+bxrTry5SlsFFFFcoy7a6tfWeBFcMFH8J5H5Vqw+LrhQBNBG/uODXO0VvDE1aekZBY61fF8JHzWrj6Nn+lKfF1uBxbSH/gQrkaK2/tCv3/AVkdNL4vkI/dWqj/fbNZlz4g1G5BBm8tT2Tisyisp4utPeQ7IVmZySxJPqTSUUVzgFFFFABTo5HicOjFWByCKbRQB0tl4rdECXcW/H8a9a0V8U2G5cCUnI421xNOj/ANan+8K7YY+vFWvcVkdpe+IZZkKW6+Wp6sTzWKSSck5NJS11Sm5askKKKKkYUVPY2wvL6C2LbRI4XdjOM10lz4OS3tZZvtrHy0LY8vrgZ9apRb2A5Cb/AFL/AO6ax62Jv9S/+6ax64cTuhoKKKK5hhRRRQAUVpWWhX19B58SKEP3S7Y3fSqE0MlvM0MqFJEOCp7Vcqc4pSa0YDKASrAg4IOQaKKgD0LSdRTUbFJQR5ijbIvoav15vY38+n3AmgbB6FT0YehrsbHxFY3agSOIJO6uePwPSvfwuNhUiozdpfmS0a9FNV0ddyMrD1BzUFxf2lqpM9xGmOxbn8utdzkkrtiLNcT4k1Jby8EETZihyMjoW71Pq3iVrhGgsgyRnhpDwSPb0rna8bHYyM17Ont1KSCiilVS7BVBJJwAO9eWM1vD+mfb73fIuYIsFs/xHsK7qqWl2K6fp8cAxvxucjux6/4VDrmpf2dYEof30nyx+3qfwr6HD044WjzS33ZL1ZieJdXMshsYG/dof3pH8R9Pw/z0rnKCSTknJNFeHWrSrTc5FIKKKKyAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDo/DWrmKQWM7fu3P7on+E+n4/56111eXAkHIOCK77Q9S/tGwBc/vo/lk9/Q/jXs5dieZeyl02JaOY8QaZ9gvd8a4glyVx/Ce4rIr0TVLFdQ0+SA4343IT2YdP8K88ZSjFWBBBwQe1ceOoeyqXWzGmJRRRXEMK9G02ZZ9Nt5FPBQfnXnNb3h/Wlsj9muDiBjlW/un/Cu7AV40qlpbMTR2sbbHB7d6uCs9HWRA6MGUjIIOQaswSfwn8K96SvqiSeuH1SUTanO6nI3YBroNX1iO2iaGBg05GCR/D/APXrlCc1w4iafuoAooormGFFFFABRRRQAUUUUAFFFFABVa7m8uLA+83FTu4RCzHgVkzSmaQsfwFY16nLGy3BEdFFFcBQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFORC7hV6mm1fsYcKZWHJ4H0q6cOeVgZajQRxhB0FPoor0kraEBRRRQMKKKKACiiigApkiCSMoehp9FDV9AMV0KOVbqKbV++hyolUcjg/SqFebUhySsUgoooqACiiigApQSrAjsaSigDaRg6Kw7inVSsJcqYz1HIq7XpU5c0bkhRRRVgFFFFABRRRQAUUUUAFFFFABRRRQAUjEKpJ6AUtVL6XbHsHVqmcuWNwKDtvdmPc02iivMKCiiigBQxHQkfSje394/nSUUALvb+8fzo3t/eP50lFF2Au9v7x/Oje394/nSU5Udvuqx+gp6gJvb+8fzo3t/eP508wSj/AJZP/wB8mmEEHBBH1FGoBvb+8fzq1p+oz6dP5kLcH7ynoaqUU4ylF3T1A7CHxZasg82KRG9uRVW+8Vl4ylpEVJ/jbtXM0V1Sx9dxtcVkK7tI5dySx5JPekoorjGFFFFABRRRQAUUUUAFFFFABRRRQAVp6LpB1WdwzlIowNxHU56AfkazK0dH1Z9KndgnmRyABlzjp0I/WtaHs/aL2mwMta3oK6ZEk8MjPETtIbqDWJWzrOutqkawpF5cSnccnJJrGqsT7L2j9lsCCnR/61P94U2nR/61P94VitwNmlpKWvUJCiiigCxY3Is76C5K7hG4baDjOK6S58Yx3FrLCLNgZEK58zpkY9K5OiqUmtgI5v8AUv8A7prHrYm/1L/7prHrhxO6GgooormGFFFFAHaaRrdiNMhilmWKSJArK3fHcVzWs3kd/qck8Q/d8KpI6471Qorqq4udWmqctkKwUUUVyjCiiigAooooAKKKmtLV7u4WGMcnqfQU0m3ZAMihkncJEhZj2FdV4a8MTS363E5ULD82MZ57f4/hVqzsYbKIJGvPdu5Ndbo8PlWIcjmQ7vw7V6lHCRhaUtxXGnS+OJP0rgPEtrd3F+8ijzIYxtTb6dz+dekahP8AZ7KRwcMRtX6muUrqrRdaHJJi2PPyMHBorp9X0hZkaeBcSjkgfxVzFeLWoypSsykwooorIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtPQb77DqaFjiKT5H/HofzrMoq6c3CSkugHqNcR4msvs2p+cowk43f8AAu/+P411GjXf23SoZScuBtf6jj/69VfE1r5+ktIB80LBx9Oh/wAfwr3sXFVsPzL1JW5w9FFFfPFBRRRQBPb3t1a/6i4kjHorcflUsurX8y7Xu5SPQNj+VU6KtVJpWTdgNK2uhINrnD/zq1WHnBq7Be4wsvP+1XRSr9JCaL9FNVg4ypBHtTq6iQooooGFFFFABRRRQAU1mCKWY4AqOW4jhHJy3oKzprh5jycDsBWNSsoeoWHXNyZmwOEHQVBRRXDKTk7soKKKKQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBJBEZpQvbv9K1wAAABwKr2kPlRZI+ZuTVmu+hT5Y3e7JYUVcstLur7mNMJ/fbgVrJ4XGPnujn/ZT/AOvXVGnOWqQjnaK3LjwzMikwTLJ/ssNprGlhkgkMcqFHHUGlKEo7oBlFFFQMKKKKACiiigBCAQQRwayJ4jDKV7dvpWxVa7h82LIHzLyKxr0+aN1ugRmUUUVwFBRRRQAUUUUAOjcxuGHUVrxyCVAy9DWNU1tcGF+funqK2o1OR2ewmjWopqsHUMpyDTq7yQooooGFFFFABRRRQAUUUUAFFFISACScAUCEdxGhZjwKyJZDLIWP4VLdXBmbav3B+tV64a1TmdlsUkFFFFYDCiiigAooooAK09N0O61HDAeXF/fb+lX9B0H7QFurpf3X8CH+L/61dcqhVCqAAOgHavTwmA51z1NuwmzJtPDlhbAF085/V+n5VppDFEMRxov+6oFSUV68KUIK0VYkOtQTWVtOCJYI2+q1PRVtJ6MDnr3wrbygtasYn/unkVy95Y3FjL5c8ZU9j2Nek1BdWkN7AYp0DKfzH0rgxGX05q8NH+A0zzWitDVtKk0y42n5om+4/rWfXhzhKEnGW5QUUUVIBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU6P/Wp/vCm06PAkUn1FNbgbNLUfnRf89F/Ojzov+ei/nXp8y7kklFR+dF/z0X86POi/wCei/nRzLuBJRUfnRf89F/Ojzov+ei/nRzLuATf6l/901j1qyzRmFwHUnae9ZVcmJabVhoKKKK5hhRRQAT0GaACiiigAooooAKKKKACiiigArpvDtqEtWuCPmkOB9BXM12mlADS7fH9yuzBRTqX7CZdUFmAHUnFdjEgiiSMdFAArlrBPMv4F/2wfy5rq69USMXXpf8AVQj3Y/yH9axav6xJv1Fx2UBf0z/WqFMTCuP1m2FtqLhRhXG8f1rsK53xMB5tue+DXJjIp0r9howaKKK8goKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6nwhccXNsT6SKP0P8ASukniE9vJC3R1Kn8RXE+GpfL1uJe0isp/LP9K7qvoMvlz0LPpoS9zy9lKOVYYKnBpKu6vF5Or3SdP3hP58/1qlXgzjyycexQUUUVIBRRRQAUUUUAPSV4zlGIq1HfnpIv4iqVFXGpKOzCxqrdwt/Hj61IJYz0dfzrGorZYmXVCsbW9P7y/nTTPEvWRfzrHoo+svsFjSe+iX7uWqrJeyPwPlHtVeis5Vpy6jsB560UUVkAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVi0h82XJHyryargEkAck1rwRCGIL37/WtqMOaV3shMlrR0fT/ALfdfP8A6pOW9/as6uu8PxCPTA3d2JNepSjzS1JNREVECIAqjgAdqWiiu8AqjqenR39uRgCVR8jf0q9RSaTVmB566FHKMMMDgikrS12IRapJjowDVm150lZtAFFFFSMKKKKACiiigDLu4fKlyB8rciq9a88QmiK9+31rIIIJB4IrgrQ5ZXWzGgooorEYUUUUAFFFFAE0Fw0J9V7itKOVJVyp/CselV2RsqSDW1Os4aPYTRt0VQiv+0g/EVbSaOT7rg12RqxlsxElFFFWAUUUUAFFRvLHGPmYCqst+OkY/E1EqkY7sC28ixruY4rNuLppjgcJ6etRPI0jZc5NNrjqVnPRbDSCiiisRhRRRQAUUUUAFaeiad/aN8FYfuk+Z/8ACsyu58N2gttKVyPnmO4/TtXXgqPtaqT2Woma6qFUKoAAGAB2paKK+jJCiiigAooooAKKKKAKuoWUeoWbwSDqPlPoa87mhe3neGQYZDg16dXH+K7QR3cdyo4lGG+orzMyopw9ot0NM56iiivEKCirem2DaleLbrIEyCSxGentTL+0awvZLZnDlCPmHfIz/Wr9nLk57abAV6KKKgAooooAKKKKACrdlpt1fti3iLAdWPAH41a0PSTqdwWfIt4/vkd/YV3MUUcESxxIERRgADpXoYTAusueeiE2ctF4QkK/vrtVPoq5/wAKJfCEoX9zdKx9GXb/AI11lFel/Z+Hta34sV2ecXum3Vg2LiIqD0Ycg/jVWvTpoY54mjlQOjDBBFcLreknTLgFMmCT7hPb2Nebi8C6K546oadzLooorzxhRRRQAUUUUAFFFFABRRRQAUUUUAFegeCPD8ZsJr+8iDfaVMcasP4OhP4/y+tcloGkvrOrRWoyI/vSsP4VHX/D8a9jjjSGJIo1CogCqo6ADoK7cHR5nzsDxnW9Lk0fVZrR8lQd0bH+JD0P+e9Z9epeNNF/tPSjcxLm5tgWGOrJ3H9f/wBdeW1hXpeznboAU+KJpm2qPxplatrGI4R6nk0qVPnlYGyJbBAPmYk+1JJYLj5GIPoau0V2exha1ibmK6NGxVhgim1o30YaLf3Ws6uKpDklYpBXW6DOJdNVM/NGSprkqv6Tfmxust/q34YVphaip1LvZiZ3+jjOpRn0BP6V01c1oTrJeo6EFShIIrpa9kSOTvm3X85/2yKr1Nd/8fk//XRv51DTEFcr4hnEt+IweI1wfrW/qF8ljblyRvI+VfU1xkjtLIzscsxyTXBjaqUeRDQ2iiivMKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKALmkvs1e0P/AE1UfmcV6LXm+n/8hO0x/wA9k/mK9Ir2srfuS9SZHCeJV265Mf7yqf0A/pWTWz4o/wCQy3+4tY1eZif40vVlLYKKKKwAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopdrbQ2DtJwDjg/5yKAEooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiinRoZJAg6mhK+gFqxhy3msOBwPrWhTUQRoEXoBTq9KnDkjYkK67w/KJNMC90Yg1yNaOj6h9guvn/ANU/De3vXRSlyy1EdlRSI6yIHRgykZBHelrvAKKKo6nqMdhbk5BlYfIv9aTaSuwOc12US6pJjooC1m0ruXcuxyxOSaSvOk7tsAoooqRhRRRQAUUUUAFZ99DhvNUcHg/WtCmugkQo3QioqQ542AxaKdIhjkKHqKbXmvTQoKKKKACiiigAooooAKKKKAHrNIvR2qQXcw/j/SoKKpTktmBP9rmP8f6Uxp5W6u1R0UOcnuwDOeTRRRUgFFFFABRRRQAUUUUAFFFFACqMsB6mvTIIxFbxRj+FAv6V5pHxKn1FenZyM16+VL4n6EyFooor1xBRRRQAUUUUAFFFFABWJ4piD6Rv/wCebg/0/rW3WT4kIGhze5X+YrDEq9GV+wI4SiiivmCxUd43DozKw6FTgihmZ2LMSzE5JPJNJRR5AFFFFABRRRQAUUUDqKAPQ9HtBZ6XBGBhioZvqf8AOKvUi42jHTHFLX1kIqMVFdCAoooqgCqGs2gvNLnjxllXev1H+cVfpr42NnpjmpnFSi4vqB5hRRRXyZYUUUUAFFFFABRRRQAUUUUAFFFOikaGVJUxuRgwyMjI9j1oA9U8H6L/AGTpIllXFzc4d8jlR2X/AD3NdFXk/wDwmuv/APP6v/flP8KP+E11/wD5/V/78p/hXpQxdKEVFJgesV5N4u0X+yNXZolxa3GXjx0U91/D+RFL/wAJrr//AD+r/wB+U/wqnqPiHUtWtxBezrIituA8tQQfqBWVfEU6sbWdwMutiFg0KkelY9WrW58r5H+7/KsKE1GWomaVFNV1YZVgRSPIkYyzAV3XVriIrxgtu3vxWXU9zcGd+OFHSoK4K01KWg0FFFFZDOi8JanNbaxFDndG4YYP0J/pXo8eoQuPmypryPSJfJ1e1fp+8A/Pj+teiV7WXWnSafRksytS1Ozhv7hWmGRITisi68QxqCLdCzerVR8SxeXrUp7SKrD8sf0rIrlr4qpGbgtLDSJbi5luZTJKxYmoqKK4G23djCiiikAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBc0lN+r2g/6aqfyOa9FrhfDUXma3E3aNWY/lj+td1XuZZG1JvzJZwniVt2uTD+6qj9Af61k1d1eXztXun6/vCPy4/pVKvIry5qsn5spBRRRWQBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAPhhe4mSGMZdztA967W50ON9DWyjA8yMbkb1fv+f+elUPCum4DX8i9crFn9T/T866ivawOFXsnKa+L8iWzy8qVYqwIIOCD2pK6DxRpv2e5F5Gv7uY/Pjs3/ANeufryq1J0puDKCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtCxh2p5hHLdPpVS3i86UL/AAjk/StYDAwOldOHhd8zExaKKK7BBRRRQBcstUurHiJ8p/cbkVrJ4oG357Xn/Zf/AOtXO0VpGpOOiYjcn8TTOCIIVj/2mO41jSzSTyGSVy7nqSaZRSlOUt2AUUUVAwooooAKKKKACiiigAooooAp30O5PMA5Xr9Kz62yMjB6Vk3EXkylf4TyPpXHiIWfMhoiooormGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAADgg16RYTC4sIJQc7kGfr3rzeuu8KXwktntHPzRncv0r0ctqKNVxfUTOjooor3SQooooAKKKKACiiigArn/Fk4SwjhzzI+fwH+RXQVwniK9F5qbKpzHENg+veuLH1FCi11eg1uZNFFFfPFBRRRQAUUUUAFFFFABRRRQB6Fo12LzS4ZAcsq7H+o/zmr9cFourNplyd+WgfhwO3uK7mGeO4iWWJw6N0INfR4PEKrTS6ohqxJRRWt4etUuNS3SDKxLvAPc9q6ZyUIuTBakcGhX9xGHEQRT03nBP4Vj+JorjRdMmeeMqXGyNgcgk+/wCtemM6opZjgD1rn9aii1m0ltJlzC6lRnsex+tef9Yq1E0i+VI8IopXQo7Ieqkg0leGAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACgkdCRSEk9TmiigAooooAKKKKAFVijhlOCpyK9MglE9vHMvR1DD8RXmVdx4ZuvP0lYyfmhYofp1H+H4V6eWVLTcO4pFDxfb8W1yB6xsf1H9a5avQtZtPtulTxAZcDcn1HP/1q89rPMafLW5u4IKKKK4BhRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB1PhC34ubkj0jU/qf6V0k8ogt5Jm6IpY/gKqaNafYtKhiIw5G5/qef8A61VfE115GktGD80zBB9Op/w/GvoqS+r4a76IndnEMxdyzHJY5NJRRXzpQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABUttGktzGkkgjjJ+Zz2FRUU1owO+i1fSYYkijuolRAFUDPAp/9uab/wA/kf6159RXorM6i05ULlO6vNR0m9tJLeS7j2uMZ54PY1wzrsdlDBsEjI6GkormxGJddpyVmhpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigByuyZ2sRn0NL50v/PR/wDvqmUU7sB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76o86X/no//fVMoo5n3Af50v8Az0f/AL6o86X/AJ6P/wB9UyijmfcB/nS/89H/AO+qPOl/56P/AN9UyijmfcB/nS/89H/76o86X/no/wD31TKKOZ9wH+dL/wA9H/76pGdnxuYnHqabRRdgFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKns7uSyuknjPKnp6j0qCimm4u6A9JsryK+tlniOQRyPQ+lWK880zVJtMn3p80Z+8h6Gu3sdSttQiDwuN3dD1FfQ4XFxrKz0kQ1YuUUUV2AFFFFABRRWLq2vw2KtHCRJP6Dov1qKlWNOPNNgLr+rCxtjDG37+QYGP4R61w55OTUk88lxM0srFnY5JNR187icQ68+bp0LSsFFFFcwBRRRQAUUUUAFFFFABRRRQAVZs9QurF91vKy56r1B/Cq1FOMnF3i7AdHF4vnVcS20bn1Viv+NamiePDZ6ojS2yxwONkjbixUHv09cVxFFdLxldqzldBY95+1/bI1lWUSRsMqynII9qyde1u30XT3ld1M7KRDHnlj9PSvJLe/vLRSttdzwg9RHIVz+RqGWWSaQySyNI56s5yT+NaPG+7aKswGkkkknJPWiiiuEAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACtrwze/ZtT8ljhJxt/4F2/w/GsWlVijBlJBByCO1aUqjpzU10A9QrgdesfsOpuFGIpPnT8eo/OvSPB0Uev2y3cv3IxtkUd39Pp3/EV2VzYxSWpjSJBt+6oUY+levjJ060VFetxRTPnKivQfGfhi2WyfUrKJYpIuZUQYDD1x2Irz6vIq0nTlysYUUUVmAUUUqqWOACT7UAJRVhLKVuuFHvUo0/1k/IVoqU30C5Soq8dP9JP0qJ7GVemG+lDozXQLlailZWQ4YEH3pKzAKKKKACiiigAooooAKKKKACtPQbH7dqaBhmKP53/DoPzrMAJOAMk132h6b/Z1gA4/fSfNJ7eg/CuvBUPa1ddkJs064jxNe/adT8lTlIBt/wCBd/8AD8K6rVL5dP0+Sc4342oD3Y9P8a88Zi7FmJJJySe9d2Z1rRVJddxISiiivGKCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACit/SdFimgW4uQWDcqmccepq3d6DayxHyF8qQdCCcH611RwlSUeYVzlaKVlKOVYYYHBFJXKMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKfFLJDIHidkYdCpxTKKL22A37TxVdQgLcIsw9ehrVi8VWDj5xJGfdc/yri6K7KePrwVr39RWR3J8TaYB/rXP/AAA1Wn8W2yg+TDI57Z4FcfRVyzKu9rILI1b3xDe3gKhvKjP8Kf41lHk5NFFcc6k6jvN3GFFFFQAUUUUASW9vNdTLDAheRugFWL3SrzT1VriLajHAYEEZ9OKt+HL6Cy1FmnIVZEKBz2OQf6Vs+ItUs30x7eKaOWSQjGxt2MHOc/hXZToUpUHUlLVCvqcfRRRXGMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA9J+FupRwx3lkzAMXEmD3BGM/hgfnXp9fNtpeXFhdJc20rRyochh/nmvS/D3xEuLyP7JdQQ/aVHyMCQHH09a7KElO0Oo07G7442Wnhy+nxxJGY8f7Tcf/XrxGvWdRvptUJFyVZCCPLA+UA9eK891vRn02YyRgtbOflP932NbYzDVIxU3rYV7syKKKs2lv5rbm+4P1rz4xcnZAJb2rS/MeE/nWhHEkQwq4p4AAwKWu+nSjD1JuFFFFaAFFFFADHjSQYZQRWfcWjRZZOV/lWnSdazqUozWoXMSirV3beWd6D5T1HpVWuCUXF2ZQUUUVIBRRRQAUUVr6Joz6lMJJAVtkPzH+97Crp05VJKMdwLnhrSDLIL6df3aH90D/EfX8P89K66moixoqIoVVGAB0Arn/EmsCCI2UDfvXH7wj+FfT6mvoIxhg6Ov/Dsjcx/EGp/b73ZG2YIshcfxHuayKKK+fqVJVJuct2WFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB2ek3CT6bDtPKKEYehFW3dY0LuwVVGST2rhYLia2ffDIyH2PWpLi/urpds0zMvp0H6V6MMclCzWorEdzKJrqWUDAdyw/E1HRRXnt3dxhRRRSAKKKKACiiigAooooAKKKKACiiigAooooAKKKKANHRdGm1u8a2gkjRgpbL5xitDV/CF5o9gbuaeB0DBcJnPP4VH4U1e20bVHuLrfsMZUbFyc1t+JvFem6tozWtsJvMLhvnQAYH410wjSdJtvUDh6KKK5gCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigApyO0bq6MVZTkEdQabRQB3Wia0mpReXIQtyg+Yf3vcVqSxJNE0ciBkYYKnoa8zikeGRZI2KupyGB5Fdpo2vx34WC4Ijuf0f6e/tXuYPGqovZ1N/wAyWjF1bw9LaSeZbAyW5P1KfX296ZGgjQKOgrvYFyxJ6CszUfD6TEy2mI37ofun6elE8HGEnKmK5zFFPmglt5DHNGyMOxFMrEYUUUUgCiiigAooooAayh1KnoayJUMchQ9jWzVDUE+ZX9eDXPiIXjfsCKVFFFcRQUVLb2011KIoI2kc9lFdVpXhiOAia9xJJ1EY+6Pr61vQw1Ss/dWncG7GXo2gSXxWe4Bjtuo7F/p7e9dnFEkMSxxoFRRgKOgp44GBWJrOvx2AaC3Ikuf0T6+/tXt06dLCU7v7yNyTW9aTTYvLjIa5cfKP7vua4d3aR2d2LMxySepNEsjzSNJIxZ2OSxPJpteNicTKvK726FpWCiiiuYAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoopVVnYKoJZjgAd6AEorrLnw6q6CqIoN1FmQkfxHuP8+lcnW1ahOi0pdQTCiiisQCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACgHByKKKAOv0DxC6Q+XekuucCTuPr611sUsc8YkidXQ9CDXmlgf3B+taVreXFnJvgkK+o7H6ivZw+IkoLm1JZ29xbQ3UeyeNXX3HT6VhXfhrq1pL/AMAk/wAams/EcMmFuk8tv7y8r/iK2Ypo5kDxSK6+qnNddqdURw9xYXVqT50DqP72Mj8+lV69DqpNpdlcEmS2TJ7qNp/SspYbswOHorqpPDdm3KPKn4gj+VV28Lj+G7I+sf8A9es3QmBztFdB/wAIu/8Az9j/AL4/+vTl8Lj+K7J+kf8A9el7GfYDnarXwzb59DXZx+G7NeXeV/xAH8qsnS7GCP5LaPPqw3H9abwspqz0C551a6deXhHkW7uD/FjA/M8VvWXhLo97N/2zj/qa6imTTRQRl5pFjQd2OBV08upU9Z6/kO422tLezi8u3iWNfYdfqe9Ommit4mkmdUQdWY4rBv8AxVBEClmnmv8A32GFH9TXMXl/c30m+4lLnsOw+gorY+lSXLT1/ILG3qvid5g0NjlE6GU8Mfp6fzrnCcnJoorxq1adaXNNlWCiiisgCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArovC+m+dcG9kX5IjhM929fwrCtbaS7uY4Ihl3OB7e9ejWltHZ2sdvEPkQY+vvXoZfh/aT53svzE2TVw3iLTfsV95sa4hm+YY7HuK7mqep2K6jYyQNgN1Q+jdq9XF0PbU7LdbEp2POqKdIjRSNG6lXUkEHsabXzRYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAXdPfl0/Gr9Y8EnlTK3bvWuCCMiu7DyvG3Yli0+KaWB98UjI3qpxTKK3A14PEV5FgSBJR/tDB/MVoxeJrZv9bDIh9sMK5eitVWmuojtI9a0+TpcBfZgRU639m3S6hP/bQVwlFWsRLsB3v2u2/5+Iv++xTWv7Net1CP+2grhKKf1l9gO0k1rT4+twG9lBNZOo+K7aFQsUEkjH1wo/rWBWVcy+bMSOg4FYV8ZOEfd0Y0jVufFN/NkRCOBf8AZGT+ZrImnmuH3zSvI3qzZqOivMqVqlT43coKKKKzAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA0dI1OPS5XlNt50jDap37do79jWv/wAJj/04f+Rv/sa5eiuini61OPLB2XogsdR/wmP/AE4f+Rv/ALGj/hMf+nD/AMjf/Y1y9FafX8R/N+C/yFZFzVL2PULs3CW/kswG4bt2T69BVOiiuWUnOTk92MKKKKkAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAq/ZXGR5THkdKoUAkHI61cJuDugNyiqdveBgFkOG9fWrlehGakrokKKKKoAooooAKKKq3F2sYKoct/KplJRV2Al5cbF8tT8x6+wrOpWJYkk5JpK8+pNzdykFFFFQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVNFdSRcZyvoahopqTi7oDRS/jb7wKmpRcwn/AJaCsmitliJrcVjWNzCP+WgqN76NfugsazaKbxEugWJ5buSXjO1fQVBRRWEpOWrGFFFFIAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD//2Q=="/></g><path fill="#130f45" fill-opacity="0.7308" d="m0 0.503937l960.0 0l0 540.0l-960.0 0z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m50.824146 47.711285l157.23622 0l0 62.895016l-157.23622 0z" fill-rule="evenodd"/><g transform="matrix(0.31447244094488186 0.0 0.0 0.3144750656167979 50.824146981627294 47.71128608923885)"><clipPath id="g3a04b465b0_0_0.2"><path d="m2.842171E-14 0l500.0 0l0 200.0l-500.0 0z" clip-rule="evenodd"/></clipPath><image clip-path="url(#g3a04b465b0_0_0.2)" fill="#000" width="500.0" height="200.0" x="0.0" y="0.0" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAYAAAAeGRPoAAAOPklEQVR42u3dbZHqwLqA0S0BCUhAQiQgAQlIQAISkIAEJCABCTjoc3ZVuGcuNWxC+u1OJ6xUrT/7Y4av9JN0QvInpfQHAJg3LwIACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgAwCCDgAIOgAg6AAg6ACAoAMAgg4ACDoACDoAIOgAgKADAIIOAIIOAAg6ACDoAICgA4CgexEAQNABAEEHAAQdABB0ABB0AEDQAQBBBwAEHQAEHQAQdABA0AEAQQcAQQcABB0AEHQAQNABQNABAEEHgAG6/zqMtPvxc9Y//nyf+ZhWT79H0Bux7j8w2xcfiH3/950VCxjp71gydum8dqOXy9OGQdTr+vyYBH3irb3LyA/I9b9O/ZbfykAFCPosg37J2AlMgj6dTR/he4pfzv3evUELEPR6U+7PO2Xvpty7oNf2JOjTfRAuqc5ye/rwAAh6vdd0SA9S5l76+sV7JOiFj4vXCvlvU/JWQEDQ2w96+nCG9STode1TG8vBCgcIevNBv2XunQt6Aav+eHZLy8WJc4CgNx30NPBw6UnQ68X8mtpcrqIO4iPoTQf9lvF/Bf1LYi7qgKC3GfTug730y1P8O0Ev45zmsVysgCA+gt5M0H8L9ZD/txP0ZZ8A50Q5QNDnF/TnP9sP2Dv/I+hlvpp2T/NbNlZEEHRBbyLoz8G+Px0efTUtL+jBTmmei6l3EB9Bbyfo63/MpF5ejN2CHrx3PufFCgqCbrxoI+jPO4iPvfTdP94HQQ90DA7svd/6OvziXGBq3146CLqgtxP0553Ec3+8/NWYLeiBbkFhvaXh11/fBE/zr62QIOiC3kTQ3x3G7QS9jE1QUA8Zvz/ie+97KyQIuqA3E/T1BzOqgh5k30hMc/fWz1ZIEHRBbybor96nTtDbPX4eefw6Z0/9ZoUEQRf0poK+ejpn6pLxswR9gEtm0LeBjyX3bHsrJQi6oLcT9D99Ix4nRa8Fve2gRz+es6ADgr6YoP+p/LMEvYHp9p9v7GEkKyUIuqAj6I5bsyCrfuDuDODFrX+8zhtBR9DnO+W++vKB7HF86PLmpL5b/2+O/bcCNpUf5yczHd2HP3vfHyp59fyv/d/vU5nrBXQ/3oP7gI3QGo9lqE8ew+bH87z9Y9bs7zdGdgXWzVX/eT8OHDeuBR/LXIL++DycB7xml/7fHWx0CPpUQT98YcT3Kea787d+wOsqDCqfLKeBP3PsZ+cS8JzX/ePMvergNQ2/GFKJ0Az53bs0/uJPp4ANly7F3Fb5HPhZbzXoj0ucRt2G+lxog4iFBv2Q+YG7p++4SltOwIbGfddI0O9vQhr1OlxGzFQ8Ql7i9d9OsD6d3pwdfAt6fqcRUeiCNlwj3vfWgx61gfmvdfKYXBFT0N/YBnzYrgv+oJUOeY2wdyMex+bFnmKJAeuQ6mx8lgpfzmN8tfF0KhSFIRstq8A9zH8t+zT/oK9S/TtVHuyxC/q/PpA1B4s5nVR1TNMtl8CNpC5gsD1NGNJV5Y2qa8aAOSY0m6fnep0wpJvAWYGowzutBn1fcI+81owSCwt67ne/fzvmM/e99dqDWumNpDFBv1SM+b9CWiNwkVEfE5rDBM/19OJzP0WgTmleQa81gzFkOQqtoJeYdv9tJZ1j2HepvSX3WvndyN97mGCW4tRAzH9GvUZobul/Z0LXXHYNxHxsmKYK+mbiz+SrjW9T8IL+/9wKDtBzCXuLMc+dmswJ+pSDe9fIwFkzNFMsu36D/t7AY9mmtoO+aeR1ipxRYqFBLz3oR35l5dtinrunPregt7Z0ablBb2m5fxCl2kFvOeaiLujVzqz97UPX2vcqdzMa9MacAS/o+VOagl5nqfGNh0+Dvp5BzCNm8lhY0Gses2zle5WbGa2sj9ft09dM0OttSAl6nb30mkG/zuw1zD3nhoUEfaqt0Usqd1GVVjZgptpjFPS6r7mg19lLrxX04wxfv2+52JegN77X+jjbt9Z0/KHAivS4FvNfP+8DfE6xJx5+sgEk6DHLJgl6rXGghaCXWG8e93M49OvwLv3v2yTX4N8jwoLexNcz7hXCvg5eebYfDBKXoNdolaYN+uOwyfbHIPm4y9m+8ufncROQ7sfr0qXY62of03RBf2zs/ryj2eMuZ8dU77oJtd7zbZo+6NfA927oeUPr/vWN2KFygxdBb+oCCvdU7uYvp6AVdexKE/FVoaGvTYmgD/3d+8KfkaEXMuoCold6z/HVOjD0cq2lT2odupEd8Z6f0rRB3wW9d2OPZ68DNijspQt6c5c4zA1nqb3z3Gt+RxzauKX6Qb+nz2+sUepbBLtU//yQdaoX9DFfQyp1Dfja7/ktTRv0iI2/iFsk576f9tIF/eVgOPXlDo9B0/C5K0nkV0Nyoz5k7y0y6F2abkZkzAxBdGh2qU7Qbxmf9ejp96ne8/VEQc+9cmb098GvjYxVgr7AJ1X77mO/rSw5W76rzICWmMbKmaI8Vwx6zuGP6HMWproq4rvj6IeJIxo9IzLle76dKOg5Oy73FLNnHvU63oVY0IcOGlOeNLeZYLD75ES0mpGpEfRbwHO/NhC73K8ivduYiAj6OfP5Rd5Bccr3/DBB0HNfu1J3QDs0+JgE3R775FHPmQYsecGGXcHARQT9MPGgFDlD0mV+7ko/x4g9vOsC3vPzBEHfTvzZLLGXbtpd0Ed94E6p7slzY6I+9vHdCr9+q4IDb0TQIy5UEXFXv93Er3VKZYN+Dfo8HRfwnl8mCPqx0M+d8jbX1yTGgp4xWNacjv/kqkjrzIH2UNitwMAXEfSoASFiwyLqkEepKf/coEd9TfOwgPf8PkHQrxmPtfT4kDMTKsiCHnIGd9RFEiKmurZpmcs9lQ1pVGRWld7nIS6FgpAb0qi9vN1C3vPaQV/q4utrgh5+jLjksfYhx7eXfFnOkkGPHAxylmNaftBbuR3ytpH3vGbQNwseH6a4V4agf4HHsfYSe6nvpmOPC15hu4KD+7qRwT1yUGox6JHnaSzlPa8Z9CXf86DUFTcFnf+bijtW/tBeFrzClgz6n0YG98iZghaDHnlIYSnvec2g7xY8PhyT5gh6pT32qNDe0vcGfVtocL81NLhHXrCjxaBHfr2o5Ffzlhr0JR+Sc113Qa9+vfjSYVty0A+FBvfLDAb3pQQ9clp06e+5oAu6oDcuYsrrKOiCLuiCLuiCLujz31O/CrqgC7qgC7qgC3obroUGAUEXdEEX9C6VPewn6IJe3djlltqfen918tRpwSvsNgm6oAt6zvu35K+tCbqgv1xWjT++b5xS65KgC7qgC/rvixu0LDzoOdPa28YfX/T3TOe+dSvogi7ow96/lndyEPQiA9qp8cdX4tKOK0EXdEFffNDH3iDJPccFfVK5x5PXMwx6zuCyE3RBF/TFB33suHgWPEGf89fDSu+llzqefG5kkBN0QRf09oKec0LuWvQEfSoRdxbqCj22bcHHlbMhsxV0QRf0RQd9nfFz7aUL+qRy71N+L7RVeik48K8zn+9K0AVd0Bcb9DmcMIygF/te9i3F3jTjEPB43v2Oc8bPvxaK+qZ/7mMIuqALelzQc6bd78Hj4cMqY3xwKOBLgh71vct7ijlpLOJ2qkOmvXKn9C/BUd9kzJZcDe6CLuihQV9lzl5GR32VOWsg6F906ddbilsuI6ectoGPY1fpeV+DVtpt5uCxM7gLuqCHBj1ipvDvOr0PeO3WmTF3QZkvC/ouxS+3/oO0fRG9Tf93x+ANivTBnnPU8z6N3AJeZ079Dz28IOiCLuifBz13L/3naznm5OHHFHvuY9gkIf66m7NER3Wq5VxxUP/td+/exH3d/5tz0O/cGdwFXdCLBD36UtHXfo998ybi234nIWJjwt75lwZ9Kdcw/nRLeFPwsVyelPj5BndBF/Sy48S10PhwfRofoneqSn0DSdBn4pjmvYwdhOZ4w5ZPV1ZBF3RBHxf0zUzHw30S4K8Oeu6ZlHMKXMmp9xrLzuAu6IJebSZvN7PxYc5XtRT0QOugYzdz2xqd08bMyeAu6N7zqkGPumZHjeWW3PlN0FPMd6LnEri5bsxcDO6C7j2fJOhziHqpi9ow46DPKeqnAs+71T31nCvUCbqgC3p+0FuOupgL+mzjViLmLU+/nzKn0QRd0AU9JugtnkAcffltFhj0R9xa3CI9VHjuxwU9V0EXdEGPC/rjRLkWZjGjL0PNgoNe4tKsuVui3Zc878jnKuiCLuixQX+cdzPlN2QOSWQFPWNvPeJShGOPDx0m2hKt/bxLPFdBF3RBjw/6z731mhv+l+SiMYIeGLh9pQ/wbcKQ/7Y1XjLs936av8SKKuiCLujlgl4r7OfKM5R8QdCfB43oG6z8Ddvjxi6tbtBEXo/9cQ34VeH3SdAFXdDLBv3nax91PfbHTo09ckGvvge76wM/9NrEt/7fHtP7Gxe0Gvdtv8INec6P53vo/98q1Z1dGGMX/FgOGaL3psY+jvWbwXzsz+2854Pf867Q+1fi20L7fsP93Ubkvf83p/T+Rk8I+uTB/7avVnTJGajA6zFRtAUdABB0AEDQAUDQAQBBBwAEHQAQdAAQdABA0AEAQQcABB0ABB0AEHQAQNABAEEHALwIACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agg4ACDoAIOgAgKADgKADAIIOAAg6ACDoACDoAICgAwCCDgAIOgAIOgAg6ACAoAMAgg4Agu5FAABBBwAm9x+vDo6+g0o7jgAAAABJRU5ErkJggg=="/></g></g></svg>
\ No newline at end of file
diff --git a/docs/language/ql-training/cpp/bad-overflow-guard.rst b/docs/language/ql-training/cpp/bad-overflow-guard.rst
index 6937e9a1a4f..dceeec3320f 100644
--- a/docs/language/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/language/ql-training/cpp/bad-overflow-guard.rst
@@ -4,10 +4,6 @@ Example: Bad overflow guard
 
 CodeQL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index 4e6ebbf4292..3fddc3f8072 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -4,10 +4,6 @@ Analyzing control flow
 
 CodeQL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. Include information slides here
 
 .. rst-class:: setup
diff --git a/docs/language/ql-training/cpp/data-flow-cpp.rst b/docs/language/ql-training/cpp/data-flow-cpp.rst
index cb7ed7b5133..e78e8e86220 100644
--- a/docs/language/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/data-flow-cpp.rst
@@ -4,10 +4,6 @@ Introduction to data flow
 
 Finding string formatting vulnerabilities in C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/global-data-flow-cpp.rst b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
index 5a5e93aafda..aaa567e7a8e 100644
--- a/docs/language/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
@@ -3,10 +3,6 @@ Introduction to global data flow
 ================================
 
 CodeQL for C/C++
-
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
    
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index e7d4b318b25..cbe29e6c520 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -4,10 +4,6 @@ Introduction to variant analysis
 
 CodeQL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 077b36520f6..3c062089428 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -4,10 +4,6 @@ Program representation
 
 CodeQL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: agenda
 
 Agenda
diff --git a/docs/language/ql-training/cpp/snprintf.rst b/docs/language/ql-training/cpp/snprintf.rst
index 26c54708c0a..c15bf74d286 100644
--- a/docs/language/ql-training/cpp/snprintf.rst
+++ b/docs/language/ql-training/cpp/snprintf.rst
@@ -4,10 +4,6 @@ Exercise: ``snprintf`` overflow
 
 CodeQL for C/C++
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/index.rst b/docs/language/ql-training/index.rst
index 309fe92c052..021bb58d3c4 100644
--- a/docs/language/ql-training/index.rst
+++ b/docs/language/ql-training/index.rst
@@ -1,10 +1,6 @@
 CodeQL training and variant analysis examples
 =============================================
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. toctree::
    :glob:
    :maxdepth: 1
diff --git a/docs/language/ql-training/java/apache-struts-java.rst b/docs/language/ql-training/java/apache-struts-java.rst
index 73d0122b7ea..be071d41562 100644
--- a/docs/language/ql-training/java/apache-struts-java.rst
+++ b/docs/language/ql-training/java/apache-struts-java.rst
@@ -8,10 +8,6 @@ Exercise: Apache Struts
 
    CVE-2017-9805
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/data-flow-java.rst b/docs/language/ql-training/java/data-flow-java.rst
index 0b9026aadfb..93ccc87b7d1 100644
--- a/docs/language/ql-training/java/data-flow-java.rst
+++ b/docs/language/ql-training/java/data-flow-java.rst
@@ -2,10 +2,6 @@
 Introduction to data flow
 =========================
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 Finding SPARQL injection vulnerabilities in Java
 
 .. rst-class:: setup
diff --git a/docs/language/ql-training/java/global-data-flow-java.rst b/docs/language/ql-training/java/global-data-flow-java.rst
index 062ce30b04c..9edacde93c3 100644
--- a/docs/language/ql-training/java/global-data-flow-java.rst
+++ b/docs/language/ql-training/java/global-data-flow-java.rst
@@ -4,10 +4,6 @@ Introduction to global data flow
 
 CodeQL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index 393e35cf5a8..f7afe713c4a 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -4,10 +4,6 @@ Introduction to variant analysis
 
 CodeQL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/java/program-representation-java.rst b/docs/language/ql-training/java/program-representation-java.rst
index ef078b53562..ba9b1a9d80d 100644
--- a/docs/language/ql-training/java/program-representation-java.rst
+++ b/docs/language/ql-training/java/program-representation-java.rst
@@ -4,10 +4,6 @@ Program representation
 
 CodeQL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: agenda
 
 Agenda
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index dc345d3b39c..a5b46eabda5 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -4,10 +4,6 @@ Example: Query injection
 
 CodeQL for Java
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. rst-class:: setup
 
 Setup
diff --git a/docs/language/ql-training/template.rst b/docs/language/ql-training/template.rst
index 0cce4a11435..21c5abef144 100644
--- a/docs/language/ql-training/template.rst
+++ b/docs/language/ql-training/template.rst
@@ -27,10 +27,6 @@ Template slide deck
    
    Second subheading
 
-.. container:: semmle-logo
-
-   Semmle :sup:`TM`
-
 .. Set up slide. Include link to QL4E snapshots required for examples 
 
 .. rst-class:: setup

From 0b6592f650421c5b5ff001674042577e038367bb Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Mon, 30 Sep 2019 11:51:17 +0100
Subject: [PATCH 142/232] docs: version number and small css tweaks

(cherry picked from commit ff78feeeeaec99bdf779242c33e25f57c7bcab29)
---
 .../slides-semmle-2/static/theme/css/default.css            | 6 ++++--
 docs/language/ql-training/conf.py                           | 4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
index 4f706120747..3f8a89c6555 100644
--- a/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
+++ b/docs/language/ql-training/_static-training/slides-semmle-2/static/theme/css/default.css
@@ -485,6 +485,7 @@ ul {
   margin-left: 2.2em;
   margin-bottom: 1em;
   position: relative;
+  width: 90%;
 }
 /* line 300, ../scss/default.scss */
 ul li {
@@ -1452,6 +1453,7 @@ hgroup .pre {
 .subheading {
   position: absolute;
   top: 62.5%;
+  left: 0;
 }
 
 .subheading p {
@@ -1557,7 +1559,7 @@ p.first.admonition-title {
   text-align: left;
   font-size: 0.8em;
   width: 100%;
-  overflow: scroll;
+  overflow: auto;
   border: 1px solid black;
 }
 
@@ -1596,7 +1598,7 @@ p.first.admonition-title {
   display: block;
   position: fixed;
   top: 0;
-  right: -1%;
+  right: 0;
   font-size: 1.2em;
 }
 
diff --git a/docs/language/ql-training/conf.py b/docs/language/ql-training/conf.py
index de712cd06a4..8f8a13569b5 100644
--- a/docs/language/ql-training/conf.py
+++ b/docs/language/ql-training/conf.py
@@ -86,9 +86,9 @@ htmlhelp_basename = 'QL training'
 # built documents.
 #
 # The short X.Y version.
-version = u'1.21'
+version = u'1.22'
 # The full version, including alpha/beta/rc tags.
-release = u'1.21'
+release = u'1.22'
 copyright = u'2019 Semmle Ltd'
 author = u'Semmle Ltd'
 

From 488ce158887ed174a854730d81dd353c962a5c1d Mon Sep 17 00:00:00 2001
From: James Fletcher <42464962+jf205@users.noreply.github.com>
Date: Tue, 5 Nov 2019 19:57:24 +0000
Subject: [PATCH 143/232] Apply suggestions from code review

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
---
 docs/language/learn-ql/ql-training.rst               | 12 ++++++------
 docs/language/ql-training/cpp/data-flow-cpp.rst      |  4 ++--
 docs/language/ql-training/cpp/intro-ql-cpp.rst       |  2 +-
 .../ql-training/cpp/program-representation-cpp.rst   |  6 +++---
 docs/language/ql-training/java/intro-ql-java.rst     |  2 +-
 .../ql-training/slide-snippets/intro-ql-general.rst  |  2 +-
 6 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/docs/language/learn-ql/ql-training.rst b/docs/language/learn-ql/ql-training.rst
index 757de7daed6..4187ae621b5 100644
--- a/docs/language/learn-ql/ql-training.rst
+++ b/docs/language/learn-ql/ql-training.rst
@@ -1,8 +1,8 @@
 CodeQL training and variant analysis examples
 =============================================
 
-QL and variant analysis
------------------------
+CodeQL and variant analysis
+---------------------------
 
 `Variant analysis <https://semmle.com/variant-analysis>`__ is the process of using a known vulnerability as a seed to find similar problems in your code. Security engineers typically perform variant analysis to identify possible vulnerabilities and to ensure that these threats are properly fixed across multiple code bases.
 
@@ -10,8 +10,8 @@ QL and variant analysis
 
 CodeQL is easy to learn, and exploring code using CodeQL is the most efficient way to perform variant analysis. 
 
-Learning QL for variant analysis
---------------------------------
+Learning CodeQL for variant analysis
+------------------------------------
 
 Start learning how to use CodeQL in variant analysis for a specific language by looking at the topics below. Each topic links to a short presentation on CodeQL, its libraries, or an example variant discovered using CodeQL.
 
@@ -45,7 +45,7 @@ CodeQL and variant analysis for C/C++
 - `Introduction to local data flow <../ql-training/cpp/data-flow-cpp.html>`__–an introduction to analyzing local data flow in C/C++ using CodeQL, including an example demonstrating how to develop a query to find a real CVE.
 - `Exercise: snprintf overflow <../ql-training/cpp/snprintf.html>`__–an example demonstrating how to develop a data flow query.
 - `Introduction to global data flow <../ql-training/cpp/global-data-flow-cpp.html>`__–an introduction to analyzing global data flow in C/C++ using CodeQL.
-- `Analyzing control flow: CodeQL for C/C++  <../ql-training/cpp/control-flow-cpp.html>`__–an introduction to analyzing control flow in C/C++ using QL.
+- `Analyzing control flow: CodeQL for C/C++  <../ql-training/cpp/control-flow-cpp.html>`__–an introduction to analyzing control flow in C/C++ using CodeQL.
 
 CodeQL and variant analysis for Java
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -61,6 +61,6 @@ More resources
 ~~~~~~~~~~~~~~
 
 - If you are completely new to CodeQL, look at our introductory topics in :doc:`Learning CodeQL <index>`.
-- To find more detailed information about how to write CodeQL queries for specific languages, visit the links in :ref:`Writing CodeQL queries <writing-ql-queries>`.
+- To find more detailed information about how to write queries for specific languages, visit the links in :ref:`Writing CodeQL queries <writing-ql-queries>`.
 - To read more about how CodeQL queries have been used in Semmle's security research, and to read about new CodeQL developments, visit the `Semmle blog <https://blog.semmle.com>`__. 
 - Find more examples of queries written by Semmle's own security researchers in the `Semmle Demos repository <https://github.com/semmle/demos>`__ on GitHub.
diff --git a/docs/language/ql-training/cpp/data-flow-cpp.rst b/docs/language/ql-training/cpp/data-flow-cpp.rst
index e78e8e86220..32a3dfa233b 100644
--- a/docs/language/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/data-flow-cpp.rst
@@ -82,9 +82,9 @@ Write a query that flags ``printf`` calls where the format argument is not a ``S
 
 .. note::
 
-  This first query is about finding places where the format specifier is not a constant string. In CodeQL for C/C++, constant strings are modeled as ``StringLiteral`` nodes, so we are looking for calls to format functions where the format specifier argument is not a string literal.
+  This first query is about finding places where the format specifier is not a constant string. In the CodeQL libraries for C/C++, constant strings are modeled as ``StringLiteral`` nodes, so we are looking for calls to format functions where the format specifier argument is not a string literal.
 
-  The `C/C++ standard libraries <https://help.semmle.com/qldoc/cpp/>`__ include many different formatting functions that may be vulnerable to this particular attack–including ``printf``, ``snprintf``, and others. Furthermore, each of these different formatting functions may include the format string in a different position in the argument list. Instead of laboriously listing all these different variants, we can make use of the CodeQL for C/C++ standard library class ``FormattingFunction``, which provides an interface that models common formatting functions in C/C++.
+  The `C/C++ standard libraries <https://help.semmle.com/qldoc/cpp/>`__ include many different formatting functions that may be vulnerable to this particular attack–including ``printf``, ``snprintf``, and others. Furthermore, each of these different formatting functions may include the format string in a different position in the argument list. Instead of laboriously listing all these different variants, we can make use of the standard CodeQL class ``FormattingFunction``, which provides an interface that models common formatting functions in C/C++.
 
 Meh...
 ======
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index cbe29e6c520..9cfb1d3b442 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -108,7 +108,7 @@ Each query library also implicitly defines a module.
 
   Queries are always contained in query files with the file extension ``.ql``. `Quick queries <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/quick-query.html>`__, run in `QL for Eclipse <https://help.semmle.com/ql-for-eclipse/Content/WebHelp/home-page.html>`__, are no exception: the quick query window maintains a temporary query file in the background.
 
-  Parts of queries can be lifted into `library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``qll``. Definitions within such libraries can be brought into scope using ``import`` statements, and similarly QLL files can import each other’s definitions using “import” statements.
+  Parts of queries can be lifted into `library files <https://help.semmle.com/QL/ql-handbook/modules.html#library-modules>`__ with the extension ``.qll``. Definitions within such libraries can be brought into scope using ``import`` statements, and similarly QLL files can import each other’s definitions using “import” statements.
 
   Logic can be encapsulated as user-defined `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ and `classes <https://help.semmle.com/QL/ql-handbook/types.html#classes>`__, and organized into `modules <https://help.semmle.com/QL/ql-handbook/modules.html>`__. Each QLL file implicitly defines a module, but QL and QLL files can also contain explicit module definitions, as we will see later.
 
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 3c062089428..156cb0a4a68 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -64,7 +64,7 @@ Working with functions
 
 Functions are represented by the Function class. Each declaration or definition of a function is represented by a ``FunctionDeclarationEntry``.
 
-Calls to functions are modeled by class Call and its subclasses:
+Calls to functions are modeled by class ``Call`` and its subclasses:
 
 - ``Call.getTarget()`` gets the declared target of the call; undefined for calls through function pointers
 - ``Function.getACallToThisFunction()`` gets a call to this function
@@ -103,7 +103,7 @@ Working with macros
     #define square(x) x*x
     y = square(y0), z = square(z0)
 
-is represented in the CodeQL database database as:
+is represented in the CodeQL database as:
 
 - A Macro entity representing the text of the *head* and *body* of the macro
 - Assignment nodes, representing the two assignments after preprocessing
@@ -117,4 +117,4 @@ Useful predicates on ``Element``: ``isInMacroExpansion()``, ``isAffectedByMacro(
 
 .. note::
 
-  The CodeQL database also contains information about macro definitions, which are represented by class ``Macro``. These macro definitions are related to the AST nodes resulting from their uses by the class ``MacroAccess``.
\ No newline at end of file
+  The CodeQL database also contains information about macro definitions, which are represented by class ``Macro``. These macro definitions are related to the AST nodes resulting from their uses by the class ``MacroAccess``.
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index f7afe713c4a..46106204ed4 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -158,7 +158,7 @@ Member predicates are inherited and can be overridden.
 
   In the example, declaring a variable “EmptyBlock e” will allow it to range over only those blocks that have zero statements.
 
-Classes in continued
+Classes continued
 =======================
 
 .. container:: column-left
diff --git a/docs/language/ql-training/slide-snippets/intro-ql-general.rst b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
index d559c5bbeb7..ae0c0cdabb5 100644
--- a/docs/language/ql-training/slide-snippets/intro-ql-general.rst
+++ b/docs/language/ql-training/slide-snippets/intro-ql-general.rst
@@ -121,7 +121,7 @@ QL is:
 - a **logic** language based on first-order logic
 - a **declarative** language without side effects
 - an **object-oriented** language
-- a **query** language working on a read-only CodeQL database database
+- a **query** language working on a read-only CodeQL database
 - equipped with rich standard libraries **for program analysis**
 
 .. note::

From 8d02a740dda1b8ed961249b4e40d7e3dfd0c7409 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Tue, 5 Nov 2019 20:03:47 +0000
Subject: [PATCH 144/232] docs: address remaining comments

---
 docs/language/ql-training/conf.py                         | 8 ++++----
 .../ql-training/slide-snippets/local-data-flow.rst        | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/language/ql-training/conf.py b/docs/language/ql-training/conf.py
index 8f8a13569b5..117f515a54f 100644
--- a/docs/language/ql-training/conf.py
+++ b/docs/language/ql-training/conf.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# QL training slides build configuration file
+# CodeQL training slides build configuration file
 #
 # This file is execfile()d with the current directory set to its
 # containing dir.
@@ -59,7 +59,7 @@ highlight_language = 'ql'
 master_doc = 'index'
 
 # General information about the project.
-project = u'QL training and variant analysis examples'
+project = u'CodeQL training and variant analysis examples'
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
@@ -77,10 +77,10 @@ slide_theme_path = ["_static-training/"]
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".
-html_title = 'QL training and variant analysis examples'
+html_title = 'CodeQL training and variant analysis examples'
 
 # Output file base name for HTML help builder.
-htmlhelp_basename = 'QL training'
+htmlhelp_basename = 'CodeQL training'
 # The Semmle version info for the current release you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
diff --git a/docs/language/ql-training/slide-snippets/local-data-flow.rst b/docs/language/ql-training/slide-snippets/local-data-flow.rst
index 068dfc9170a..85b851a9ce0 100644
--- a/docs/language/ql-training/slide-snippets/local-data-flow.rst
+++ b/docs/language/ql-training/slide-snippets/local-data-flow.rst
@@ -70,7 +70,7 @@ Local vs global data flow
 
   For further information, see:
 
-  - `Introduction to data flow analysis in QL <https://help.semmle.com/QL/learn-ql/ql/intro-to-data-flow.html>`__
+  - `Introduction to data flow analysis in CodeQL <https://help.semmle.com/QL/learn-ql/ql/intro-to-data-flow.html>`__
 
 .. rst-class:: background2
 

From fca7d9a391ea21206c6ec533e8fd66ac780c0e31 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@knef.dk>
Date: Wed, 6 Nov 2019 07:42:34 +0100
Subject: [PATCH 145/232] C#: Cache IRType like for C++

---
 csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll | 1 +
 csharp/ql/src/semmle/code/csharp/ir/internal/CSharpType.qll   | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
index 0abfa14023d..5534ed20914 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
@@ -4,6 +4,7 @@
 
 private import internal.IRTypeInternal
 
+cached
 private newtype TIRType =
   TIRVoidType() or
   TIRUnknownType() or
diff --git a/csharp/ql/src/semmle/code/csharp/ir/internal/CSharpType.qll b/csharp/ql/src/semmle/code/csharp/ir/internal/CSharpType.qll
index ac400b210a5..36b1285f9e0 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/internal/CSharpType.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/internal/CSharpType.qll
@@ -144,6 +144,7 @@ private IRType getIRTypeForPRValue(Type type) {
 
 string getOpaqueTagIdentityString(Type tag) { result = tag.getQualifiedName() }
 
+cached
 private newtype TCSharpType =
   TPRValueType(Type type) { exists(getIRTypeForPRValue(type)) } or
   TGLValueAddressType(Type type) { any() } or
@@ -163,6 +164,7 @@ class CSharpType extends TCSharpType {
    * Gets the `IRType` that represents this `CSharpType`. Many different `CSharpType`s can map to a
    * single `IRType`.
    */
+  cached
   abstract IRType getIRType();
 
   /**

From 21d4e5f18624397b811c9fba594924de5be640f4 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Wed, 6 Nov 2019 10:16:43 +0100
Subject: [PATCH 146/232] Doc: Add missing `t` in `support`.

---
 change-notes/1.23/analysis-javascript.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 812e1e67748..49f527af424 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -2,7 +2,7 @@
 
 ## General improvements
 
-* Suppor for `globalThis` has been added.
+* Support for `globalThis` has been added.
 
 * Support for the following frameworks and libraries has been improved:
   - [firebase](https://www.npmjs.com/package/firebase)

From 7a7a8b2b091fad67b88fa138bdad41698a295071 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 25 Oct 2019 11:11:26 +0100
Subject: [PATCH 147/232] JS: More steps in getImmediatePredecessor

---
 .../semmle/javascript/dataflow/DataFlow.qll   | 73 +++++++++++--------
 1 file changed, 41 insertions(+), 32 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 8798df6cc37..7c77df24e09 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -188,11 +188,7 @@ module DataFlow {
       lvalueFlowStep(result, this) and
       not lvalueDefaultFlowStep(_, this)
       or
-      // Use of variable -> definition of variable
-      exists(SsaVariable var |
-        this = valueNode(var.getAUse()) and
-        result = TSsaDefNode(var)
-      )
+      immediateFlowStep(result, this)
       or
       // Refinement of variable -> original definition of variable
       exists(SsaRefinementNode refinement |
@@ -1299,6 +1295,44 @@ module DataFlow {
     )
   }
 
+  /**
+   * Flow steps shared between `getImmediatePredecessor` and `localFlowStep`.
+   *
+   * Inlining is forced because the two relations are indexed differently.
+   */
+  pragma[inline]
+  private predicate immediateFlowStep(Node pred, Node succ) {
+    exists(SsaVariable v |
+      pred = TSsaDefNode(v.getDefinition()) and
+      succ = valueNode(v.getAUse())
+    )
+    or
+    exists(Expr predExpr, Expr succExpr |
+      pred = valueNode(predExpr) and succ = valueNode(succExpr)
+    |
+      predExpr = succExpr.(ParExpr).getExpression()
+      or
+      predExpr = succExpr.(SeqExpr).getLastOperand()
+      or
+      predExpr = succExpr.(AssignExpr).getRhs()
+      or
+      predExpr = succExpr.(TypeAssertion).getExpression()
+      or
+      predExpr = succExpr.(NonNullAssertion).getExpression()
+      or
+      predExpr = succExpr.(ExpressionWithTypeArguments).getExpression()
+    )
+    or
+    // flow from 'this' parameter into 'this' expressions
+    exists(ThisExpr thiz |
+      pred = TThisNode(thiz.getBindingContainer()) and
+      succ = valueNode(thiz)
+    )
+    or
+    // `f.call(...)` and `f.apply(...)` evaluate to the result of the reflective call they perform
+    pred = TReflectiveCallNode(succ.asExpr(), _)
+  }
+
   /**
    * Holds if data can flow from `pred` to `succ` in one local step.
    */
@@ -1309,6 +1343,8 @@ module DataFlow {
     or
     lvalueDefaultFlowStep(pred, succ)
     or
+    immediateFlowStep(pred, succ)
+    or
     // Flow through implicit SSA nodes
     exists(SsaImplicitDefinition ssa | succ = TSsaDefNode(ssa) |
       // from any explicit definition or implicit init of a captured variable into
@@ -1326,45 +1362,18 @@ module DataFlow {
       pred = TSsaDefNode(ssa.(SsaPseudoDefinition).getAnInput().getDefinition())
     )
     or
-    // flow out of local variables
-    exists(SsaVariable v |
-      pred = TSsaDefNode(v.getDefinition()) and
-      succ = valueNode(v.getAUse())
-    )
-    or
     exists(Expr predExpr, Expr succExpr |
       pred = valueNode(predExpr) and succ = valueNode(succExpr)
     |
-      predExpr = succExpr.(ParExpr).getExpression()
-      or
-      predExpr = succExpr.(SeqExpr).getLastOperand()
-      or
       predExpr = succExpr.(LogicalBinaryExpr).getAnOperand()
       or
-      predExpr = succExpr.(AssignExpr).getRhs()
-      or
       predExpr = succExpr.(ConditionalExpr).getABranch()
       or
-      predExpr = succExpr.(TypeAssertion).getExpression()
-      or
-      predExpr = succExpr.(NonNullAssertion).getExpression()
-      or
-      predExpr = succExpr.(ExpressionWithTypeArguments).getExpression()
-      or
       exists(Function f |
         predExpr = f.getAReturnedExpr() and
         localCall(succExpr, f)
       )
     )
-    or
-    // flow from 'this' parameter into 'this' expressions
-    exists(ThisExpr thiz |
-      pred = TThisNode(thiz.getBindingContainer()) and
-      succ = valueNode(thiz)
-    )
-    or
-    // `f.call(...)` and `f.apply(...)` evaluate to the result of the reflective call they perform
-    pred = TReflectiveCallNode(succ.asExpr(), _)
   }
 
   /**

From bc35f24f31e8d6772e16eb02adb74a3ad38aaaec Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 25 Oct 2019 11:11:42 +0100
Subject: [PATCH 148/232] JS: Generalize access paths to arbitrary root nodes

---
 .../semmle/javascript/GlobalAccessPaths.qll   | 266 ++++++++++++------
 .../javascript/dataflow/TypeTracking.qll      |  20 ++
 .../dataflow/internal/CallGraphs.qll          |   6 +-
 .../CallGraphs/AnnotatedTest/access-path.js   |  39 +++
 4 files changed, 242 insertions(+), 89 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/access-path.js

diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 9e089fc9cf0..99e0d168298 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -5,6 +5,24 @@
 import javascript
 
 module GlobalAccessPath {
+  /**
+   * A source node that can be the root of an access path.
+   */
+  private class Root extends DataFlow::SourceNode {
+    Root() {
+      not this.accessesGlobal(_) and
+      not this instanceof DataFlow::PropRead and
+      not this instanceof PropertyProjection and
+      not this instanceof Closure::ClosureNamespaceAccess and
+      not this = DataFlow::parameterNode(any(ImmediatelyInvokedFunctionExpr iife).getAParameter())
+    }
+
+    /** Holds if this represents the root of the global access path. */
+    predicate isGlobal() {
+      this = DataFlow::globalAccessPathRootPseudoNode()
+    }
+  }
+
   /**
    * A local variable with exactly one definition, not counting implicit initialization.
    */
@@ -20,6 +38,78 @@ module GlobalAccessPath {
     DataFlow::Node getValue() { result = getSsaDefinition().getRhsNode() }
   }
 
+  /**
+   * Gets the access path relative to `root` referred to by `node`.
+   *
+   * This holds for direct references as well as for aliases
+   * established through local data flow.
+   *
+   * Examples:
+   * ```
+   * function f(x) {
+   *   let a = x.f.g; // access path relative to 'x' is '.f.g'
+   *   let b = a.h;   // access path relative to 'x' is '.f.g.h'
+   * }
+   * ```
+   */
+  cached
+  string fromReference(DataFlow::Node node, Root root) {
+    root = node and
+    not root.isGlobal() and
+    result = ""
+    or
+    result = fromReference(node.getImmediatePredecessor(), root)
+    or
+    exists(EffectivelyConstantVariable var |
+      var.isCaptured() and
+      node.asExpr() = var.getAnAccess() and
+      result = fromReference(var.getValue(), root)
+    )
+    or
+    node.accessesGlobal(result) and
+    result != "undefined" and
+    root.isGlobal()
+    or
+    not node.accessesGlobal(_) and
+    exists(DataFlow::PropRead prop | node = prop |
+      result = fromReference(prop.getBase(), root) + "." + prop.getPropertyName()
+    )
+    or
+    exists(Closure::ClosureNamespaceAccess acc | node = acc |
+      result = acc.getClosureNamespace() and
+      root.isGlobal()
+    )
+    or
+    exists(PropertyProjection proj | node = proj |
+      proj.isSingletonProjection() and
+      result = fromReference(proj.getObject(), root) + "." + proj.getASelector()
+    )
+    or
+    // Treat 'e || {}' as having the same name as 'e'
+    exists(LogOrExpr e | node.asExpr() = e |
+      e.getRightOperand().(ObjectExpr).getNumProperty() = 0 and
+      result = fromReference(e.getLeftOperand().flow(), root)
+    )
+    or
+    // Treat 'e && e.f' as having the same name as 'e.f'
+    exists(LogAndExpr e, Expr lhs, PropAccess rhs | node.asExpr() = e |
+      lhs = e.getLeftOperand() and
+      rhs = e.getRightOperand() and
+      (
+        exists(Variable v |
+          lhs = v.getAnAccess() and
+          rhs.getBase() = v.getAnAccess()
+        )
+        or
+        exists(string name |
+          lhs.(PropAccess).getQualifiedName() = name and
+          rhs.getBase().(PropAccess).getQualifiedName() = name
+        )
+      ) and
+      result = fromReference(rhs.flow(), root)
+    )
+  }
+
   /**
    * Gets the global access path referred to by `node`.
    *
@@ -40,52 +130,7 @@ module GlobalAccessPath {
    */
   cached
   string fromReference(DataFlow::Node node) {
-    result = fromReference(node.getImmediatePredecessor())
-    or
-    exists(EffectivelyConstantVariable var |
-      var.isCaptured() and
-      node.asExpr() = var.getAnAccess() and
-      result = fromReference(var.getValue())
-    )
-    or
-    node.accessesGlobal(result) and
-    result != "undefined"
-    or
-    not node.accessesGlobal(_) and
-    exists(DataFlow::PropRead prop | node = prop |
-      result = fromReference(prop.getBase()) + "." + prop.getPropertyName()
-    )
-    or
-    exists(Closure::ClosureNamespaceAccess acc | node = acc | result = acc.getClosureNamespace())
-    or
-    exists(PropertyProjection proj | node = proj |
-      proj.isSingletonProjection() and
-      result = fromReference(proj.getObject()) + "." + proj.getASelector()
-    )
-    or
-    // Treat 'e || {}' as having the same name as 'e'
-    exists(LogOrExpr e | node.asExpr() = e |
-      e.getRightOperand().(ObjectExpr).getNumProperty() = 0 and
-      result = fromReference(e.getLeftOperand().flow())
-    )
-    or
-    // Treat 'e && e.f' as having the same name as 'e.f'
-    exists(LogAndExpr e, Expr lhs, PropAccess rhs | node.asExpr() = e |
-      lhs = e.getLeftOperand() and
-      rhs = e.getRightOperand() and
-      (
-        exists(Variable v |
-          lhs = v.getAnAccess() and
-          rhs.getBase() = v.getAnAccess()
-        )
-        or
-        exists(string name |
-          lhs.(PropAccess).getQualifiedName() = name and
-          rhs.getBase().(PropAccess).getQualifiedName() = name
-        )
-      ) and
-      result = fromReference(rhs.flow())
-    )
+    result = fromReference(node, DataFlow::globalAccessPathRootPseudoNode())
   }
 
   /**
@@ -96,7 +141,9 @@ module GlobalAccessPath {
    * foo = foo || {};
    * ```
    */
-  private predicate isSelfAssignment(DataFlow::Node rhs) { fromRhs(rhs) = fromReference(rhs) }
+  private predicate isSelfAssignment(DataFlow::Node rhs) {
+    fromRhs(rhs, DataFlow::globalAccessPathRootPseudoNode()) = fromReference(rhs, DataFlow::globalAccessPathRootPseudoNode())
+  }
 
   /**
    * Holds if there is an assignment to `accessPath` in `file`, not counting
@@ -104,7 +151,7 @@ module GlobalAccessPath {
    */
   private predicate isAssignedInFile(string accessPath, File file) {
     exists(DataFlow::Node rhs |
-      fromRhs(rhs) = accessPath and
+      fromRhs(rhs, DataFlow::globalAccessPathRootPseudoNode()) = accessPath and
       not isSelfAssignment(rhs) and
       // Note: Avoid unneeded materialization of DataFlow::Node.getFile()
       rhs.getAstNode().getFile() = file
@@ -112,13 +159,71 @@ module GlobalAccessPath {
   }
 
   /**
-   * Holds if `accessPath` is only assigned to from one file, not counting
+   * Holds if the global `accessPath` is only assigned to from one file, not counting
    * self-assignments.
    */
   predicate isAssignedInUniqueFile(string accessPath) {
     strictcount(File f | isAssignedInFile(accessPath, f)) = 1
   }
 
+  /**
+   * Gets the access path relative to `root`, which `node` is being assigned to, if any.
+   *
+   * Only holds for the immediate right-hand side of an assignment or property, not
+   * for nodes that transitively flow there.
+   *
+   * For example, the class nodes below all map to `.foo.bar` relative to `x`:
+   * ```
+   * function f(x) {
+   *   x.foo.bar = class {};
+   *   x.foo = { bar: class() };
+   *   let alias = x;
+   *   alias.foo.bar = class {};
+   * }
+   * ```
+   */
+  cached
+  string fromRhs(DataFlow::Node node, Root root) {
+    exists(DataFlow::SourceNode base, string baseName, string name |
+      node = base.getAPropertyWrite(name).getRhs() and
+      result = baseName + "." + name
+    |
+      baseName = fromReference(base, root)
+      or
+      baseName = fromRhs(base, root)
+    )
+    or
+    exists(GlobalVariable var |
+      node = var.getAnAssignedExpr().flow() and
+      result = var.getName() and
+      root.isGlobal()
+    )
+    or
+    exists(FunctionDeclStmt fun |
+      node = DataFlow::valueNode(fun) and
+      result = fun.getId().(GlobalVarDecl).getName() and
+      root.isGlobal()
+    )
+    or
+    exists(ClassDeclStmt cls |
+      node = DataFlow::valueNode(cls) and
+      result = cls.getIdentifier().(GlobalVarDecl).getName() and
+      root.isGlobal()
+    )
+    or
+    exists(EnumDeclaration decl |
+      node = DataFlow::valueNode(decl) and
+      result = decl.getIdentifier().(GlobalVarDecl).getName() and
+      root.isGlobal()
+    )
+    or
+    exists(NamespaceDeclaration decl |
+      node = DataFlow::valueNode(decl) and
+      result = decl.getId().(GlobalVarDecl).getName() and
+      root.isGlobal()
+    )
+  }
+
   /**
    * Gets the global access path `node` is being assigned to, if any.
    *
@@ -138,48 +243,41 @@ module GlobalAccessPath {
    */
   cached
   string fromRhs(DataFlow::Node node) {
-    exists(DataFlow::SourceNode base, string baseName, string name |
-      node = base.getAPropertyWrite(name).getRhs() and
-      result = baseName + "." + name
-    |
-      baseName = fromReference(base)
-      or
-      baseName = fromRhs(base)
-    )
+    result = fromRhs(node, DataFlow::globalAccessPathRootPseudoNode())
+  }
+
+  /**
+   * Gets the access path relative to `root` referenced by or assigned to `node`.
+   */
+  string getAccessPath(DataFlow::Node node, Root root) {
+    result = fromReference(node, root)
     or
-    exists(GlobalVariable var |
-      node = var.getAnAssignedExpr().flow() and
-      result = var.getName()
-    )
-    or
-    exists(FunctionDeclStmt fun |
-      node = DataFlow::valueNode(fun) and
-      result = fun.getId().(GlobalVarDecl).getName()
-    )
-    or
-    exists(ClassDeclStmt cls |
-      node = DataFlow::valueNode(cls) and
-      result = cls.getIdentifier().(GlobalVarDecl).getName()
-    )
-    or
-    exists(EnumDeclaration decl |
-      node = DataFlow::valueNode(decl) and
-      result = decl.getIdentifier().(GlobalVarDecl).getName()
-    )
-    or
-    exists(NamespaceDeclaration decl |
-      node = DataFlow::valueNode(decl) and
-      result = decl.getId().(GlobalVarDecl).getName()
-    )
+    not exists(fromReference(node, root)) and
+    result = fromRhs(node, root)
   }
 
   /**
    * Gets the global access path referenced by or assigned to `node`.
    */
   string getAccessPath(DataFlow::Node node) {
-    result = fromReference(node)
+    result = getAccessPath(node, DataFlow::globalAccessPathRootPseudoNode())
+  }
+
+  /**
+   * Holds if there is a step from `pred` to `succ` through an assignment to an access path.
+   */
+  pragma[inline]
+  predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(string name, Root root |
+      name = fromRhs(pred, root) and
+      name = fromReference(succ, root) and
+      not root.isGlobal()
+    )
     or
-    not exists(fromReference(node)) and
-    result = fromRhs(node)
+    exists(string name |
+      name = fromRhs(pred) and
+      name = fromReference(succ) and
+      isAssignedInUniqueFile(name)
+    )
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
index ef639d99ad4..62e53962c3f 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
@@ -14,6 +14,9 @@ private class PropertyName extends string {
     this = any(DataFlow::PropRef pr).getPropertyName()
     or
     GlobalAccessPath::isAssignedInUniqueFile(this)
+    or
+    this = GlobalAccessPath::fromRhs(_, _) and
+    this != ""
   }
 }
 
@@ -95,6 +98,7 @@ module StepSummary {
     any(AdditionalTypeTrackingStep st).step(pred, succ) and
     summary = LevelStep()
     or
+    // Store to global access path
     exists(string name |
       name = GlobalAccessPath::fromRhs(pred) and
       GlobalAccessPath::isAssignedInUniqueFile(name) and
@@ -102,6 +106,7 @@ module StepSummary {
       summary = StoreStep(name)
     )
     or
+    // Load from global access path
     exists(string name |
       name = GlobalAccessPath::fromReference(succ) and
       GlobalAccessPath::isAssignedInUniqueFile(name) and
@@ -109,6 +114,21 @@ module StepSummary {
       summary = LoadStep(name)
     )
     or
+    // Store to non-global access path
+    exists(string name |
+      name = GlobalAccessPath::fromRhs(pred, succ) and
+      succ != DataFlow::globalAccessPathRootPseudoNode() and
+      summary = StoreStep(name)
+    )
+    or
+    // Load from non-global access path
+    exists(string name |
+      name = GlobalAccessPath::fromReference(succ, pred) and
+      pred != DataFlow::globalAccessPathRootPseudoNode() and
+      summary = LoadStep(name) and
+      name != ""
+    )
+    or
     // Summarize calls with flow directly from a parameter to a return.
     exists(DataFlow::ParameterNode param, DataFlow::FunctionNode fun |
       (
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
index a5e140734a4..1e554b170f1 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
@@ -43,11 +43,7 @@ module CallGraph {
     or
     imprecision = 0 and
     t.start() and
-    exists(string name |
-      GlobalAccessPath::isAssignedInUniqueFile(name) and
-      GlobalAccessPath::fromRhs(function) = name and
-      GlobalAccessPath::fromReference(result) = name
-    )
+    GlobalAccessPath::step(function, result)
     or
     imprecision = 0 and
     exists(DataFlow::ClassNode cls |
diff --git a/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/access-path.js b/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/access-path.js
new file mode 100644
index 00000000000..f320d3ae8f4
--- /dev/null
+++ b/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/access-path.js
@@ -0,0 +1,39 @@
+function foo() {
+  let self = this;
+
+  /** name:direct */
+  self.foo.bar.direct = function() {};
+
+  /** calls:direct */
+  self.foo.bar.direct();
+
+  self.foo.bar = {
+    /** name:baz */
+    baz() {},
+    bong() {
+      /** calls:baz */
+      self.foo.bar.baz();
+    }
+  }
+
+  /** calls:baz */
+  self.foo.bar.baz();
+
+  self.foo.bar.Class = class {
+    /** name:m */
+    m() {}
+  }
+
+  self.foo.bar.instance = new self.foo.bar.Class();
+
+  /** calls:m */
+  self.foo.bar.instance.m();
+
+  let unknownObject = unknownCall();
+
+  /** name:direct2 */
+  unknownObject.bar.baz.direct = function() {};
+
+  /** calls:direct2 */
+  unknownObject.bar.baz.direct();
+}

From e90516d4d8baebff5228d6190f58306f47407175 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Thu, 24 Oct 2019 09:51:47 +0100
Subject: [PATCH 149/232] JS: Dont use getALocalSource in fromRhs

---
 .../ql/src/semmle/javascript/GlobalAccessPaths.qll     | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 99e0d168298..3e797e7914c 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -184,13 +184,13 @@ module GlobalAccessPath {
    */
   cached
   string fromRhs(DataFlow::Node node, Root root) {
-    exists(DataFlow::SourceNode base, string baseName, string name |
-      node = base.getAPropertyWrite(name).getRhs() and
-      result = baseName + "." + name
+    exists(DataFlow::PropWrite write, string baseName |
+      node = write.getRhs() and
+      result = baseName + "." + write.getPropertyName()
     |
-      baseName = fromReference(base, root)
+      baseName = fromReference(write.getBase(), root)
       or
-      baseName = fromRhs(base, root)
+      baseName = fromRhs(write.getBase(), root)
     )
     or
     exists(GlobalVariable var |

From c365833731965757e9123cb87d446c5a92bcdaa0 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Fri, 25 Oct 2019 11:47:50 +0100
Subject: [PATCH 150/232] JS: Refactor the public access path API

---
 .../ql/src/semmle/javascript/Closure.qll      |   4 +-
 .../semmle/javascript/GlobalAccessPaths.qll   | 169 +++++++++++++-----
 javascript/ql/src/semmle/javascript/JSDoc.qll |   2 +-
 .../src/semmle/javascript/dataflow/Nodes.qll  |  10 +-
 .../javascript/dataflow/TypeTracking.qll      |  19 +-
 .../dataflow/internal/CallGraphs.qll          |   2 +-
 6 files changed, 136 insertions(+), 70 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/Closure.qll b/javascript/ql/src/semmle/javascript/Closure.qll
index 066f68ca5fa..83b8049d48f 100644
--- a/javascript/ql/src/semmle/javascript/Closure.qll
+++ b/javascript/ql/src/semmle/javascript/Closure.qll
@@ -230,7 +230,7 @@ module Closure {
    * Gets the closure namespace path addressed by the given data flow node, if any.
    */
   string getClosureNamespaceFromSourceNode(DataFlow::SourceNode node) {
-    result = GlobalAccessPath::getAccessPath(node) and
+    node = AccessPath::getAReferenceOrAssignmentTo(result) and
     hasClosureNamespacePrefix(result)
   }
 
@@ -238,7 +238,7 @@ module Closure {
    * Gets the closure namespace path written to by the given property write, if any.
    */
   string getWrittenClosureNamespace(DataFlow::PropWrite node) {
-    result = GlobalAccessPath::fromRhs(node.getRhs()) and
+    node.getRhs() = AccessPath::getAnAssignmentTo(result) and
     hasClosureNamespacePrefix(result)
   }
 
diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 3e797e7914c..8833e3a9179 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -4,11 +4,41 @@
 
 import javascript
 
+deprecated
 module GlobalAccessPath {
+  /**
+   * DEPRECATED. Instead use `AccessPath::getAReferenceTo` with the result and parameter reversed.
+   */
+  pragma[inline]
+  string fromReference(DataFlow::Node node) {
+    node = AccessPath::getAReferenceTo(result)
+  }
+
+  /**
+   * DEPRECATED. Instead use `AccessPath::getAnAssignmentTo` with the result and parameter reversed.
+   */
+  pragma[inline]
+  string fromRhs(DataFlow::Node node) {
+    node = AccessPath::getAnAssignmentTo(result)
+  }
+
+  /**
+   * DEPRECATED. Use `AccessPath::getAReferenceOrAssignmentTo`.
+   */
+  pragma[inline]
+  string getAccessPath(DataFlow::Node node) {
+    result = fromReference(node)
+    or
+    not exists(fromReference(node)) and
+    result = fromRhs(node)
+  }
+}
+
+module AccessPath {
   /**
    * A source node that can be the root of an access path.
    */
-  private class Root extends DataFlow::SourceNode {
+  class Root extends DataFlow::SourceNode {
     Root() {
       not this.accessesGlobal(_) and
       not this instanceof DataFlow::PropRead and
@@ -53,7 +83,7 @@ module GlobalAccessPath {
    * ```
    */
   cached
-  string fromReference(DataFlow::Node node, Root root) {
+  private string fromReference(DataFlow::Node node, Root root) {
     root = node and
     not root.isGlobal() and
     result = ""
@@ -110,29 +140,6 @@ module GlobalAccessPath {
     )
   }
 
-  /**
-   * Gets the global access path referred to by `node`.
-   *
-   * This holds for direct references as well as for aliases
-   * established through local data flow.
-   *
-   * Examples:
-   * ```
-   * function f() {
-   *   let v = foo.bar; // reference to 'foo.bar'
-   *   v.baz;           // reference to 'foo.bar.baz'
-   * }
-   *
-   * (function(ns) {
-   *   ns.x;            // reference to 'NS.x'
-   * })(NS = NS || {});
-   * ```
-   */
-  cached
-  string fromReference(DataFlow::Node node) {
-    result = fromReference(node, DataFlow::globalAccessPathRootPseudoNode())
-  }
-
   /**
    * Holds if `rhs` is the right-hand side of a self-assignment.
    *
@@ -183,7 +190,7 @@ module GlobalAccessPath {
    * ```
    */
   cached
-  string fromRhs(DataFlow::Node node, Root root) {
+  private string fromRhs(DataFlow::Node node, Root root) {
     exists(DataFlow::PropWrite write, string baseName |
       node = write.getRhs() and
       result = baseName + "." + write.getPropertyName()
@@ -225,42 +232,109 @@ module GlobalAccessPath {
   }
 
   /**
-   * Gets the global access path `node` is being assigned to, if any.
+   * Gets a node that refers to the given access path relative to the given `root` node,
+   * or `root` itself if the access path is empty.
    *
-   * Only holds for the immediate right-hand side of an assignment or property, not
-   * for nodes that transitively flow there.
+   * This works for direct references as well as for aliases established through local data flow.
    *
-   * For example, the class nodes below all map to `foo.bar`:
+   * Note that non-empty access paths contain an initial `.`, such as in `.foo.bar`.
+   *
+   * For example:
+   * ```
+   * function f(x) {
+   *   let a = x.f.g; // reference to (x, ".f.g")
+   *   let b = a.h;   // reference to (x, ".f.g.h")
+   * }
+   * ```
+   */
+  DataFlow::Node getAReferenceTo(Root root, string path) {
+    path = fromReference(result, root) and
+    not root.isGlobal()
+  }
+
+  /**
+   * Gets a node that refers to the given global access path.
+   *
+   * This works for direct references as well as for aliases established through local data flow.
+   *
+   * Examples:
+   * ```
+   * function f() {
+   *   let v = foo.bar; // reference to 'foo.bar'
+   *   v.baz;           // reference to 'foo.bar.baz'
+   * }
+   *
+   * (function(ns) {
+   *   ns.x;            // reference to 'NS.x'
+   * })(NS = NS || {});
+   * ```
+   */
+  DataFlow::Node getAReferenceTo(string path) {
+    path = fromReference(result, DataFlow::globalAccessPathRootPseudoNode())
+  }
+
+  /**
+   * Gets a node that is assigned to the given access path relative to the given `root` node.
+   *
+   * Only gets the immediate right-hand side of an assignment or property, not
+   * nodes that transitively flow there.
+   *
+   * Note that access paths contain an initial `.`, such as in `.foo.bar`.
+   *
+   * For example, the class nodes below are all assignments to `(x, ".foo.bar")`.
+   * ```
+   * function f(x) {
+   *   x.foo.bar = class {};
+   *   x.foo = { bar: class() };
+   *   let alias = x;
+   *   alias.foo.bar = class {};
+   * }
+   * ```
+   */
+  DataFlow::Node getAnAssignmentTo(Root root, string path) {
+    path = fromRhs(result, root) and
+    not root.isGlobal()
+  }
+
+  /**
+   * Gets a node that is assigned to the given global access path.
+   *
+   * Only gets the immediate right-hand side of an assignment or property or a global declaration,
+   * not nodes that transitively flow there.
+   *
+   * For example, the class nodes below are all assignmetns to `foo.bar`:
    * ```
    * foo.bar = class {};
-   *
    * foo = { bar: class {} };
-   *
    * (function(f) {
    *   f.bar = class {}
    *  })(foo = foo || {});
    * ```
    */
-  cached
-  string fromRhs(DataFlow::Node node) {
-    result = fromRhs(node, DataFlow::globalAccessPathRootPseudoNode())
+  DataFlow::Node getAnAssignmentTo(string path) {
+    path = fromRhs(result, DataFlow::globalAccessPathRootPseudoNode())
   }
 
   /**
-   * Gets the access path relative to `root` referenced by or assigned to `node`.
+   * Gets a node that refers to or is assigned to the given global access path.
+   *
+   * See `getAReferenceTo` and `getAnAssignmentTo` for more details.
    */
-  string getAccessPath(DataFlow::Node node, Root root) {
-    result = fromReference(node, root)
+  DataFlow::Node getAReferenceOrAssignmentTo(string path) {
+    result = getAReferenceTo(path)
     or
-    not exists(fromReference(node, root)) and
-    result = fromRhs(node, root)
+    result = getAnAssignmentTo(path)
   }
 
   /**
-   * Gets the global access path referenced by or assigned to `node`.
+   * Gets a node that refers to or is assigned to the given access path.
+   *
+   * See `getAReferenceTo` and `getAnAssignmentTo` for more details.
    */
-  string getAccessPath(DataFlow::Node node) {
-    result = getAccessPath(node, DataFlow::globalAccessPathRootPseudoNode())
+  DataFlow::Node getAReferenceOrAssignmentTo(Root root, string path) {
+    result = getAReferenceTo(root, path)
+    or
+    result = getAnAssignmentTo(root, path)
   }
 
   /**
@@ -269,14 +343,13 @@ module GlobalAccessPath {
   pragma[inline]
   predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(string name, Root root |
-      name = fromRhs(pred, root) and
-      name = fromReference(succ, root) and
-      not root.isGlobal()
+      pred = getAnAssignmentTo(root, name) and
+      succ = getAReferenceTo(root, name)
     )
     or
     exists(string name |
-      name = fromRhs(pred) and
-      name = fromReference(succ) and
+      pred = getAnAssignmentTo(name) and
+      succ = getAReferenceTo(name) and
       isAssignedInUniqueFile(name)
     )
   }
diff --git a/javascript/ql/src/semmle/javascript/JSDoc.qll b/javascript/ql/src/semmle/javascript/JSDoc.qll
index 806a9477ba6..c080061bc7c 100644
--- a/javascript/ql/src/semmle/javascript/JSDoc.qll
+++ b/javascript/ql/src/semmle/javascript/JSDoc.qll
@@ -582,7 +582,7 @@ module JSDoc {
      * within this container.
      */
     string resolveAlias(string alias) {
-      result = GlobalAccessPath::getAccessPath(getNodeFromAlias(alias))
+      getNodeFromAlias(alias) = AccessPath::getAReferenceOrAssignmentTo(result)
     }
 
     /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index a44f2909ce0..a1e15538ad2 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -771,11 +771,7 @@ class ClassNode extends DataFlow::SourceNode {
    */
   pragma[noinline]
   predicate hasQualifiedName(string name) {
-    exists(DataFlow::Node rhs |
-      getAClassReference().flowsTo(rhs) and
-      name = GlobalAccessPath::fromRhs(rhs) and
-      GlobalAccessPath::isAssignedInUniqueFile(name)
-    )
+    getAClassReference().flowsTo(AccessPath::getAnAssignmentTo(name))
   }
 }
 
@@ -883,7 +879,7 @@ module ClassNode {
   }
 
   private DataFlow::PropRef getAPrototypeReferenceInFile(string name, File f) {
-    GlobalAccessPath::getAccessPath(result.getBase()) = name and
+    result.getBase() = AccessPath::getAReferenceOrAssignmentTo(name) and
     result.getPropertyName() = "prototype" and
     result.getFile() = f
   }
@@ -904,7 +900,7 @@ module ClassNode {
         )
         or
         exists(string name |
-          name = GlobalAccessPath::fromRhs(this) and
+          this = AccessPath::getAnAssignmentTo(name) and
           exists(getAPrototypeReferenceInFile(name, getFile()))
         )
       )
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
index 62e53962c3f..ecbb3187728 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
@@ -13,10 +13,9 @@ private class PropertyName extends string {
   PropertyName() {
     this = any(DataFlow::PropRef pr).getPropertyName()
     or
-    GlobalAccessPath::isAssignedInUniqueFile(this)
+    AccessPath::isAssignedInUniqueFile(this)
     or
-    this = GlobalAccessPath::fromRhs(_, _) and
-    this != ""
+    exists(AccessPath::getAnAssignmentTo(_, this))
   }
 }
 
@@ -100,31 +99,29 @@ module StepSummary {
     or
     // Store to global access path
     exists(string name |
-      name = GlobalAccessPath::fromRhs(pred) and
-      GlobalAccessPath::isAssignedInUniqueFile(name) and
+      pred = AccessPath::getAnAssignmentTo(name) and
+      AccessPath::isAssignedInUniqueFile(name) and
       succ = DataFlow::globalAccessPathRootPseudoNode() and
       summary = StoreStep(name)
     )
     or
     // Load from global access path
     exists(string name |
-      name = GlobalAccessPath::fromReference(succ) and
-      GlobalAccessPath::isAssignedInUniqueFile(name) and
+      succ = AccessPath::getAReferenceTo(name) and
+      AccessPath::isAssignedInUniqueFile(name) and
       pred = DataFlow::globalAccessPathRootPseudoNode() and
       summary = LoadStep(name)
     )
     or
     // Store to non-global access path
     exists(string name |
-      name = GlobalAccessPath::fromRhs(pred, succ) and
-      succ != DataFlow::globalAccessPathRootPseudoNode() and
+      pred = AccessPath::getAnAssignmentTo(succ, name) and
       summary = StoreStep(name)
     )
     or
     // Load from non-global access path
     exists(string name |
-      name = GlobalAccessPath::fromReference(succ, pred) and
-      pred != DataFlow::globalAccessPathRootPseudoNode() and
+      succ = AccessPath::getAReferenceTo(pred, name) and
       summary = LoadStep(name) and
       name != ""
     )
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
index 1e554b170f1..d58a83fa0bd 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
@@ -43,7 +43,7 @@ module CallGraph {
     or
     imprecision = 0 and
     t.start() and
-    GlobalAccessPath::step(function, result)
+    AccessPath::step(function, result)
     or
     imprecision = 0 and
     exists(DataFlow::ClassNode cls |

From b373901e11461d598edb6101dadaa9544ce7e0c8 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Mon, 28 Oct 2019 09:36:27 +0000
Subject: [PATCH 151/232] JS: Avoid leading dot in access paths

---
 .../semmle/javascript/GlobalAccessPaths.qll   | 34 ++++++++++++-------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 8833e3a9179..2b7da2fe7ae 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -68,6 +68,18 @@ module AccessPath {
     DataFlow::Node getValue() { result = getSsaDefinition().getRhsNode() }
   }
 
+  /**
+   * Appends a single property name onto the access path `base`, where
+   * the empty string represents the empty access path.
+   */
+  bindingset[base, prop]
+  private string join(string base, string prop) {
+    base = "" and result = prop
+    or
+    base != "" and
+    result = base + "." + prop
+  }
+
   /**
    * Gets the access path relative to `root` referred to by `node`.
    *
@@ -77,8 +89,8 @@ module AccessPath {
    * Examples:
    * ```
    * function f(x) {
-   *   let a = x.f.g; // access path relative to 'x' is '.f.g'
-   *   let b = a.h;   // access path relative to 'x' is '.f.g.h'
+   *   let a = x.f.g; // access path relative to 'x' is 'f.g'
+   *   let b = a.h;   // access path relative to 'x' is 'f.g.h'
    * }
    * ```
    */
@@ -102,7 +114,7 @@ module AccessPath {
     or
     not node.accessesGlobal(_) and
     exists(DataFlow::PropRead prop | node = prop |
-      result = fromReference(prop.getBase(), root) + "." + prop.getPropertyName()
+      result = join(fromReference(prop.getBase(), root), prop.getPropertyName())
     )
     or
     exists(Closure::ClosureNamespaceAccess acc | node = acc |
@@ -112,7 +124,7 @@ module AccessPath {
     or
     exists(PropertyProjection proj | node = proj |
       proj.isSingletonProjection() and
-      result = fromReference(proj.getObject(), root) + "." + proj.getASelector()
+      result = join(fromReference(proj.getObject(), root), proj.getASelector().getStringValue())
     )
     or
     // Treat 'e || {}' as having the same name as 'e'
@@ -179,7 +191,7 @@ module AccessPath {
    * Only holds for the immediate right-hand side of an assignment or property, not
    * for nodes that transitively flow there.
    *
-   * For example, the class nodes below all map to `.foo.bar` relative to `x`:
+   * For example, the class nodes below all map to `foo.bar` relative to `x`:
    * ```
    * function f(x) {
    *   x.foo.bar = class {};
@@ -193,7 +205,7 @@ module AccessPath {
   private string fromRhs(DataFlow::Node node, Root root) {
     exists(DataFlow::PropWrite write, string baseName |
       node = write.getRhs() and
-      result = baseName + "." + write.getPropertyName()
+      result = join(baseName, write.getPropertyName())
     |
       baseName = fromReference(write.getBase(), root)
       or
@@ -237,13 +249,11 @@ module AccessPath {
    *
    * This works for direct references as well as for aliases established through local data flow.
    *
-   * Note that non-empty access paths contain an initial `.`, such as in `.foo.bar`.
-   *
    * For example:
    * ```
    * function f(x) {
-   *   let a = x.f.g; // reference to (x, ".f.g")
-   *   let b = a.h;   // reference to (x, ".f.g.h")
+   *   let a = x.f.g; // reference to (x, "f.g")
+   *   let b = a.h;   // reference to (x, "f.g.h")
    * }
    * ```
    */
@@ -279,9 +289,7 @@ module AccessPath {
    * Only gets the immediate right-hand side of an assignment or property, not
    * nodes that transitively flow there.
    *
-   * Note that access paths contain an initial `.`, such as in `.foo.bar`.
-   *
-   * For example, the class nodes below are all assignments to `(x, ".foo.bar")`.
+   * For example, the class nodes below are all assignments to `(x, "foo.bar")`.
    * ```
    * function f(x) {
    *   x.foo.bar = class {};

From 7e80823cb62179e2bd21950131f6a864ba2feaa4 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 30 Oct 2019 10:40:09 +0000
Subject: [PATCH 152/232] JS: Fix deprecated API usage

---
 javascript/ql/src/semmle/javascript/dataflow/Nodes.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index a1e15538ad2..d06056a4696 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -965,7 +965,7 @@ module ClassNode {
       )
       or
       exists(string name |
-        GlobalAccessPath::fromRhs(this) = name and
+        this = AccessPath::getAnAssignmentTo(name) and
         result = getAPrototypeReferenceInFile(name, getFile())
       )
       or

From 3ec95881b497c8738703e85f847267d148c39585 Mon Sep 17 00:00:00 2001
From: Asger F <42069257+asger-semmle@users.noreply.github.com>
Date: Wed, 30 Oct 2019 11:16:35 +0000
Subject: [PATCH 153/232] Update
 javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll

Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
---
 javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 2b7da2fe7ae..b19a19482d1 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -165,7 +165,7 @@ module AccessPath {
   }
 
   /**
-   * Holds if there is an assignment to `accessPath` in `file`, not counting
+   * Holds if there is an assignment to the global `accessPath` in `file`, not counting
    * self-assignments.
    */
   private predicate isAssignedInFile(string accessPath, File file) {

From 81723ab92a8d3bdda994a3020ed948e95a5c7f63 Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Wed, 6 Nov 2019 11:57:34 +0000
Subject: [PATCH 154/232] JS: Update GlobalAccessPaths test

---
 .../GlobalAccessPaths/GlobalAccessPaths.expected       |  6 ++++--
 .../GlobalAccessPaths/GlobalAccessPaths.ql             | 10 ++++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected b/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected
index a54916e0142..414252881a2 100644
--- a/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected
+++ b/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected
@@ -1,4 +1,4 @@
-test_fromReference
+test_getAReferenceTo
 | other_ns.js:2:11:2:12 | ns | NS |
 | other_ns.js:3:3:3:4 | ns | NS |
 | other_ns.js:3:3:3:8 | ns.foo | NS.foo |
@@ -39,6 +39,7 @@ test_fromReference
 | test.js:12:19:12:25 | foo.bar | foo.bar |
 | test.js:13:7:13:15 | something | something |
 | test.js:14:5:14:23 | notUnique | bar.baz |
+| test.js:14:5:14:23 | notUnique = bar.baz | bar.baz |
 | test.js:14:17:14:19 | bar | bar |
 | test.js:14:17:14:23 | bar.baz | bar.baz |
 | test.js:22:11:22:12 | ns | NS |
@@ -54,10 +55,11 @@ test_fromReference
 | test.js:33:9:33:16 | bar = {} | foo.bar |
 | test.js:33:22:33:24 | foo | foo |
 | test.js:39:3:39:20 | lazyInit | foo.bar |
+| test.js:39:3:39:20 | lazyInit = foo.bar | foo.bar |
 | test.js:39:14:39:16 | foo | foo |
 | test.js:39:14:39:20 | foo.bar | foo.bar |
 | test.js:40:3:40:10 | lazyInit | foo.bar |
-test_fromRhs
+test_getAnAssignmentTo
 | other_ns.js:4:9:4:16 | NS \|\| {} | NS |
 | other_ns.js:6:12:6:13 | {} | Conflict |
 | test.js:1:1:20:1 | functio ... ss {}\\n} | f |
diff --git a/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.ql b/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.ql
index 4a233f3947b..8412511df8d 100644
--- a/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.ql
+++ b/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.ql
@@ -1,9 +1,11 @@
 import javascript
 
-query string test_fromReference(DataFlow::Node node) {
-  result = GlobalAccessPath::fromReference(node)
+query string test_getAReferenceTo(DataFlow::Node node) {
+  node = AccessPath::getAReferenceTo(result)
 }
 
-query string test_fromRhs(DataFlow::Node node) { result = GlobalAccessPath::fromRhs(node) }
+query string test_getAnAssignmentTo(DataFlow::Node node) {
+  node = AccessPath::getAnAssignmentTo(result)
+}
 
-query string test_assignedUnique() { GlobalAccessPath::isAssignedInUniqueFile(result) }
+query string test_assignedUnique() { AccessPath::isAssignedInUniqueFile(result) }

From dc923ef694ca8cec80f8b25c7285ee13c6231753 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 6 Nov 2019 13:28:46 +0100
Subject: [PATCH 155/232] remove change note

Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
---
 change-notes/1.23/analysis-javascript.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 8b89369fcff..bb135758904 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -11,7 +11,6 @@
   - [rate-limiter-flexible](https://www.npmjs.com/package/rate-limiter-flexible)
 
 * The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.
-* Promises derived from a Deferred object are now recognized.
 
 * TypeScript 3.6 and 3.7 features are now supported.
 

From 19554ff6e7a8584e63b76bbde90ff88379e26781 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 6 Nov 2019 13:37:54 +0100
Subject: [PATCH 156/232] change "e.g." to "for example" in qldoc

---
 javascript/ql/src/Statements/UseOfReturnlessFunction.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
index 48af33b8e43..123515a7cbd 100644
--- a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
+++ b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -160,7 +160,7 @@ predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
 module Deferred {
   /**
    * An instance of a `Deferred` class. 
-   * E.g. the result from `new Deferred()` or `new $.Deferred()`.  
+   * For example the result from `new Deferred()` or `new $.Deferred()`.
    */
   class DeferredInstance extends DataFlow::NewNode {
   	// Describes both `new Deferred()`, `new $.Deferred` and other variants. 

From 24615f2bdbb73398e129cc28fa8a95326c5e53c8 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Wed, 6 Nov 2019 12:37:20 +0000
Subject: [PATCH 157/232] docs: further review comments

---
 docs/language/ql-training/cpp/control-flow-cpp.rst   |  2 +-
 docs/language/ql-training/cpp/intro-ql-cpp.rst       | 12 ++++++------
 .../ql-training/cpp/program-representation-cpp.rst   | 10 +++++-----
 docs/language/ql-training/java/intro-ql-java.rst     | 10 +++++-----
 .../ql-training/java/program-representation-java.rst | 12 ++++++------
 .../ql-training/java/query-injection-java.rst        |  6 +++---
 .../ql-training/slide-snippets/local-data-flow.rst   |  2 +-
 7 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index 3fddc3f8072..f72633b714f 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -89,7 +89,7 @@ Control flow graphs
 Modeling control flow
 =====================
 
-The control flow is modeled with a QL class, ``ControlFlowNode``. Examples of control flow nodes include statements and expressions.
+The control flow is modeled with a CodeQL class, ``ControlFlowNode``. Examples of control flow nodes include statements and expressions.
 
 - ``ControlFlowNode`` provides API for traversing the control flow graph:
 
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index 9cfb1d3b442..4e2cd4ca0b4 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -70,7 +70,7 @@ A simple CodeQL query
 
    A `query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
 
-   In our example here, the first line of the query imports the `CodeQL for C/C++ standard library <https://help.semmle.com/qldoc/cpp/>`__, which defines concepts like ``IfStmt`` and ``Block``.
+   In our example here, the first line of the query imports the `CodeQL library for C/C++ <https://help.semmle.com/qldoc/cpp/>`__, which defines concepts like ``IfStmt`` and ``Block``.
    The query proper starts by declaring two variables–ifStmt and block. These variables represent sets of values in the database, according to the type of each of the variables. For example, ifStmt has the type IfStmt, which means it represents the set of all if statements in the program.
 
    If we simply selected these two variables::
@@ -135,10 +135,10 @@ A predicate allows you to pull out and name parts of a query.
 
    You can imagine a predicate to be a self-contained from-where-select statement, that produces an intermediate relation, or table. In this case, the ``isEmpty`` predicate will be the set of all blocks which are empty.
 
-Classes
-=======
+Classes in QL
+=============
 
-A class allows you to name a set of values and define (member) predicates on them.
+A QL class allows you to name a set of values and define (member) predicates on them.
 
 A class has at least one supertype and optionally a **characteristic predicate**; it contains the values that belong to *all* supertypes *and* satisfy the characteristic predicate, if provided.
 
@@ -158,8 +158,8 @@ Member predicates are inherited and can be overridden.
 
   In the example, declaring a variable “EmptyBlock e” will allow it to range over only those blocks that have zero statements.
 
-Classes continued
-=================
+Classes in QL continued
+=======================
 
 .. container:: column-left
 
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 156cb0a4a68..8f7a4d43de9 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -21,16 +21,16 @@ Agenda
 
 .. resume slides
 
-AST classes
-===========
+AST CodeQL classes
+==================
 
-Important AST classes include:
+Important AST CodeQL classes include:
 
 - ``Expr``: expressions such as assignments, variable references, function calls, ...
 - ``Stmt``: statements such as conditionals, loops, try statements, ... 
 - ``DeclarationEntry``: places where functions, variables or types are declared and/or defined
 
-These three (and all other AST classes) are subclasses of ``Element``.
+These three (and all other AST CodeQL classes) are subclasses of ``Element``.
 
 Symbol table
 ============
@@ -64,7 +64,7 @@ Working with functions
 
 Functions are represented by the Function class. Each declaration or definition of a function is represented by a ``FunctionDeclarationEntry``.
 
-Calls to functions are modeled by class ``Call`` and its subclasses:
+Calls to functions are modeled by CodeQL class ``Call`` and its subclasses:
 
 - ``Call.getTarget()`` gets the declared target of the call; undefined for calls through function pointers
 - ``Function.getACallToThisFunction()`` gets a call to this function
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index 46106204ed4..1666d9caca8 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -70,7 +70,7 @@ A simple CodeQL query
 
    A `query <https://help.semmle.com/QL/ql-handbook/queries.html>`__ consists of a “select” clause that indicates what results should be returned. Typically it will also provide a “from” clause to declare some variables, and a “where” clause to state conditions over those variables. For more information on the structure of query files (including links to useful topics in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__), see `Introduction to query files <https://help.semmle.com/QL/learn-ql/ql/writing-queries/introduction-to-queries.html>`__.
 
-   In our example here, the first line of the query imports the `CodeQL for Java library <https://help.semmle.com/qldoc/java/>`__, which defines concepts like ``IfStmt`` and ``Block``.
+   In our example here, the first line of the query imports the `CodeQL library for Java <https://help.semmle.com/qldoc/java/>`__, which defines concepts like ``IfStmt`` and ``Block``.
    The query proper starts by declaring two variables–ifStmt and block. These variables represent sets of values in the database, according to the type of each of the variables. For example, ``ifStmt`` has the type ``IfStmt``, which means it represents the set of all if statements in the program.
 
    If we simply selected these two variables::
@@ -135,10 +135,10 @@ A predicate allows you to pull out and name parts of a query.
    You can imagine a predicate to be a self-contained from-where-select statement, that produces an intermediate relation, or table. In this case, the ``isEmpty`` predicate will be the set of all blocks which are empty.
 
 
-Classes
-=======
+Classes in QL
+=============
 
-A class allows you to name a set of values and define (member) predicates on them.
+A QL class allows you to name a set of values and define (member) predicates on them.
 
 A class has at least one supertype and optionally a **characteristic predicate**; it contains the values that belong to *all* supertypes *and* satisfy the characteristic predicate, if provided.
 
@@ -158,7 +158,7 @@ Member predicates are inherited and can be overridden.
 
   In the example, declaring a variable “EmptyBlock e” will allow it to range over only those blocks that have zero statements.
 
-Classes continued
+Classes in QL continued
 =======================
 
 .. container:: column-left
diff --git a/docs/language/ql-training/java/program-representation-java.rst b/docs/language/ql-training/java/program-representation-java.rst
index ba9b1a9d80d..a66a81d6083 100644
--- a/docs/language/ql-training/java/program-representation-java.rst
+++ b/docs/language/ql-training/java/program-representation-java.rst
@@ -12,7 +12,7 @@ Agenda
 - Abstract syntax trees
 - Database representation
 - Program elements
-- AST classes
+- AST CodeQL classes
 
 .. insert abstract-syntax-tree.rst
 
@@ -23,7 +23,7 @@ Agenda
 Program elements
 ================
 
-- The QL class ``Element`` represents program elements with a name.
+- The CodeQL class ``Element`` represents program elements with a name.
 - This includes: packages (``Package``), compilation units (``CompilationUnit``), types (``Type``), methods (``Method``), constructors (``Constructor``), and variables (``Variable``).
 - It is often convenient to refer to an element that might either be a method or a constructor; the class ``Callable``, which is a common superclass of ``Method`` and ``Constructor``, can be used for this purpose.
 
@@ -31,7 +31,7 @@ Program elements
 AST
 ===
 
-There are two primary AST classes, used within ``Callables``:
+There are two primary AST CodeQL classes, used within ``Callables``:
 
    - ``Expr``: expressions such as assignments, variable references, function calls, ...
    - ``Stmt``: statements such as conditionals, loops, try statements, ... 
@@ -47,7 +47,7 @@ Types
 
 The database also includes information about the types used in a program:
 
-- ``PrimitiveType`` represents a `primitive type <http://docs.oracle.com/javase/tutorial/java/nutsandbolts/datatypes.html>`__, that is, one of ``boolean``, ``byte``, ``char``, ``double``, ``float``, ``int``, ``long``, ``short``. QL also classifies ``void`` and ``<nulltype>`` (the type of the ``null`` literal) as primitive types.
+- ``PrimitiveType`` represents a `primitive type <http://docs.oracle.com/javase/tutorial/java/nutsandbolts/datatypes.html>`__, that is, one of ``boolean``, ``byte``, ``char``, ``double``, ``float``, ``int``, ``long``, ``short``. CodeQL also classifies ``void`` and ``<nulltype>`` (the type of the ``null`` literal) as primitive types.
 - ``RefType`` represents a reference type; it has several subclasses:
 
   - ``Class`` represents a Java class.
@@ -74,9 +74,9 @@ Working with variables
 Working with callables
 ======================
 
-Callables are represented by the ``Callable`` QL class. 
+Callables are represented by the ``Callable`` CodeQL class. 
 
-Calls to callables are modeled by the QL class ``Call`` and its subclasses:
+Calls to callables are modeled by the CodeQL class ``Call`` and its subclasses:
 
 - ``Call.getCallee()`` gets the declared target of the call
 - ``Call.getAReference()`` gets a call to this function
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index a5b46eabda5..799c99e5209 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -77,14 +77,14 @@ Let’s start by looking for calls to methods with names of the form ``sparql*Qu
 
 .. note::
 
-  - When performing `variant analysis <https://semmle.com/  variant-analysis>`__, it is usually helpful to write a simple   query that finds the simple syntactic pattern, before trying to   go on to describe the cases where it goes wrong.
-  - In this case, we start by looking for all the method calls   which appear to run, before trying to refine the query to find   cases which are vulnerable to query injection.
+  - When performing `variant analysis <https://semmle.com/variant-analysis>`__, it is usually helpful to write a simple query that finds the simple syntactic pattern, before trying to go on to describe the cases where it goes wrong.
+  - In this case, we start by looking for all the method calls that appear to run, before trying to refine the query to find cases which are vulnerable to query injection.
   - The ``select`` clause defines what this query is looking for:
   
     - a ``MethodAccess``: the call to a SPARQL query method
     - a ``Method``: the SPARQL query method.
   
-  - The ``where`` part of the query ties these variables together using `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ defined in the `standard CodeQL for   Java library <https://help.semmle.com/qldoc/java/>`__.
+  - The ``where`` part of the query ties these variables together using `predicates <https://help.semmle.com/QL/ql-handbook/predicates.html>`__ defined in the `standard CodeQL library for Java <https://help.semmle.com/qldoc/java/>`__.
 
 CodeQL query: find string concatenation
 =======================================
diff --git a/docs/language/ql-training/slide-snippets/local-data-flow.rst b/docs/language/ql-training/slide-snippets/local-data-flow.rst
index 85b851a9ce0..ed681b0398a 100644
--- a/docs/language/ql-training/slide-snippets/local-data-flow.rst
+++ b/docs/language/ql-training/slide-snippets/local-data-flow.rst
@@ -70,7 +70,7 @@ Local vs global data flow
 
   For further information, see:
 
-  - `Introduction to data flow analysis in CodeQL <https://help.semmle.com/QL/learn-ql/ql/intro-to-data-flow.html>`__
+  - `Introduction to data flow analysis with CodeQL <https://help.semmle.com/QL/learn-ql/ql/intro-to-data-flow.html>`__
 
 .. rst-class:: background2
 

From a4bf361f6440b7acf870ae9e1509448aa0337e0a Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 15:37:54 +0000
Subject: [PATCH 158/232] JavaScript: Remove remaining `--experimental`
 extractor options.

---
 .../ql/test/library-tests/CFG/CFG.expected    |  8 +-
 .../ql/test/library-tests/CFG/classes.js      |  2 -
 .../ql/test/library-tests/CFG/fields.js       |  2 -
 .../ql/test/library-tests/CFG/mixedMembers.js |  2 -
 .../ql/test/library-tests/CFG/staticFields.js |  3 -
 .../ql/test/library-tests/Classes/fields.js   |  2 -
 .../Comprehensions/comprehensions.js          |  2 -
 .../ql/test/library-tests/DataFlow/tst.js     |  2 -
 .../ql/test/library-tests/Decorators/tst.js   |  2 -
 .../ql/test/library-tests/DefUse/es2015.js    |  2 -
 .../test/library-tests/Expr/legacyletexpr.js  |  2 -
 .../test/library-tests/Expr/mozextensions.js  |  2 -
 .../ql/test/library-tests/Expr/tests.expected | 84 +++++++++----------
 .../library-tests/Flow/namespace-reexport.js  |  2 -
 .../library-tests/Flow/reexport-mixins.js     |  2 -
 .../library-tests/Flow/reexport/lib/index.js  |  2 -
 .../library-tests/Functions/exprclosures.js   |  2 -
 .../ql/test/library-tests/LocalObjects/tst.js |  2 -
 javascript/ql/test/library-tests/Modules/b.js |  2 -
 .../ql/test/library-tests/Modules/m/c.js      |  2 -
 .../test/library-tests/Modules/tests.expected |  6 +-
 .../OptionalChaining/short-circuiting.js      |  1 -
 .../library-tests/OptionalChaining/tst.js     |  2 -
 .../ql/test/library-tests/ThisExpr/tst.js     |  1 -
 .../TypeInference/NullishCoalescing/tst.js    |  1 -
 .../TypeInference/OptionalChaining/tst.js     |  1 -
 .../frameworks/ReactJS/statePropertyReads.js  |  2 -
 .../frameworks/ReactJS/statePropertyWrites.js |  2 -
 .../ql/test/library-tests/stmts/foreach.js    |  2 -
 .../test/library-tests/stmts/guardedCatch.js  |  2 -
 .../ql/test/library-tests/stmts/jscript.js    |  2 -
 .../test/library-tests/stmts/legacyletstmt.js |  2 -
 .../variables/getDeclaringContainer.expected  |  4 +-
 .../library-tests/variables/legacyletstmt.js  |  2 -
 .../Declarations/DeadStoreOfLocal/fields.js   |  2 -
 .../Declarations/UnusedVariable/funbind.js    |  2 -
 .../Declarations/UnusedVariable/restprops.js  |  2 -
 .../HeterogeneousComparison/tst.js            |  2 -
 .../ImplicitOperandConversion/tst.js          |  1 -
 .../Expressions/ShiftOutOfRange/tst.js        |  2 -
 .../SuspiciousInvocation/fields.js            |  2 -
 .../SuspiciousInvocation/optional-chaining.js |  1 -
 .../SuspiciousPropAccess/optional-chaining.js |  1 -
 .../yield_in_non_generator.js                 |  2 -
 .../UnboundEventHandlerReceiver/tst.js        |  2 -
 .../ExpressionClosures/foreach.js             |  2 -
 .../ExpressionClosures/jscript.js             |  2 -
 .../ExpressionClosures/letExpr.js             |  2 -
 .../ExpressionClosures/letStmt.js             |  2 -
 .../postfixComprehension.js                   |  2 -
 .../ExpressionClosures/tst.js                 |  2 -
 .../ForInComprehensionBlocks/tst.js           |  2 -
 .../SemicolonInsertion/jscript.js             |  2 -
 .../YieldInNonGenerator/tst.js                |  3 -
 .../React/DirectStateMutation/valid9.js       |  2 -
 .../issue7506.js                              |  2 -
 .../undefined.js                              |  2 -
 .../UnusedOrUndefinedStateProperty/unused.js  |  2 -
 .../UselessConditional/UselessConditional.js  |  2 -
 59 files changed, 51 insertions(+), 156 deletions(-)

diff --git a/javascript/ql/test/library-tests/CFG/CFG.expected b/javascript/ql/test/library-tests/CFG/CFG.expected
index 7904099cb44..a41f1c4999a 100644
--- a/javascript/ql/test/library-tests/CFG/CFG.expected
+++ b/javascript/ql/test/library-tests/CFG/CFG.expected
@@ -546,7 +546,7 @@
 | classes | 39 | static x = 5; | 39 | t = cla ... () {} } |
 | classes | 39 | t | 39 | A |
 | classes | 39 | t = cla ... () {} } | 39 | t |
-| classes | 39 | t = cla ... () {} } | 42 | exit node of <toplevel> |
+| classes | 39 | t = cla ... () {} } | 40 | exit node of <toplevel> |
 | classes | 39 | x | 39 | 5 |
 | classes | 39 | {} | 39 | exit node of () {} |
 | decorated_parameter | 1 | C | 2 | foo |
@@ -625,7 +625,7 @@
 | fields | 8 | {} | 8 | exit node of () {} |
 | fields | 11 | A | 12 | constructor |
 | fields | 11 | B | 11 | A |
-| fields | 11 | class B ... \\n  z;\\n} | 21 | exit node of <toplevel> |
+| fields | 11 | class B ... \\n  z;\\n} | 19 | exit node of <toplevel> |
 | fields | 12 | constru ... er;\\n  } | 11 | class B ... \\n  z;\\n} |
 | fields | 12 | constructor | 12 | function in constru ... er;\\n  } |
 | fields | 12 | entry node of () {\\n   ... er;\\n  } | 12 | {\\n    b ... er;\\n  } |
@@ -680,7 +680,7 @@
 | globals | 19 | h | 20 | {\\n} |
 | globals | 20 | {\\n} | 21 | exit node of function\\n h()\\n{\\n} |
 | mixedMembers | 1 | Mixed | 3 | constructor |
-| mixedMembers | 1 | class M ... z) {}\\n} | 7 | exit node of <toplevel> |
+| mixedMembers | 1 | class M ... z) {}\\n} | 6 | exit node of <toplevel> |
 | mixedMembers | 1 | entry node of <toplevel> | 1 | Mixed |
 | mixedMembers | 2 | 3 | 2 | x = 3 |
 | mixedMembers | 2 | x | 2 | 3 |
@@ -746,7 +746,7 @@
 | staticFields | 2 | C | 2 | new C() |
 | staticFields | 2 | instance | 2 | C |
 | staticFields | 2 | new C() | 2 | static  ... ew C(); |
-| staticFields | 2 | static  ... ew C(); | 7 | exit node of <toplevel> |
+| staticFields | 2 | static  ... ew C(); | 4 | exit node of <toplevel> |
 | staticFieldsTS | 1 | C | 1 | constructor |
 | staticFieldsTS | 1 | class C ...  C();\\n} | 2 | instance |
 | staticFieldsTS | 1 | constructor | 1 | function in constructor() {} |
diff --git a/javascript/ql/test/library-tests/CFG/classes.js b/javascript/ql/test/library-tests/CFG/classes.js
index cf4bedc2a3b..fa35da77f32 100644
--- a/javascript/ql/test/library-tests/CFG/classes.js
+++ b/javascript/ql/test/library-tests/CFG/classes.js
@@ -37,5 +37,3 @@ t = class extends A { f() {} }
 t = class extends A { x = 5; f() {} }
 t = class extends A { static x = 5; f() {} }
 t = class extends A { static x = 5; f() {} constructor() {} }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/CFG/fields.js b/javascript/ql/test/library-tests/CFG/fields.js
index ef4b105c9ff..e93c13eaa18 100644
--- a/javascript/ql/test/library-tests/CFG/fields.js
+++ b/javascript/ql/test/library-tests/CFG/fields.js
@@ -16,5 +16,3 @@ class B extends A {
   }
   z;
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/CFG/mixedMembers.js b/javascript/ql/test/library-tests/CFG/mixedMembers.js
index 33de7b7ff4a..8ff3721d61c 100644
--- a/javascript/ql/test/library-tests/CFG/mixedMembers.js
+++ b/javascript/ql/test/library-tests/CFG/mixedMembers.js
@@ -3,5 +3,3 @@ class Mixed {
   constructor(y) {}
   method(z) {}
 }
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/CFG/staticFields.js b/javascript/ql/test/library-tests/CFG/staticFields.js
index 5d8fc7605a2..fa3070ab19f 100644
--- a/javascript/ql/test/library-tests/CFG/staticFields.js
+++ b/javascript/ql/test/library-tests/CFG/staticFields.js
@@ -1,6 +1,3 @@
 class C {
   static instance = new C();
 }
-
-// semmle-extractor-options: --experimental
-
diff --git a/javascript/ql/test/library-tests/Classes/fields.js b/javascript/ql/test/library-tests/Classes/fields.js
index 63b701e48ac..f71520fc1f8 100644
--- a/javascript/ql/test/library-tests/Classes/fields.js
+++ b/javascript/ql/test/library-tests/Classes/fields.js
@@ -2,5 +2,3 @@ class C {
   x;
   y = 42
 }
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/Comprehensions/comprehensions.js b/javascript/ql/test/library-tests/Comprehensions/comprehensions.js
index 5194bcc9ddd..32b649bfdae 100644
--- a/javascript/ql/test/library-tests/Comprehensions/comprehensions.js
+++ b/javascript/ql/test/library-tests/Comprehensions/comprehensions.js
@@ -8,5 +8,3 @@ year;
 year;
 (for (i of numbers) for (j of letters) i+j);
 (for (i of numbers) for (j of letters) if (i<j) i+j);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/DataFlow/tst.js b/javascript/ql/test/library-tests/DataFlow/tst.js
index 5de8e4e8688..319ca7fcb45 100644
--- a/javascript/ql/test/library-tests/DataFlow/tst.js
+++ b/javascript/ql/test/library-tests/DataFlow/tst.js
@@ -113,5 +113,3 @@ x ?? y;                           // flow through short-circuiting operator
 });
 
 Array.call()  // flow from implicit call to `Array` to `Array.call`
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Decorators/tst.js b/javascript/ql/test/library-tests/Decorators/tst.js
index 5b3f6432a00..d2135995168 100644
--- a/javascript/ql/test/library-tests/Decorators/tst.js
+++ b/javascript/ql/test/library-tests/Decorators/tst.js
@@ -7,5 +7,3 @@ var o = {
   get bar() { return 42 },
   set bar(v) { }
 };
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/DefUse/es2015.js b/javascript/ql/test/library-tests/DefUse/es2015.js
index 7bc60b605fc..2264f76cecc 100644
--- a/javascript/ql/test/library-tests/DefUse/es2015.js
+++ b/javascript/ql/test/library-tests/DefUse/es2015.js
@@ -4,5 +4,3 @@ for (let fn in fns)
 function getSquares() {
   return [for (i of [0, 1, 2]) i*i];
 }
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Expr/legacyletexpr.js b/javascript/ql/test/library-tests/Expr/legacyletexpr.js
index d5d121d8a79..6e7eedff052 100644
--- a/javascript/ql/test/library-tests/Expr/legacyletexpr.js
+++ b/javascript/ql/test/library-tests/Expr/legacyletexpr.js
@@ -1,3 +1 @@
 console.log(let (x = 23, y = 19) x + y);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/Expr/mozextensions.js b/javascript/ql/test/library-tests/Expr/mozextensions.js
index 5c44146b42f..bab58100c65 100644
--- a/javascript/ql/test/library-tests/Expr/mozextensions.js
+++ b/javascript/ql/test/library-tests/Expr/mozextensions.js
@@ -1,3 +1 @@
 array.map(function(x) x+1);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/Expr/tests.expected b/javascript/ql/test/library-tests/Expr/tests.expected
index 9757957cc39..1c3963b50ea 100644
--- a/javascript/ql/test/library-tests/Expr/tests.expected
+++ b/javascript/ql/test/library-tests/Expr/tests.expected
@@ -682,29 +682,29 @@ test_getTopLevel
 | functions.js:7:4:7:4 | x | functions.js:1:1:10:7 | <toplevel> |
 | functions.js:7:7:7:16 | in_f_again | functions.js:1:1:10:7 | <toplevel> |
 | functions.js:10:1:10:6 | global | functions.js:1:1:10:7 | <toplevel> |
-| legacyletexpr.js:1:1:1:7 | console | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:1:1:11 | console.log | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:1:1:39 | console ...  x + y) | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:9:1:11 | log | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:13:1:38 | let (x  ... ) x + y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:18:1:18 | x | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:18:1:23 | x = 23 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:22:1:23 | 23 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:26:1:26 | y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:26:1:31 | y = 19 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:30:1:31 | 19 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:34:1:34 | x | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:34:1:38 | x + y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:38:1:38 | y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:5 | array | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:9 | array.map | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:26 | array.m ... x) x+1) | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:7:1:9 | map | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:11:1:25 | function(x) x+1 | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:20:1:20 | x | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:23:1:23 | x | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:23:1:25 | x+1 | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:25:1:25 | 1 | mozextensions.js:1:1:3:42 | <toplevel> |
+| legacyletexpr.js:1:1:1:7 | console | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:1:1:11 | console.log | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:1:1:39 | console ...  x + y) | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:9:1:11 | log | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:13:1:38 | let (x  ... ) x + y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:18:1:18 | x | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:18:1:23 | x = 23 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:22:1:23 | 23 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:26:1:26 | y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:26:1:31 | y = 19 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:30:1:31 | 19 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:34:1:34 | x | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:34:1:38 | x + y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:38:1:38 | y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:5 | array | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:9 | array.map | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:26 | array.m ... x) x+1) | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:7:1:9 | map | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:11:1:25 | function(x) x+1 | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:20:1:20 | x | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:23:1:23 | x | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:23:1:25 | x+1 | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:25:1:25 | 1 | mozextensions.js:1:1:2:0 | <toplevel> |
 | nullSensitiveContexts.js:7:1:7:3 | foo | nullSensitiveContexts.js:1:1:61:0 | <toplevel> |
 | nullSensitiveContexts.js:7:1:7:8 | foo[bar] | nullSensitiveContexts.js:1:1:61:0 | <toplevel> |
 | nullSensitiveContexts.js:7:5:7:7 | bar | nullSensitiveContexts.js:1:1:61:0 | <toplevel> |
@@ -1922,25 +1922,25 @@ test_getContainer
 | functions.js:7:4:7:4 | x | functions.js:1:1:9:1 | functio ... \\t\\t});\\n} |
 | functions.js:7:7:7:16 | in_f_again | functions.js:1:1:9:1 | functio ... \\t\\t});\\n} |
 | functions.js:10:1:10:6 | global | functions.js:1:1:10:7 | <toplevel> |
-| legacyletexpr.js:1:1:1:7 | console | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:1:1:11 | console.log | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:1:1:39 | console ...  x + y) | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:9:1:11 | log | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:13:1:38 | let (x  ... ) x + y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:18:1:18 | x | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:18:1:23 | x = 23 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:22:1:23 | 23 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:26:1:26 | y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:26:1:31 | y = 19 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:30:1:31 | 19 | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:34:1:34 | x | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:34:1:38 | x + y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| legacyletexpr.js:1:38:1:38 | y | legacyletexpr.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:5 | array | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:9 | array.map | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:1:1:26 | array.m ... x) x+1) | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:7:1:9 | map | mozextensions.js:1:1:3:42 | <toplevel> |
-| mozextensions.js:1:11:1:25 | function(x) x+1 | mozextensions.js:1:1:3:42 | <toplevel> |
+| legacyletexpr.js:1:1:1:7 | console | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:1:1:11 | console.log | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:1:1:39 | console ...  x + y) | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:9:1:11 | log | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:13:1:38 | let (x  ... ) x + y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:18:1:18 | x | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:18:1:23 | x = 23 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:22:1:23 | 23 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:26:1:26 | y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:26:1:31 | y = 19 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:30:1:31 | 19 | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:34:1:34 | x | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:34:1:38 | x + y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| legacyletexpr.js:1:38:1:38 | y | legacyletexpr.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:5 | array | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:9 | array.map | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:1:1:26 | array.m ... x) x+1) | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:7:1:9 | map | mozextensions.js:1:1:2:0 | <toplevel> |
+| mozextensions.js:1:11:1:25 | function(x) x+1 | mozextensions.js:1:1:2:0 | <toplevel> |
 | mozextensions.js:1:20:1:20 | x | mozextensions.js:1:11:1:25 | function(x) x+1 |
 | mozextensions.js:1:23:1:23 | x | mozextensions.js:1:11:1:25 | function(x) x+1 |
 | mozextensions.js:1:23:1:25 | x+1 | mozextensions.js:1:11:1:25 | function(x) x+1 |
diff --git a/javascript/ql/test/library-tests/Flow/namespace-reexport.js b/javascript/ql/test/library-tests/Flow/namespace-reexport.js
index 0a1e70c5abe..021a140061a 100644
--- a/javascript/ql/test/library-tests/Flow/namespace-reexport.js
+++ b/javascript/ql/test/library-tests/Flow/namespace-reexport.js
@@ -1,3 +1 @@
 export * as h from './h';
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Flow/reexport-mixins.js b/javascript/ql/test/library-tests/Flow/reexport-mixins.js
index f38cd783b9b..ff303ad3432 100644
--- a/javascript/ql/test/library-tests/Flow/reexport-mixins.js
+++ b/javascript/ql/test/library-tests/Flow/reexport-mixins.js
@@ -1,3 +1 @@
 export default from './mixins';
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Flow/reexport/lib/index.js b/javascript/ql/test/library-tests/Flow/reexport/lib/index.js
index 5ffc9d62bc4..e20cf1a083e 100644
--- a/javascript/ql/test/library-tests/Flow/reexport/lib/index.js
+++ b/javascript/ql/test/library-tests/Flow/reexport/lib/index.js
@@ -1,3 +1 @@
 export data from './src/utils/util'
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Functions/exprclosures.js b/javascript/ql/test/library-tests/Functions/exprclosures.js
index 66e0f855744..dd6a10086bd 100644
--- a/javascript/ql/test/library-tests/Functions/exprclosures.js
+++ b/javascript/ql/test/library-tests/Functions/exprclosures.js
@@ -1,3 +1 @@
 a.map(function(x) x+1);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/LocalObjects/tst.js b/javascript/ql/test/library-tests/LocalObjects/tst.js
index dee138c0f27..a02a29776c0 100644
--- a/javascript/ql/test/library-tests/LocalObjects/tst.js
+++ b/javascript/ql/test/library-tests/LocalObjects/tst.js
@@ -89,5 +89,3 @@
 	let bound = {};
 	bound::unknown();
 });
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Modules/b.js b/javascript/ql/test/library-tests/Modules/b.js
index 4b58c09c31b..835bd1abbf6 100644
--- a/javascript/ql/test/library-tests/Modules/b.js
+++ b/javascript/ql/test/library-tests/Modules/b.js
@@ -5,5 +5,3 @@ f();
 export { f as g };
 
 export f2 from './a';
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Modules/m/c.js b/javascript/ql/test/library-tests/Modules/m/c.js
index 6c3645f382d..8192ccc9b45 100644
--- a/javascript/ql/test/library-tests/Modules/m/c.js
+++ b/javascript/ql/test/library-tests/Modules/m/c.js
@@ -3,5 +3,3 @@ import * as b from '../b';
 b.g();
 
 export { g as h } from '../b';
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Modules/tests.expected b/javascript/ql/test/library-tests/Modules/tests.expected
index 8cdd45f9066..39d24b09700 100644
--- a/javascript/ql/test/library-tests/Modules/tests.expected
+++ b/javascript/ql/test/library-tests/Modules/tests.expected
@@ -104,15 +104,15 @@ test_Module_exports
 | a.js:1:1:5:32 | <toplevel> | default | a.js:1:1:3:1 | export  ... n 23;\\n} |
 | a.js:1:1:5:32 | <toplevel> | x | a.js:5:1:5:32 | export  ...  } = o; |
 | a.js:1:1:5:32 | <toplevel> | y | a.js:5:1:5:32 | export  ...  } = o; |
-| b.js:1:1:10:0 | <toplevel> | f2 | b.js:7:1:7:21 | export  ...  './a'; |
-| b.js:1:1:10:0 | <toplevel> | g | b.js:5:1:5:18 | export { f as g }; |
+| b.js:1:1:8:0 | <toplevel> | f2 | b.js:7:1:7:21 | export  ...  './a'; |
+| b.js:1:1:8:0 | <toplevel> | g | b.js:5:1:5:18 | export { f as g }; |
 | e.js:1:1:4:0 | <toplevel> | g | e.js:3:1:3:35 | export  ...  './a'; |
 | e.js:1:1:4:0 | <toplevel> | x | e.js:2:1:2:16 | export { x, y }; |
 | e.js:1:1:4:0 | <toplevel> | y | e.js:2:1:2:16 | export { x, y }; |
 | es2015_require.js:1:1:3:25 | <toplevel> | default | es2015_require.js:3:1:3:25 | export  ... ss C {} |
 | export-in-mjs.mjs:1:1:1:34 | <toplevel> | exported_from_mjs | export-in-mjs.mjs:1:1:1:34 | export  ... s = 42; |
 | f.ts:1:1:6:0 | <toplevel> | foo | f.ts:5:1:5:24 | export  ... oo() {} |
-| m/c.js:1:1:8:0 | <toplevel> | h | m/c.js:5:1:5:30 | export  ... '../b'; |
+| m/c.js:1:1:6:0 | <toplevel> | h | m/c.js:5:1:5:30 | export  ... '../b'; |
 | tst.html:4:23:8:0 | <toplevel> | y | tst.html:7:3:7:22 | export const y = 42; |
 test_ExportDefaultDeclarations
 | a.js:1:1:3:1 | export  ... n 23;\\n} |
diff --git a/javascript/ql/test/library-tests/OptionalChaining/short-circuiting.js b/javascript/ql/test/library-tests/OptionalChaining/short-circuiting.js
index 97576676994..7367e64dd4c 100644
--- a/javascript/ql/test/library-tests/OptionalChaining/short-circuiting.js
+++ b/javascript/ql/test/library-tests/OptionalChaining/short-circuiting.js
@@ -13,4 +13,3 @@
     DUMP(o3);
     DUMP(o4);
 });
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/OptionalChaining/tst.js b/javascript/ql/test/library-tests/OptionalChaining/tst.js
index b0ee7435722..39389024d6d 100644
--- a/javascript/ql/test/library-tests/OptionalChaining/tst.js
+++ b/javascript/ql/test/library-tests/OptionalChaining/tst.js
@@ -13,5 +13,3 @@ a?.m().b;
 a.m?.().b;
 a.m()?.b;
 a?.m?.()?.b;
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/ThisExpr/tst.js b/javascript/ql/test/library-tests/ThisExpr/tst.js
index 418021624e7..316e3feb1de 100644
--- a/javascript/ql/test/library-tests/ThisExpr/tst.js
+++ b/javascript/ql/test/library-tests/ThisExpr/tst.js
@@ -146,4 +146,3 @@ class C_lodash {
     }
 
 }
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/tst.js b/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/tst.js
index 6c3458781a1..28d7e45c44e 100644
--- a/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/tst.js
+++ b/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/tst.js
@@ -21,4 +21,3 @@
 
     v7 = x ?? {};
 });
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/TypeInference/OptionalChaining/tst.js b/javascript/ql/test/library-tests/TypeInference/OptionalChaining/tst.js
index 4890c8335cc..42747617b6b 100644
--- a/javascript/ql/test/library-tests/TypeInference/OptionalChaining/tst.js
+++ b/javascript/ql/test/library-tests/TypeInference/OptionalChaining/tst.js
@@ -22,4 +22,3 @@
     var v11 = h();
     var v12 = h?.();
 });
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js
index df115aac5b8..697bc35c150 100644
--- a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyReads.js
@@ -11,5 +11,3 @@ class Reads extends React.Component {
         prevState.p4;
     }
 }
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js
index 4f15d9a1b31..692400c7381 100644
--- a/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/statePropertyWrites.js
@@ -43,5 +43,3 @@ React.createClass({
     };
   }
 });
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/stmts/foreach.js b/javascript/ql/test/library-tests/stmts/foreach.js
index ee6fd60e59b..1df30053437 100644
--- a/javascript/ql/test/library-tests/stmts/foreach.js
+++ b/javascript/ql/test/library-tests/stmts/foreach.js
@@ -6,5 +6,3 @@ for each (var item in obj) {
 }
 
 console.log(sum); // logs "26", which is 5+13+8
-
-//semmle-extractor-options: --experimental --extract-program-text
diff --git a/javascript/ql/test/library-tests/stmts/guardedCatch.js b/javascript/ql/test/library-tests/stmts/guardedCatch.js
index 2c9a24cdb07..0c7b4c2b890 100644
--- a/javascript/ql/test/library-tests/stmts/guardedCatch.js
+++ b/javascript/ql/test/library-tests/stmts/guardedCatch.js
@@ -7,5 +7,3 @@ function f(g) {
 		console.log("something else!");
 	}
 }
-
-//semmle-extractor-options: --experimental --extract-program-text
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/stmts/jscript.js b/javascript/ql/test/library-tests/stmts/jscript.js
index 6e281fcec08..0f6a81c8fb3 100644
--- a/javascript/ql/test/library-tests/stmts/jscript.js
+++ b/javascript/ql/test/library-tests/stmts/jscript.js
@@ -1,5 +1,3 @@
 function window::onload() {}
 
 window.onload = function onload() {}
-
-//semmle-extractor-options: --experimental --extract-program-text
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/stmts/legacyletstmt.js b/javascript/ql/test/library-tests/stmts/legacyletstmt.js
index e88411c12c1..89b5e7505e9 100644
--- a/javascript/ql/test/library-tests/stmts/legacyletstmt.js
+++ b/javascript/ql/test/library-tests/stmts/legacyletstmt.js
@@ -1,5 +1,3 @@
 let (x = 23, y = 19) {
   console.log(x + y);
 }
-
-//semmle-extractor-options: --experimental --extract-program-text
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/variables/getDeclaringContainer.expected b/javascript/ql/test/library-tests/variables/getDeclaringContainer.expected
index 158f001459c..bf97e07b559 100644
--- a/javascript/ql/test/library-tests/variables/getDeclaringContainer.expected
+++ b/javascript/ql/test/library-tests/variables/getDeclaringContainer.expected
@@ -24,7 +24,7 @@
 | x | defaultargs.js:3:3:3:25 | functio ... = x) {} |
 | x | defaultargs.js:4:3:4:51 | functio ... [0]) {} |
 | x | for.js:1:2:5:1 | functio ...    x;\\n} |
-| x | legacyletstmt.js:1:1:9:42 | <toplevel> |
+| x | legacyletstmt.js:1:1:8:0 | <toplevel> |
 | x | let.js:1:1:22:0 | <toplevel> |
 | x | let.js:1:1:22:0 | <toplevel> |
 | x | let.js:1:1:22:0 | <toplevel> |
@@ -36,7 +36,7 @@
 | x | variables.js:13:1:23:1 | functio ... z;\\n\\t}\\n} |
 | y | defaultargs.js:3:3:3:25 | functio ... = x) {} |
 | y | defaultargs.js:4:3:4:51 | functio ... [0]) {} |
-| y | legacyletstmt.js:1:1:9:42 | <toplevel> |
+| y | legacyletstmt.js:1:1:8:0 | <toplevel> |
 | y | let.js:1:1:22:0 | <toplevel> |
 | y | let.js:14:1:21:1 | functio ...     }\\n} |
 | y | typeoftype.ts:3:3:5:3 | functio ... e x\\n  } |
diff --git a/javascript/ql/test/library-tests/variables/legacyletstmt.js b/javascript/ql/test/library-tests/variables/legacyletstmt.js
index 07531d1cc9c..69beaac8a09 100644
--- a/javascript/ql/test/library-tests/variables/legacyletstmt.js
+++ b/javascript/ql/test/library-tests/variables/legacyletstmt.js
@@ -5,5 +5,3 @@ let (x = 23, y = 19) {
 }
 
 console.log(x - y);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/fields.js b/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/fields.js
index 6b5cc4cc2d8..22e649c68c6 100644
--- a/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/fields.js
+++ b/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/fields.js
@@ -3,5 +3,3 @@ var x = 42;
 class C {
   myX = x
 }
-
-// semmle-extractor-options: --experimental --source-type module
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedVariable/funbind.js b/javascript/ql/test/query-tests/Declarations/UnusedVariable/funbind.js
index b3210a08775..ce0a9ddfd0f 100644
--- a/javascript/ql/test/query-tests/Declarations/UnusedVariable/funbind.js
+++ b/javascript/ql/test/query-tests/Declarations/UnusedVariable/funbind.js
@@ -2,5 +2,3 @@ function test(bar, e) {
   let foo = bar;
   e.target::foo::baz();
 }
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedVariable/restprops.js b/javascript/ql/test/query-tests/Declarations/UnusedVariable/restprops.js
index d4e6de4b3ba..3f0516d2266 100644
--- a/javascript/ql/test/query-tests/Declarations/UnusedVariable/restprops.js
+++ b/javascript/ql/test/query-tests/Declarations/UnusedVariable/restprops.js
@@ -2,5 +2,3 @@ function f(o) {
   let { x, ...ys } = o;
   return ys;
 }
-
-// semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/tst.js b/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/tst.js
index 46199104674..f500d4cdafc 100644
--- a/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/tst.js
+++ b/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/tst.js
@@ -232,5 +232,3 @@ function l() {
 function f(...x) {
     x === 42
 };
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/tst.js b/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/tst.js
index e1ef6f1cdfd..a454ed9bde3 100644
--- a/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/tst.js
+++ b/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/tst.js
@@ -107,4 +107,3 @@ function l() {
     g();
 });
 
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/tst.js b/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/tst.js
index 356d0cf57ee..a8cedd993b2 100644
--- a/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/tst.js
+++ b/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/tst.js
@@ -1,4 +1,2 @@
 var n = 1<<40; // NOT OK
 var n2 = BigInt(1) << 40n; // OK
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/fields.js b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/fields.js
index 23651d79e6c..01a0c35bc5b 100644
--- a/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/fields.js
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/fields.js
@@ -3,5 +3,3 @@ class A {
 }
 
 class B {}
-
-// semmle-extractor-options: --experimental --source-type module
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/optional-chaining.js b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/optional-chaining.js
index 2df3535216a..9be73a4dde5 100644
--- a/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/optional-chaining.js
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/optional-chaining.js
@@ -7,4 +7,3 @@
     b();
     b?.();
 });
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/optional-chaining.js b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/optional-chaining.js
index 9f662507227..fa6003ad795 100644
--- a/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/optional-chaining.js
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/optional-chaining.js
@@ -7,4 +7,3 @@
     b.p;
     b?.p;
 });
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/yield_in_non_generator.js b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/yield_in_non_generator.js
index ae0bcba2a23..c0cd2619e81 100644
--- a/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/yield_in_non_generator.js
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/yield_in_non_generator.js
@@ -4,5 +4,3 @@ function outer() {
   }
   inner().next()
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/tst.js b/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/tst.js
index 6733344c3ba..6657556b072 100644
--- a/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/tst.js
+++ b/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/tst.js
@@ -172,5 +172,3 @@ class Component4 extends React.Component {
         this.setState({ });
     }
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js
index 0095642669c..1df30053437 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/foreach.js
@@ -6,5 +6,3 @@ for each (var item in obj) {
 }
 
 console.log(sum); // logs "26", which is 5+13+8
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/jscript.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/jscript.js
index 373939cae64..0f6a81c8fb3 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/jscript.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/jscript.js
@@ -1,5 +1,3 @@
 function window::onload() {}
 
 window.onload = function onload() {}
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letExpr.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letExpr.js
index 51e8fd38fda..a5c7a09b6be 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letExpr.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letExpr.js
@@ -3,5 +3,3 @@ var x = 42, y = 19;
 console.log(let (x = 23, y = 19) x + y);
 
 console.log(x - y);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js
index 07531d1cc9c..69beaac8a09 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/letStmt.js
@@ -5,5 +5,3 @@ let (x = 23, y = 19) {
 }
 
 console.log(x - y);
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/postfixComprehension.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/postfixComprehension.js
index bb08a86ceec..3cca1b5c615 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/postfixComprehension.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/postfixComprehension.js
@@ -2,5 +2,3 @@ var numbers = [1, 2, 3, 4, 5];
 var squares = [i*i for (i of numbers)];
 var specialKeyCodes = [for (keyCodeName of Object.keys(SPECIAL_CODES_MAP))
     SPECIAL_CODES_MAP[keyCodeName]];
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/tst.js
index dbfeda687e0..202ea2a262a 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/tst.js
@@ -6,5 +6,3 @@
 
 // OK
 [1, 2, 3].map((x) => x * x);
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/tst.js
index 30135633974..08542e2be52 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/tst.js
@@ -1,4 +1,2 @@
 var a = [23,,42];
 var desc = [for(i in a) i + " = a[" + i + "]"];
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/jscript.js b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/jscript.js
index 66a296a0ae8..5e9b07cf675 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/jscript.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/jscript.js
@@ -23,5 +23,3 @@ foo();
 foo();
 foo();
 foo();
-
-//semmle-extractor-options: --experimental
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/tst.js
index 5081e9991d1..a68f3ad35f9 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/tst.js
@@ -4,6 +4,3 @@ function idMaker(){
         // NOT OK
         yield index++;
 }
-
-//semmle-extractor-options: --experimental
-
diff --git a/javascript/ql/test/query-tests/React/DirectStateMutation/valid9.js b/javascript/ql/test/query-tests/React/DirectStateMutation/valid9.js
index f1adc83643f..0d4d465638d 100644
--- a/javascript/ql/test/query-tests/React/DirectStateMutation/valid9.js
+++ b/javascript/ql/test/query-tests/React/DirectStateMutation/valid9.js
@@ -11,5 +11,3 @@ React.createClass({
     };
   }
 });
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/issue7506.js b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/issue7506.js
index 7d5a881389c..f5acdc8d99a 100644
--- a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/issue7506.js
+++ b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/issue7506.js
@@ -19,5 +19,3 @@ class C2 extends React.Component {
     const { p1: p2 } = state
   }
 }
-
-// semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/undefined.js b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/undefined.js
index dda64bc62e8..6db5702e2fc 100644
--- a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/undefined.js
+++ b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/undefined.js
@@ -166,5 +166,3 @@ class C11 extends React.Component {
         this.state.writeIn_getDerivedStateFromProps; // OK
     }
 }
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/unused.js b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/unused.js
index e1972ddec1f..d71aa7136da 100644
--- a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/unused.js
+++ b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/unused.js
@@ -72,5 +72,3 @@ class C6 extends React.Component {
     }
 
 }
-
-//semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.js b/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.js
index 8731ac0cfac..a3e429ed0b5 100644
--- a/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.js
+++ b/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.js
@@ -176,5 +176,3 @@ async function awaitFlow(){
 	if (v) { // OK
 	}
 });
-
-// semmle-extractor-options: --experimental

From 2e7bd4db6f163b3d19eda68fab2b460dc8f43196 Mon Sep 17 00:00:00 2001
From: James Fletcher <42464962+jf205@users.noreply.github.com>
Date: Wed, 6 Nov 2019 12:59:45 +0000
Subject: [PATCH 159/232] Update
 docs/language/ql-training/cpp/program-representation-cpp.rst

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
---
 docs/language/ql-training/cpp/program-representation-cpp.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index 8f7a4d43de9..7048251aa02 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -64,7 +64,7 @@ Working with functions
 
 Functions are represented by the Function class. Each declaration or definition of a function is represented by a ``FunctionDeclarationEntry``.
 
-Calls to functions are modeled by CodeQL class ``Call`` and its subclasses:
+Calls to functions are modeled by the CodeQL class ``Call`` and its subclasses:
 
 - ``Call.getTarget()`` gets the declared target of the call; undefined for calls through function pointers
 - ``Function.getACallToThisFunction()`` gets a call to this function

From 79f107946068940e7050b1ed3bc52abf54c48ac8 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 6 Nov 2019 13:01:23 +0000
Subject: [PATCH 160/232] JavaScript: Add `options` files with `--experimental`
 extractor options.

---
 javascript/ql/test/library-tests/CFG/options                     | 1 +
 javascript/ql/test/library-tests/Classes/options                 | 1 +
 javascript/ql/test/library-tests/Comprehensions/options          | 1 +
 javascript/ql/test/library-tests/DataFlow/options                | 1 +
 javascript/ql/test/library-tests/Decorators/options              | 1 +
 javascript/ql/test/library-tests/DefUse/options                  | 1 +
 javascript/ql/test/library-tests/Expr/options                    | 1 +
 javascript/ql/test/library-tests/Flow/options                    | 1 +
 javascript/ql/test/library-tests/Flow/reexport/lib/options       | 1 +
 javascript/ql/test/library-tests/Functions/options               | 1 +
 javascript/ql/test/library-tests/LocalObjects/options            | 1 +
 javascript/ql/test/library-tests/Modules/m/options               | 1 +
 javascript/ql/test/library-tests/Modules/options                 | 1 +
 javascript/ql/test/library-tests/OptionalChaining/options        | 1 +
 javascript/ql/test/library-tests/ThisExpr/options                | 1 +
 .../test/library-tests/TypeInference/NullishCoalescing/options   | 1 +
 .../ql/test/library-tests/TypeInference/OptionalChaining/options | 1 +
 javascript/ql/test/library-tests/frameworks/ReactJS/options      | 1 +
 javascript/ql/test/library-tests/stmts/options                   | 1 +
 javascript/ql/test/library-tests/variables/options               | 1 +
 .../ql/test/query-tests/Declarations/DeadStoreOfLocal/options    | 1 +
 .../ql/test/query-tests/Declarations/UnusedVariable/options      | 1 +
 .../test/query-tests/Expressions/HeterogeneousComparison/options | 1 +
 .../query-tests/Expressions/ImplicitOperandConversion/options    | 1 +
 .../ql/test/query-tests/Expressions/ShiftOutOfRange/options      | 1 +
 .../ql/test/query-tests/Expressions/SuspiciousInvocation/options | 1 +
 .../ql/test/query-tests/Expressions/SuspiciousPropAccess/options | 1 +
 .../query-tests/Expressions/UnboundEventHandlerReceiver/options  | 1 +
 .../test/query-tests/LanguageFeatures/ExpressionClosures/options | 1 +
 .../LanguageFeatures/ForInComprehensionBlocks/options            | 1 +
 .../test/query-tests/LanguageFeatures/SemicolonInsertion/options | 1 +
 .../query-tests/LanguageFeatures/YieldInNonGenerator/options     | 1 +
 javascript/ql/test/query-tests/React/DirectStateMutation/options | 1 +
 .../query-tests/React/UnusedOrUndefinedStateProperty/options     | 1 +
 .../ql/test/query-tests/Statements/UselessConditional/options    | 1 +
 35 files changed, 35 insertions(+)
 create mode 100644 javascript/ql/test/library-tests/CFG/options
 create mode 100644 javascript/ql/test/library-tests/Classes/options
 create mode 100644 javascript/ql/test/library-tests/Comprehensions/options
 create mode 100644 javascript/ql/test/library-tests/DataFlow/options
 create mode 100644 javascript/ql/test/library-tests/Decorators/options
 create mode 100644 javascript/ql/test/library-tests/DefUse/options
 create mode 100644 javascript/ql/test/library-tests/Expr/options
 create mode 100644 javascript/ql/test/library-tests/Flow/options
 create mode 100644 javascript/ql/test/library-tests/Flow/reexport/lib/options
 create mode 100644 javascript/ql/test/library-tests/Functions/options
 create mode 100644 javascript/ql/test/library-tests/LocalObjects/options
 create mode 100644 javascript/ql/test/library-tests/Modules/m/options
 create mode 100644 javascript/ql/test/library-tests/Modules/options
 create mode 100644 javascript/ql/test/library-tests/OptionalChaining/options
 create mode 100644 javascript/ql/test/library-tests/ThisExpr/options
 create mode 100644 javascript/ql/test/library-tests/TypeInference/NullishCoalescing/options
 create mode 100644 javascript/ql/test/library-tests/TypeInference/OptionalChaining/options
 create mode 100644 javascript/ql/test/library-tests/frameworks/ReactJS/options
 create mode 100644 javascript/ql/test/library-tests/stmts/options
 create mode 100644 javascript/ql/test/library-tests/variables/options
 create mode 100644 javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/options
 create mode 100644 javascript/ql/test/query-tests/Declarations/UnusedVariable/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/options
 create mode 100644 javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/options
 create mode 100644 javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/options
 create mode 100644 javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/options
 create mode 100644 javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/options
 create mode 100644 javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/options
 create mode 100644 javascript/ql/test/query-tests/React/DirectStateMutation/options
 create mode 100644 javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/options
 create mode 100644 javascript/ql/test/query-tests/Statements/UselessConditional/options

diff --git a/javascript/ql/test/library-tests/CFG/options b/javascript/ql/test/library-tests/CFG/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/CFG/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Classes/options b/javascript/ql/test/library-tests/Classes/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Classes/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Comprehensions/options b/javascript/ql/test/library-tests/Comprehensions/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Comprehensions/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/DataFlow/options b/javascript/ql/test/library-tests/DataFlow/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/DataFlow/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Decorators/options b/javascript/ql/test/library-tests/Decorators/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Decorators/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/DefUse/options b/javascript/ql/test/library-tests/DefUse/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/DefUse/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Expr/options b/javascript/ql/test/library-tests/Expr/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Expr/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Flow/options b/javascript/ql/test/library-tests/Flow/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Flow/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Flow/reexport/lib/options b/javascript/ql/test/library-tests/Flow/reexport/lib/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Flow/reexport/lib/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Functions/options b/javascript/ql/test/library-tests/Functions/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Functions/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/LocalObjects/options b/javascript/ql/test/library-tests/LocalObjects/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/LocalObjects/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Modules/m/options b/javascript/ql/test/library-tests/Modules/m/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Modules/m/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/Modules/options b/javascript/ql/test/library-tests/Modules/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/Modules/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/OptionalChaining/options b/javascript/ql/test/library-tests/OptionalChaining/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/OptionalChaining/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/ThisExpr/options b/javascript/ql/test/library-tests/ThisExpr/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/ThisExpr/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/options b/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeInference/NullishCoalescing/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/TypeInference/OptionalChaining/options b/javascript/ql/test/library-tests/TypeInference/OptionalChaining/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeInference/OptionalChaining/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/options b/javascript/ql/test/library-tests/frameworks/ReactJS/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/stmts/options b/javascript/ql/test/library-tests/stmts/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/stmts/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/library-tests/variables/options b/javascript/ql/test/library-tests/variables/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/library-tests/variables/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/options b/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Declarations/DeadStoreOfLocal/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedVariable/options b/javascript/ql/test/query-tests/Declarations/UnusedVariable/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Declarations/UnusedVariable/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/options b/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/HeterogeneousComparison/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/options b/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/ImplicitOperandConversion/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/options b/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/ShiftOutOfRange/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/options b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousInvocation/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/options b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/options b/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Expressions/UnboundEventHandlerReceiver/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/options b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ExpressionClosures/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/options b/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/LanguageFeatures/ForInComprehensionBlocks/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/options b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/options b/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/LanguageFeatures/YieldInNonGenerator/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/React/DirectStateMutation/options b/javascript/ql/test/query-tests/React/DirectStateMutation/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/React/DirectStateMutation/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/options b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/React/UnusedOrUndefinedStateProperty/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental
diff --git a/javascript/ql/test/query-tests/Statements/UselessConditional/options b/javascript/ql/test/query-tests/Statements/UselessConditional/options
new file mode 100644
index 00000000000..ae107b46f9e
--- /dev/null
+++ b/javascript/ql/test/query-tests/Statements/UselessConditional/options
@@ -0,0 +1 @@
+semmle-extractor-options: --experimental

From 1fa8c43a8c4ca2cd8905318634c03e42e7e179f3 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:00:51 +0000
Subject: [PATCH 161/232] JavaScript: Remove a redundant extractor option.

---
 javascript/ql/test/query-tests/NodeJS/DubiousImport/l.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/l.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/l.js
index abf7cc4034f..8eb1794ae7b 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/l.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/l.js
@@ -3,5 +3,3 @@ class C {
 }
 
 module.exports = C;
-
-// semmle-extractor-options: --abort-on-parse-errors
\ No newline at end of file

From 48483724358022cf3df1494bfb316d5a04ddac7d Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:09:17 +0000
Subject: [PATCH 162/232] JavaScript: Replace `--externs` extractor flag with
 `/** @externs */` comment.

---
 javascript/ql/test/library-tests/Externs/Point.js               | 2 +-
 .../test/query-tests/Declarations/ArgumentsRedefined/externs.js | 2 +-
 .../test/query-tests/Declarations/DeadStoreOfGlobal/externs.js  | 2 +-
 .../query-tests/Declarations/DeadStoreOfProperty/externs.js     | 2 +-
 .../test/query-tests/Declarations/RedeclaredVariable/externs.js | 2 +-
 .../test/query-tests/Declarations/TooManyParameters/externs.js  | 2 +-
 .../ql/test/query-tests/Declarations/UnusedParameter/externs.js | 2 +-
 .../ql/test/query-tests/Expressions/ExprHasNoEffect/externs.js  | 2 +-
 .../ql/test/query-tests/Expressions/SelfAssignment/externs.js   | 2 +-
 javascript/ql/test/query-tests/JSDoc/BadParamTag/externs.js     | 2 +-
 .../query-tests/LanguageFeatures/InconsistentNew/externs.js     | 2 +-
 .../SemicolonInsertion/SemicolonInsertion.expected              | 2 +-
 .../query-tests/LanguageFeatures/SpuriousArguments/externs.js   | 2 +-
 .../query-tests/NodeJS/DubiousImport/DubiousImport.expected     | 2 +-
 javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js  | 2 +-
 .../ql/test/query-tests/NodeJS/DubiousImport/fs-monkeypatch.js  | 2 +-
 javascript/ql/test/query-tests/NodeJS/DubiousImport/fs.js       | 2 +-
 17 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/javascript/ql/test/library-tests/Externs/Point.js b/javascript/ql/test/library-tests/Externs/Point.js
index a811a482009..ea4c950e7d2 100644
--- a/javascript/ql/test/library-tests/Externs/Point.js
+++ b/javascript/ql/test/library-tests/Externs/Point.js
@@ -17,4 +17,4 @@ Point.prototype['final'];
 /** @type {!Point} */
 var aPoint;
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
diff --git a/javascript/ql/test/query-tests/Declarations/ArgumentsRedefined/externs.js b/javascript/ql/test/query-tests/Declarations/ArgumentsRedefined/externs.js
index f91c316b0ed..7824a7ffe02 100644
--- a/javascript/ql/test/query-tests/Declarations/ArgumentsRedefined/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/ArgumentsRedefined/externs.js
@@ -1,3 +1,3 @@
 var arguments;
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/DeadStoreOfGlobal/externs.js b/javascript/ql/test/query-tests/Declarations/DeadStoreOfGlobal/externs.js
index d3594220a05..6e79be49a81 100644
--- a/javascript/ql/test/query-tests/Declarations/DeadStoreOfGlobal/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/DeadStoreOfGlobal/externs.js
@@ -38,4 +38,4 @@ function Worker(opt_arg0) {}
  */
 Worker.prototype.onmessage = function() {};
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/Declarations/DeadStoreOfProperty/externs.js b/javascript/ql/test/query-tests/Declarations/DeadStoreOfProperty/externs.js
index a32e349e56d..11caae4e1b1 100644
--- a/javascript/ql/test/query-tests/Declarations/DeadStoreOfProperty/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/DeadStoreOfProperty/externs.js
@@ -40,4 +40,4 @@ function Element() {}
  */
 Element.prototype.clientTop;
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/externs.js b/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/externs.js
index 19dd15789e9..0a9eab06996 100644
--- a/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/RedeclaredVariable/externs.js
@@ -2,4 +2,4 @@
 var f = function() {};
 var f = function(x) {};
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/TooManyParameters/externs.js b/javascript/ql/test/query-tests/Declarations/TooManyParameters/externs.js
index a3c8c8999c0..4327b4885f5 100644
--- a/javascript/ql/test/query-tests/Declarations/TooManyParameters/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/TooManyParameters/externs.js
@@ -1,4 +1,4 @@
 // OK: overly long parameter lists in external APIs aren't the fault of the externs definitions
 function f(a, b, c, d, e, f, g, h) {}
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedParameter/externs.js b/javascript/ql/test/query-tests/Declarations/UnusedParameter/externs.js
index ec8e5c4f6db..9153844b527 100644
--- a/javascript/ql/test/query-tests/Declarations/UnusedParameter/externs.js
+++ b/javascript/ql/test/query-tests/Declarations/UnusedParameter/externs.js
@@ -1,3 +1,3 @@
 function String(str) {}
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Expressions/ExprHasNoEffect/externs.js b/javascript/ql/test/query-tests/Expressions/ExprHasNoEffect/externs.js
index d3fff886259..98a1d68e520 100644
--- a/javascript/ql/test/query-tests/Expressions/ExprHasNoEffect/externs.js
+++ b/javascript/ql/test/query-tests/Expressions/ExprHasNoEffect/externs.js
@@ -53,4 +53,4 @@ function Error() {}
  */
 function SyntaxError() {}
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/Expressions/SelfAssignment/externs.js b/javascript/ql/test/query-tests/Expressions/SelfAssignment/externs.js
index 70685e250c1..58b2c99e892 100644
--- a/javascript/ql/test/query-tests/Expressions/SelfAssignment/externs.js
+++ b/javascript/ql/test/query-tests/Expressions/SelfAssignment/externs.js
@@ -36,4 +36,4 @@ function Element() {}
 
 Element.prototype.innerHTML;
 
-// semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/JSDoc/BadParamTag/externs.js b/javascript/ql/test/query-tests/JSDoc/BadParamTag/externs.js
index f27d6054e27..433db5a26f4 100644
--- a/javascript/ql/test/query-tests/JSDoc/BadParamTag/externs.js
+++ b/javascript/ql/test/query-tests/JSDoc/BadParamTag/externs.js
@@ -3,4 +3,4 @@
  */
 function f(x) {}
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/InconsistentNew/externs.js b/javascript/ql/test/query-tests/LanguageFeatures/InconsistentNew/externs.js
index c81b555e5aa..0ffbf63dd3f 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/InconsistentNew/externs.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/InconsistentNew/externs.js
@@ -7,4 +7,4 @@ String.prototype.toString = function() {};
 function Array() {}
 Array.prototype.toString = function() {};
 
-//semmle-extractor-options: --externs
\ No newline at end of file
+/** @externs */
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/SemicolonInsertion.expected b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/SemicolonInsertion.expected
index 81808eb76ba..bab6488e83b 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/SemicolonInsertion.expected
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SemicolonInsertion/SemicolonInsertion.expected
@@ -1,4 +1,4 @@
 | export.js:5:8:5:17 | var x = 42 | Avoid automated semicolon insertion (95% of all statements in $@ have an explicit semicolon). | export.js:1:1:29:0 | <toplevel> | the enclosing script |
-| jscript.js:3:1:3:36 | window. ... ad() {} | Avoid automated semicolon insertion (95% of all statements in $@ have an explicit semicolon). | jscript.js:1:1:27:42 | <toplevel> | the enclosing script |
+| jscript.js:3:1:3:36 | window. ... ad() {} | Avoid automated semicolon insertion (95% of all statements in $@ have an explicit semicolon). | jscript.js:1:1:26:0 | <toplevel> | the enclosing script |
 | tst.js:5:1:5:3 | var a = ... : 2\\n  } | Avoid automated semicolon insertion (91% of all statements in $@ have an explicit semicolon). | tst.js:1:1:42:1 | functio ... oo();\\n} | the enclosing function |
 | tst.js:7:3:7:10 | return 1 | Avoid automated semicolon insertion (91% of all statements in $@ have an explicit semicolon). | tst.js:1:1:42:1 | functio ... oo();\\n} | the enclosing function |
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/externs.js b/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/externs.js
index cf8665ea531..c8a88126efb 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/externs.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/externs.js
@@ -39,4 +39,4 @@ function Number() {}
 
 Number.parseFloat = function(num) {};
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/DubiousImport.expected b/javascript/ql/test/query-tests/NodeJS/DubiousImport/DubiousImport.expected
index e28c1641af8..88425eed728 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/DubiousImport.expected
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/DubiousImport.expected
@@ -1,5 +1,5 @@
 | a.js:1:11:1:28 | require('./b').foo | Module $@ does not export symbol foo. | b.js:1:1:5:21 | <toplevel> | b |
 | main.js:5:1:5:5 | b.foo | Module $@ does not export symbol foo. | b.js:1:1:5:21 | <toplevel> | b |
 | main.js:15:1:15:9 | fs.renmae | Module $@ does not export symbol renmae. | fs.js:1:1:15:0 | <toplevel> | fs |
-| main.js:23:1:23:5 | l.bar | Module $@ does not export symbol bar. | l.js:1:1:7:52 | <toplevel> | l |
+| main.js:23:1:23:5 | l.bar | Module $@ does not export symbol bar. | l.js:1:1:6:0 | <toplevel> | l |
 | multi_import.js:16:3:16:10 | mod2.bar | Module $@ does not export symbol bar. | b.js:1:1:5:21 | <toplevel> | b |
diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js
index f1cb91159f0..bd8e36c10e3 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/externs.js
@@ -615,4 +615,4 @@ Array.some = function(arr, callback, opt_context) {};
  */
 Array.isArray = function(arr) {};
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs-monkeypatch.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs-monkeypatch.js
index e4c633ecf31..fefe8f6b2e7 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs-monkeypatch.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs-monkeypatch.js
@@ -2,4 +2,4 @@ var fs = require('fs');
 
 fs.move = fs.rename;
 
-//semmle-extractor-options: --externs
+/** @externs */
diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs.js
index 9fc7f5f1343..7b5e87d891a 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/fs.js
@@ -11,4 +11,4 @@ fs.rename;
 
 module.exports = fs;
 
-//semmle-extractor-options: --externs
+/** @externs */

From 8fdf6298b980e7426e026fbdd6365a2478e94026 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:14:07 +0000
Subject: [PATCH 163/232] JavaScript: Remove `--platform node` extractor
 options.

---
 javascript/ql/test/query-tests/NodeJS/DubiousImport/f.js      | 3 +--
 .../ql/test/query-tests/NodeJS/UnusedDependency/src/other.js  | 2 --
 .../ql/test/query-tests/Security/CWE-089/untyped/tst4.js      | 2 --
 .../test/query-tests/Statements/ReturnOutsideFunction/node.js | 3 +--
 .../test/tutorials/Introducing the JavaScript libraries/m.js  | 4 ++--
 5 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/javascript/ql/test/query-tests/NodeJS/DubiousImport/f.js b/javascript/ql/test/query-tests/NodeJS/DubiousImport/f.js
index 3d097fb8ede..c475ea2262f 100644
--- a/javascript/ql/test/query-tests/NodeJS/DubiousImport/f.js
+++ b/javascript/ql/test/query-tests/NodeJS/DubiousImport/f.js
@@ -4,5 +4,4 @@
 	module.exports = me;
 }(module));
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process"); // ensure this is treated as Node.js code
diff --git a/javascript/ql/test/query-tests/NodeJS/UnusedDependency/src/other.js b/javascript/ql/test/query-tests/NodeJS/UnusedDependency/src/other.js
index 20c9961d626..3b29030a26f 100644
--- a/javascript/ql/test/query-tests/NodeJS/UnusedDependency/src/other.js
+++ b/javascript/ql/test/query-tests/NodeJS/UnusedDependency/src/other.js
@@ -1,4 +1,2 @@
 import hipsterness from 'react';
 import curry from 'lodash/function/curry';
-
-//semmle-extractor-options: --platform node
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst4.js b/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst4.js
index 7df5c6b4f3f..73cddfb3a6a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst4.js
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/tst4.js
@@ -7,5 +7,3 @@ angular.module('myApp', ['ngRoute'])
 .controller('FindPost', function($routeParams) {
   db.get('SELECT * FROM Post WHERE id = "' + $routeParams.id + '"');
 });
-
-// semmle-extractor-options: --platform node
diff --git a/javascript/ql/test/query-tests/Statements/ReturnOutsideFunction/node.js b/javascript/ql/test/query-tests/Statements/ReturnOutsideFunction/node.js
index 3397ebd38a4..572dbe25035 100644
--- a/javascript/ql/test/query-tests/Statements/ReturnOutsideFunction/node.js
+++ b/javascript/ql/test/query-tests/Statements/ReturnOutsideFunction/node.js
@@ -1,5 +1,4 @@
 // not a syntax error, but still NOT OK
 return 42;
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("path") // ensure this is treated as Node.js code
diff --git a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/m.js b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/m.js
index c53a0a15327..a54fda636cc 100644
--- a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/m.js	
+++ b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/m.js	
@@ -1,2 +1,2 @@
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process")
+;

From 5681565d4addcc24fefabfd19737f4e686c887e0 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:20:23 +0000
Subject: [PATCH 164/232] JavaScript: Move `--html elements` extractor options
 into `options` file.

---
 .../ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.html       | 1 -
 .../ql/test/query-tests/DOM/HTML/AmbiguousIdAttributeGood.html   | 1 -
 .../ql/test/query-tests/DOM/HTML/ConflictingAttributes.html      | 1 -
 .../ql/test/query-tests/DOM/HTML/ConflictingAttributesGood.html  | 1 -
 javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html | 1 -
 .../ql/test/query-tests/DOM/HTML/DuplicateAttributesGood.html    | 1 -
 .../ql/test/query-tests/DOM/HTML/MalformedIdAttribute.html       | 1 -
 .../ql/test/query-tests/DOM/HTML/MalformedIdAttributeGood.html   | 1 -
 javascript/ql/test/query-tests/DOM/HTML/options                  | 1 +
 9 files changed, 1 insertion(+), 8 deletions(-)
 create mode 100644 javascript/ql/test/query-tests/DOM/HTML/options

diff --git a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.html b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.html
index 3277461d787..98a490ec408 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttribute.html
@@ -4,5 +4,4 @@
 <li id="first">First element
 <li id="first">Second element
 </ul>
-semmle-extractor-options: --html elements
 </body>
diff --git a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttributeGood.html b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttributeGood.html
index 7800cfcd048..bb5969c1f79 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttributeGood.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/AmbiguousIdAttributeGood.html
@@ -10,5 +10,4 @@
 <li class="duplicate-class">duplicate-class</li>
 <li class="duplicate-class">duplicate-class</li>
 </ul>
-semmle-extractor-options: --html elements
 </body>
diff --git a/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributes.html b/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributes.html
index 370337bc7af..92af95c3e3c 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributes.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributes.html
@@ -1,2 +1 @@
 <a href="http://semmle.com" href="https://semmle.com">Semmle</a>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributesGood.html b/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributesGood.html
index 9b6a94b0e2d..dfe1141a21b 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributesGood.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/ConflictingAttributesGood.html
@@ -1,2 +1 @@
 <a href="https://semmle.com">Semmle</a>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
index eedc176211b..a78e3314283 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
@@ -1,2 +1 @@
 <a href="https://semmle.com" href="https://semmle.com">Semmle</a>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributesGood.html b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributesGood.html
index 9b6a94b0e2d..dfe1141a21b 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributesGood.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributesGood.html
@@ -1,2 +1 @@
 <a href="https://semmle.com">Semmle</a>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttribute.html b/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttribute.html
index 666592a7716..9da8fcde502 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttribute.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttribute.html
@@ -1,2 +1 @@
 <div id="heading important">An important heading</div>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttributeGood.html b/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttributeGood.html
index 9a7815efb64..1dfea0491fe 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttributeGood.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/MalformedIdAttributeGood.html
@@ -1,2 +1 @@
 <div class="heading important">An important heading</div>
-semmle-extractor-options: --html elements
diff --git a/javascript/ql/test/query-tests/DOM/HTML/options b/javascript/ql/test/query-tests/DOM/HTML/options
new file mode 100644
index 00000000000..49be7a9261e
--- /dev/null
+++ b/javascript/ql/test/query-tests/DOM/HTML/options
@@ -0,0 +1 @@
+semmle-extractor-options: --html elements

From 6b817203fdcc89c58022d856d07198d8579d244a Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:24:52 +0000
Subject: [PATCH 165/232] JavaScript: Move `--tolerate-parse-errors` extractor
 options into `options` file.

---
 javascript/ql/test/library-tests/Errors/options                 | 1 +
 javascript/ql/test/library-tests/Errors/setters.js              | 2 --
 javascript/ql/test/library-tests/Errors/tst.js                  | 2 --
 javascript/ql/test/library-tests/JSON/JSONError.expected        | 1 -
 javascript/ql/test/library-tests/JSON/invalid.json              | 1 -
 javascript/ql/test/library-tests/JSON/options                   | 1 +
 .../ql/test/library-tests/TypeScript/SyntaxErrors/jsdocTypes.ts | 2 --
 .../ql/test/library-tests/TypeScript/SyntaxErrors/options       | 1 +
 javascript/ql/test/library-tests/YAML/YAMLError.expected        | 2 +-
 javascript/ql/test/library-tests/YAML/err.yaml                  | 1 -
 javascript/ql/test/library-tests/YAML/options                   | 1 +
 javascript/ql/test/library-tests/frameworks/Express/options     | 1 +
 .../ql/test/query-tests/AngularJS/DuplicateDependency/options   | 1 +
 .../test/query-tests/Declarations/UniqueParameterNames/options  | 1 +
 .../test/query-tests/Declarations/UniqueParameterNames/tst.js   | 2 --
 .../ql/test/query-tests/LanguageFeatures/SyntaxError/options    | 1 +
 .../ql/test/query-tests/LanguageFeatures/SyntaxError/tst.js     | 2 --
 javascript/ql/test/query-tests/filters/ClassifyFiles/nonbmp.js  | 2 --
 javascript/ql/test/query-tests/filters/ClassifyFiles/options    | 1 +
 .../test/query-tests/filters/ClassifyFiles/some-template.html   | 1 -
 javascript/ql/test/query-tests/filters/ClassifyFiles/templ.js   | 1 -
 javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl.html  | 1 -
 javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl2.html | 1 -
 .../test/tutorials/Introducing the JavaScript libraries/options | 1 +
 24 files changed, 11 insertions(+), 20 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/Errors/options
 create mode 100644 javascript/ql/test/library-tests/JSON/options
 create mode 100644 javascript/ql/test/library-tests/TypeScript/SyntaxErrors/options
 create mode 100644 javascript/ql/test/library-tests/YAML/options
 create mode 100644 javascript/ql/test/library-tests/frameworks/Express/options
 create mode 100644 javascript/ql/test/query-tests/AngularJS/DuplicateDependency/options
 create mode 100644 javascript/ql/test/query-tests/Declarations/UniqueParameterNames/options
 create mode 100644 javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/options
 create mode 100644 javascript/ql/test/query-tests/filters/ClassifyFiles/options
 create mode 100644 javascript/ql/test/tutorials/Introducing the JavaScript libraries/options

diff --git a/javascript/ql/test/library-tests/Errors/options b/javascript/ql/test/library-tests/Errors/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/library-tests/Errors/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/Errors/setters.js b/javascript/ql/test/library-tests/Errors/setters.js
index 50865e9f0c9..a8d40c45d2f 100644
--- a/javascript/ql/test/library-tests/Errors/setters.js
+++ b/javascript/ql/test/library-tests/Errors/setters.js
@@ -8,5 +8,3 @@ var o = {
   set y(...ys) {},
   set z(z, ...zs) {}
 };
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/Errors/tst.js b/javascript/ql/test/library-tests/Errors/tst.js
index baf2fbf4711..f0931ee0e49 100644
--- a/javascript/ql/test/library-tests/Errors/tst.js
+++ b/javascript/ql/test/library-tests/Errors/tst.js
@@ -1,4 +1,2 @@
   while
 }
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/JSON/JSONError.expected b/javascript/ql/test/library-tests/JSON/JSONError.expected
index 37d5aabfd08..e63d3862491 100644
--- a/javascript/ql/test/library-tests/JSON/JSONError.expected
+++ b/javascript/ql/test/library-tests/JSON/JSONError.expected
@@ -1,2 +1 @@
 | invalid.json:3:1:3:1 | Error: Comments are not legal in JSON. |
-| invalid.json:4:1:4:1 | Error: Comments are not legal in JSON. |
diff --git a/javascript/ql/test/library-tests/JSON/invalid.json b/javascript/ql/test/library-tests/JSON/invalid.json
index 54c870bb907..03f76948f63 100644
--- a/javascript/ql/test/library-tests/JSON/invalid.json
+++ b/javascript/ql/test/library-tests/JSON/invalid.json
@@ -1,4 +1,3 @@
 "hi"
 
 // JSON doesn't have comments
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/JSON/options b/javascript/ql/test/library-tests/JSON/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/library-tests/JSON/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/jsdocTypes.ts b/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/jsdocTypes.ts
index 6bba445dce4..55716a17a65 100644
--- a/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/jsdocTypes.ts
+++ b/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/jsdocTypes.ts
@@ -23,5 +23,3 @@ var nns: Array<?number>;
 var dns: Array<!number>;
 var anys: Array<*>;
 var vars: Array<...number>;
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/options b/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/SyntaxErrors/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/YAML/YAMLError.expected b/javascript/ql/test/library-tests/YAML/YAMLError.expected
index 2045e49be51..386d8874ef2 100644
--- a/javascript/ql/test/library-tests/YAML/YAMLError.expected
+++ b/javascript/ql/test/library-tests/YAML/YAMLError.expected
@@ -1 +1 @@
-| err.yaml:4:1:4:1 | found unexpected end of stream |
+| err.yaml:3:1:3:1 | found unexpected end of stream |
diff --git a/javascript/ql/test/library-tests/YAML/err.yaml b/javascript/ql/test/library-tests/YAML/err.yaml
index f6d3951be96..96d2d75ddc0 100644
--- a/javascript/ql/test/library-tests/YAML/err.yaml
+++ b/javascript/ql/test/library-tests/YAML/err.yaml
@@ -1,3 +1,2 @@
 "unterminated string
-# semmle-extractor-options: --tolerate-parse-errors
 
diff --git a/javascript/ql/test/library-tests/YAML/options b/javascript/ql/test/library-tests/YAML/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/library-tests/YAML/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/library-tests/frameworks/Express/options b/javascript/ql/test/library-tests/frameworks/Express/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Express/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/AngularJS/DuplicateDependency/options b/javascript/ql/test/query-tests/AngularJS/DuplicateDependency/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/query-tests/AngularJS/DuplicateDependency/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/options b/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/tst.js b/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/tst.js
index 2d543e5bf1b..470b14e8300 100644
--- a/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/tst.js
+++ b/javascript/ql/test/query-tests/Declarations/UniqueParameterNames/tst.js
@@ -12,5 +12,3 @@ this.addPropertyListener(prop.name, function(_, _, _, a) {
 function f(x, y, x) {
   'use strict';
 }
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/options b/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/tst.js
index 2da4e693aeb..e7aaa89f128 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SyntaxError/tst.js
@@ -1,4 +1,2 @@
 function findBox() {
   return $("box.important
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/nonbmp.js b/javascript/ql/test/query-tests/filters/ClassifyFiles/nonbmp.js
index ba9b39b4f72..5d56c9b782e 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/nonbmp.js
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/nonbmp.js
@@ -1,3 +1 @@
 😼😼
-
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/options b/javascript/ql/test/query-tests/filters/ClassifyFiles/options
new file mode 100644
index 00000000000..13f987b19ca
--- /dev/null
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/options
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/some-template.html b/javascript/ql/test/query-tests/filters/ClassifyFiles/some-template.html
index 734e6cf7da8..671a0c7b51b 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/some-template.html
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/some-template.html
@@ -1,4 +1,3 @@
 <script type="text/javascript">
 %some made-up template syntax
 </script>
-semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/templ.js b/javascript/ql/test/query-tests/filters/ClassifyFiles/templ.js
index 1a42f3cf925..cda21380525 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/templ.js
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/templ.js
@@ -3,4 +3,3 @@ common.autofocus('#id_password');
 {% else %}
 common.autofocus('#id_username');
 {% endif %}
-// semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl.html b/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl.html
index c21d85208f5..e3bdc744425 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl.html
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl.html
@@ -5,4 +5,3 @@ common.autofocus('#id_password');
 common.autofocus('#id_username');
 {% endif %}
 </script>
-semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl2.html b/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl2.html
index 8e96a8b41f4..700fe9c08d2 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl2.html
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/tmpl2.html
@@ -5,4 +5,3 @@
     {{/config}}
   }
 </script>
-semmle-extractor-options: --tolerate-parse-errors
diff --git a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/options b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/options
new file mode 100644
index 00000000000..a1b2b21840f
--- /dev/null
+++ b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/options	
@@ -0,0 +1 @@
+semmle-extractor-options: --tolerate-parse-errors
\ No newline at end of file

From 3ad5af7ceff7a942277bb5ef0a42b09cdf21c1a2 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Tue, 5 Nov 2019 16:44:57 +0000
Subject: [PATCH 166/232] JavaScript: Move `--extract-program-text` extractor
 options into `options` files.

---
 .../test/library-tests/Lines/Lines.expected   | 10 ++--
 .../ql/test/library-tests/Lines/options       |  1 +
 .../ql/test/library-tests/Lines/tst1.js       |  4 +-
 .../ql/test/library-tests/Lines/tst2.js       |  2 +-
 .../ql/test/library-tests/Lines/tst3.js       |  4 +-
 .../TypeScript/Modifiers/options              |  1 +
 .../library-tests/TypeScript/Modifiers/tst.ts |  2 -
 .../test/library-tests/stmts/conditionals.js  |  2 +-
 .../ql/test/library-tests/stmts/es2015.js     |  2 +-
 .../ql/test/library-tests/stmts/functions.js  |  2 +-
 .../ql/test/library-tests/stmts/loops.js      |  2 +-
 .../ql/test/library-tests/stmts/options       |  2 +-
 .../ql/test/library-tests/stmts/others.js     |  2 +-
 .../test/library-tests/stmts/tests.expected   | 51 +++++++++----------
 javascript/ql/test/library-tests/stmts/try.js |  2 +-
 15 files changed, 43 insertions(+), 46 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/Lines/options
 create mode 100644 javascript/ql/test/library-tests/TypeScript/Modifiers/options

diff --git a/javascript/ql/test/library-tests/Lines/Lines.expected b/javascript/ql/test/library-tests/Lines/Lines.expected
index 552c1b8ff0e..e3c7973c9b8 100644
--- a/javascript/ql/test/library-tests/Lines/Lines.expected
+++ b/javascript/ql/test/library-tests/Lines/Lines.expected
@@ -1,4 +1,4 @@
-| tst1.js:1:1:1:55 | abc // semmle-extractor-options: --extract-program-text | abc // semmle-extractor-options: --extract-program-text | \n |
+| tst1.js:1:1:1:3 | abc | abc | \n |
 | tst1.js:2:1:2:3 | def | def | \r |
 | tst1.js:3:1:3:3 | ghi | ghi | \r\n |
 | tst1.js:4:1:4:3 | jkl | jkl | \n |
@@ -6,13 +6,13 @@
 | tst1.js:6:1:6:3 | mno | mno | \u2028 |
 | tst1.js:7:1:7:0 |  |  | \n |
 | tst1.js:8:1:8:3 | pqr | pqr | \u2029 |
-| tst1.js:9:1:9:3 | stu | stu |  |
-| tst2.js:1:1:1:63 | first_line  // semmle-extractor-options: --extract-program-text | first_line  // semmle-extractor-options: --extract-program-text | \n |
-| tst3.js:1:1:1:56 | 42;  // semmle-extractor-options: --extract-program-text | 42;  // semmle-extractor-options: --extract-program-text | \n |
+| tst1.js:9:1:9:3 | stu | stu | \n |
+| tst2.js:1:1:1:10 | first_line | first_line | \n |
+| tst3.js:1:1:1:3 | 42; | 42; | \n |
 | tst3.js:2:1:2:4 | \t42; | \t42; | \n |
 | tst3.js:3:1:3:5 | \t\t42; | \t\t42; | \n |
 | tst3.js:4:1:4:6 | \t\t\t42; | \t\t\t42; | \n |
 | tst3.js:5:1:5:6 | \t\t 42; | \t\t 42; | \n |
 | tst3.js:6:1:6:6 | \t \t42; | \t \t42; | \n |
 | tst3.js:7:1:7:7 |     42; |     42; | \n |
-| tst3.js:8:1:8:5 |   42; |   42; |  |
+| tst3.js:8:1:8:5 |   42; |   42; | \n |
diff --git a/javascript/ql/test/library-tests/Lines/options b/javascript/ql/test/library-tests/Lines/options
new file mode 100644
index 00000000000..d51f2d49be2
--- /dev/null
+++ b/javascript/ql/test/library-tests/Lines/options
@@ -0,0 +1 @@
+semmle-extractor-options: --extract-program-text
diff --git a/javascript/ql/test/library-tests/Lines/tst1.js b/javascript/ql/test/library-tests/Lines/tst1.js
index f10f44a7440..d5fa50c5f3a 100644
--- a/javascript/ql/test/library-tests/Lines/tst1.js
+++ b/javascript/ql/test/library-tests/Lines/tst1.js
@@ -1,5 +1,5 @@
-abc // semmle-extractor-options: --extract-program-text
+abc
 def
ghi
 jkl
 
mno

-pqr
stu
\ No newline at end of file
+pqr
stu
diff --git a/javascript/ql/test/library-tests/Lines/tst2.js b/javascript/ql/test/library-tests/Lines/tst2.js
index d3c77609145..c380edd400c 100644
--- a/javascript/ql/test/library-tests/Lines/tst2.js
+++ b/javascript/ql/test/library-tests/Lines/tst2.js
@@ -1 +1 @@
-first_line  // semmle-extractor-options: --extract-program-text
+first_line
diff --git a/javascript/ql/test/library-tests/Lines/tst3.js b/javascript/ql/test/library-tests/Lines/tst3.js
index ad0059d91ea..8c8468ffab2 100644
--- a/javascript/ql/test/library-tests/Lines/tst3.js
+++ b/javascript/ql/test/library-tests/Lines/tst3.js
@@ -1,8 +1,8 @@
-42;  // semmle-extractor-options: --extract-program-text
+42;
 	42;
 		42;
 			42;
 		 42;
 	 	42;
     42;
-  42;
\ No newline at end of file
+  42;
diff --git a/javascript/ql/test/library-tests/TypeScript/Modifiers/options b/javascript/ql/test/library-tests/TypeScript/Modifiers/options
new file mode 100644
index 00000000000..d51f2d49be2
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/Modifiers/options
@@ -0,0 +1 @@
+semmle-extractor-options: --extract-program-text
diff --git a/javascript/ql/test/library-tests/TypeScript/Modifiers/tst.ts b/javascript/ql/test/library-tests/TypeScript/Modifiers/tst.ts
index a56c724cf57..615a36ae6e5 100644
--- a/javascript/ql/test/library-tests/TypeScript/Modifiers/tst.ts
+++ b/javascript/ql/test/library-tests/TypeScript/Modifiers/tst.ts
@@ -113,5 +113,3 @@ interface InterfaceFields {
   z?: number;
   readonly w?: number;
 }
-
-// semmle-extractor-options: --extract-program-text
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/stmts/conditionals.js b/javascript/ql/test/library-tests/stmts/conditionals.js
index 12562b2881f..e21a4299f87 100644
--- a/javascript/ql/test/library-tests/stmts/conditionals.js
+++ b/javascript/ql/test/library-tests/stmts/conditionals.js
@@ -1,4 +1,4 @@
-if (true) // semmle-extractor-options: --extract-program-text
+if (true)
     ;
 if (b)
     ;
diff --git a/javascript/ql/test/library-tests/stmts/es2015.js b/javascript/ql/test/library-tests/stmts/es2015.js
index 6264c54a04f..09a501be36b 100644
--- a/javascript/ql/test/library-tests/stmts/es2015.js
+++ b/javascript/ql/test/library-tests/stmts/es2015.js
@@ -1,2 +1,2 @@
-for (var x of [1, 2, 3]) // semmle-extractor-options: --extract-program-text
+for (var x of [1, 2, 3])
 	console.log(x);
diff --git a/javascript/ql/test/library-tests/stmts/functions.js b/javascript/ql/test/library-tests/stmts/functions.js
index f1ac615a040..20ecacefad5 100644
--- a/javascript/ql/test/library-tests/stmts/functions.js
+++ b/javascript/ql/test/library-tests/stmts/functions.js
@@ -1,4 +1,4 @@
-function g(x, y) { // semmle-extractor-options: --extract-program-text
+function g(x, y) {
     return x+y;
 }
 
diff --git a/javascript/ql/test/library-tests/stmts/loops.js b/javascript/ql/test/library-tests/stmts/loops.js
index e2a63b3e3f9..6d424254d74 100644
--- a/javascript/ql/test/library-tests/stmts/loops.js
+++ b/javascript/ql/test/library-tests/stmts/loops.js
@@ -1,4 +1,4 @@
-while(true) // semmle-extractor-options: --extract-program-text
+while(true)
     ;
 outer: for(a; b; c) {
     for(;;)
diff --git a/javascript/ql/test/library-tests/stmts/options b/javascript/ql/test/library-tests/stmts/options
index ae107b46f9e..7b186f72cc5 100644
--- a/javascript/ql/test/library-tests/stmts/options
+++ b/javascript/ql/test/library-tests/stmts/options
@@ -1 +1 @@
-semmle-extractor-options: --experimental
+semmle-extractor-options: --experimental --extract-program-text
diff --git a/javascript/ql/test/library-tests/stmts/others.js b/javascript/ql/test/library-tests/stmts/others.js
index 58d6c5c1709..3b2a62a47bf 100644
--- a/javascript/ql/test/library-tests/stmts/others.js
+++ b/javascript/ql/test/library-tests/stmts/others.js
@@ -1,4 +1,4 @@
-with(a) { // semmle-extractor-options: --extract-program-text
+with(a) {
 }
 debugger;
 var x = 23, y;
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/stmts/tests.expected b/javascript/ql/test/library-tests/stmts/tests.expected
index c4632fbc065..75d6f0a24b4 100644
--- a/javascript/ql/test/library-tests/stmts/tests.expected
+++ b/javascript/ql/test/library-tests/stmts/tests.expected
@@ -4,14 +4,11 @@ test_LetStmt
 test_LineTerminators
 | conditionals.js:12:1:12:1 | } |
 | functions.js:9:1:9:1 | } |
-| guardedCatch.js:11:1:11:65 | //semmle-extractor-options: --experimental --extract-program-text |
-| jscript.js:5:1:5:65 | //semmle-extractor-options: --experimental --extract-program-text |
-| legacyletstmt.js:5:1:5:65 | //semmle-extractor-options: --experimental --extract-program-text |
 | loops.js:22:1:22:18 | for (x = 0 in xs); |
 | others.js:4:1:4:14 | var x = 23, y; |
 | try.js:5:1:5:29 | try {} catch(x) {} finally {} |
 test_EnclosingStmt
-| conditionals.js:1:5:1:8 | true | conditionals.js:1:1:2:5 | if (tru ... t\\n    ; |
+| conditionals.js:1:5:1:8 | true | conditionals.js:1:1:2:5 | if (true)\\n    ; |
 | conditionals.js:3:5:3:5 | b | conditionals.js:3:1:6:5 | if (b)\\n ... e\\n    ; |
 | conditionals.js:7:9:7:9 | b | conditionals.js:7:1:12:1 | switch  ... ault:\\n} |
 | conditionals.js:8:6:8:7 | 23 | conditionals.js:8:1:8:8 | case 23: |
@@ -96,7 +93,7 @@ test_EnclosingStmt
 | legacyletstmt.js:2:15:2:15 | x | legacyletstmt.js:2:3:2:21 | console.log(x + y); |
 | legacyletstmt.js:2:15:2:19 | x + y | legacyletstmt.js:2:3:2:21 | console.log(x + y); |
 | legacyletstmt.js:2:19:2:19 | y | legacyletstmt.js:2:3:2:21 | console.log(x + y); |
-| loops.js:1:7:1:10 | true | loops.js:1:1:2:5 | while(t ... t\\n    ; |
+| loops.js:1:7:1:10 | true | loops.js:1:1:2:5 | while(true)\\n    ; |
 | loops.js:3:1:3:5 | outer | loops.js:3:1:11:1 | outer:  ... inue;\\n} |
 | loops.js:3:12:3:12 | a | loops.js:3:8:11:1 | for(a;  ... inue;\\n} |
 | loops.js:3:15:3:15 | b | loops.js:3:8:11:1 | for(a;  ... inue;\\n} |
@@ -129,7 +126,7 @@ test_EnclosingStmt
 | loops.js:22:6:22:6 | x | loops.js:22:1:22:18 | for (x = 0 in xs); |
 | loops.js:22:10:22:10 | 0 | loops.js:22:1:22:18 | for (x = 0 in xs); |
 | loops.js:22:15:22:16 | xs | loops.js:22:1:22:18 | for (x = 0 in xs); |
-| others.js:1:6:1:6 | a | others.js:1:1:2:1 | with(a) ... -text\\n} |
+| others.js:1:6:1:6 | a | others.js:1:1:2:1 | with(a) {\\n} |
 | others.js:4:5:4:5 | x | others.js:4:1:4:14 | var x = 23, y; |
 | others.js:4:5:4:10 | x = 23 | others.js:4:1:4:14 | var x = 23, y; |
 | others.js:4:9:4:10 | 23 | others.js:4:1:4:14 | var x = 23, y; |
@@ -140,7 +137,7 @@ test_EnclosingStmt
 | try.js:5:14:5:14 | x | try.js:5:8:5:18 | catch(x) {} |
 test_NumCatchClauses
 | guardedCatch.js:2:2:8:2 | try {\\n\\t ... !");\\n\\t} | 2 |
-| try.js:1:1:3:16 | try { / ... ) { ; } | 1 |
+| try.js:1:1:3:16 | try {\\n  ... ) { ; } | 1 |
 | try.js:4:1:4:20 | try {} finally { ; } | 0 |
 | try.js:5:1:5:29 | try {}  ... ally {} | 1 |
 test_DoubleColonMethods
@@ -151,7 +148,7 @@ test_SemicolonInsertion
 test_getGuard
 | guardedCatch.js:4:4:6:2 | catch ( ... !");\\n\\t} | guardedCatch.js:4:16:4:33 | e instanceof Error |
 test_Containers
-| conditionals.js:1:1:2:5 | if (tru ... t\\n    ; | conditionals.js:1:1:12:1 | <toplevel> |
+| conditionals.js:1:1:2:5 | if (true)\\n    ; | conditionals.js:1:1:12:1 | <toplevel> |
 | conditionals.js:2:5:2:5 | ; | conditionals.js:1:1:12:1 | <toplevel> |
 | conditionals.js:3:1:6:5 | if (b)\\n ... e\\n    ; | conditionals.js:1:1:12:1 | <toplevel> |
 | conditionals.js:4:5:4:5 | ; | conditionals.js:1:1:12:1 | <toplevel> |
@@ -164,22 +161,22 @@ test_Containers
 | es2015.js:1:1:2:16 | for (va ... log(x); | es2015.js:1:1:3:0 | <toplevel> |
 | es2015.js:1:6:1:10 | var x | es2015.js:1:1:3:0 | <toplevel> |
 | es2015.js:2:2:2:16 | console.log(x); | es2015.js:1:1:3:0 | <toplevel> |
-| foreach.js:1:1:1:12 | var sum = 0; | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:2:1:2:42 | var obj ... p3: 8}; | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:4:1:6:1 | for eac ... item;\\n} | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:4:11:4:18 | var item | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:4:28:6:1 | {\\n  sum += item;\\n} | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:5:3:5:14 | sum += item; | foreach.js:1:1:11:0 | <toplevel> |
-| foreach.js:8:1:8:17 | console.log(sum); | foreach.js:1:1:11:0 | <toplevel> |
+| foreach.js:1:1:1:12 | var sum = 0; | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:2:1:2:42 | var obj ... p3: 8}; | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:4:1:6:1 | for eac ... item;\\n} | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:4:11:4:18 | var item | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:4:28:6:1 | {\\n  sum += item;\\n} | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:5:3:5:14 | sum += item; | foreach.js:1:1:9:0 | <toplevel> |
+| foreach.js:8:1:8:17 | console.log(sum); | foreach.js:1:1:9:0 | <toplevel> |
 | functions.js:1:1:3:1 | functio ...  x+y;\\n} | functions.js:1:1:9:1 | <toplevel> |
-| functions.js:1:18:3:1 | { // se ...  x+y;\\n} | functions.js:1:1:3:1 | functio ...  x+y;\\n} |
+| functions.js:1:18:3:1 | {\\n    return x+y;\\n} | functions.js:1:1:3:1 | functio ...  x+y;\\n} |
 | functions.js:2:5:2:15 | return x+y; | functions.js:1:1:3:1 | functio ...  x+y;\\n} |
 | functions.js:5:1:5:15 | function h() {} | functions.js:1:1:9:1 | <toplevel> |
 | functions.js:5:14:5:15 | {} | functions.js:5:1:5:15 | function h() {} |
 | functions.js:7:1:9:1 | k = fun ... turn;\\n} | functions.js:1:1:9:1 | <toplevel> |
 | functions.js:7:16:9:1 | {\\n    return;\\n} | functions.js:7:5:9:1 | functio ... turn;\\n} |
 | functions.js:8:5:8:11 | return; | functions.js:7:5:9:1 | functio ... turn;\\n} |
-| guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} | guardedCatch.js:1:1:11:65 | <toplevel> |
+| guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} | guardedCatch.js:1:1:10:0 | <toplevel> |
 | guardedCatch.js:1:15:9:1 | {\\n\\ttry  ... );\\n\\t}\\n} | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
 | guardedCatch.js:2:2:8:2 | try {\\n\\t ... !");\\n\\t} | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
 | guardedCatch.js:2:6:4:2 | {\\n\\t\\tg();\\n\\t} | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
@@ -190,14 +187,14 @@ test_Containers
 | guardedCatch.js:6:4:8:2 | catch ( ... !");\\n\\t} | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
 | guardedCatch.js:6:14:8:2 | {\\n\\t\\tcon ... !");\\n\\t} | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
 | guardedCatch.js:7:3:7:33 | console ... lse!"); | guardedCatch.js:1:1:9:1 | functio ... );\\n\\t}\\n} |
-| jscript.js:1:1:1:28 | functio ... ad() {} | jscript.js:1:1:5:65 | <toplevel> |
+| jscript.js:1:1:1:28 | functio ... ad() {} | jscript.js:1:1:4:0 | <toplevel> |
 | jscript.js:1:27:1:28 | {} | jscript.js:1:1:1:28 | functio ... ad() {} |
-| jscript.js:3:1:3:36 | window. ... ad() {} | jscript.js:1:1:5:65 | <toplevel> |
+| jscript.js:3:1:3:36 | window. ... ad() {} | jscript.js:1:1:4:0 | <toplevel> |
 | jscript.js:3:35:3:36 | {} | jscript.js:3:17:3:36 | function onload() {} |
-| legacyletstmt.js:1:1:3:1 | let (x  ... + y);\\n} | legacyletstmt.js:1:1:5:65 | <toplevel> |
-| legacyletstmt.js:1:22:3:1 | {\\n  con ... + y);\\n} | legacyletstmt.js:1:1:5:65 | <toplevel> |
-| legacyletstmt.js:2:3:2:21 | console.log(x + y); | legacyletstmt.js:1:1:5:65 | <toplevel> |
-| loops.js:1:1:2:5 | while(t ... t\\n    ; | loops.js:1:1:22:18 | <toplevel> |
+| legacyletstmt.js:1:1:3:1 | let (x  ... + y);\\n} | legacyletstmt.js:1:1:4:0 | <toplevel> |
+| legacyletstmt.js:1:22:3:1 | {\\n  con ... + y);\\n} | legacyletstmt.js:1:1:4:0 | <toplevel> |
+| legacyletstmt.js:2:3:2:21 | console.log(x + y); | legacyletstmt.js:1:1:4:0 | <toplevel> |
+| loops.js:1:1:2:5 | while(true)\\n    ; | loops.js:1:1:22:18 | <toplevel> |
 | loops.js:2:5:2:5 | ; | loops.js:1:1:22:18 | <toplevel> |
 | loops.js:3:1:11:1 | outer:  ... inue;\\n} | loops.js:1:1:22:18 | <toplevel> |
 | loops.js:3:8:11:1 | for(a;  ... inue;\\n} | loops.js:1:1:22:18 | <toplevel> |
@@ -223,12 +220,12 @@ test_Containers
 | loops.js:21:16:21:16 | ; | loops.js:1:1:22:18 | <toplevel> |
 | loops.js:22:1:22:18 | for (x = 0 in xs); | loops.js:1:1:22:18 | <toplevel> |
 | loops.js:22:18:22:18 | ; | loops.js:1:1:22:18 | <toplevel> |
-| others.js:1:1:2:1 | with(a) ... -text\\n} | others.js:1:1:4:14 | <toplevel> |
-| others.js:1:9:2:1 | { // se ... -text\\n} | others.js:1:1:4:14 | <toplevel> |
+| others.js:1:1:2:1 | with(a) {\\n} | others.js:1:1:4:14 | <toplevel> |
+| others.js:1:9:2:1 | {\\n} | others.js:1:1:4:14 | <toplevel> |
 | others.js:3:1:3:9 | debugger; | others.js:1:1:4:14 | <toplevel> |
 | others.js:4:1:4:14 | var x = 23, y; | others.js:1:1:4:14 | <toplevel> |
-| try.js:1:1:3:16 | try { / ... ) { ; } | try.js:1:1:5:29 | <toplevel> |
-| try.js:1:5:3:1 | { // se ...  "!";\\n} | try.js:1:1:5:29 | <toplevel> |
+| try.js:1:1:3:16 | try {\\n  ... ) { ; } | try.js:1:1:5:29 | <toplevel> |
+| try.js:1:5:3:1 | {\\n    throw "!";\\n} | try.js:1:1:5:29 | <toplevel> |
 | try.js:2:5:2:14 | throw "!"; | try.js:1:1:5:29 | <toplevel> |
 | try.js:3:3:3:16 | catch(x) { ; } | try.js:1:1:5:29 | <toplevel> |
 | try.js:3:12:3:16 | { ; } | try.js:1:1:5:29 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/stmts/try.js b/javascript/ql/test/library-tests/stmts/try.js
index 2d82952fbd3..0151114bf84 100644
--- a/javascript/ql/test/library-tests/stmts/try.js
+++ b/javascript/ql/test/library-tests/stmts/try.js
@@ -1,4 +1,4 @@
-try { // semmle-extractor-options: --extract-program-text
+try {
     throw "!";
 } catch(x) { ; }
 try {} finally { ; }

From 725059deea8abccc6a38531fed27e7db47d7a2a7 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 6 Nov 2019 12:08:33 +0000
Subject: [PATCH 167/232] JavaScript: Remove `--source-type module` extractor
 options.

---
 .../library-tests/DataFlow/flowStep.expected     |  8 ++++----
 javascript/ql/test/library-tests/DataFlow/tst.ts |  4 +---
 .../library-tests/Flow/AbstractValues.expected   | 16 ++++++++--------
 javascript/ql/test/library-tests/Flow/tst.ts     |  4 +---
 .../InterProceduralFlow/callback.js              |  2 +-
 .../InterProceduralFlow/properties2.js           |  2 +-
 .../library-tests/NPM/ImportedModule.expected    | 10 +++++-----
 .../ql/test/library-tests/NPM/Modules.expected   |  6 +++---
 .../NPM/NPMPackage_getMainModule.expected        |  4 ++--
 .../ql/test/library-tests/NPM/src/index.js       |  3 +--
 .../ql/test/library-tests/NPM/src/lib/tst.js     |  3 +--
 .../src/node_modules/third-party-module/fancy.js |  3 +--
 .../NodeJS/Module_getAnImport.expected           |  1 +
 .../NodeJS/Module_getAnImportedModule.expected   |  2 +-
 .../test/library-tests/NodeJS/Modules.expected   |  2 +-
 .../test/library-tests/NodeJS/Require.expected   |  1 +
 .../library-tests/NodeJS/RequireImport.expected  |  2 +-
 javascript/ql/test/library-tests/NodeJS/e.js     |  3 +--
 18 files changed, 35 insertions(+), 41 deletions(-)

diff --git a/javascript/ql/test/library-tests/DataFlow/flowStep.expected b/javascript/ql/test/library-tests/DataFlow/flowStep.expected
index a6446732fbe..ad843094a5e 100644
--- a/javascript/ql/test/library-tests/DataFlow/flowStep.expected
+++ b/javascript/ql/test/library-tests/DataFlow/flowStep.expected
@@ -142,11 +142,11 @@
 | tst.js:111:29:111:31 | o2c | tst.js:111:6:111:38 | v2c |
 | tst.js:111:36:111:38 | o2d | tst.js:111:6:111:32 | [v2a, v ...  = o2c] |
 | tst.js:115:1:115:12 | reflective call | tst.js:115:1:115:12 | Array.call() |
-| tst.ts:1:1:1:1 | A | tst.ts:1:11:1:11 | A |
+| tst.ts:1:1:1:1 | A | tst.ts:1:18:1:18 | A |
 | tst.ts:1:1:1:1 | A | tst.ts:7:1:7:0 | A |
-| tst.ts:1:1:5:1 | A | tst.ts:7:1:7:0 | A |
-| tst.ts:1:1:5:1 | A | tst.ts:11:11:11:11 | A |
-| tst.ts:1:1:5:1 | namespa ... lysed\\n} | tst.ts:1:1:5:1 | A |
+| tst.ts:1:8:5:1 | A | tst.ts:7:1:7:0 | A |
+| tst.ts:1:8:5:1 | A | tst.ts:11:11:11:11 | A |
+| tst.ts:1:8:5:1 | namespa ... lysed\\n} | tst.ts:1:8:5:1 | A |
 | tst.ts:2:14:2:19 | x | tst.ts:4:3:4:3 | x |
 | tst.ts:2:18:2:19 | 42 | tst.ts:2:14:2:19 | x |
 | tst.ts:7:1:7:0 | A | tst.ts:8:3:8:3 | A |
diff --git a/javascript/ql/test/library-tests/DataFlow/tst.ts b/javascript/ql/test/library-tests/DataFlow/tst.ts
index dca2ee632b7..29c85cba933 100644
--- a/javascript/ql/test/library-tests/DataFlow/tst.ts
+++ b/javascript/ql/test/library-tests/DataFlow/tst.ts
@@ -1,4 +1,4 @@
-namespace A {
+export namespace A {
   export let x = 42;
   setX();
   x;                                     // global namespace exports are incompletely analysed
@@ -11,5 +11,3 @@ function setX() {
 var nd2 = A.x as number;                 // flow through type assertions
 
 class StringList extends List<string> {} // flow through expressions with type arguments
-
-// semmle-extractor-options: --source-type module
diff --git a/javascript/ql/test/library-tests/Flow/AbstractValues.expected b/javascript/ql/test/library-tests/Flow/AbstractValues.expected
index 42117cac98a..531faf562bd 100644
--- a/javascript/ql/test/library-tests/Flow/AbstractValues.expected
+++ b/javascript/ql/test/library-tests/Flow/AbstractValues.expected
@@ -194,8 +194,8 @@
 | n.js:2:1:2:15 | function g |
 | n.js:2:1:2:15 | instance of function g |
 | n.js:3:16:3:23 | object literal |
-| namespace-reexport.js:1:1:4:0 | exports object of module namespace-reexport |
-| namespace-reexport.js:1:1:4:0 | module object of module namespace-reexport |
+| namespace-reexport.js:1:1:2:0 | exports object of module namespace-reexport |
+| namespace-reexport.js:1:1:2:0 | module object of module namespace-reexport |
 | nestedImport.js:1:1:13:0 | exports object of module nestedImport |
 | nestedImport.js:1:1:13:0 | module object of module nestedImport |
 | nestedImport.js:9:1:12:1 | function tst |
@@ -235,14 +235,14 @@
 | objlit.js:43:12:45:3 | object literal |
 | reexport-d.js:1:1:2:0 | exports object of module reexport-d |
 | reexport-d.js:1:1:2:0 | module object of module reexport-d |
-| reexport-mixins.js:1:1:4:0 | exports object of module reexport-mixins |
-| reexport-mixins.js:1:1:4:0 | module object of module reexport-mixins |
+| reexport-mixins.js:1:1:2:0 | exports object of module reexport-mixins |
+| reexport-mixins.js:1:1:2:0 | module object of module reexport-mixins |
 | reexport-unknown.js:1:1:2:0 | exports object of module reexport-unknown |
 | reexport-unknown.js:1:1:2:0 | module object of module reexport-unknown |
 | reexport/client/src/index.js:1:1:3:0 | exports object of module index |
 | reexport/client/src/index.js:1:1:3:0 | module object of module index |
-| reexport/lib/index.js:1:1:4:0 | exports object of module index |
-| reexport/lib/index.js:1:1:4:0 | module object of module index |
+| reexport/lib/index.js:1:1:2:0 | exports object of module index |
+| reexport/lib/index.js:1:1:2:0 | module object of module index |
 | reexport/lib/src/utils/util.js:1:1:3:0 | exports object of module util |
 | reexport/lib/src/utils/util.js:1:1:3:0 | module object of module util |
 | refinements.js:1:1:8:1 | function f1 |
@@ -341,8 +341,8 @@
 | tst.js:174:1:183:1 | function awaitFlow |
 | tst.mjs:1:1:4:0 | exports object of module tst |
 | tst.mjs:1:1:4:0 | module object of module tst |
-| tst.ts:1:1:15:0 | exports object of module tst |
-| tst.ts:1:1:15:0 | module object of module tst |
+| tst.ts:1:1:13:0 | exports object of module tst |
+| tst.ts:1:1:13:0 | module object of module tst |
 | tst.ts:8:1:10:1 | function setX |
 | tst.ts:8:1:10:1 | instance of function setX |
 | with.js:1:1:17:1 | function f |
diff --git a/javascript/ql/test/library-tests/Flow/tst.ts b/javascript/ql/test/library-tests/Flow/tst.ts
index 615efbb7103..63e329f75c0 100644
--- a/javascript/ql/test/library-tests/Flow/tst.ts
+++ b/javascript/ql/test/library-tests/Flow/tst.ts
@@ -1,4 +1,4 @@
-namespace A {
+export namespace A {
   export let x = 42;
   setX();
   let x2 = x;
@@ -10,5 +10,3 @@ function setX() {
 }
 
 let a = A;
-
-// semmle-extractor-options: --source-type module
diff --git a/javascript/ql/test/library-tests/InterProceduralFlow/callback.js b/javascript/ql/test/library-tests/InterProceduralFlow/callback.js
index 8ba9bd12fee..1e4d7aed2e8 100644
--- a/javascript/ql/test/library-tests/InterProceduralFlow/callback.js
+++ b/javascript/ql/test/library-tests/InterProceduralFlow/callback.js
@@ -28,4 +28,4 @@ let source3 = "source3";
 call2(source3, store);
 call2(source3, confounder);
 
-// semmle-extractor-options: --source-type module
+export default 0;
diff --git a/javascript/ql/test/library-tests/InterProceduralFlow/properties2.js b/javascript/ql/test/library-tests/InterProceduralFlow/properties2.js
index 849516d57bb..9f1b0c9ba07 100644
--- a/javascript/ql/test/library-tests/InterProceduralFlow/properties2.js
+++ b/javascript/ql/test/library-tests/InterProceduralFlow/properties2.js
@@ -42,4 +42,4 @@ var o5 = {};
 setP(o5, "not a source");
 var sink10 = getP(o5);
 
-// semmle-extractor-options: --source-type module
+export default 0;
diff --git a/javascript/ql/test/library-tests/NPM/ImportedModule.expected b/javascript/ql/test/library-tests/NPM/ImportedModule.expected
index 2a89dfeb394..ce2a65d591f 100644
--- a/javascript/ql/test/library-tests/NPM/ImportedModule.expected
+++ b/javascript/ql/test/library-tests/NPM/ImportedModule.expected
@@ -1,6 +1,6 @@
-| src/lib/tst2.js:1:1:1:13 | require("..") | src/index.js:1:1:5:0 | <toplevel> |
-| src/node_modules/nested/tst3.js:1:1:1:29 | require ... odule') | src/node_modules/third-party-module/fancy.js:1:1:5:0 | <toplevel> |
+| src/lib/tst2.js:1:1:1:13 | require("..") | src/index.js:1:1:4:0 | <toplevel> |
+| src/node_modules/nested/tst3.js:1:1:1:29 | require ... odule') | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
 | src/node_modules/nested/tst3.js:2:1:2:12 | require('a') | src/node_modules/nested/node_modules/a/index.js:1:1:1:25 | <toplevel> |
-| src/node_modules/tst2.js:1:1:1:38 | require ... cy.js') | src/node_modules/third-party-module/fancy.js:1:1:5:0 | <toplevel> |
-| src/tst2.js:1:1:1:12 | require(".") | src/index.js:1:1:5:0 | <toplevel> |
-| src/tst.js:1:1:1:38 | require ... cy.js') | src/node_modules/third-party-module/fancy.js:1:1:5:0 | <toplevel> |
+| src/node_modules/tst2.js:1:1:1:38 | require ... cy.js') | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
+| src/tst2.js:1:1:1:12 | require(".") | src/index.js:1:1:4:0 | <toplevel> |
+| src/tst.js:1:1:1:38 | require ... cy.js') | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/NPM/Modules.expected b/javascript/ql/test/library-tests/NPM/Modules.expected
index 4d0dde9c33e..e7fa54d6f9a 100644
--- a/javascript/ql/test/library-tests/NPM/Modules.expected
+++ b/javascript/ql/test/library-tests/NPM/Modules.expected
@@ -1,9 +1,9 @@
 | b | src/node_modules/b/lib/index.js:1:1:2:0 | <toplevel> |
 | b | src/node_modules/b/lib/index.ts:1:1:2:0 | <toplevel> |
 | c | src/node_modules/c/src/index.js:1:1:2:0 | <toplevel> |
-| test-package | src/index.js:1:1:5:0 | <toplevel> |
+| test-package | src/index.js:1:1:4:0 | <toplevel> |
 | test-package | src/lib/tst2.js:1:1:1:14 | <toplevel> |
-| test-package | src/lib/tst.js:1:1:5:0 | <toplevel> |
+| test-package | src/lib/tst.js:1:1:4:0 | <toplevel> |
 | test-package | src/tst2.js:1:1:1:13 | <toplevel> |
 | test-package | src/tst.js:1:1:2:38 | <toplevel> |
-| third-party-module | src/node_modules/third-party-module/fancy.js:1:1:5:0 | <toplevel> |
+| third-party-module | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/NPM/NPMPackage_getMainModule.expected b/javascript/ql/test/library-tests/NPM/NPMPackage_getMainModule.expected
index 67fd1880bf0..a8b7753abae 100644
--- a/javascript/ql/test/library-tests/NPM/NPMPackage_getMainModule.expected
+++ b/javascript/ql/test/library-tests/NPM/NPMPackage_getMainModule.expected
@@ -1,4 +1,4 @@
 | b | src/node_modules/b/lib/index.ts:1:1:2:0 | <toplevel> |
 | c | src/node_modules/c/src/index.js:1:1:2:0 | <toplevel> |
-| test-package | src/index.js:1:1:5:0 | <toplevel> |
-| third-party-module | src/node_modules/third-party-module/fancy.js:1:1:5:0 | <toplevel> |
+| test-package | src/index.js:1:1:4:0 | <toplevel> |
+| third-party-module | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/NPM/src/index.js b/javascript/ql/test/library-tests/NPM/src/index.js
index b875bfd3a10..e99778b633f 100644
--- a/javascript/ql/test/library-tests/NPM/src/index.js
+++ b/javascript/ql/test/library-tests/NPM/src/index.js
@@ -1,4 +1,3 @@
 alert("Hello");
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process");
diff --git a/javascript/ql/test/library-tests/NPM/src/lib/tst.js b/javascript/ql/test/library-tests/NPM/src/lib/tst.js
index 840fb76057b..d8fc422959c 100644
--- a/javascript/ql/test/library-tests/NPM/src/lib/tst.js
+++ b/javascript/ql/test/library-tests/NPM/src/lib/tst.js
@@ -1,4 +1,3 @@
 alert("world");
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process");
diff --git a/javascript/ql/test/library-tests/NPM/src/node_modules/third-party-module/fancy.js b/javascript/ql/test/library-tests/NPM/src/node_modules/third-party-module/fancy.js
index f53610fe05c..7dfe5aea1d2 100644
--- a/javascript/ql/test/library-tests/NPM/src/node_modules/third-party-module/fancy.js
+++ b/javascript/ql/test/library-tests/NPM/src/node_modules/third-party-module/fancy.js
@@ -1,4 +1,3 @@
 ('alert' in this ? alert : console.log)("Hello");
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process");
diff --git a/javascript/ql/test/library-tests/NodeJS/Module_getAnImport.expected b/javascript/ql/test/library-tests/NodeJS/Module_getAnImport.expected
index 9f2e4dba88e..d1cc2576141 100644
--- a/javascript/ql/test/library-tests/NodeJS/Module_getAnImport.expected
+++ b/javascript/ql/test/library-tests/NodeJS/Module_getAnImport.expected
@@ -9,6 +9,7 @@
 | b.js:1:1:8:0 | <toplevel> | b.js:1:1:1:18 | require('./sub/c') |
 | d.js:1:1:7:15 | <toplevel> | d.js:1:1:1:38 | require ... s/ini') |
 | d.js:1:1:7:15 | <toplevel> | d.js:7:1:7:14 | require('foo') |
+| e.js:1:1:6:0 | <toplevel> | e.js:5:1:5:18 | require("process") |
 | index.js:1:1:3:0 | <toplevel> | index.js:1:12:1:26 | require('path') |
 | index.js:1:1:3:0 | <toplevel> | index.js:2:1:2:41 | require ... b.js")) |
 | mjs-files/require-from-js.js:1:1:4:0 | <toplevel> | mjs-files/require-from-js.js:1:12:1:36 | require ... on-me') |
diff --git a/javascript/ql/test/library-tests/NodeJS/Module_getAnImportedModule.expected b/javascript/ql/test/library-tests/NodeJS/Module_getAnImportedModule.expected
index c038d8f9031..0fa0e65f359 100644
--- a/javascript/ql/test/library-tests/NodeJS/Module_getAnImportedModule.expected
+++ b/javascript/ql/test/library-tests/NodeJS/Module_getAnImportedModule.expected
@@ -1,6 +1,6 @@
 | a.js:1:1:14:0 | <toplevel> | b.js:1:1:8:0 | <toplevel> |
 | a.js:1:1:14:0 | <toplevel> | d.js:1:1:7:15 | <toplevel> |
-| a.js:1:1:14:0 | <toplevel> | e.js:1:1:7:0 | <toplevel> |
+| a.js:1:1:14:0 | <toplevel> | e.js:1:1:6:0 | <toplevel> |
 | a.js:1:1:14:0 | <toplevel> | index.js:1:1:3:0 | <toplevel> |
 | a.js:1:1:14:0 | <toplevel> | sub/c.js:1:1:4:0 | <toplevel> |
 | b.js:1:1:8:0 | <toplevel> | sub/c.js:1:1:4:0 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/NodeJS/Modules.expected b/javascript/ql/test/library-tests/NodeJS/Modules.expected
index 05306ec82c5..1ef82d0328e 100644
--- a/javascript/ql/test/library-tests/NodeJS/Modules.expected
+++ b/javascript/ql/test/library-tests/NodeJS/Modules.expected
@@ -1,7 +1,7 @@
 | a.js:1:1:14:0 | <toplevel> | a.js:0:0:0:0 | a.js | a.js | a |
 | b.js:1:1:8:0 | <toplevel> | b.js:0:0:0:0 | b.js | b.js | b |
 | d.js:1:1:7:15 | <toplevel> | d.js:0:0:0:0 | d.js | d.js | d |
-| e.js:1:1:7:0 | <toplevel> | e.js:0:0:0:0 | e.js | e.js | e |
+| e.js:1:1:6:0 | <toplevel> | e.js:0:0:0:0 | e.js | e.js | e |
 | index.js:1:1:3:0 | <toplevel> | index.js:0:0:0:0 | index.js | index.js | index |
 | mjs-files/require-from-js.js:1:1:4:0 | <toplevel> | mjs-files/require-from-js.js:0:0:0:0 | mjs-files/require-from-js.js | mjs-files/require-from-js.js | require-from-js |
 | sub/c.js:1:1:4:0 | <toplevel> | sub/c.js:0:0:0:0 | sub/c.js | sub/c.js | c |
diff --git a/javascript/ql/test/library-tests/NodeJS/Require.expected b/javascript/ql/test/library-tests/NodeJS/Require.expected
index 491c80a9a87..7e9a50685ab 100644
--- a/javascript/ql/test/library-tests/NodeJS/Require.expected
+++ b/javascript/ql/test/library-tests/NodeJS/Require.expected
@@ -9,6 +9,7 @@
 | b.js:1:1:1:18 | require('./sub/c') |
 | d.js:1:1:1:38 | require ... s/ini') |
 | d.js:7:1:7:14 | require('foo') |
+| e.js:5:1:5:18 | require("process") |
 | f.js:2:1:2:7 | r("fs") |
 | index.js:1:12:1:26 | require('path') |
 | index.js:2:1:2:41 | require ... b.js")) |
diff --git a/javascript/ql/test/library-tests/NodeJS/RequireImport.expected b/javascript/ql/test/library-tests/NodeJS/RequireImport.expected
index a7ec65d67a2..e01527d2784 100644
--- a/javascript/ql/test/library-tests/NodeJS/RequireImport.expected
+++ b/javascript/ql/test/library-tests/NodeJS/RequireImport.expected
@@ -3,7 +3,7 @@
 | a.js:4:6:4:29 | require ... /d.js') | ./sub/../d.js | d.js:1:1:7:15 | <toplevel> |
 | a.js:7:1:7:18 | require('./sub/c') | ./sub/c | sub/c.js:1:1:4:0 | <toplevel> |
 | a.js:10:1:10:18 | require(__dirname) |  | index.js:1:1:3:0 | <toplevel> |
-| a.js:11:1:11:25 | require ... + '/e') | /e | e.js:1:1:7:0 | <toplevel> |
+| a.js:11:1:11:25 | require ... + '/e') | /e | e.js:1:1:6:0 | <toplevel> |
 | a.js:12:1:12:28 | require ...  + 'c') | ./sub/c | sub/c.js:1:1:4:0 | <toplevel> |
 | b.js:1:1:1:18 | require('./sub/c') | ./sub/c | sub/c.js:1:1:4:0 | <toplevel> |
 | d.js:7:1:7:14 | require('foo') | foo | sub/f.js:1:1:4:17 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/NodeJS/e.js b/javascript/ql/test/library-tests/NodeJS/e.js
index 0a3f338f7d0..22254c56326 100644
--- a/javascript/ql/test/library-tests/NodeJS/e.js
+++ b/javascript/ql/test/library-tests/NodeJS/e.js
@@ -2,5 +2,4 @@
 	require('./a.js');
 })();
 
-// semmle-extractor-options: --platform
-// semmle-extractor-options: node
+require("process");

From 49008c9ff5923efbe3f29ccf66901eec67c40aa7 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Tue, 5 Nov 2019 14:20:10 +0100
Subject: [PATCH 168/232] C++: IR data flow local virtual dispatch

This is just good enough to cause no performance regressions and pass
the virtual-dispatch tests we have for `security.TaintTracking`. In
particular, it fixes the tests for `UncontrolledProcessOperation.ql`
when enabling `DefaultTaintTracking.qll`.
---
 .../ir/dataflow/internal/DataFlowDispatch.qll | 53 +++++++++++++++++++
 .../dataflow/dataflow-tests/dispatch.cpp      | 46 ++++++++++++++++
 .../dataflow/dataflow-tests/test.expected     |  6 +++
 .../dataflow-tests/test_diff.expected         |  2 +
 .../dataflow/dataflow-tests/test_ir.expected  |  8 +++
 5 files changed, 115 insertions(+)
 create mode 100644 cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index d0325a28d3e..9572639de59 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -1,5 +1,6 @@
 private import cpp
 private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
 
 Function viableImpl(CallInstruction call) { result = viableCallable(call) }
 
@@ -20,6 +21,58 @@ Function viableCallable(CallInstruction call) {
     functionSignatureWithBody(qualifiedName, nparams, result) and
     strictcount(Function other | functionSignatureWithBody(qualifiedName, nparams, other)) = 1
   )
+  or
+  // Rudimentary virtual dispatch support. It's essentially local data flow
+  // where the source is a derived-to-base conversion and the target is the
+  // qualifier of a call.
+  exists(Class derived, DataFlow::Node thisArgument |
+    nodeMayHaveClass(derived, thisArgument) and
+    overrideMayAffectCall(derived, thisArgument, _, result, call)
+  )
+}
+
+/**
+ * Holds if `call` is a virtual function call with qualifier `thisArgument` in
+ * `enclosingFunction`, whose static target is overridden by
+ * `overridingFunction` in `overridingClass`.
+ */
+pragma[noinline]
+private predicate overrideMayAffectCall(
+  Class overridingClass, DataFlow::Node thisArgument, Function enclosingFunction,
+  MemberFunction overridingFunction, CallInstruction call
+) {
+  call.getEnclosingFunction() = enclosingFunction and
+  overridingFunction.getAnOverriddenFunction+() = call.getStaticCallTarget() and
+  overridingFunction.getDeclaringType() = overridingClass and
+  thisArgument = DataFlow::instructionNode(call.getThisArgument())
+}
+
+/**
+ * Holds if `node` may have dynamic class `derived`, where `derived` is a class
+ * that may affect virtual dispatch within the enclosing function.
+ *
+ * For the sake of performance, this recursion is written out manually to make
+ * it a relation on `Class x Node` rather than `Node x Node` or `MemberFunction
+ * x Node`, both of which would be larger. It's a forward search since there
+ * should usually be fewer classes than calls.
+ *
+ * If a value is cast several classes up in the hierarchy, that will be modeled
+ * as a chain of `ConvertToBaseInstruction`s and will cause the search to start
+ * from each of them and pass through subsequent ones. There might be
+ * performance to gain by stopping before a second upcast and reconstructing
+ * the full chain in a "big-step" recursion after this one.
+ */
+private predicate nodeMayHaveClass(Class derived, DataFlow::Node node) {
+  exists(ConvertToBaseInstruction toBase |
+    derived = toBase.getDerivedClass() and
+    overrideMayAffectCall(derived, _, toBase.getEnclosingFunction(), _, _) and
+    node.asInstruction() = toBase
+  )
+  or
+  exists(DataFlow::Node prev |
+    nodeMayHaveClass(derived, prev) and
+    DataFlow::localFlowStep(prev, node)
+  )
 }
 
 /**
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
new file mode 100644
index 00000000000..f37eb4e9cbe
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
@@ -0,0 +1,46 @@
+int source();
+void sink(int);
+
+// This class has the opposite behavior of what the member function names suggest.
+struct Top {
+  virtual int isSource1() { return 0; }
+  virtual int isSource2() { return 0; }
+  virtual void isSink(int x) { }
+  virtual int notSource1() { return source(); }
+  virtual int notSource2() { return source(); }
+  virtual void notSink(int x) { sink(x); }
+};
+
+// This class has the correct behavior for just the functions ending in 2.
+struct Middle : Top {
+  int isSource2() override { return source(); }
+  int notSource2() override { return 0; }
+};
+
+// This class has all the behavior suggested by the function names.
+struct Bottom : Middle {
+  int isSource1() override { return source(); }
+  void isSink(int x) override { sink(x); }
+  int notSource1() override { return 0; }
+  void notSink(int x) override { }
+};
+
+void VirtualDispatch(Bottom *bottomPtr, Bottom &bottomRef) {
+  Top *topPtr = bottomPtr, &topRef = bottomRef;
+
+  sink(topPtr->isSource1()); // flow [NOT DETECTED]
+  sink(topPtr->isSource2()); // flow [NOT DETECTED by AST]
+  topPtr->isSink(source()); // flow [NOT DETECTED]
+
+  sink(topPtr->notSource1()); // no flow [FALSE POSITIVE]
+  sink(topPtr->notSource2()); // no flow [FALSE POSITIVE]
+  topPtr->notSink(source()); // no flow [FALSE POSITIVE]
+
+  sink(topRef.isSource1()); // flow [NOT DETECTED]
+  sink(topRef.isSource2()); // flow [NOT DETECTED by AST]
+  topRef.isSink(source()); // flow [NOT DETECTED]
+
+  sink(topRef.notSource1()); // no flow [FALSE POSITIVE]
+  sink(topRef.notSource2()); // no flow [FALSE POSITIVE]
+  topRef.notSink(source()); // no flow [FALSE POSITIVE]
+}
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected
index 6527db4b77e..24fa6fdb5bd 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected
@@ -15,6 +15,12 @@
 | clang.cpp:30:27:30:34 | call to getFirst | clang.cpp:28:27:28:32 | call to source |
 | clang.cpp:37:10:37:11 | m2 | clang.cpp:34:32:34:37 | call to source |
 | clang.cpp:45:17:45:18 | m2 | clang.cpp:43:35:43:40 | call to source |
+| dispatch.cpp:11:38:11:38 | x | dispatch.cpp:37:19:37:24 | call to source |
+| dispatch.cpp:11:38:11:38 | x | dispatch.cpp:45:18:45:23 | call to source |
+| dispatch.cpp:35:16:35:25 | call to notSource1 | dispatch.cpp:9:37:9:42 | call to source |
+| dispatch.cpp:36:16:36:25 | call to notSource2 | dispatch.cpp:10:37:10:42 | call to source |
+| dispatch.cpp:43:15:43:24 | call to notSource1 | dispatch.cpp:9:37:9:42 | call to source |
+| dispatch.cpp:44:15:44:24 | call to notSource2 | dispatch.cpp:10:37:10:42 | call to source |
 | lambdas.cpp:14:3:14:6 | t | lambdas.cpp:8:10:8:15 | call to source |
 | lambdas.cpp:18:8:18:8 | call to operator() | lambdas.cpp:8:10:8:15 | call to source |
 | lambdas.cpp:21:3:21:6 | t | lambdas.cpp:8:10:8:15 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
index 7d0d4e7d72e..8e914d53337 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
@@ -5,6 +5,8 @@
 | clang.cpp:28:27:28:32 | clang.cpp:29:27:29:28 | AST only |
 | clang.cpp:28:27:28:32 | clang.cpp:30:27:30:34 | AST only |
 | clang.cpp:39:42:39:47 | clang.cpp:41:18:41:19 | IR only |
+| dispatch.cpp:16:37:16:42 | dispatch.cpp:32:16:32:24 | IR only |
+| dispatch.cpp:16:37:16:42 | dispatch.cpp:40:15:40:23 | IR only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:14:3:14:6 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:18:8:18:8 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:21:3:21:6 | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
index 9b67a013a58..8d21837510e 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
@@ -12,6 +12,14 @@
 | clang.cpp:37:10:37:11 | Load: m2 | clang.cpp:34:32:34:37 | Call: call to source |
 | clang.cpp:41:18:41:19 | Load: m2 | clang.cpp:39:42:39:47 | Call: call to source |
 | clang.cpp:45:17:45:18 | Load: m2 | clang.cpp:43:35:43:40 | Call: call to source |
+| dispatch.cpp:11:38:11:38 | Load: x | dispatch.cpp:37:19:37:24 | Call: call to source |
+| dispatch.cpp:11:38:11:38 | Load: x | dispatch.cpp:45:18:45:23 | Call: call to source |
+| dispatch.cpp:32:16:32:24 | Call: call to isSource2 | dispatch.cpp:16:37:16:42 | Call: call to source |
+| dispatch.cpp:35:16:35:25 | Call: call to notSource1 | dispatch.cpp:9:37:9:42 | Call: call to source |
+| dispatch.cpp:36:16:36:25 | Call: call to notSource2 | dispatch.cpp:10:37:10:42 | Call: call to source |
+| dispatch.cpp:40:15:40:23 | Call: call to isSource2 | dispatch.cpp:16:37:16:42 | Call: call to source |
+| dispatch.cpp:43:15:43:24 | Call: call to notSource1 | dispatch.cpp:9:37:9:42 | Call: call to source |
+| dispatch.cpp:44:15:44:24 | Call: call to notSource2 | dispatch.cpp:10:37:10:42 | Call: call to source |
 | test.cpp:7:8:7:9 | Load: t1 | test.cpp:6:12:6:17 | Call: call to source |
 | test.cpp:9:8:9:9 | Load: t1 | test.cpp:6:12:6:17 | Call: call to source |
 | test.cpp:10:8:10:9 | Load: t2 | test.cpp:6:12:6:17 | Call: call to source |

From ec9ef334864e59dc9e95fda9ab8267b99e7f29dd Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Wed, 6 Nov 2019 13:59:52 +0100
Subject: [PATCH 169/232] C++: IR data flow through inheritance conversions

This makes IR data flow behave more like AST data flow, and it makes IR
virtual dispatch work without further changes.
---
 .../semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll | 3 ++-
 .../library-tests/dataflow/dataflow-tests/dispatch.cpp    | 8 ++++----
 .../dataflow/dataflow-tests/test_diff.expected            | 4 ++++
 .../dataflow/dataflow-tests/test_ir.expected              | 4 ++++
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index cd989c94710..4e84424fcb7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -205,7 +205,8 @@ private predicate simpleInstructionLocalFlowStep(Instruction iFrom, Instruction
   iTo.(CopyInstruction).getSourceValue() = iFrom or
   iTo.(PhiInstruction).getAnOperand().getDef() = iFrom or
   // Treat all conversions as flow, even conversions between different numeric types.
-  iTo.(ConvertInstruction).getUnary() = iFrom
+  iTo.(ConvertInstruction).getUnary() = iFrom or
+  iTo.(InheritanceConversionInstruction).getUnary() = iFrom
 }
 
 /**
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
index f37eb4e9cbe..5e4f2f97f46 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp
@@ -28,17 +28,17 @@ struct Bottom : Middle {
 void VirtualDispatch(Bottom *bottomPtr, Bottom &bottomRef) {
   Top *topPtr = bottomPtr, &topRef = bottomRef;
 
-  sink(topPtr->isSource1()); // flow [NOT DETECTED]
+  sink(topPtr->isSource1()); // flow [NOT DETECTED by AST]
   sink(topPtr->isSource2()); // flow [NOT DETECTED by AST]
-  topPtr->isSink(source()); // flow [NOT DETECTED]
+  topPtr->isSink(source()); // flow [NOT DETECTED by AST]
 
   sink(topPtr->notSource1()); // no flow [FALSE POSITIVE]
   sink(topPtr->notSource2()); // no flow [FALSE POSITIVE]
   topPtr->notSink(source()); // no flow [FALSE POSITIVE]
 
-  sink(topRef.isSource1()); // flow [NOT DETECTED]
+  sink(topRef.isSource1()); // flow [NOT DETECTED by AST]
   sink(topRef.isSource2()); // flow [NOT DETECTED by AST]
-  topRef.isSink(source()); // flow [NOT DETECTED]
+  topRef.isSink(source()); // flow [NOT DETECTED by AST]
 
   sink(topRef.notSource1()); // no flow [FALSE POSITIVE]
   sink(topRef.notSource2()); // no flow [FALSE POSITIVE]
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
index 8e914d53337..9b8be3abd1e 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected
@@ -7,6 +7,10 @@
 | clang.cpp:39:42:39:47 | clang.cpp:41:18:41:19 | IR only |
 | dispatch.cpp:16:37:16:42 | dispatch.cpp:32:16:32:24 | IR only |
 | dispatch.cpp:16:37:16:42 | dispatch.cpp:40:15:40:23 | IR only |
+| dispatch.cpp:22:37:22:42 | dispatch.cpp:31:16:31:24 | IR only |
+| dispatch.cpp:22:37:22:42 | dispatch.cpp:39:15:39:23 | IR only |
+| dispatch.cpp:33:18:33:23 | dispatch.cpp:23:38:23:38 | IR only |
+| dispatch.cpp:41:17:41:22 | dispatch.cpp:23:38:23:38 | IR only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:14:3:14:6 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:18:8:18:8 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:21:3:21:6 | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
index 8d21837510e..651e580a105 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected
@@ -14,9 +14,13 @@
 | clang.cpp:45:17:45:18 | Load: m2 | clang.cpp:43:35:43:40 | Call: call to source |
 | dispatch.cpp:11:38:11:38 | Load: x | dispatch.cpp:37:19:37:24 | Call: call to source |
 | dispatch.cpp:11:38:11:38 | Load: x | dispatch.cpp:45:18:45:23 | Call: call to source |
+| dispatch.cpp:23:38:23:38 | Load: x | dispatch.cpp:33:18:33:23 | Call: call to source |
+| dispatch.cpp:23:38:23:38 | Load: x | dispatch.cpp:41:17:41:22 | Call: call to source |
+| dispatch.cpp:31:16:31:24 | Call: call to isSource1 | dispatch.cpp:22:37:22:42 | Call: call to source |
 | dispatch.cpp:32:16:32:24 | Call: call to isSource2 | dispatch.cpp:16:37:16:42 | Call: call to source |
 | dispatch.cpp:35:16:35:25 | Call: call to notSource1 | dispatch.cpp:9:37:9:42 | Call: call to source |
 | dispatch.cpp:36:16:36:25 | Call: call to notSource2 | dispatch.cpp:10:37:10:42 | Call: call to source |
+| dispatch.cpp:39:15:39:23 | Call: call to isSource1 | dispatch.cpp:22:37:22:42 | Call: call to source |
 | dispatch.cpp:40:15:40:23 | Call: call to isSource2 | dispatch.cpp:16:37:16:42 | Call: call to source |
 | dispatch.cpp:43:15:43:24 | Call: call to notSource1 | dispatch.cpp:9:37:9:42 | Call: call to source |
 | dispatch.cpp:44:15:44:24 | Call: call to notSource2 | dispatch.cpp:10:37:10:42 | Call: call to source |

From aa841c306dd0a2ca2e732a29df4883ace4bba4ad Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Tue, 5 Nov 2019 14:48:31 +0100
Subject: [PATCH 170/232] C++: Use virtual dispatch in DefaultTaintTracking

This bit is only used by the compatibility code that sends flow into
parameters of functions without body.
---
 .../semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll  | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
index 0753dfd266e..e0135e0ad2f 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -2,6 +2,7 @@ import cpp
 import semmle.code.cpp.security.Security
 private import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch as Dispatch
 
 /**
  * A predictable instruction is one where an external user can predict
@@ -145,7 +146,8 @@ GlobalOrNamespaceVariable globalVarFromId(string id) {
 }
 
 Function resolveCall(Call call) {
-  // TODO: improve virtual dispatch. This will help in the test for
-  // `UncontrolledProcessOperation.ql`.
-  result = call.getTarget()
+  exists(CallInstruction callInstruction |
+    callInstruction.getAST() = call and
+    result = Dispatch::viableCallable(callInstruction)
+  )
 }

From f9feb05a727bf9640636ca89ae68d0fcbacd25cf Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 5 Nov 2019 17:05:38 +0000
Subject: [PATCH 171/232] CPP: Add a test of NtohlArrayNoBoundOpenSource.ql.

---
 .../NtohlArrayNoBound.expected                |   8 ++
 .../NtohlArrayNoBound/NtohlArrayNoBound.qlref |   1 +
 .../NtohlArrayNoBound/test.cpp                | 100 ++++++++++++++++++
 3 files changed, 109 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.expected
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.qlref
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/test.cpp

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.expected
new file mode 100644
index 00000000000..6c2fa97858c
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.expected	
@@ -0,0 +1,8 @@
+| test.cpp:12:25:12:29 | call to ntohl | Unchecked use of data from network function $@ | test.cpp:12:25:12:29 | call to ntohl | call to ntohl |
+| test.cpp:21:26:21:29 | len2 | Unchecked use of data from network function $@ | test.cpp:10:16:10:20 | call to ntohl | call to ntohl |
+| test.cpp:31:26:31:29 | len2 | Unchecked use of data from network function $@ | test.cpp:10:16:10:20 | call to ntohl | call to ntohl |
+| test.cpp:61:26:61:29 | len2 | Unchecked use of data from network function $@ | test.cpp:10:16:10:20 | call to ntohl | call to ntohl |
+| test.cpp:64:9:64:12 | len2 | Unchecked use of data from network function $@ | test.cpp:10:16:10:20 | call to ntohl | call to ntohl |
+| test.cpp:73:10:73:13 | lens | Unchecked use of data from network function $@ | test.cpp:10:16:10:20 | call to ntohl | call to ntohl |
+| test.cpp:86:10:86:13 | len3 | Unchecked use of data from network function $@ | test.cpp:85:10:85:14 | call to ntohl | call to ntohl |
+| test.cpp:94:9:94:11 | len | Unchecked use of data from network function $@ | test.cpp:99:8:99:12 | call to ntohl | call to ntohl |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.qlref
new file mode 100644
index 00000000000..2647a5479f2
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/NtohlArrayNoBound.qlref	
@@ -0,0 +1 @@
+Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBoundOpenSource.ql
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/test.cpp
new file mode 100644
index 00000000000..e3f01f9ae77
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Buffer Overflow/NtohlArrayNoBound/test.cpp	
@@ -0,0 +1,100 @@
+
+typedef unsigned int size_t;
+void *memcpy(void *s1, const void *s2, size_t n);
+size_t strlen(const char *s);
+int ntohl(int x);
+
+void test1(const char *source, size_t len)
+{
+	char buffer[256];
+	size_t len2 = ntohl(len);
+
+	memcpy(buffer, source, ntohl(len)); // BAD
+
+	if (len2 < 256)
+	{
+		memcpy(buffer, source, len2); // GOOD
+	}
+
+	if (source != 0)
+	{
+		memcpy(buffer, source, len2); // BAD
+	}
+
+	if ((len2 < 256) && (source != 0))
+	{
+		memcpy(buffer, source, len2); // GOOD
+	}
+
+	if ((len2 < 256) || (source != 0))
+	{
+		memcpy(buffer, source, len2); // BAD
+	}
+
+	if (len2 < 256)
+	{
+		if (source != 0)
+		{
+			memcpy(buffer, source, len2); // GOOD
+		}
+	}
+
+	if (len2 >= 256)
+	{
+		// fail
+	} else {
+		memcpy(buffer, source, len2); // GOOD
+	}
+
+	if (len2 + 1 < 256)
+	{
+		memcpy(buffer, source, len2 + 1); // GOOD
+	}
+
+	if (strlen(source) < 256)
+	{
+		memcpy(buffer, source, strlen(source)); // GOOD
+	}
+
+	if (strlen(source) < 256)
+	{
+		memcpy(buffer, source, len2); // BAD
+	}
+
+	buffer[len2] = 0; // BAD
+
+	if (len2 < 256)
+	{
+		buffer[len2] = 0; // GOOD
+	}
+
+	{
+		unsigned short lens = len2;
+		buffer[lens] = 0; // BAD
+	}
+
+	if (len2 < 256)
+	{
+		unsigned short lens = len2;
+		buffer[lens] = 0; // GOOD
+	}
+
+	size_t len3 = 0;
+	if (len3 < 256)
+	{
+		len3 = ntohl(len);
+		buffer[len3] = 0; // BAD
+	}
+}
+
+void test2(size_t len)
+{
+	char buffer[256];
+
+	buffer[len] = 0; // BAD
+}
+
+void test3(size_t len)
+{
+	test2(ntohl(len));
+}

From b6f16dee81a97f6f50d047beb9a90c0e9f9ee1c5 Mon Sep 17 00:00:00 2001
From: Taus Brock-Nannestad <taus@semmle.com>
Date: Wed, 6 Nov 2019 15:14:48 +0100
Subject: [PATCH 172/232] Python: Fix bad join order in `py/unused-import`

---
 python/ql/src/Imports/UnusedImport.ql | 59 +++++++++++++++++----------
 1 file changed, 38 insertions(+), 21 deletions(-)

diff --git a/python/ql/src/Imports/UnusedImport.ql b/python/ql/src/Imports/UnusedImport.ql
index 3ac04e2e4d2..4049f3d5e41 100644
--- a/python/ql/src/Imports/UnusedImport.ql
+++ b/python/ql/src/Imports/UnusedImport.ql
@@ -41,41 +41,58 @@ predicate all_not_understood(Module m) {
 }
 
 predicate imported_module_used_in_doctest(Import imp) {
-    exists(string modname |
+    exists(string modname, string docstring |
         imp.getAName().getAsname().(Name).getId() = modname and
         // Look for doctests containing the patterns:
         // >>> …name…
         // ... …name…
-        exists(StrConst doc |
-            doc.getEnclosingModule() = imp.getScope() and
-            doc.isDocString() and
-            doc.getText().regexpMatch("[\\s\\S]*(>>>|\\.\\.\\.).*" + modname + "[\\s\\S]*")
-        )
+        docstring = doctest_in_scope(imp.getScope()) and
+        docstring.regexpMatch("[\\s\\S]*(>>>|\\.\\.\\.).*" + modname + "[\\s\\S]*")
+    )
+}
+
+pragma[noinline]
+private string doctest_in_scope(Scope scope) {
+    exists(StrConst doc |
+        doc.getEnclosingModule() = scope and
+        doc.isDocString() and
+        result = doc.getText() and
+        result.regexpMatch("[\\s\\S]*(>>>|\\.\\.\\.)[\\s\\S]*")
+    )
+}
+
+pragma[noinline]
+private string typehint_annotation_in_file(File file) {
+    exists(StrConst annotation |
+        annotation = any(Arguments a).getAnAnnotation()
+        or
+        annotation = any(AnnAssign a).getAnnotation()
+    |
+        annotation.pointsTo(Value::forString(result)) and
+        file = annotation.getLocation().getFile()
+    )
+}
+
+pragma[noinline]
+private string typehint_comment_in_file(File file) {
+    exists(Comment typehint |
+        file = typehint.getLocation().getFile() and
+        result = typehint.getText() and
+        result.matches("# type:%")
     )
 }
 
 predicate imported_module_used_in_typehint(Import imp) {
-    exists(string modname, Location loc |
+    exists(string modname, File file |
         imp.getAName().getAsname().(Name).getId() = modname and
-        loc.getFile() = imp.getScope().(Module).getFile()
+        file = imp.getScope().(Module).getFile()
     |
         // Look for type hints containing the patterns:
         // # type: …name…
-        exists(Comment typehint |
-            loc = typehint.getLocation() and
-            typehint.getText().regexpMatch("# type:.*" + modname + ".*")
-        )
+        typehint_comment_in_file(file).regexpMatch("# type:.*" + modname + ".*")
         or
         // Type hint is inside a string annotation, as needed for forward references
-        exists(string typehint, Expr annotation |
-            annotation = any(Arguments a).getAnAnnotation()
-            or
-            annotation = any(AnnAssign a).getAnnotation()
-        |
-            annotation.pointsTo(Value::forString(typehint)) and
-            loc = annotation.getLocation() and
-            typehint.regexpMatch(".*\\b" + modname + "\\b.*")
-        )
+        typehint_annotation_in_file(file).regexpMatch(".*\\b" + modname + "\\b.*")
     )
 }
 

From 217ecd3551753708e146d46957d4765842adc3b7 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Wed, 6 Nov 2019 15:50:08 +0100
Subject: [PATCH 173/232] C++: Add <p> tags to split text into paragraphs

Without this, the rendered output is one big paragraph.
---
 .../Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
index 4d5dfabef14..621ae3273fd 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp	
@@ -21,7 +21,9 @@ Solutions to this problem can be thought of as falling into one of two
 categories: (1) rewrite the signed expression so that overflow cannot occur
 but the signedness remains, or (2) rewrite (or cast) the signed expression
 into unsigned form.
+</p>
 
+<p>
 Below we list examples of expressions where signed overflow may
 occur, along with proposed solutions.  The list should not be
 considered exhaustive.
@@ -31,21 +33,29 @@ considered exhaustive.
 Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>, 
 it is possible to rewrite it as <code>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</code>.
 Note that <code>i + delta</code>does not actually overflow, due to <code>int</code> promotion
+</p>
 
+<p>
 Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>USHORT_MAX - delta</code>. It must be true
 that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
 header has been included.
+</p>
 
+<p>
 Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is possible to rewrite it as <code>INT_MAX - delta</code>. It must be true
 that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
 header has been included.
+</p>
 
+<p>
 Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>(unsigned)i + delta &lt; i</code>.
 Note that program semantics are affected by this change.
+</p>
 
+<p>
 Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
 it is also possible to rewrite it as <code>unsigned int i, delta</code> and
 <code>i + delta &lt; i</code>.  Note that program semantics are 

From 43148083ebf7ca19832a5017b88f0853f5559ab9 Mon Sep 17 00:00:00 2001
From: Taus Brock-Nannestad <taus@semmle.com>
Date: Wed, 6 Nov 2019 16:36:28 +0100
Subject: [PATCH 174/232] Python: Fix bad join order for `global_name_used`.

As it turns out, there was a further bad join-order in the `global_name_used`
predicate. In this case, there was a common subexpression in the RA that was
being factored out and evaluated separately, producing a large number of tuples.
---
 python/ql/src/Imports/UnusedImport.ql | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/python/ql/src/Imports/UnusedImport.ql b/python/ql/src/Imports/UnusedImport.ql
index 3ac04e2e4d2..3d9163f9320 100644
--- a/python/ql/src/Imports/UnusedImport.ql
+++ b/python/ql/src/Imports/UnusedImport.ql
@@ -13,17 +13,17 @@
 import python
 import Variables.Definition
 
-predicate global_name_used(Module m, Variable name) {
+predicate global_name_used(Module m, string name) {
     exists(Name u, GlobalVariable v |
         u.uses(v) and
-        v.getId() = name.getId() and
+        v.getId() = name and
         u.getEnclosingModule() = m
     )
     or
     // A use of an undefined class local variable, will use the global variable
     exists(Name u, LocalVariable v |
         u.uses(v) and
-        v.getId() = name.getId() and
+        v.getId() = name and
         u.getEnclosingModule() = m and
         not v.getScope().getEnclosingScope*() instanceof Function
     )
@@ -84,7 +84,7 @@ predicate unused_import(Import imp, Variable name) {
     not imp.getAnImportedModuleName() = "__future__" and
     not imp.getEnclosingModule().declaredInAll(name.getId()) and
     imp.getScope() = imp.getEnclosingModule() and
-    not global_name_used(imp.getScope(), name) and
+    not global_name_used(imp.getScope(), name.getId()) and
     // Imports in `__init__.py` are used to force module loading
     not imp.getEnclosingModule().isPackageInit() and
     // Name may be imported for use in epytext documentation

From 399ac1f11297d24231ee8daab34daafd7618db0f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Nov 2019 15:57:44 +0000
Subject: [PATCH 175/232] CPP: Rename 'getAssertedFalseCondition' to something
 less misleading.

---
 .../Security/CWE/CWE-457/InitializationFunctions.qll   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 240bd7aa25e..1c299b9ad51 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -89,9 +89,9 @@ class ParameterNullCheck extends ParameterCheck {
       (
         va = this.(NotExpr).getOperand() or
         va = any(EQExpr eq | eq = this and eq.getAnOperand().getValue() = "0").getAnOperand() or
-        va = getAssertedFalseCondition(this) or
+        va = getCheckedFalseCondition(this) or
         va = any(NEExpr eq |
-            eq = getAssertedFalseCondition(this) and eq.getAnOperand().getValue() = "0"
+            eq = getCheckedFalseCondition(this) and eq.getAnOperand().getValue() = "0"
           ).getAnOperand()
       )
       or
@@ -101,7 +101,7 @@ class ParameterNullCheck extends ParameterCheck {
         va = this or
         va = any(NEExpr eq | eq = this and eq.getAnOperand().getValue() = "0").getAnOperand() or
         va = any(EQExpr eq |
-            eq = getAssertedFalseCondition(this) and eq.getAnOperand().getValue() = "0"
+            eq = getCheckedFalseCondition(this) and eq.getAnOperand().getValue() = "0"
           ).getAnOperand()
       )
     )
@@ -669,7 +669,7 @@ FieldAccess getAFieldAccess(Variable v) {
 }
 
 /**
- * Gets a condition which is asserted to be false by the given `ne` expression, according to this pattern:
+ * Gets a condition which is checked to be false by the given `ne` expression, according to this pattern:
  * ```
  * int a = !!result;
  * if (!a) {  // <- ne
@@ -677,7 +677,7 @@ FieldAccess getAFieldAccess(Variable v) {
  * }
  * ```
  */
-Expr getAssertedFalseCondition(NotExpr ne) {
+private Expr getCheckedFalseCondition(NotExpr ne) {
   exists(LocalVariable v |
     result = v.getInitializer().getExpr().(NotExpr).getOperand().(NotExpr).getOperand() and
     ne.getOperand() = v.getAnAccess() and

From 0c3f4e530f62ce1340c022948f5a2a84108e6353 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Nov 2019 16:07:28 +0000
Subject: [PATCH 176/232] CPP: Make some library predicates private.

---
 .../src/Security/CWE/CWE-457/InitializationFunctions.qll  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 1c299b9ad51..276b6043901 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -567,7 +567,7 @@ Expr getAnInitializedArgument(Call call) { result = call.getArgument(initialized
  * the call, under the given context and evidence.
  */
 pragma[nomagic]
-int conditionallyInitializedArgument(
+private int conditionallyInitializedArgument(
   Call call, ConditionalInitializationFunction target, Context c, Evidence e
 ) {
   target = getTarget(call) and
@@ -588,7 +588,7 @@ Expr getAConditionallyInitializedArgument(
 /**
  * Gets the type signature for the functions parameters.
  */
-string typeSig(Function f) {
+private string typeSig(Function f) {
   result = concat(int i, Type pt |
       pt = f.getParameter(i).getType()
     |
@@ -599,7 +599,7 @@ string typeSig(Function f) {
 /**
  * Holds where qualifiedName and typeSig make up the signature for the function.
  */
-predicate functionSignature(Function f, string qualifiedName, string typeSig) {
+private predicate functionSignature(Function f, string qualifiedName, string typeSig) {
   qualifiedName = f.getQualifiedName() and
   typeSig = typeSig(f)
 }
@@ -611,7 +611,7 @@ predicate functionSignature(Function f, string qualifiedName, string typeSig) {
  * This is useful for identifying call to target dependencies across libraries, where the libraries
  * are never statically linked together.
  */
-Function getAPossibleDefinition(Function undefinedFunction) {
+private Function getAPossibleDefinition(Function undefinedFunction) {
   not undefinedFunction.isDefined() and
   exists(string qn, string typeSig |
     functionSignature(undefinedFunction, qn, typeSig) and functionSignature(result, qn, typeSig)

From 81c58d5a64cdda985da83f0395cca56230b9477c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Nov 2019 16:17:33 +0000
Subject: [PATCH 177/232] CPP: Improve QLDoc comments.

---
 cpp/ql/src/semmle/code/cpp/NestedFields.qll | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/NestedFields.qll b/cpp/ql/src/semmle/code/cpp/NestedFields.qll
index 12109be8ece..c4be8b8b9ff 100644
--- a/cpp/ql/src/semmle/code/cpp/NestedFields.qll
+++ b/cpp/ql/src/semmle/code/cpp/NestedFields.qll
@@ -1,9 +1,8 @@
 import cpp
 
 /**
- * Gets a `Field` that is nested within the given `Struct`.
- *
- * This identifies `Field`s which are located in the same memory
+ * Gets a `Field` that is within the given `Struct`, either directly or nested
+ * inside one or more levels of member structs.
  */
 private Field getANestedField(Struct s) {
   result = s.getAField()
@@ -15,7 +14,7 @@ private Field getANestedField(Struct s) {
 }
 
 /**
- * Unwraps a series of field accesses to determine the inner-most qualifier.
+ * Unwraps a series of field accesses to determine the outer-most qualifier.
  */
 private Expr getUltimateQualifier(FieldAccess fa) {
   exists(Expr qualifier | qualifier = fa.getQualifier() |

From 2b24eb2e7083c7c776dd68b59289b8b6ea0ae479 Mon Sep 17 00:00:00 2001
From: Taus Brock-Nannestad <taus@semmle.com>
Date: Wed, 6 Nov 2019 17:14:05 +0100
Subject: [PATCH 178/232] Python: Fix bad join order for
 `py/multiple-calls-to-init`.

The `multiple_invocation_paths` predicate had a bad join order where
we (essentially) joined `i1` with `i2` and only then joined `i1` and `i2`
separately to reduce the number of tuples. The join coming from `i1 != i2` had
little impact, but `i1.getFunction() = multi` made a big difference (and
similarly for `i2`). I factored out the code so that these joins would be done
more eagerly. Thus, we went from

```
[2019-11-06 16:53:05] (38s) Starting to evaluate predicate MethodCallOrder::multiple_invocation_paths#ffff/4@2ce75a
[2019-11-06 16:53:35] (68s) Tuple counts for MethodCallOrder::multiple_invocation_paths#ffff:
                      134547    ~9%       {2} r1 = SCAN CallGraph::TInvocation#fff AS I OUTPUT I.<0>, I.<2>
                      235284431 ~3%       {4} r2 = JOIN r1 WITH CallGraph::TInvocation#fff AS R ON FIRST 1 OUTPUT r1.<0>, r1.<1>, R.<1>, R.<2>
                      235149884 ~3%       {4} r3 = SELECT r2 ON r2.<3> != r2.<1>
                      235149884 ~4%       {3} r4 = SCAN r3 OUTPUT r3.<1>, r3.<0>, r3.<3>
                      166753634 ~5%       {4} r5 = JOIN r4 WITH #CallGraph::FunctionInvocation::getACallee_dispred#ffPlus#swapped AS R ON FIRST 1 OUTPUT R.<1>, r4.<2>, r4.<1>, r4.<0>
                      129778    ~0%       {4} r6 = JOIN r5 WITH #CallGraph::FunctionInvocation::getACallee_dispred#ffPlus AS R ON FIRST 2 OUTPUT r5.<0>, r5.<3>, r5.<1>, r5.<2>
                                          return r6
[2019-11-06 16:53:35] (68s) Registering MethodCallOrder::multiple_invocation_paths#ffff + [] with content 1705dcbc08kd9aa40rp2g2e9civhv
[2019-11-06 16:53:35] (68s)  >>> Wrote relation MethodCallOrder::multiple_invocation_paths#ffff with 129778 rows and 4 columns.
```

to

```
[2019-11-06 17:22:22] (25s) Starting to evaluate predicate MethodCallOrder::multiple_invocation_paths_helper#ffff/4@586aec
[2019-11-06 17:22:22] (25s) Tuple counts for MethodCallOrder::multiple_invocation_paths_helper#ffff:
                      134547 ~0%     {2} r1 = SCAN CallGraph::TInvocation#fff AS I OUTPUT I.<2>, I.<0>
                      88111  ~4%     {3} r2 = JOIN r1 WITH #CallGraph::FunctionInvocation::getACallee_dispred#ffPlus#swapped AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
                      761305 ~0%     {4} r3 = JOIN r2 WITH #CallGraph::FunctionInvocation::getACallee_dispred#ffPlus AS R ON FIRST 1 OUTPUT r2.<1>, r2.<2>, r2.<0>, R.<1>
                      673194 ~0%     {4} r4 = SELECT r3 ON r3.<3> != r3.<1>
                      673194 ~0%     {4} r5 = SCAN r4 OUTPUT r4.<2>, r4.<1>, r4.<3>, r4.<0>
                                     return r5
[2019-11-06 17:22:22] (25s) Registering MethodCallOrder::multiple_invocation_paths_helper#ffff + [] with content 20edaaecf25nldgp24d9c4et8m3kv
[2019-11-06 17:22:22] (25s)  >>> Wrote relation MethodCallOrder::multiple_invocation_paths_helper#ffff with 673194 rows and 4 columns.
[2019-11-06 17:22:22] (25s) Starting to evaluate predicate MethodCallOrder::multiple_invocation_paths_helper#ffff_2301#join_rhs/4@9e5441
[2019-11-06 17:22:22] (25s) Tuple counts for MethodCallOrder::multiple_invocation_paths_helper#ffff_2301#join_rhs:
                      673194 ~0%     {4} r1 = SCAN MethodCallOrder::multiple_invocation_paths_helper#ffff AS I OUTPUT I.<2>, I.<3>, I.<0>, I.<1>
                                     return r1
[2019-11-06 17:22:22] (25s) Registering MethodCallOrder::multiple_invocation_paths_helper#ffff_2301#join_rhs + [] with content 2069301e655fi9mcovngg9hetfqas
[2019-11-06 17:22:22] (25s)  >>> Wrote relation MethodCallOrder::multiple_invocation_paths_helper#ffff_2301#join_rhs with 673194 rows and 4 columns.
[2019-11-06 17:22:22] (25s) Starting to evaluate predicate MethodCallOrder::multiple_invocation_paths#ffff/4@2f7c34
[2019-11-06 17:22:22] (25s) Tuple counts for MethodCallOrder::multiple_invocation_paths#ffff:
                      134547 ~0%     {2} r1 = SCAN CallGraph::TInvocation#fff AS I OUTPUT I.<2>, I.<0>
                      129778 ~0%     {4} r2 = JOIN r1 WITH MethodCallOrder::multiple_invocation_paths_helper#ffff_2301#join_rhs AS R ON FIRST 2 OUTPUT R.<2>, R.<3>, r1.<0>, r1.<1>
                                     return r2
[2019-11-06 17:22:22] (25s) Registering MethodCallOrder::multiple_invocation_paths#ffff + [] with content 1705dcbc08kd9aa40rp2g2e9civhv
[2019-11-06 17:22:22] (25s)  >>> Wrote relation MethodCallOrder::multiple_invocation_paths#ffff with 129778 rows and 4 columns.
[2019-11-06 17:22:22] (25s) Starting to evaluate predicate MethodCallOrder::multiple_invocation_paths#ffff_0312#join_rhs/4@9f9146
[2019-11-06 17:22:22] (25s) Tuple counts for MethodCallOrder::multiple_invocation_paths#ffff_0312#join_rhs:
                      129778 ~0%     {4} r1 = SCAN MethodCallOrder::multiple_invocation_paths#ffff AS I OUTPUT I.<0>, I.<3>, I.<1>, I.<2>
                                     return r1
[2019-11-06 17:22:22] (25s) Registering MethodCallOrder::multiple_invocation_paths#ffff_0312#join_rhs + [] with content 17c3fe1fcbf6ghhdr7hiukqp41rst
[2019-11-06 17:22:22] (25s)  >>> Wrote relation MethodCallOrder::multiple_invocation_paths#ffff_0312#join_rhs with 129778 rows and 4 columns.
```

Execution time on `salt` went from 29.5s to somewhere below 299ms (the predicate
was not listed in the timing report).
---
 python/ql/src/Classes/MethodCallOrder.qll | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/Classes/MethodCallOrder.qll b/python/ql/src/Classes/MethodCallOrder.qll
index fe6ef07266a..5073cefc134 100644
--- a/python/ql/src/Classes/MethodCallOrder.qll
+++ b/python/ql/src/Classes/MethodCallOrder.qll
@@ -3,11 +3,16 @@ import python
 // Helper predicates for multiple call to __init__/__del__ queries.
 
 pragma [noinline]
-private predicate multiple_invocation_paths(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2, FunctionObject multi) {
+private predicate multiple_invocation_paths_helper(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2, FunctionObject multi) {
     i1 != i2 and
     i1 = top.getACallee+() and
     i2 = top.getACallee+() and
-    i1.getFunction() = multi and
+    i1.getFunction() = multi
+}
+
+pragma [noinline]
+private predicate multiple_invocation_paths(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2, FunctionObject multi) {
+    multiple_invocation_paths_helper(top, i1, i2, multi) and
     i2.getFunction() = multi
 }
 

From e886cf729773f9e1f86ff35805e596e5f4274d9f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Nov 2019 16:27:06 +0000
Subject: [PATCH 179/232] CPP: 'i.e.' -> 'that is'.

---
 cpp/ql/src/Microsoft/SAL.qll                                   | 2 +-
 cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll        | 2 +-
 .../src/semmle/code/cpp/security/boostorg/asio/protocols.qll   | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/Microsoft/SAL.qll b/cpp/ql/src/Microsoft/SAL.qll
index fe6b455fa9b..963a726ae54 100644
--- a/cpp/ql/src/Microsoft/SAL.qll
+++ b/cpp/ql/src/Microsoft/SAL.qll
@@ -126,7 +126,7 @@ class SALParameter extends Parameter {
 }
 
 /**
- * A SAL element, i.e. a SAL annotation or a declaration entry
+ * A SAL element, that is, a SAL annotation or a declaration entry
  * that may have SAL annotations.
  */
 library class SALElement extends Element {
diff --git a/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll b/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
index 2fa9322843e..a181c9bb543 100644
--- a/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
+++ b/cpp/ql/src/semmle/code/cpp/dispatch/VirtualDispatch.qll
@@ -63,7 +63,7 @@ module VirtualDispatch {
 
   /**
    * Holds if `c` cannot inherit the member function `f`,
-   * i.e. `c` or one of its supertypes overrides `f`.
+   * that is, `c` or one of its supertypes overrides `f`.
    */
   private predicate cannotInherit(Class c, MemberFunction f) {
     exists(Class overridingType, MemberFunction override |
diff --git a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
index ae3733473ad..af1a8eaf8e7 100644
--- a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
@@ -56,7 +56,8 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value for a approved protocols, but that are hard-coded (i.e. no protocol negotiation)
+     * returns the value for an approved protocol, but that are hard-coded
+     * (that is, no protocol negotiation)
      */
     EnumConstant getAnApprovedButHardcodedProtocolConstant() {
       result = this.getATls12ProtocolConstant()

From 54e40a8977f50173dbfd0befae900fa5080208af Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 6 Nov 2019 12:19:09 +0000
Subject: [PATCH 180/232] JavaScript: Move `--html all` extractor options into
 `options` file.

---
 javascript/ql/test/library-tests/HTML/HtmlText/HtmlText.html    | 2 +-
 javascript/ql/test/library-tests/HTML/HtmlText/options          | 1 +
 .../frameworks/AngularJS/expressions/scopes/options             | 1 +
 .../frameworks/AngularJS/expressions/scopes/tst.html            | 1 -
 .../frameworks/AngularJS/expressions/sources/HtmlText.html      | 1 -
 .../frameworks/AngularJS/expressions/sources/options            | 1 +
 6 files changed, 4 insertions(+), 3 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/HTML/HtmlText/options
 create mode 100644 javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/options
 create mode 100644 javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/options

diff --git a/javascript/ql/test/library-tests/HTML/HtmlText/HtmlText.html b/javascript/ql/test/library-tests/HTML/HtmlText/HtmlText.html
index 6cf4bfc564f..0b571650c40 100644
--- a/javascript/ql/test/library-tests/HTML/HtmlText/HtmlText.html
+++ b/javascript/ql/test/library-tests/HTML/HtmlText/HtmlText.html
@@ -1,4 +1,4 @@
-//  semmle-extractor-options: --html all
+
 <html>
   <body>
   (1) as child #0
diff --git a/javascript/ql/test/library-tests/HTML/HtmlText/options b/javascript/ql/test/library-tests/HTML/HtmlText/options
new file mode 100644
index 00000000000..46bf0192945
--- /dev/null
+++ b/javascript/ql/test/library-tests/HTML/HtmlText/options
@@ -0,0 +1 @@
+semmle-extractor-options: --html all
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/options b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/options
new file mode 100644
index 00000000000..46bf0192945
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/options
@@ -0,0 +1 @@
+semmle-extractor-options: --html all
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/tst.html b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/tst.html
index 23449e03c0e..29608f2da53 100644
--- a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/tst.html
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/scopes/tst.html
@@ -17,4 +17,3 @@
   <my-template-directive />
 
 </div>
-// semmle-extractor-options: --html all
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/HtmlText.html b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/HtmlText.html
index 9678f75e0cc..87bb928ac4c 100644
--- a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/HtmlText.html
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/HtmlText.html
@@ -7,4 +7,3 @@
 <div>
   {{myExpr3}}
 </div>
-semmle-extractor-options: --html all
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/options b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/options
new file mode 100644
index 00000000000..46bf0192945
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/expressions/sources/options
@@ -0,0 +1 @@
+semmle-extractor-options: --html all

From 6c38f55e28aa4b9ebff51ccddd6a414fa03f45de Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Nov 2019 16:31:21 +0000
Subject: [PATCH 181/232] CPP: QLDoc protocols.qll.

---
 .../cpp/security/boostorg/asio/protocols.qll  | 61 ++++++++++---------
 1 file changed, 32 insertions(+), 29 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
index af1a8eaf8e7..73ccd49e2f8 100644
--- a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
@@ -3,7 +3,7 @@ import semmle.code.cpp.dataflow.DataFlow
 
 module BoostorgAsio {
   /**
-   * Represents boost::asio::ssl::context enum
+   * Represents the `boost::asio::ssl::context` enum.
    */
   class SslContextMethod extends Enum {
     SslContextMethod() {
@@ -12,7 +12,7 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value for a banned protocol
+     * Gets an enumeration constant for a banned protocol.
      */
     EnumConstant getABannedProtocolConstant() {
       result = this.getAnEnumConstant() and
@@ -56,15 +56,15 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value for an approved protocol, but that are hard-coded
-     * (that is, no protocol negotiation)
+     * Gets an enumeration constant for an approved protocol, that is hard-coded
+     * (no protocol negotiation).
      */
     EnumConstant getAnApprovedButHardcodedProtocolConstant() {
       result = this.getATls12ProtocolConstant()
     }
 
     /**
-     * returns the value for a TLS v1.2 protocol
+     * Gets an enumeration constant for a TLS v1.2 protocol.
      */
     EnumConstant getATls12ProtocolConstant() {
       result = this.getAnEnumConstant() and
@@ -81,7 +81,7 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value for a TLS v1.3 protocol
+     * Gets an enumeration constant for a TLS v1.3 protocol.
      */
     EnumConstant getATls13ProtocolConstant() {
       result = this.getAnEnumConstant() and
@@ -98,7 +98,7 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value of a generic TLS or SSL/TLS protocol
+     * Gets an enumeration constant for a generic TLS or SSL/TLS protocol.
      */
     EnumConstant getAGenericTlsProtocolConstant() {
       result = this.getAnEnumConstant() and
@@ -117,7 +117,7 @@ module BoostorgAsio {
     }
 
     /**
-     * returns the value of a generic SSL/TLS protocol
+     * Gets an enumeration constant for a generic SSL/TLS protocol.
      */
     EnumConstant getASslv23ProtocolConstant() {
       result = this.getAnEnumConstant() and
@@ -136,7 +136,9 @@ module BoostorgAsio {
   }
 
   /**
-   * NOTE: ignore - Modern versions of OpenSSL do not support SSL v2 anymore, so this option is for backwards compatibility only
+   * Gets the value for the no_sslv2 constant, right shifted by 16 bits.
+   * 
+   * Note that modern versions of OpelSSL do not support SSL v2, so this option is for backwards compatibility only.
    */
   int getShiftedSslOptionsNoSsl2() {
     // SSL_OP_NO_SSLv2 was removed from modern OpenSSL versions
@@ -144,7 +146,7 @@ module BoostorgAsio {
   }
 
   /**
-   * RightShift(16) value for no_sslv3 constant
+   * Gets the value for the no_sslv3 constant, right shifted by 16 bits.
    */
   int getShiftedSslOptionsNoSsl3() {
     // SSL_OP_NO_SSLv3 == 0x02000000U
@@ -152,7 +154,7 @@ module BoostorgAsio {
   }
 
   /**
-   * RightShift(16) value for no_tlsv1 constant
+   * Gets the value for the no_tlsv1 constant, right shifted by 16 bits.
    */
   int getShiftedSslOptionsNoTls1() {
     // SSL_OP_NO_TLSv1 == 0x04000000U
@@ -160,7 +162,7 @@ module BoostorgAsio {
   }
 
   /**
-   * RightShift(16) value for no_tlsv1_1 constant
+   * Gets the value for the no_tlsv1_1 constant, right shifted by 16 bits.
    */
   int getShiftedSslOptionsNoTls1_1() {
     // SSL_OP_NO_TLSv1_1 == 0x10000000U
@@ -168,7 +170,7 @@ module BoostorgAsio {
   }
 
   /**
-   * RightShift(16) value for no_tlsv1_2 constant
+   * Gets the value for the no_tlsv1_2 constant, right shifted by 16 bits.
    */
   int getShiftedSslOptionsNoTls1_2() {
     // SSL_OP_NO_TLSv1_2 == 0x08000000U
@@ -176,7 +178,7 @@ module BoostorgAsio {
   }
 
   /**
-   * RightShift(16) value for no_tlsv1_3 constant
+   * Gets the value for the no_tlsv1_3 constant, right shifted by 16 bits.
    */
   int getShiftedSslOptionsNoTls1_3() {
     // SSL_OP_NO_TLSv1_2 == 0x20000000U
@@ -184,7 +186,7 @@ module BoostorgAsio {
   }
 
   /**
-   * Represents boost::asio::ssl::context class
+   * Represents the `boost::asio::ssl::context` class.
    */
   class SslContextClass extends Class {
     SslContextClass() { this.getQualifiedName() = "boost::asio::ssl::context" }
@@ -197,7 +199,7 @@ module BoostorgAsio {
   }
 
   /**
-   * Represents boost::asio::ssl::context::set_options member function
+   * Represents `boost::asio::ssl::context::set_options` member function.
    */
   class SslSetOptionsFunction extends Function {
     SslSetOptionsFunction() {
@@ -206,7 +208,7 @@ module BoostorgAsio {
   }
 
   /**
-   * holds if the expression represents a banned protocol
+   * Holds if the expression represents a banned protocol.
    */
   predicate isExprBannedBoostProtocol(Expr e) {
     exists(Literal va | va = e |
@@ -245,7 +247,7 @@ module BoostorgAsio {
   }
 
   /**
-   * holds if the expression represents a TLS v1.2 protocol
+   * Holds if the expression represents a TLS v1.2 protocol.
    */
   predicate isExprTls12BoostProtocol(Expr e) {
     exists(Literal va | va = e |
@@ -270,7 +272,7 @@ module BoostorgAsio {
   }
 
   /**
-   * holds if the expression represents a protocol that requires Crypto Board approval
+   * Holds if the expression represents a protocol that requires Crypto Board approval.
    */
   predicate isExprTls13BoostProtocol(Expr e) {
     exists(Literal va | va = e |
@@ -295,7 +297,7 @@ module BoostorgAsio {
   }
 
   /**
-   * holds if the expression represents a generic TLS or SSL/TLS protocol
+   * Holds if the expression represents a generic TLS or SSL/TLS protocol.
    */
   predicate isExprTlsBoostProtocol(Expr e) {
     exists(Literal va | va = e |
@@ -326,7 +328,7 @@ module BoostorgAsio {
   }
 
   /**
-   * holds if the expression represents a generic SSl/TLS protocol
+   * Holds if the expression represents a generic SSl/TLS protocol.
    */
   predicate isExprSslV23BoostProtocol(Expr e) {
     exists(Literal va | va = e |
@@ -352,7 +354,8 @@ module BoostorgAsio {
 
   //////////////////////// Dataflow /////////////////////
   /**
-   * Abstract - Protocol value Flows to the first argument of the context constructor
+   * Abstract class for flows of protocol values to the first argument of a context
+   * constructor.
    */
   abstract class SslContextCallAbstractConfig extends DataFlow::Configuration {
     bindingset[this]
@@ -367,7 +370,7 @@ module BoostorgAsio {
   }
 
   /**
-   * any Protocol value Flows to the first argument of the context constructor
+   * Any protocol value that flows to the first argument of a context constructor.
    */
   class SslContextCallConfig extends SslContextCallAbstractConfig {
     SslContextCallConfig() { this = "SslContextCallConfig" }
@@ -381,7 +384,7 @@ module BoostorgAsio {
   }
 
   /**
-   * a banned protocol value Flows to the first argument of the context constructor
+   * A banned protocol value that flows to the first argument of a context constructor.
    */
   class SslContextCallBannedProtocolConfig extends SslContextCallAbstractConfig {
     SslContextCallBannedProtocolConfig() { this = "SslContextCallBannedProtocolConfig" }
@@ -396,7 +399,7 @@ module BoostorgAsio {
   }
 
   /**
-   * a TLS 1.2 protocol value Flows to the first argument of the context constructor
+   * A TLS 1.2 protocol value that flows to the first argument of a context constructor.
    */
   class SslContextCallTls12ProtocolConfig extends SslContextCallAbstractConfig {
     SslContextCallTls12ProtocolConfig() { this = "SslContextCallTls12ProtocolConfig" }
@@ -411,7 +414,7 @@ module BoostorgAsio {
   }
 
   /**
-   * a TLS 1.3 protocol value Flows to the first argument of the context constructor
+   * A TLS 1.3 protocol value that flows to the first argument of a context constructor.
    */
   class SslContextCallTls13ProtocolConfig extends SslContextCallAbstractConfig {
     SslContextCallTls13ProtocolConfig() { this = "SslContextCallTls12ProtocolConfig" }
@@ -426,7 +429,7 @@ module BoostorgAsio {
   }
 
   /**
-   * a generic TLS protocol value Flows to the first argument of the context constructor
+   * A generic TLS protocol value that flows to the first argument of a context constructor.
    */
   class SslContextCallTlsProtocolConfig extends SslContextCallAbstractConfig {
     SslContextCallTlsProtocolConfig() { this = "SslContextCallTlsProtocolConfig" }
@@ -441,7 +444,7 @@ module BoostorgAsio {
   }
 
   /**
-   * a context constructor call flows to a call calling SetOptions()
+   * A context constructor call that flows to a call to `SetOptions()`.
    */
   class SslContextFlowsToSetOptionConfig extends DataFlow::Configuration {
     SslContextFlowsToSetOptionConfig() { this = "SslContextFlowsToSetOptionConfig" }
@@ -465,7 +468,7 @@ module BoostorgAsio {
   }
 
   /**
-   * an option value flows to the 1st parameter of SetOptions()
+   * An option value that flows to the first parameter of a call to `SetOptions()`.
    */
   class SslOptionConfig extends DataFlow::Configuration {
     SslOptionConfig() { this = "SslOptionConfig" }

From a9e3bfbd11476210ff72c95f15866b7f745bae8e Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Wed, 6 Nov 2019 13:08:28 -0700
Subject: [PATCH 182/232] C++/C#: Treat string literals like read-only global
 variables for alias purposes.

Previously, we didn't track string literals as known memory locations at all, so they all just got marked as `UnknownMemoryLocation`, just like an aribtrary read from a random pointer. This led to some confusing def-use chains, where it would look like the contents of a string literal were being written to by the side effect of an earlier function call, which of course is impossible.

To fix this, I've made two changes. First, each string literal is now given a corresponding `IRVariable` (specifically `IRStringLiteral`), since a string literal behaves more or less as a read-only global variable. Second, the `IRVariable` for each string literal is now marked `isReadOnly()`, which the alias analysis uses to determine that an arbitrary write to aliased memory will not overwrite the contents of a string literal.

I originally planned to treat all string literals with the same value as being the same memory location, since this is the usual behavior of modern compilers. However, this made implementing `IRVariable.getAST()` tricky for string literals, so I left them unpooled.
---
 .../implementation/aliased_ssa/IRVariable.qll | 57 ++++++++++++++-----
 .../aliased_ssa/Instruction.qll               | 10 ++--
 .../aliased_ssa/internal/AliasAnalysis.qll    |  4 ++
 .../aliased_ssa/internal/AliasedSSA.qll       | 12 ++--
 .../aliased_ssa/internal/SSAConstruction.qll  |  5 --
 .../implementation/internal/TIRVariable.qll   |  6 ++
 .../cpp/ir/implementation/raw/IRVariable.qll  | 57 ++++++++++++++-----
 .../cpp/ir/implementation/raw/Instruction.qll | 10 ++--
 .../raw/internal/IRConstruction.qll           | 23 +++++---
 .../unaliased_ssa/IRVariable.qll              | 57 ++++++++++++++-----
 .../unaliased_ssa/Instruction.qll             | 10 ++--
 .../unaliased_ssa/internal/AliasAnalysis.qll  |  4 ++
 .../internal/SSAConstruction.qll              |  5 --
 .../ir/ssa/aliased_ssa_ir.expected            | 26 +++++++++
 cpp/ql/test/library-tests/ir/ssa/ssa.cpp      |  8 +++
 .../ir/ssa/unaliased_ssa_ir.expected          | 25 ++++++++
 .../implementation/internal/TIRVariable.qll   |  6 ++
 .../ir/implementation/raw/IRVariable.qll      | 57 ++++++++++++++-----
 .../ir/implementation/raw/Instruction.qll     | 10 ++--
 .../raw/internal/IRConstruction.qll           | 25 +++++---
 .../unaliased_ssa/IRVariable.qll              | 57 ++++++++++++++-----
 .../unaliased_ssa/Instruction.qll             | 10 ++--
 .../internal/SSAConstruction.qll              |  5 --
 23 files changed, 359 insertions(+), 130 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
index 1a607f82c29..e10e266b2ab 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
@@ -22,6 +22,12 @@ abstract class IRVariable extends TIRVariable {
 
   abstract string toString();
 
+  /**
+   * Holds if this variable's value cannot be changed within a function. Currently used for string
+   * literals, but could also apply to `const` global and static variables.
+   */
+  predicate isReadOnly() { none() }
+
   /**
    * Gets the type of the variable.
    */
@@ -113,34 +119,43 @@ class IRStaticUserVariable extends IRUserVariable {
   final override Language::StaticVariable getVariable() { result = var }
 }
 
+abstract class IRGeneratedVariable extends IRVariable {
+  Language::AST ast;
+  Language::LanguageType type;
+
+  final override Language::LanguageType getLanguageType() { result = type }
+
+  final override Language::AST getAST() { result = ast }
+
+  override string toString() { result = getBaseString() + getLocationString() }
+
+  override string getUniqueId() { none() }
+
+  final string getLocationString() {
+    result = ast.getLocation().getStartLine().toString() + ":" +
+        ast.getLocation().getStartColumn().toString()
+  }
+
+  string getBaseString() { none() }
+}
+
 IRTempVariable getIRTempVariable(Language::AST ast, TempVariableTag tag) {
   result.getAST() = ast and
   result.getTag() = tag
 }
 
-class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
-  Language::AST ast;
+class IRTempVariable extends IRGeneratedVariable, IRAutomaticVariable, TIRTempVariable {
   TempVariableTag tag;
-  Language::LanguageType type;
 
   IRTempVariable() { this = TIRTempVariable(func, ast, tag, type) }
 
-  final override Language::LanguageType getLanguageType() { result = type }
-
-  final override Language::AST getAST() { result = ast }
-
   final override string getUniqueId() {
     result = "Temp: " + Construction::getTempVariableUniqueId(this)
   }
 
   final TempVariableTag getTag() { result = tag }
 
-  override string toString() {
-    result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
-        ast.getLocation().getStartColumn().toString()
-  }
-
-  string getBaseString() { result = "#temp" }
+  override string getBaseString() { result = "#temp" }
 }
 
 class IRReturnVariable extends IRTempVariable {
@@ -154,3 +169,19 @@ class IRThrowVariable extends IRTempVariable {
 
   override string getBaseString() { result = "#throw" }
 }
+
+class IRStringLiteral extends IRGeneratedVariable, TIRStringLiteral {
+  Language::StringLiteral literal;
+
+  IRStringLiteral() { this = TIRStringLiteral(func, ast, type, literal) }
+
+  final override predicate isReadOnly() { any() }
+
+  final override string getUniqueId() {
+    result = "String: " + getLocationString() + "=" + Language::getStringLiteralText(literal)
+  }
+
+  override string getBaseString() { result = "#string" }
+
+  final Language::StringLiteral getLiteral() { result = literal }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
index 049983c9126..9f7cf68b065 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -808,14 +808,12 @@ class FloatConstantInstruction extends ConstantInstruction {
   FloatConstantInstruction() { getResultType() instanceof Language::FloatingPointType }
 }
 
-class StringConstantInstruction extends Instruction {
-  Language::StringLiteral value;
+class StringConstantInstruction extends VariableInstruction {
+  override IRStringLiteral var;
 
-  StringConstantInstruction() { value = Construction::getInstructionStringLiteral(this) }
+  final override string getImmediateString() { result = Language::getStringLiteralText(getValue()) }
 
-  final override string getImmediateString() { result = Language::getStringLiteralText(value) }
-
-  final Language::StringLiteral getValue() { result = value }
+  final Language::StringLiteral getValue() { result = var.getLiteral() }
 }
 
 class BinaryInstruction extends Instruction {
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
index b9aa07c1b36..0923ec8f994 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -308,6 +308,10 @@ predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset)
   instr.(VariableAddressInstruction).getIRVariable() = var and
   bitOffset = 0
   or
+  // A string literal is just a special read-only global variable.
+  instr.(StringConstantInstruction).getIRVariable() = var and
+  bitOffset = 0
+  or
   exists(Operand operand, IntValue originalBitOffset, IntValue propagatedBitOffset |
     operand = instr.getAnOperand() and
     // If an operand is propagated, then the result points to the same variable,
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
index 955d422cf9a..0835ffb7da6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
@@ -210,17 +210,21 @@ Overlap getOverlap(MemoryLocation def, MemoryLocation use) {
     def instanceof UnknownVirtualVariable and
     result instanceof MustTotallyOverlap
     or
-    // An UnknownMemoryLocation may partially overlap any Location within the same virtual variable.
+    // An UnknownMemoryLocation may partially overlap any Location within the same virtual variable,
+    // unless the location is read-only.
     def.getVirtualVariable() = use.getVirtualVariable() and
     def instanceof UnknownMemoryLocation and
-    result instanceof MayPartiallyOverlap
+    result instanceof MayPartiallyOverlap and
+    not use.(VariableMemoryLocation).getVariable().isReadOnly()
     or
     // An UnknownNonLocalMemoryLocation may partially overlap any location within the same virtual
-    // variable, except a local variable.
+    // variable, except a local variable or read-only variable.
     def.getVirtualVariable() = use.getVirtualVariable() and
     def instanceof UnknownNonLocalMemoryLocation and
     result instanceof MayPartiallyOverlap and
-    not use.(VariableMemoryLocation).getVariable() instanceof IRAutomaticVariable
+    not exists(IRVariable var | var = use.(VariableMemoryLocation).getVariable() |
+      var instanceof IRAutomaticVariable or var.isReadOnly()
+    )
     or
     exists(VariableMemoryLocation defVariableLocation |
       defVariableLocation = def and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
index 7152dec5c4a..c8362098295 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -341,11 +341,6 @@ private module Cached {
     result = getOldInstruction(instruction).(OldIR::ConstantValueInstruction).getValue()
   }
 
-  cached
-  Language::StringLiteral getInstructionStringLiteral(Instruction instruction) {
-    result = getOldInstruction(instruction).(OldIR::StringConstantInstruction).getValue()
-  }
-
   cached
   Language::BuiltInOperation getInstructionBuiltInOperation(Instruction instruction) {
     result = getOldInstruction(instruction)
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll
index fea67ef5ecd..01c135abf13 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll
@@ -9,4 +9,10 @@ newtype TIRVariable =
     Language::Function func, Language::AST ast, TempVariableTag tag, Language::LanguageType type
   ) {
     Construction::hasTempVariable(func, ast, tag, type)
+  } or
+  TIRStringLiteral(
+    Language::Function func, Language::AST ast, Language::LanguageType type,
+    Language::StringLiteral literal
+  ) {
+    Construction::hasStringLiteral(func, ast, type, literal)
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
index 1a607f82c29..e10e266b2ab 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
@@ -22,6 +22,12 @@ abstract class IRVariable extends TIRVariable {
 
   abstract string toString();
 
+  /**
+   * Holds if this variable's value cannot be changed within a function. Currently used for string
+   * literals, but could also apply to `const` global and static variables.
+   */
+  predicate isReadOnly() { none() }
+
   /**
    * Gets the type of the variable.
    */
@@ -113,34 +119,43 @@ class IRStaticUserVariable extends IRUserVariable {
   final override Language::StaticVariable getVariable() { result = var }
 }
 
+abstract class IRGeneratedVariable extends IRVariable {
+  Language::AST ast;
+  Language::LanguageType type;
+
+  final override Language::LanguageType getLanguageType() { result = type }
+
+  final override Language::AST getAST() { result = ast }
+
+  override string toString() { result = getBaseString() + getLocationString() }
+
+  override string getUniqueId() { none() }
+
+  final string getLocationString() {
+    result = ast.getLocation().getStartLine().toString() + ":" +
+        ast.getLocation().getStartColumn().toString()
+  }
+
+  string getBaseString() { none() }
+}
+
 IRTempVariable getIRTempVariable(Language::AST ast, TempVariableTag tag) {
   result.getAST() = ast and
   result.getTag() = tag
 }
 
-class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
-  Language::AST ast;
+class IRTempVariable extends IRGeneratedVariable, IRAutomaticVariable, TIRTempVariable {
   TempVariableTag tag;
-  Language::LanguageType type;
 
   IRTempVariable() { this = TIRTempVariable(func, ast, tag, type) }
 
-  final override Language::LanguageType getLanguageType() { result = type }
-
-  final override Language::AST getAST() { result = ast }
-
   final override string getUniqueId() {
     result = "Temp: " + Construction::getTempVariableUniqueId(this)
   }
 
   final TempVariableTag getTag() { result = tag }
 
-  override string toString() {
-    result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
-        ast.getLocation().getStartColumn().toString()
-  }
-
-  string getBaseString() { result = "#temp" }
+  override string getBaseString() { result = "#temp" }
 }
 
 class IRReturnVariable extends IRTempVariable {
@@ -154,3 +169,19 @@ class IRThrowVariable extends IRTempVariable {
 
   override string getBaseString() { result = "#throw" }
 }
+
+class IRStringLiteral extends IRGeneratedVariable, TIRStringLiteral {
+  Language::StringLiteral literal;
+
+  IRStringLiteral() { this = TIRStringLiteral(func, ast, type, literal) }
+
+  final override predicate isReadOnly() { any() }
+
+  final override string getUniqueId() {
+    result = "String: " + getLocationString() + "=" + Language::getStringLiteralText(literal)
+  }
+
+  override string getBaseString() { result = "#string" }
+
+  final Language::StringLiteral getLiteral() { result = literal }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
index 049983c9126..9f7cf68b065 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -808,14 +808,12 @@ class FloatConstantInstruction extends ConstantInstruction {
   FloatConstantInstruction() { getResultType() instanceof Language::FloatingPointType }
 }
 
-class StringConstantInstruction extends Instruction {
-  Language::StringLiteral value;
+class StringConstantInstruction extends VariableInstruction {
+  override IRStringLiteral var;
 
-  StringConstantInstruction() { value = Construction::getInstructionStringLiteral(this) }
+  final override string getImmediateString() { result = Language::getStringLiteralText(getValue()) }
 
-  final override string getImmediateString() { result = Language::getStringLiteralText(value) }
-
-  final Language::StringLiteral getValue() { result = value }
+  final Language::StringLiteral getValue() { result = var.getLiteral() }
 }
 
 class BinaryInstruction extends Instruction {
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
index fbf6b7e3d08..fe161e5196a 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
@@ -44,6 +44,13 @@ private module Cached {
     )
   }
 
+  cached
+  predicate hasStringLiteral(Function func, Locatable ast, CppType type, StringLiteral literal) {
+    literal = ast and
+    literal.getEnclosingFunction() = func and
+    getTypeForPRValue(literal.getType()) = type
+  }
+
   cached
   predicate hasModeledMemoryResult(Instruction instruction) { none() }
 
@@ -231,8 +238,14 @@ private module Cached {
 
   cached
   IRVariable getInstructionVariable(Instruction instruction) {
-    result = getInstructionTranslatedElement(instruction)
-          .getInstructionVariable(getInstructionTag(instruction))
+    exists(TranslatedElement element, InstructionTag tag |
+      element = getInstructionTranslatedElement(instruction) and
+      tag = getInstructionTag(instruction) and
+      (
+        result = element.getInstructionVariable(tag) or
+        result.(IRStringLiteral).getAST() = element.getInstructionStringLiteral(tag)
+      )
+    )
   }
 
   cached
@@ -263,12 +276,6 @@ private module Cached {
     )
   }
 
-  cached
-  StringLiteral getInstructionStringLiteral(Instruction instruction) {
-    result = getInstructionTranslatedElement(instruction)
-          .getInstructionStringLiteral(getInstructionTag(instruction))
-  }
-
   cached
   BuiltInOperation getInstructionBuiltInOperation(Instruction instruction) {
     result = getInstructionTranslatedElement(instruction)
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
index 1a607f82c29..e10e266b2ab 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
@@ -22,6 +22,12 @@ abstract class IRVariable extends TIRVariable {
 
   abstract string toString();
 
+  /**
+   * Holds if this variable's value cannot be changed within a function. Currently used for string
+   * literals, but could also apply to `const` global and static variables.
+   */
+  predicate isReadOnly() { none() }
+
   /**
    * Gets the type of the variable.
    */
@@ -113,34 +119,43 @@ class IRStaticUserVariable extends IRUserVariable {
   final override Language::StaticVariable getVariable() { result = var }
 }
 
+abstract class IRGeneratedVariable extends IRVariable {
+  Language::AST ast;
+  Language::LanguageType type;
+
+  final override Language::LanguageType getLanguageType() { result = type }
+
+  final override Language::AST getAST() { result = ast }
+
+  override string toString() { result = getBaseString() + getLocationString() }
+
+  override string getUniqueId() { none() }
+
+  final string getLocationString() {
+    result = ast.getLocation().getStartLine().toString() + ":" +
+        ast.getLocation().getStartColumn().toString()
+  }
+
+  string getBaseString() { none() }
+}
+
 IRTempVariable getIRTempVariable(Language::AST ast, TempVariableTag tag) {
   result.getAST() = ast and
   result.getTag() = tag
 }
 
-class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
-  Language::AST ast;
+class IRTempVariable extends IRGeneratedVariable, IRAutomaticVariable, TIRTempVariable {
   TempVariableTag tag;
-  Language::LanguageType type;
 
   IRTempVariable() { this = TIRTempVariable(func, ast, tag, type) }
 
-  final override Language::LanguageType getLanguageType() { result = type }
-
-  final override Language::AST getAST() { result = ast }
-
   final override string getUniqueId() {
     result = "Temp: " + Construction::getTempVariableUniqueId(this)
   }
 
   final TempVariableTag getTag() { result = tag }
 
-  override string toString() {
-    result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
-        ast.getLocation().getStartColumn().toString()
-  }
-
-  string getBaseString() { result = "#temp" }
+  override string getBaseString() { result = "#temp" }
 }
 
 class IRReturnVariable extends IRTempVariable {
@@ -154,3 +169,19 @@ class IRThrowVariable extends IRTempVariable {
 
   override string getBaseString() { result = "#throw" }
 }
+
+class IRStringLiteral extends IRGeneratedVariable, TIRStringLiteral {
+  Language::StringLiteral literal;
+
+  IRStringLiteral() { this = TIRStringLiteral(func, ast, type, literal) }
+
+  final override predicate isReadOnly() { any() }
+
+  final override string getUniqueId() {
+    result = "String: " + getLocationString() + "=" + Language::getStringLiteralText(literal)
+  }
+
+  override string getBaseString() { result = "#string" }
+
+  final Language::StringLiteral getLiteral() { result = literal }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
index 049983c9126..9f7cf68b065 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -808,14 +808,12 @@ class FloatConstantInstruction extends ConstantInstruction {
   FloatConstantInstruction() { getResultType() instanceof Language::FloatingPointType }
 }
 
-class StringConstantInstruction extends Instruction {
-  Language::StringLiteral value;
+class StringConstantInstruction extends VariableInstruction {
+  override IRStringLiteral var;
 
-  StringConstantInstruction() { value = Construction::getInstructionStringLiteral(this) }
+  final override string getImmediateString() { result = Language::getStringLiteralText(getValue()) }
 
-  final override string getImmediateString() { result = Language::getStringLiteralText(value) }
-
-  final Language::StringLiteral getValue() { result = value }
+  final Language::StringLiteral getValue() { result = var.getLiteral() }
 }
 
 class BinaryInstruction extends Instruction {
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index b9aa07c1b36..0923ec8f994 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -308,6 +308,10 @@ predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset)
   instr.(VariableAddressInstruction).getIRVariable() = var and
   bitOffset = 0
   or
+  // A string literal is just a special read-only global variable.
+  instr.(StringConstantInstruction).getIRVariable() = var and
+  bitOffset = 0
+  or
   exists(Operand operand, IntValue originalBitOffset, IntValue propagatedBitOffset |
     operand = instr.getAnOperand() and
     // If an operand is propagated, then the result points to the same variable,
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
index 7152dec5c4a..c8362098295 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -341,11 +341,6 @@ private module Cached {
     result = getOldInstruction(instruction).(OldIR::ConstantValueInstruction).getValue()
   }
 
-  cached
-  Language::StringLiteral getInstructionStringLiteral(Instruction instruction) {
-    result = getOldInstruction(instruction).(OldIR::StringConstantInstruction).getValue()
-  }
-
   cached
   Language::BuiltInOperation getInstructionBuiltInOperation(Instruction instruction) {
     result = getOldInstruction(instruction)
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 98786207c45..07faf581d3e 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -869,3 +869,29 @@ ssa.cpp:
 #  207|     v0_25(void)          = UnmodeledUse                       : mu*
 #  207|     v0_26(void)          = AliasedUse                         : ~m0_1
 #  207|     v0_27(void)          = ExitFunction                       : 
+
+#  215| char StringLiteralAliasing()
+#  215|   Block 0
+#  215|     v0_0(void)           = EnterFunction                 : 
+#  215|     m0_1(unknown)        = AliasedDefinition             : 
+#  215|     mu0_2(unknown)       = UnmodeledDefinition           : 
+#  216|     r0_3(glval<unknown>) = FunctionAddress[ExternalFunc] : 
+#  216|     v0_4(void)           = Call                          : func:r0_3
+#  216|     m0_5(unknown)        = ^CallSideEffect               : ~m0_1
+#  216|     m0_6(unknown)        = Chi                           : total:m0_1, partial:m0_5
+#  218|     r0_7(glval<char *>)  = VariableAddress[s]            : 
+#  218|     r0_8(glval<char[8]>) = StringConstant["Literal"]     : 
+#  218|     r0_9(char *)         = Convert                       : r0_8
+#  218|     m0_10(char *)        = Store                         : &:r0_7, r0_9
+#  219|     r0_11(glval<char>)   = VariableAddress[#return]      : 
+#  219|     r0_12(glval<char *>) = VariableAddress[s]            : 
+#  219|     r0_13(char *)        = Load                          : &:r0_12, m0_10
+#  219|     r0_14(int)           = Constant[2]                   : 
+#  219|     r0_15(glval<char>)   = PointerAdd[1]                 : r0_13, r0_14
+#  219|     r0_16(char)          = Load                          : &:r0_15, ~m0_1
+#  219|     m0_17(char)          = Store                         : &:r0_11, r0_16
+#  215|     r0_18(glval<char>)   = VariableAddress[#return]      : 
+#  215|     v0_19(void)          = ReturnValue                   : &:r0_18, m0_17
+#  215|     v0_20(void)          = UnmodeledUse                  : mu*
+#  215|     v0_21(void)          = AliasedUse                    : ~m0_6
+#  215|     v0_22(void)          = ExitFunction                  : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
index 4dfb0a2f6cd..8ce2b8900d8 100644
--- a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
+++ b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
@@ -210,3 +210,11 @@ int ModeledCallTarget(int x) {
   return y;
 }
 
+extern void ExternalFunc();
+
+char StringLiteralAliasing() {
+  ExternalFunc();
+
+  const char* s = "Literal";
+  return s[2];  // Should be defined by `AliasedDefinition`, not `Chi` or `CallSideEffect`.
+}
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 5ac06cadb55..03cf52c2ad6 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -833,3 +833,28 @@ ssa.cpp:
 #  207|     v0_22(void)          = UnmodeledUse                       : mu*
 #  207|     v0_23(void)          = AliasedUse                         : ~mu0_2
 #  207|     v0_24(void)          = ExitFunction                       : 
+
+#  215| char StringLiteralAliasing()
+#  215|   Block 0
+#  215|     v0_0(void)           = EnterFunction                 : 
+#  215|     mu0_1(unknown)       = AliasedDefinition             : 
+#  215|     mu0_2(unknown)       = UnmodeledDefinition           : 
+#  216|     r0_3(glval<unknown>) = FunctionAddress[ExternalFunc] : 
+#  216|     v0_4(void)           = Call                          : func:r0_3
+#  216|     mu0_5(unknown)       = ^CallSideEffect               : ~mu0_2
+#  218|     r0_6(glval<char *>)  = VariableAddress[s]            : 
+#  218|     r0_7(glval<char[8]>) = StringConstant["Literal"]     : 
+#  218|     r0_8(char *)         = Convert                       : r0_7
+#  218|     m0_9(char *)         = Store                         : &:r0_6, r0_8
+#  219|     r0_10(glval<char>)   = VariableAddress[#return]      : 
+#  219|     r0_11(glval<char *>) = VariableAddress[s]            : 
+#  219|     r0_12(char *)        = Load                          : &:r0_11, m0_9
+#  219|     r0_13(int)           = Constant[2]                   : 
+#  219|     r0_14(glval<char>)   = PointerAdd[1]                 : r0_12, r0_13
+#  219|     r0_15(char)          = Load                          : &:r0_14, ~mu0_2
+#  219|     m0_16(char)          = Store                         : &:r0_10, r0_15
+#  215|     r0_17(glval<char>)   = VariableAddress[#return]      : 
+#  215|     v0_18(void)          = ReturnValue                   : &:r0_17, m0_16
+#  215|     v0_19(void)          = UnmodeledUse                  : mu*
+#  215|     v0_20(void)          = AliasedUse                    : ~mu0_2
+#  215|     v0_21(void)          = ExitFunction                  : 
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/TIRVariable.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/TIRVariable.qll
index fea67ef5ecd..01c135abf13 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/TIRVariable.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/TIRVariable.qll
@@ -9,4 +9,10 @@ newtype TIRVariable =
     Language::Function func, Language::AST ast, TempVariableTag tag, Language::LanguageType type
   ) {
     Construction::hasTempVariable(func, ast, tag, type)
+  } or
+  TIRStringLiteral(
+    Language::Function func, Language::AST ast, Language::LanguageType type,
+    Language::StringLiteral literal
+  ) {
+    Construction::hasStringLiteral(func, ast, type, literal)
   }
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll
index 1a607f82c29..e10e266b2ab 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll
@@ -22,6 +22,12 @@ abstract class IRVariable extends TIRVariable {
 
   abstract string toString();
 
+  /**
+   * Holds if this variable's value cannot be changed within a function. Currently used for string
+   * literals, but could also apply to `const` global and static variables.
+   */
+  predicate isReadOnly() { none() }
+
   /**
    * Gets the type of the variable.
    */
@@ -113,34 +119,43 @@ class IRStaticUserVariable extends IRUserVariable {
   final override Language::StaticVariable getVariable() { result = var }
 }
 
+abstract class IRGeneratedVariable extends IRVariable {
+  Language::AST ast;
+  Language::LanguageType type;
+
+  final override Language::LanguageType getLanguageType() { result = type }
+
+  final override Language::AST getAST() { result = ast }
+
+  override string toString() { result = getBaseString() + getLocationString() }
+
+  override string getUniqueId() { none() }
+
+  final string getLocationString() {
+    result = ast.getLocation().getStartLine().toString() + ":" +
+        ast.getLocation().getStartColumn().toString()
+  }
+
+  string getBaseString() { none() }
+}
+
 IRTempVariable getIRTempVariable(Language::AST ast, TempVariableTag tag) {
   result.getAST() = ast and
   result.getTag() = tag
 }
 
-class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
-  Language::AST ast;
+class IRTempVariable extends IRGeneratedVariable, IRAutomaticVariable, TIRTempVariable {
   TempVariableTag tag;
-  Language::LanguageType type;
 
   IRTempVariable() { this = TIRTempVariable(func, ast, tag, type) }
 
-  final override Language::LanguageType getLanguageType() { result = type }
-
-  final override Language::AST getAST() { result = ast }
-
   final override string getUniqueId() {
     result = "Temp: " + Construction::getTempVariableUniqueId(this)
   }
 
   final TempVariableTag getTag() { result = tag }
 
-  override string toString() {
-    result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
-        ast.getLocation().getStartColumn().toString()
-  }
-
-  string getBaseString() { result = "#temp" }
+  override string getBaseString() { result = "#temp" }
 }
 
 class IRReturnVariable extends IRTempVariable {
@@ -154,3 +169,19 @@ class IRThrowVariable extends IRTempVariable {
 
   override string getBaseString() { result = "#throw" }
 }
+
+class IRStringLiteral extends IRGeneratedVariable, TIRStringLiteral {
+  Language::StringLiteral literal;
+
+  IRStringLiteral() { this = TIRStringLiteral(func, ast, type, literal) }
+
+  final override predicate isReadOnly() { any() }
+
+  final override string getUniqueId() {
+    result = "String: " + getLocationString() + "=" + Language::getStringLiteralText(literal)
+  }
+
+  override string getBaseString() { result = "#string" }
+
+  final Language::StringLiteral getLiteral() { result = literal }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
index 049983c9126..9f7cf68b065 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
@@ -808,14 +808,12 @@ class FloatConstantInstruction extends ConstantInstruction {
   FloatConstantInstruction() { getResultType() instanceof Language::FloatingPointType }
 }
 
-class StringConstantInstruction extends Instruction {
-  Language::StringLiteral value;
+class StringConstantInstruction extends VariableInstruction {
+  override IRStringLiteral var;
 
-  StringConstantInstruction() { value = Construction::getInstructionStringLiteral(this) }
+  final override string getImmediateString() { result = Language::getStringLiteralText(getValue()) }
 
-  final override string getImmediateString() { result = Language::getStringLiteralText(value) }
-
-  final Language::StringLiteral getValue() { result = value }
+  final Language::StringLiteral getValue() { result = var.getLiteral() }
 }
 
 class BinaryInstruction extends Instruction {
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRConstruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRConstruction.qll
index 0d2627e183f..72881a7c720 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRConstruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRConstruction.qll
@@ -52,6 +52,15 @@ private module Cached {
     )
   }
 
+  cached
+  predicate hasStringLiteral(
+    Callable callable, Language::AST ast, CSharpType type, StringLiteral literal
+  ) {
+    literal = ast and
+    literal.getEnclosingCallable() = callable and
+    getTypeForPRValue(literal.getType()) = type
+  }
+
   cached
   predicate hasModeledMemoryResult(Instruction instruction) { none() }
 
@@ -232,8 +241,14 @@ private module Cached {
 
   cached
   IRVariable getInstructionVariable(Instruction instruction) {
-    result = getInstructionTranslatedElement(instruction)
-          .getInstructionVariable(getInstructionTag(instruction))
+    exists(TranslatedElement element, InstructionTag tag |
+      element = getInstructionTranslatedElement(instruction) and
+      tag = getInstructionTag(instruction) and
+      (
+        result = element.getInstructionVariable(tag) or
+        result.(IRStringLiteral).getAST() = element.getInstructionStringLiteral(tag)
+      )
+    )
   }
 
   cached
@@ -265,12 +280,6 @@ private module Cached {
           .getInstructionConstantValue(getInstructionTag(instruction))
   }
 
-  cached
-  StringLiteral getInstructionStringLiteral(Instruction instruction) {
-    result = getInstructionTranslatedElement(instruction)
-          .getInstructionStringLiteral(getInstructionTag(instruction))
-  }
-
   cached
   CSharpType getInstructionExceptionType(Instruction instruction) {
     result = getInstructionTranslatedElement(instruction)
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll
index 1a607f82c29..e10e266b2ab 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll
@@ -22,6 +22,12 @@ abstract class IRVariable extends TIRVariable {
 
   abstract string toString();
 
+  /**
+   * Holds if this variable's value cannot be changed within a function. Currently used for string
+   * literals, but could also apply to `const` global and static variables.
+   */
+  predicate isReadOnly() { none() }
+
   /**
    * Gets the type of the variable.
    */
@@ -113,34 +119,43 @@ class IRStaticUserVariable extends IRUserVariable {
   final override Language::StaticVariable getVariable() { result = var }
 }
 
+abstract class IRGeneratedVariable extends IRVariable {
+  Language::AST ast;
+  Language::LanguageType type;
+
+  final override Language::LanguageType getLanguageType() { result = type }
+
+  final override Language::AST getAST() { result = ast }
+
+  override string toString() { result = getBaseString() + getLocationString() }
+
+  override string getUniqueId() { none() }
+
+  final string getLocationString() {
+    result = ast.getLocation().getStartLine().toString() + ":" +
+        ast.getLocation().getStartColumn().toString()
+  }
+
+  string getBaseString() { none() }
+}
+
 IRTempVariable getIRTempVariable(Language::AST ast, TempVariableTag tag) {
   result.getAST() = ast and
   result.getTag() = tag
 }
 
-class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
-  Language::AST ast;
+class IRTempVariable extends IRGeneratedVariable, IRAutomaticVariable, TIRTempVariable {
   TempVariableTag tag;
-  Language::LanguageType type;
 
   IRTempVariable() { this = TIRTempVariable(func, ast, tag, type) }
 
-  final override Language::LanguageType getLanguageType() { result = type }
-
-  final override Language::AST getAST() { result = ast }
-
   final override string getUniqueId() {
     result = "Temp: " + Construction::getTempVariableUniqueId(this)
   }
 
   final TempVariableTag getTag() { result = tag }
 
-  override string toString() {
-    result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
-        ast.getLocation().getStartColumn().toString()
-  }
-
-  string getBaseString() { result = "#temp" }
+  override string getBaseString() { result = "#temp" }
 }
 
 class IRReturnVariable extends IRTempVariable {
@@ -154,3 +169,19 @@ class IRThrowVariable extends IRTempVariable {
 
   override string getBaseString() { result = "#throw" }
 }
+
+class IRStringLiteral extends IRGeneratedVariable, TIRStringLiteral {
+  Language::StringLiteral literal;
+
+  IRStringLiteral() { this = TIRStringLiteral(func, ast, type, literal) }
+
+  final override predicate isReadOnly() { any() }
+
+  final override string getUniqueId() {
+    result = "String: " + getLocationString() + "=" + Language::getStringLiteralText(literal)
+  }
+
+  override string getBaseString() { result = "#string" }
+
+  final Language::StringLiteral getLiteral() { result = literal }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
index 049983c9126..9f7cf68b065 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -808,14 +808,12 @@ class FloatConstantInstruction extends ConstantInstruction {
   FloatConstantInstruction() { getResultType() instanceof Language::FloatingPointType }
 }
 
-class StringConstantInstruction extends Instruction {
-  Language::StringLiteral value;
+class StringConstantInstruction extends VariableInstruction {
+  override IRStringLiteral var;
 
-  StringConstantInstruction() { value = Construction::getInstructionStringLiteral(this) }
+  final override string getImmediateString() { result = Language::getStringLiteralText(getValue()) }
 
-  final override string getImmediateString() { result = Language::getStringLiteralText(value) }
-
-  final Language::StringLiteral getValue() { result = value }
+  final Language::StringLiteral getValue() { result = var.getLiteral() }
 }
 
 class BinaryInstruction extends Instruction {
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
index 7152dec5c4a..c8362098295 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -341,11 +341,6 @@ private module Cached {
     result = getOldInstruction(instruction).(OldIR::ConstantValueInstruction).getValue()
   }
 
-  cached
-  Language::StringLiteral getInstructionStringLiteral(Instruction instruction) {
-    result = getOldInstruction(instruction).(OldIR::StringConstantInstruction).getValue()
-  }
-
   cached
   Language::BuiltInOperation getInstructionBuiltInOperation(Instruction instruction) {
     result = getOldInstruction(instruction)

From 51c4ef4f7f20f22d45dd90f48f24957c2d885008 Mon Sep 17 00:00:00 2001
From: Robert Marsh <rdmarsh@semmle.com>
Date: Wed, 6 Nov 2019 13:32:35 -0800
Subject: [PATCH 183/232] C++: add SSA IR test for array initializers

---
 .../ir/ssa/aliased_ssa_ir.expected            | 71 +++++++++++++++++++
 cpp/ql/test/library-tests/ir/ssa/ssa.cpp      | 10 +++
 .../ir/ssa/unaliased_ssa_ir.expected          | 65 +++++++++++++++++
 3 files changed, 146 insertions(+)

diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 98786207c45..7345c6a5204 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -869,3 +869,74 @@ ssa.cpp:
 #  207|     v0_25(void)          = UnmodeledUse                       : mu*
 #  207|     v0_26(void)          = AliasedUse                         : ~m0_1
 #  207|     v0_27(void)          = ExitFunction                       : 
+
+#  213| void InitArray()
+#  213|   Block 0
+#  213|     v0_0(void)            = EnterFunction            : 
+#  213|     m0_1(unknown)         = AliasedDefinition        : 
+#  213|     mu0_2(unknown)        = UnmodeledDefinition      : 
+#  214|     r0_3(glval<char[32]>) = VariableAddress[a_pad]   : 
+#  214|     r0_4(glval<char[1]>)  = StringConstant[""]       : 
+#  214|     r0_5(char[1])         = Load                     : &:r0_4, ~m0_1
+#  214|     m0_6(char[1])         = Store                    : &:r0_3, r0_5
+#  214|     r0_7(unknown[31])     = Constant[0]              : 
+#  214|     r0_8(int)             = Constant[1]              : 
+#  214|     r0_9(glval<char>)     = PointerAdd[1]            : r0_3, r0_8
+#  214|     m0_10(unknown[31])    = Store                    : &:r0_9, r0_7
+#  215|     r0_11(glval<char[4]>) = VariableAddress[a_nopad] : 
+#  215|     r0_12(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_13(char[4])        = Load                     : &:r0_12, ~m0_1
+#  215|     m0_14(char[4])        = Store                    : &:r0_11, r0_13
+#  216|     r0_15(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     r0_16(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_17(char[5])        = Load                     : &:r0_16, ~m0_1
+#  216|     m0_18(char[5])        = Store                    : &:r0_15, r0_17
+#  217|     r0_19(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_20(char[2])        = Uninitialized[b]         : &:r0_19
+#  218|     r0_21(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     m0_22(char[2])        = Uninitialized[c]         : &:r0_21
+#  218|     r0_23(int)            = Constant[0]              : 
+#  218|     r0_24(glval<char>)    = PointerAdd[1]            : r0_21, r0_23
+#  218|     r0_25(unknown[2])     = Constant[0]              : 
+#  218|     m0_26(unknown[2])     = Store                    : &:r0_24, r0_25
+#  219|     r0_27(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     m0_28(char[2])        = Uninitialized[d]         : &:r0_27
+#  219|     r0_29(int)            = Constant[0]              : 
+#  219|     r0_30(glval<char>)    = PointerAdd[1]            : r0_27, r0_29
+#  219|     r0_31(char)           = Constant[0]              : 
+#  219|     m0_32(char)           = Store                    : &:r0_30, r0_31
+#  219|     m0_33(char[2])        = Chi                      : total:m0_28, partial:m0_32
+#  219|     r0_34(int)            = Constant[1]              : 
+#  219|     r0_35(glval<char>)    = PointerAdd[1]            : r0_27, r0_34
+#  219|     r0_36(char)           = Constant[0]              : 
+#  219|     m0_37(char)           = Store                    : &:r0_35, r0_36
+#  219|     m0_38(char[2])        = Chi                      : total:m0_33, partial:m0_37
+#  220|     r0_39(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     m0_40(char[2])        = Uninitialized[e]         : &:r0_39
+#  220|     r0_41(int)            = Constant[0]              : 
+#  220|     r0_42(glval<char>)    = PointerAdd[1]            : r0_39, r0_41
+#  220|     r0_43(char)           = Constant[0]              : 
+#  220|     m0_44(char)           = Store                    : &:r0_42, r0_43
+#  220|     m0_45(char[2])        = Chi                      : total:m0_40, partial:m0_44
+#  220|     r0_46(int)            = Constant[1]              : 
+#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_39, r0_46
+#  220|     r0_48(char)           = Constant[1]              : 
+#  220|     m0_49(char)           = Store                    : &:r0_47, r0_48
+#  220|     m0_50(char[2])        = Chi                      : total:m0_45, partial:m0_49
+#  221|     r0_51(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     m0_52(char[3])        = Uninitialized[f]         : &:r0_51
+#  221|     r0_53(int)            = Constant[0]              : 
+#  221|     r0_54(glval<char>)    = PointerAdd[1]            : r0_51, r0_53
+#  221|     r0_55(char)           = Constant[0]              : 
+#  221|     m0_56(char)           = Store                    : &:r0_54, r0_55
+#  221|     m0_57(char[3])        = Chi                      : total:m0_52, partial:m0_56
+#  221|     r0_58(int)            = Constant[1]              : 
+#  221|     r0_59(glval<char>)    = PointerAdd[1]            : r0_51, r0_58
+#  221|     r0_60(unknown[2])     = Constant[0]              : 
+#  221|     m0_61(unknown[2])     = Store                    : &:r0_59, r0_60
+#  221|     m0_62(char[3])        = Chi                      : total:m0_57, partial:m0_61
+#  222|     v0_63(void)           = NoOp                     : 
+#  213|     v0_64(void)           = ReturnVoid               : 
+#  213|     v0_65(void)           = UnmodeledUse             : mu*
+#  213|     v0_66(void)           = AliasedUse               : ~m0_1
+#  213|     v0_67(void)           = ExitFunction             : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
index 4dfb0a2f6cd..a38c66dcaf8 100644
--- a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
+++ b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
@@ -210,3 +210,13 @@ int ModeledCallTarget(int x) {
   return y;
 }
 
+void InitArray() {
+    char a_pad[32] = ""; 
+    char a_nopad[4] = "foo";
+    char a_infer[] = "blah";
+    char b[2];
+    char c[2] = {};
+    char d[2] = { 0 };
+    char e[2] = { 0, 1 };
+    char f[3] = { 0 };
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 5ac06cadb55..056b0cd5ac7 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -833,3 +833,68 @@ ssa.cpp:
 #  207|     v0_22(void)          = UnmodeledUse                       : mu*
 #  207|     v0_23(void)          = AliasedUse                         : ~mu0_2
 #  207|     v0_24(void)          = ExitFunction                       : 
+
+#  213| void InitArray()
+#  213|   Block 0
+#  213|     v0_0(void)            = EnterFunction            : 
+#  213|     mu0_1(unknown)        = AliasedDefinition        : 
+#  213|     mu0_2(unknown)        = UnmodeledDefinition      : 
+#  214|     r0_3(glval<char[32]>) = VariableAddress[a_pad]   : 
+#  214|     r0_4(glval<char[1]>)  = StringConstant[""]       : 
+#  214|     r0_5(char[1])         = Load                     : &:r0_4, ~mu0_2
+#  214|     mu0_6(char[1])        = Store                    : &:r0_3, r0_5
+#  214|     r0_7(unknown[31])     = Constant[0]              : 
+#  214|     r0_8(int)             = Constant[1]              : 
+#  214|     r0_9(glval<char>)     = PointerAdd[1]            : r0_3, r0_8
+#  214|     mu0_10(unknown[31])   = Store                    : &:r0_9, r0_7
+#  215|     r0_11(glval<char[4]>) = VariableAddress[a_nopad] : 
+#  215|     r0_12(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_13(char[4])        = Load                     : &:r0_12, ~mu0_2
+#  215|     m0_14(char[4])        = Store                    : &:r0_11, r0_13
+#  216|     r0_15(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     r0_16(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_17(char[5])        = Load                     : &:r0_16, ~mu0_2
+#  216|     m0_18(char[5])        = Store                    : &:r0_15, r0_17
+#  217|     r0_19(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_20(char[2])        = Uninitialized[b]         : &:r0_19
+#  218|     r0_21(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     mu0_22(char[2])       = Uninitialized[c]         : &:r0_21
+#  218|     r0_23(int)            = Constant[0]              : 
+#  218|     r0_24(glval<char>)    = PointerAdd[1]            : r0_21, r0_23
+#  218|     r0_25(unknown[2])     = Constant[0]              : 
+#  218|     mu0_26(unknown[2])    = Store                    : &:r0_24, r0_25
+#  219|     r0_27(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     mu0_28(char[2])       = Uninitialized[d]         : &:r0_27
+#  219|     r0_29(int)            = Constant[0]              : 
+#  219|     r0_30(glval<char>)    = PointerAdd[1]            : r0_27, r0_29
+#  219|     r0_31(char)           = Constant[0]              : 
+#  219|     mu0_32(char)          = Store                    : &:r0_30, r0_31
+#  219|     r0_33(int)            = Constant[1]              : 
+#  219|     r0_34(glval<char>)    = PointerAdd[1]            : r0_27, r0_33
+#  219|     r0_35(char)           = Constant[0]              : 
+#  219|     mu0_36(char)          = Store                    : &:r0_34, r0_35
+#  220|     r0_37(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     mu0_38(char[2])       = Uninitialized[e]         : &:r0_37
+#  220|     r0_39(int)            = Constant[0]              : 
+#  220|     r0_40(glval<char>)    = PointerAdd[1]            : r0_37, r0_39
+#  220|     r0_41(char)           = Constant[0]              : 
+#  220|     mu0_42(char)          = Store                    : &:r0_40, r0_41
+#  220|     r0_43(int)            = Constant[1]              : 
+#  220|     r0_44(glval<char>)    = PointerAdd[1]            : r0_37, r0_43
+#  220|     r0_45(char)           = Constant[1]              : 
+#  220|     mu0_46(char)          = Store                    : &:r0_44, r0_45
+#  221|     r0_47(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     mu0_48(char[3])       = Uninitialized[f]         : &:r0_47
+#  221|     r0_49(int)            = Constant[0]              : 
+#  221|     r0_50(glval<char>)    = PointerAdd[1]            : r0_47, r0_49
+#  221|     r0_51(char)           = Constant[0]              : 
+#  221|     mu0_52(char)          = Store                    : &:r0_50, r0_51
+#  221|     r0_53(int)            = Constant[1]              : 
+#  221|     r0_54(glval<char>)    = PointerAdd[1]            : r0_47, r0_53
+#  221|     r0_55(unknown[2])     = Constant[0]              : 
+#  221|     mu0_56(unknown[2])    = Store                    : &:r0_54, r0_55
+#  222|     v0_57(void)           = NoOp                     : 
+#  213|     v0_58(void)           = ReturnVoid               : 
+#  213|     v0_59(void)           = UnmodeledUse             : mu*
+#  213|     v0_60(void)           = AliasedUse               : ~mu0_2
+#  213|     v0_61(void)           = ExitFunction             : 

From 81ad11090ed4291a1671f40b7be8cb32d258bb24 Mon Sep 17 00:00:00 2001
From: Robert Marsh <rdmarsh@semmle.com>
Date: Wed, 6 Nov 2019 10:54:43 -0800
Subject: [PATCH 184/232] C++: uninit instr for string literal initializers

---
 .../internal/TranslatedDeclarationEntry.qll   |   3 +-
 .../test/library-tests/ir/ir/raw_ir.expected  | 119 ++++++++---------
 .../ir/ssa/aliased_ssa_ir.expected            | 121 +++++++++---------
 .../ir/ssa/unaliased_ssa_ir.expected          | 119 ++++++++---------
 4 files changed, 187 insertions(+), 175 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
index 294a539ec31..c3572bd0e79 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
@@ -120,7 +120,8 @@ abstract class TranslatedVariableDeclaration extends TranslatedElement, Initiali
 
   private predicate hasUninitializedInstruction() {
     not exists(getInitialization()) or
-    getInitialization() instanceof TranslatedListInitialization
+    getInitialization() instanceof TranslatedListInitialization or
+    getInitialization() instanceof TranslatedStringLiteralInitialization
   }
 }
 
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 90c3061114e..b4480e1c580 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -2666,64 +2666,67 @@ ir.cpp:
 #  571|     mu0_1(unknown)        = AliasedDefinition        : 
 #  571|     mu0_2(unknown)        = UnmodeledDefinition      : 
 #  572|     r0_3(glval<char[32]>) = VariableAddress[a_pad]   : 
-#  572|     r0_4(glval<char[1]>)  = StringConstant[""]       : 
-#  572|     r0_5(char[1])         = Load                     : &:r0_4, ~mu0_2
-#  572|     mu0_6(char[1])        = Store                    : &:r0_3, r0_5
-#  572|     r0_7(unknown[31])     = Constant[0]              : 
-#  572|     r0_8(int)             = Constant[1]              : 
-#  572|     r0_9(glval<char>)     = PointerAdd[1]            : r0_3, r0_8
-#  572|     mu0_10(unknown[31])   = Store                    : &:r0_9, r0_7
-#  573|     r0_11(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  573|     r0_12(glval<char[4]>) = StringConstant["foo"]    : 
-#  573|     r0_13(char[4])        = Load                     : &:r0_12, ~mu0_2
-#  573|     mu0_14(char[4])       = Store                    : &:r0_11, r0_13
-#  574|     r0_15(glval<char[5]>) = VariableAddress[a_infer] : 
-#  574|     r0_16(glval<char[5]>) = StringConstant["blah"]   : 
-#  574|     r0_17(char[5])        = Load                     : &:r0_16, ~mu0_2
-#  574|     mu0_18(char[5])       = Store                    : &:r0_15, r0_17
-#  575|     r0_19(glval<char[2]>) = VariableAddress[b]       : 
-#  575|     mu0_20(char[2])       = Uninitialized[b]         : &:r0_19
-#  576|     r0_21(glval<char[2]>) = VariableAddress[c]       : 
-#  576|     mu0_22(char[2])       = Uninitialized[c]         : &:r0_21
-#  576|     r0_23(int)            = Constant[0]              : 
-#  576|     r0_24(glval<char>)    = PointerAdd[1]            : r0_21, r0_23
-#  576|     r0_25(unknown[2])     = Constant[0]              : 
-#  576|     mu0_26(unknown[2])    = Store                    : &:r0_24, r0_25
-#  577|     r0_27(glval<char[2]>) = VariableAddress[d]       : 
-#  577|     mu0_28(char[2])       = Uninitialized[d]         : &:r0_27
-#  577|     r0_29(int)            = Constant[0]              : 
-#  577|     r0_30(glval<char>)    = PointerAdd[1]            : r0_27, r0_29
-#  577|     r0_31(char)           = Constant[0]              : 
-#  577|     mu0_32(char)          = Store                    : &:r0_30, r0_31
-#  577|     r0_33(int)            = Constant[1]              : 
-#  577|     r0_34(glval<char>)    = PointerAdd[1]            : r0_27, r0_33
-#  577|     r0_35(char)           = Constant[0]              : 
-#  577|     mu0_36(char)          = Store                    : &:r0_34, r0_35
-#  578|     r0_37(glval<char[2]>) = VariableAddress[e]       : 
-#  578|     mu0_38(char[2])       = Uninitialized[e]         : &:r0_37
-#  578|     r0_39(int)            = Constant[0]              : 
-#  578|     r0_40(glval<char>)    = PointerAdd[1]            : r0_37, r0_39
-#  578|     r0_41(char)           = Constant[0]              : 
-#  578|     mu0_42(char)          = Store                    : &:r0_40, r0_41
-#  578|     r0_43(int)            = Constant[1]              : 
-#  578|     r0_44(glval<char>)    = PointerAdd[1]            : r0_37, r0_43
-#  578|     r0_45(char)           = Constant[1]              : 
-#  578|     mu0_46(char)          = Store                    : &:r0_44, r0_45
-#  579|     r0_47(glval<char[3]>) = VariableAddress[f]       : 
-#  579|     mu0_48(char[3])       = Uninitialized[f]         : &:r0_47
-#  579|     r0_49(int)            = Constant[0]              : 
-#  579|     r0_50(glval<char>)    = PointerAdd[1]            : r0_47, r0_49
-#  579|     r0_51(char)           = Constant[0]              : 
-#  579|     mu0_52(char)          = Store                    : &:r0_50, r0_51
-#  579|     r0_53(int)            = Constant[1]              : 
-#  579|     r0_54(glval<char>)    = PointerAdd[1]            : r0_47, r0_53
-#  579|     r0_55(unknown[2])     = Constant[0]              : 
-#  579|     mu0_56(unknown[2])    = Store                    : &:r0_54, r0_55
-#  580|     v0_57(void)           = NoOp                     : 
-#  571|     v0_58(void)           = ReturnVoid               : 
-#  571|     v0_59(void)           = UnmodeledUse             : mu*
-#  571|     v0_60(void)           = AliasedUse               : ~mu0_2
-#  571|     v0_61(void)           = ExitFunction             : 
+#  572|     mu0_4(char[32])       = Uninitialized[a_pad]     : &:r0_3
+#  572|     r0_5(glval<char[1]>)  = StringConstant[""]       : 
+#  572|     r0_6(char[1])         = Load                     : &:r0_5, ~mu0_2
+#  572|     mu0_7(char[1])        = Store                    : &:r0_3, r0_6
+#  572|     r0_8(unknown[31])     = Constant[0]              : 
+#  572|     r0_9(int)             = Constant[1]              : 
+#  572|     r0_10(glval<char>)    = PointerAdd[1]            : r0_3, r0_9
+#  572|     mu0_11(unknown[31])   = Store                    : &:r0_10, r0_8
+#  573|     r0_12(glval<char[4]>) = VariableAddress[a_nopad] : 
+#  573|     mu0_13(char[4])       = Uninitialized[a_nopad]   : &:r0_12
+#  573|     r0_14(glval<char[4]>) = StringConstant["foo"]    : 
+#  573|     r0_15(char[4])        = Load                     : &:r0_14, ~mu0_2
+#  573|     mu0_16(char[4])       = Store                    : &:r0_12, r0_15
+#  574|     r0_17(glval<char[5]>) = VariableAddress[a_infer] : 
+#  574|     mu0_18(char[5])       = Uninitialized[a_infer]   : &:r0_17
+#  574|     r0_19(glval<char[5]>) = StringConstant["blah"]   : 
+#  574|     r0_20(char[5])        = Load                     : &:r0_19, ~mu0_2
+#  574|     mu0_21(char[5])       = Store                    : &:r0_17, r0_20
+#  575|     r0_22(glval<char[2]>) = VariableAddress[b]       : 
+#  575|     mu0_23(char[2])       = Uninitialized[b]         : &:r0_22
+#  576|     r0_24(glval<char[2]>) = VariableAddress[c]       : 
+#  576|     mu0_25(char[2])       = Uninitialized[c]         : &:r0_24
+#  576|     r0_26(int)            = Constant[0]              : 
+#  576|     r0_27(glval<char>)    = PointerAdd[1]            : r0_24, r0_26
+#  576|     r0_28(unknown[2])     = Constant[0]              : 
+#  576|     mu0_29(unknown[2])    = Store                    : &:r0_27, r0_28
+#  577|     r0_30(glval<char[2]>) = VariableAddress[d]       : 
+#  577|     mu0_31(char[2])       = Uninitialized[d]         : &:r0_30
+#  577|     r0_32(int)            = Constant[0]              : 
+#  577|     r0_33(glval<char>)    = PointerAdd[1]            : r0_30, r0_32
+#  577|     r0_34(char)           = Constant[0]              : 
+#  577|     mu0_35(char)          = Store                    : &:r0_33, r0_34
+#  577|     r0_36(int)            = Constant[1]              : 
+#  577|     r0_37(glval<char>)    = PointerAdd[1]            : r0_30, r0_36
+#  577|     r0_38(char)           = Constant[0]              : 
+#  577|     mu0_39(char)          = Store                    : &:r0_37, r0_38
+#  578|     r0_40(glval<char[2]>) = VariableAddress[e]       : 
+#  578|     mu0_41(char[2])       = Uninitialized[e]         : &:r0_40
+#  578|     r0_42(int)            = Constant[0]              : 
+#  578|     r0_43(glval<char>)    = PointerAdd[1]            : r0_40, r0_42
+#  578|     r0_44(char)           = Constant[0]              : 
+#  578|     mu0_45(char)          = Store                    : &:r0_43, r0_44
+#  578|     r0_46(int)            = Constant[1]              : 
+#  578|     r0_47(glval<char>)    = PointerAdd[1]            : r0_40, r0_46
+#  578|     r0_48(char)           = Constant[1]              : 
+#  578|     mu0_49(char)          = Store                    : &:r0_47, r0_48
+#  579|     r0_50(glval<char[3]>) = VariableAddress[f]       : 
+#  579|     mu0_51(char[3])       = Uninitialized[f]         : &:r0_50
+#  579|     r0_52(int)            = Constant[0]              : 
+#  579|     r0_53(glval<char>)    = PointerAdd[1]            : r0_50, r0_52
+#  579|     r0_54(char)           = Constant[0]              : 
+#  579|     mu0_55(char)          = Store                    : &:r0_53, r0_54
+#  579|     r0_56(int)            = Constant[1]              : 
+#  579|     r0_57(glval<char>)    = PointerAdd[1]            : r0_50, r0_56
+#  579|     r0_58(unknown[2])     = Constant[0]              : 
+#  579|     mu0_59(unknown[2])    = Store                    : &:r0_57, r0_58
+#  580|     v0_60(void)           = NoOp                     : 
+#  571|     v0_61(void)           = ReturnVoid               : 
+#  571|     v0_62(void)           = UnmodeledUse             : mu*
+#  571|     v0_63(void)           = AliasedUse               : ~mu0_2
+#  571|     v0_64(void)           = ExitFunction             : 
 
 #  584| void VarArgs()
 #  584|   Block 0
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 7345c6a5204..bc2bea75e11 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -876,67 +876,72 @@ ssa.cpp:
 #  213|     m0_1(unknown)         = AliasedDefinition        : 
 #  213|     mu0_2(unknown)        = UnmodeledDefinition      : 
 #  214|     r0_3(glval<char[32]>) = VariableAddress[a_pad]   : 
-#  214|     r0_4(glval<char[1]>)  = StringConstant[""]       : 
-#  214|     r0_5(char[1])         = Load                     : &:r0_4, ~m0_1
-#  214|     m0_6(char[1])         = Store                    : &:r0_3, r0_5
-#  214|     r0_7(unknown[31])     = Constant[0]              : 
-#  214|     r0_8(int)             = Constant[1]              : 
-#  214|     r0_9(glval<char>)     = PointerAdd[1]            : r0_3, r0_8
-#  214|     m0_10(unknown[31])    = Store                    : &:r0_9, r0_7
-#  215|     r0_11(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  215|     r0_12(glval<char[4]>) = StringConstant["foo"]    : 
-#  215|     r0_13(char[4])        = Load                     : &:r0_12, ~m0_1
-#  215|     m0_14(char[4])        = Store                    : &:r0_11, r0_13
-#  216|     r0_15(glval<char[5]>) = VariableAddress[a_infer] : 
-#  216|     r0_16(glval<char[5]>) = StringConstant["blah"]   : 
-#  216|     r0_17(char[5])        = Load                     : &:r0_16, ~m0_1
-#  216|     m0_18(char[5])        = Store                    : &:r0_15, r0_17
-#  217|     r0_19(glval<char[2]>) = VariableAddress[b]       : 
-#  217|     m0_20(char[2])        = Uninitialized[b]         : &:r0_19
-#  218|     r0_21(glval<char[2]>) = VariableAddress[c]       : 
-#  218|     m0_22(char[2])        = Uninitialized[c]         : &:r0_21
-#  218|     r0_23(int)            = Constant[0]              : 
-#  218|     r0_24(glval<char>)    = PointerAdd[1]            : r0_21, r0_23
-#  218|     r0_25(unknown[2])     = Constant[0]              : 
-#  218|     m0_26(unknown[2])     = Store                    : &:r0_24, r0_25
-#  219|     r0_27(glval<char[2]>) = VariableAddress[d]       : 
-#  219|     m0_28(char[2])        = Uninitialized[d]         : &:r0_27
-#  219|     r0_29(int)            = Constant[0]              : 
-#  219|     r0_30(glval<char>)    = PointerAdd[1]            : r0_27, r0_29
-#  219|     r0_31(char)           = Constant[0]              : 
-#  219|     m0_32(char)           = Store                    : &:r0_30, r0_31
-#  219|     m0_33(char[2])        = Chi                      : total:m0_28, partial:m0_32
-#  219|     r0_34(int)            = Constant[1]              : 
-#  219|     r0_35(glval<char>)    = PointerAdd[1]            : r0_27, r0_34
+#  214|     m0_4(char[32])        = Uninitialized[a_pad]     : &:r0_3
+#  214|     r0_5(glval<char[1]>)  = StringConstant[""]       : 
+#  214|     r0_6(char[1])         = Load                     : &:r0_5, ~m0_1
+#  214|     m0_7(char[1])         = Store                    : &:r0_3, r0_6
+#  214|     m0_8(char[32])        = Chi                      : total:m0_4, partial:m0_7
+#  214|     r0_9(unknown[31])     = Constant[0]              : 
+#  214|     r0_10(int)            = Constant[1]              : 
+#  214|     r0_11(glval<char>)    = PointerAdd[1]            : r0_3, r0_10
+#  214|     m0_12(unknown[31])    = Store                    : &:r0_11, r0_9
+#  214|     m0_13(char[32])       = Chi                      : total:m0_8, partial:m0_12
+#  215|     r0_14(glval<char[4]>) = VariableAddress[a_nopad] : 
+#  215|     m0_15(char[4])        = Uninitialized[a_nopad]   : &:r0_14
+#  215|     r0_16(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_17(char[4])        = Load                     : &:r0_16, ~m0_1
+#  215|     m0_18(char[4])        = Store                    : &:r0_14, r0_17
+#  216|     r0_19(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     m0_20(char[5])        = Uninitialized[a_infer]   : &:r0_19
+#  216|     r0_21(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_22(char[5])        = Load                     : &:r0_21, ~m0_1
+#  216|     m0_23(char[5])        = Store                    : &:r0_19, r0_22
+#  217|     r0_24(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_25(char[2])        = Uninitialized[b]         : &:r0_24
+#  218|     r0_26(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     m0_27(char[2])        = Uninitialized[c]         : &:r0_26
+#  218|     r0_28(int)            = Constant[0]              : 
+#  218|     r0_29(glval<char>)    = PointerAdd[1]            : r0_26, r0_28
+#  218|     r0_30(unknown[2])     = Constant[0]              : 
+#  218|     m0_31(unknown[2])     = Store                    : &:r0_29, r0_30
+#  219|     r0_32(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     m0_33(char[2])        = Uninitialized[d]         : &:r0_32
+#  219|     r0_34(int)            = Constant[0]              : 
+#  219|     r0_35(glval<char>)    = PointerAdd[1]            : r0_32, r0_34
 #  219|     r0_36(char)           = Constant[0]              : 
 #  219|     m0_37(char)           = Store                    : &:r0_35, r0_36
 #  219|     m0_38(char[2])        = Chi                      : total:m0_33, partial:m0_37
-#  220|     r0_39(glval<char[2]>) = VariableAddress[e]       : 
-#  220|     m0_40(char[2])        = Uninitialized[e]         : &:r0_39
-#  220|     r0_41(int)            = Constant[0]              : 
-#  220|     r0_42(glval<char>)    = PointerAdd[1]            : r0_39, r0_41
-#  220|     r0_43(char)           = Constant[0]              : 
-#  220|     m0_44(char)           = Store                    : &:r0_42, r0_43
-#  220|     m0_45(char[2])        = Chi                      : total:m0_40, partial:m0_44
-#  220|     r0_46(int)            = Constant[1]              : 
-#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_39, r0_46
-#  220|     r0_48(char)           = Constant[1]              : 
+#  219|     r0_39(int)            = Constant[1]              : 
+#  219|     r0_40(glval<char>)    = PointerAdd[1]            : r0_32, r0_39
+#  219|     r0_41(char)           = Constant[0]              : 
+#  219|     m0_42(char)           = Store                    : &:r0_40, r0_41
+#  219|     m0_43(char[2])        = Chi                      : total:m0_38, partial:m0_42
+#  220|     r0_44(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     m0_45(char[2])        = Uninitialized[e]         : &:r0_44
+#  220|     r0_46(int)            = Constant[0]              : 
+#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_44, r0_46
+#  220|     r0_48(char)           = Constant[0]              : 
 #  220|     m0_49(char)           = Store                    : &:r0_47, r0_48
 #  220|     m0_50(char[2])        = Chi                      : total:m0_45, partial:m0_49
-#  221|     r0_51(glval<char[3]>) = VariableAddress[f]       : 
-#  221|     m0_52(char[3])        = Uninitialized[f]         : &:r0_51
-#  221|     r0_53(int)            = Constant[0]              : 
-#  221|     r0_54(glval<char>)    = PointerAdd[1]            : r0_51, r0_53
-#  221|     r0_55(char)           = Constant[0]              : 
-#  221|     m0_56(char)           = Store                    : &:r0_54, r0_55
-#  221|     m0_57(char[3])        = Chi                      : total:m0_52, partial:m0_56
-#  221|     r0_58(int)            = Constant[1]              : 
-#  221|     r0_59(glval<char>)    = PointerAdd[1]            : r0_51, r0_58
-#  221|     r0_60(unknown[2])     = Constant[0]              : 
-#  221|     m0_61(unknown[2])     = Store                    : &:r0_59, r0_60
+#  220|     r0_51(int)            = Constant[1]              : 
+#  220|     r0_52(glval<char>)    = PointerAdd[1]            : r0_44, r0_51
+#  220|     r0_53(char)           = Constant[1]              : 
+#  220|     m0_54(char)           = Store                    : &:r0_52, r0_53
+#  220|     m0_55(char[2])        = Chi                      : total:m0_50, partial:m0_54
+#  221|     r0_56(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     m0_57(char[3])        = Uninitialized[f]         : &:r0_56
+#  221|     r0_58(int)            = Constant[0]              : 
+#  221|     r0_59(glval<char>)    = PointerAdd[1]            : r0_56, r0_58
+#  221|     r0_60(char)           = Constant[0]              : 
+#  221|     m0_61(char)           = Store                    : &:r0_59, r0_60
 #  221|     m0_62(char[3])        = Chi                      : total:m0_57, partial:m0_61
-#  222|     v0_63(void)           = NoOp                     : 
-#  213|     v0_64(void)           = ReturnVoid               : 
-#  213|     v0_65(void)           = UnmodeledUse             : mu*
-#  213|     v0_66(void)           = AliasedUse               : ~m0_1
-#  213|     v0_67(void)           = ExitFunction             : 
+#  221|     r0_63(int)            = Constant[1]              : 
+#  221|     r0_64(glval<char>)    = PointerAdd[1]            : r0_56, r0_63
+#  221|     r0_65(unknown[2])     = Constant[0]              : 
+#  221|     m0_66(unknown[2])     = Store                    : &:r0_64, r0_65
+#  221|     m0_67(char[3])        = Chi                      : total:m0_62, partial:m0_66
+#  222|     v0_68(void)           = NoOp                     : 
+#  213|     v0_69(void)           = ReturnVoid               : 
+#  213|     v0_70(void)           = UnmodeledUse             : mu*
+#  213|     v0_71(void)           = AliasedUse               : ~m0_1
+#  213|     v0_72(void)           = ExitFunction             : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 056b0cd5ac7..93f27b13f02 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -840,61 +840,64 @@ ssa.cpp:
 #  213|     mu0_1(unknown)        = AliasedDefinition        : 
 #  213|     mu0_2(unknown)        = UnmodeledDefinition      : 
 #  214|     r0_3(glval<char[32]>) = VariableAddress[a_pad]   : 
-#  214|     r0_4(glval<char[1]>)  = StringConstant[""]       : 
-#  214|     r0_5(char[1])         = Load                     : &:r0_4, ~mu0_2
-#  214|     mu0_6(char[1])        = Store                    : &:r0_3, r0_5
-#  214|     r0_7(unknown[31])     = Constant[0]              : 
-#  214|     r0_8(int)             = Constant[1]              : 
-#  214|     r0_9(glval<char>)     = PointerAdd[1]            : r0_3, r0_8
-#  214|     mu0_10(unknown[31])   = Store                    : &:r0_9, r0_7
-#  215|     r0_11(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  215|     r0_12(glval<char[4]>) = StringConstant["foo"]    : 
-#  215|     r0_13(char[4])        = Load                     : &:r0_12, ~mu0_2
-#  215|     m0_14(char[4])        = Store                    : &:r0_11, r0_13
-#  216|     r0_15(glval<char[5]>) = VariableAddress[a_infer] : 
-#  216|     r0_16(glval<char[5]>) = StringConstant["blah"]   : 
-#  216|     r0_17(char[5])        = Load                     : &:r0_16, ~mu0_2
-#  216|     m0_18(char[5])        = Store                    : &:r0_15, r0_17
-#  217|     r0_19(glval<char[2]>) = VariableAddress[b]       : 
-#  217|     m0_20(char[2])        = Uninitialized[b]         : &:r0_19
-#  218|     r0_21(glval<char[2]>) = VariableAddress[c]       : 
-#  218|     mu0_22(char[2])       = Uninitialized[c]         : &:r0_21
-#  218|     r0_23(int)            = Constant[0]              : 
-#  218|     r0_24(glval<char>)    = PointerAdd[1]            : r0_21, r0_23
-#  218|     r0_25(unknown[2])     = Constant[0]              : 
-#  218|     mu0_26(unknown[2])    = Store                    : &:r0_24, r0_25
-#  219|     r0_27(glval<char[2]>) = VariableAddress[d]       : 
-#  219|     mu0_28(char[2])       = Uninitialized[d]         : &:r0_27
-#  219|     r0_29(int)            = Constant[0]              : 
-#  219|     r0_30(glval<char>)    = PointerAdd[1]            : r0_27, r0_29
-#  219|     r0_31(char)           = Constant[0]              : 
-#  219|     mu0_32(char)          = Store                    : &:r0_30, r0_31
-#  219|     r0_33(int)            = Constant[1]              : 
-#  219|     r0_34(glval<char>)    = PointerAdd[1]            : r0_27, r0_33
-#  219|     r0_35(char)           = Constant[0]              : 
-#  219|     mu0_36(char)          = Store                    : &:r0_34, r0_35
-#  220|     r0_37(glval<char[2]>) = VariableAddress[e]       : 
-#  220|     mu0_38(char[2])       = Uninitialized[e]         : &:r0_37
-#  220|     r0_39(int)            = Constant[0]              : 
-#  220|     r0_40(glval<char>)    = PointerAdd[1]            : r0_37, r0_39
-#  220|     r0_41(char)           = Constant[0]              : 
-#  220|     mu0_42(char)          = Store                    : &:r0_40, r0_41
-#  220|     r0_43(int)            = Constant[1]              : 
-#  220|     r0_44(glval<char>)    = PointerAdd[1]            : r0_37, r0_43
-#  220|     r0_45(char)           = Constant[1]              : 
-#  220|     mu0_46(char)          = Store                    : &:r0_44, r0_45
-#  221|     r0_47(glval<char[3]>) = VariableAddress[f]       : 
-#  221|     mu0_48(char[3])       = Uninitialized[f]         : &:r0_47
-#  221|     r0_49(int)            = Constant[0]              : 
-#  221|     r0_50(glval<char>)    = PointerAdd[1]            : r0_47, r0_49
-#  221|     r0_51(char)           = Constant[0]              : 
-#  221|     mu0_52(char)          = Store                    : &:r0_50, r0_51
-#  221|     r0_53(int)            = Constant[1]              : 
-#  221|     r0_54(glval<char>)    = PointerAdd[1]            : r0_47, r0_53
-#  221|     r0_55(unknown[2])     = Constant[0]              : 
-#  221|     mu0_56(unknown[2])    = Store                    : &:r0_54, r0_55
-#  222|     v0_57(void)           = NoOp                     : 
-#  213|     v0_58(void)           = ReturnVoid               : 
-#  213|     v0_59(void)           = UnmodeledUse             : mu*
-#  213|     v0_60(void)           = AliasedUse               : ~mu0_2
-#  213|     v0_61(void)           = ExitFunction             : 
+#  214|     mu0_4(char[32])       = Uninitialized[a_pad]     : &:r0_3
+#  214|     r0_5(glval<char[1]>)  = StringConstant[""]       : 
+#  214|     r0_6(char[1])         = Load                     : &:r0_5, ~mu0_2
+#  214|     mu0_7(char[1])        = Store                    : &:r0_3, r0_6
+#  214|     r0_8(unknown[31])     = Constant[0]              : 
+#  214|     r0_9(int)             = Constant[1]              : 
+#  214|     r0_10(glval<char>)    = PointerAdd[1]            : r0_3, r0_9
+#  214|     mu0_11(unknown[31])   = Store                    : &:r0_10, r0_8
+#  215|     r0_12(glval<char[4]>) = VariableAddress[a_nopad] : 
+#  215|     m0_13(char[4])        = Uninitialized[a_nopad]   : &:r0_12
+#  215|     r0_14(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_15(char[4])        = Load                     : &:r0_14, ~mu0_2
+#  215|     m0_16(char[4])        = Store                    : &:r0_12, r0_15
+#  216|     r0_17(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     m0_18(char[5])        = Uninitialized[a_infer]   : &:r0_17
+#  216|     r0_19(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_20(char[5])        = Load                     : &:r0_19, ~mu0_2
+#  216|     m0_21(char[5])        = Store                    : &:r0_17, r0_20
+#  217|     r0_22(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_23(char[2])        = Uninitialized[b]         : &:r0_22
+#  218|     r0_24(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     mu0_25(char[2])       = Uninitialized[c]         : &:r0_24
+#  218|     r0_26(int)            = Constant[0]              : 
+#  218|     r0_27(glval<char>)    = PointerAdd[1]            : r0_24, r0_26
+#  218|     r0_28(unknown[2])     = Constant[0]              : 
+#  218|     mu0_29(unknown[2])    = Store                    : &:r0_27, r0_28
+#  219|     r0_30(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     mu0_31(char[2])       = Uninitialized[d]         : &:r0_30
+#  219|     r0_32(int)            = Constant[0]              : 
+#  219|     r0_33(glval<char>)    = PointerAdd[1]            : r0_30, r0_32
+#  219|     r0_34(char)           = Constant[0]              : 
+#  219|     mu0_35(char)          = Store                    : &:r0_33, r0_34
+#  219|     r0_36(int)            = Constant[1]              : 
+#  219|     r0_37(glval<char>)    = PointerAdd[1]            : r0_30, r0_36
+#  219|     r0_38(char)           = Constant[0]              : 
+#  219|     mu0_39(char)          = Store                    : &:r0_37, r0_38
+#  220|     r0_40(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     mu0_41(char[2])       = Uninitialized[e]         : &:r0_40
+#  220|     r0_42(int)            = Constant[0]              : 
+#  220|     r0_43(glval<char>)    = PointerAdd[1]            : r0_40, r0_42
+#  220|     r0_44(char)           = Constant[0]              : 
+#  220|     mu0_45(char)          = Store                    : &:r0_43, r0_44
+#  220|     r0_46(int)            = Constant[1]              : 
+#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_40, r0_46
+#  220|     r0_48(char)           = Constant[1]              : 
+#  220|     mu0_49(char)          = Store                    : &:r0_47, r0_48
+#  221|     r0_50(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     mu0_51(char[3])       = Uninitialized[f]         : &:r0_50
+#  221|     r0_52(int)            = Constant[0]              : 
+#  221|     r0_53(glval<char>)    = PointerAdd[1]            : r0_50, r0_52
+#  221|     r0_54(char)           = Constant[0]              : 
+#  221|     mu0_55(char)          = Store                    : &:r0_53, r0_54
+#  221|     r0_56(int)            = Constant[1]              : 
+#  221|     r0_57(glval<char>)    = PointerAdd[1]            : r0_50, r0_56
+#  221|     r0_58(unknown[2])     = Constant[0]              : 
+#  221|     mu0_59(unknown[2])    = Store                    : &:r0_57, r0_58
+#  222|     v0_60(void)           = NoOp                     : 
+#  213|     v0_61(void)           = ReturnVoid               : 
+#  213|     v0_62(void)           = UnmodeledUse             : mu*
+#  213|     v0_63(void)           = AliasedUse               : ~mu0_2
+#  213|     v0_64(void)           = ExitFunction             : 

From 0040c9fb4c1defdc206d9558b4e87925f8ca2ce0 Mon Sep 17 00:00:00 2001
From: Sauyon Lee <sauyon@github.com>
Date: Wed, 6 Nov 2019 05:42:59 -0800
Subject: [PATCH 185/232] Update links to OWASP cheat sheet

---
 cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp  |  2 +-
 .../src/Security Features/CWE-079/XSS.qhelp   |  2 +-
 .../CWE-090/LDAPInjection.qhelp               |  2 +-
 .../CWE-451/MissingXFrameOptions.qhelp        |  2 +-
 .../CWE-601/UrlRedirect.qhelp                 |  2 +-
 .../CWE-611/UseXmlSecureResolver.qhelp        |  2 +-
 java/ql/src/Security/CWE/CWE-079/XSS.qhelp    |  2 +-
 .../src/Security/CWE/CWE-089/SqlTainted.qhelp |  2 +-
 .../Security/CWE/CWE-089/SqlUnescaped.qhelp   |  2 +-
 .../src/Security/CWE/CWE-319/HttpsUrls.qhelp  |  2 +-
 java/ql/src/Security/CWE/CWE-319/UseSSL.qhelp |  2 +-
 .../CWE/CWE-319/UseSSLSocketFactories.qhelp   |  2 +-
 .../CWE/CWE-502/UnsafeDeserialization.qhelp   |  2 +-
 java/ql/src/Security/CWE/CWE-611/XXE.qhelp    |  2 +-
 .../semmle/code/java/security/XmlParsers.qll  | 24 +++++++++----------
 .../CWE-020/IncompleteHostnameRegExp.qhelp    |  2 +-
 .../IncompleteUrlSubstringSanitization.qhelp  |  2 +-
 .../CWE-020/MissingRegExpAnchor.qhelp         |  2 +-
 .../src/Security/CWE-079/ReflectedXss.qhelp   |  2 +-
 .../ql/src/Security/CWE-079/StoredXss.qhelp   |  2 +-
 javascript/ql/src/Security/CWE-079/Xss.qhelp  |  4 ++--
 .../CWE-327/BrokenCryptoAlgorithm.qhelp       |  2 +-
 .../CWE-451/MissingXFrameOptions.qhelp        |  2 +-
 .../CWE-502/UnsafeDeserialization.qhelp       |  2 +-
 .../CWE-601/ClientSideUrlRedirect.qhelp       |  2 +-
 .../CWE-601/ServerSideUrlRedirect.qhelp       |  2 +-
 .../CWE-770/MissingRateLimiting.qhelp         |  2 +-
 .../CWE-916/InsufficientPasswordHash.qhelp    |  2 +-
 .../CWE-020/IncompleteHostnameRegExp.qhelp    |  2 +-
 .../IncompleteUrlSubstringSanitization.qhelp  |  2 +-
 .../CWE-079/Jinja2WithoutEscaping.qhelp       |  2 +-
 .../src/Security/CWE-079/ReflectedXss.qhelp   |  2 +-
 .../src/Security/CWE-089/SqlInjection.qhelp   |  2 +-
 .../CWE-327/BrokenCryptoAlgorithm.qhelp       |  2 +-
 .../CWE-502/UnsafeDeserialization.qhelp       |  2 +-
 .../ql/src/Security/CWE-601/UrlRedirect.qhelp |  2 +-
 36 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp
index ccd297c3b36..4ad7a40fed6 100644
--- a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp
@@ -34,7 +34,7 @@ characters before writing to the HTML page.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/csharp/ql/src/Security Features/CWE-079/XSS.qhelp b/csharp/ql/src/Security Features/CWE-079/XSS.qhelp
index 9a71290694d..409be1030e7 100644
--- a/csharp/ql/src/Security Features/CWE-079/XSS.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-079/XSS.qhelp	
@@ -29,7 +29,7 @@ leaving the website vulnerable to cross-site scripting.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp b/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp
index 118e91ed4d9..04f01720ce6 100644
--- a/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-090/LDAPInjection.qhelp	
@@ -33,7 +33,7 @@ the query cannot be changed by a malicious user.</p>
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php?title=LDAP_Injection_Prevention_Cheat_Sheet">LDAP Injection Prevention Cheat Sheet</a>.</li>
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html">LDAP Injection Prevention Cheat Sheet</a>.</li>
 <li>OWASP: <a href="https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java">Preventing LDAP Injection in Java</a>.</li>
 <li>AntiXSS doc: <a href="http://www.nudoq.org/#!/Packages/AntiXSS/AntiXssLibrary/Encoder/M/LdapFilterEncode">LdapFilterEncode</a>.</li>
 <li>AntiXSS doc: <a href="http://www.nudoq.org/#!/Packages/AntiXSS/AntiXssLibrary/Encoder/M/LdapDistinguishedNameEncode">LdapDistinguishedNameEncode</a>.</li>
diff --git a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp
index 7df415aff5b..6d5d298c8e4 100644
--- a/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-451/MissingXFrameOptions.qhelp	
@@ -51,7 +51,7 @@ This next example shows how to specify the <code>X-Frame-Options</code> header w
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet">Clickjacking Defense Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html">Clickjacking Defense Cheat Sheet</a>.
 </li>
 <li>
 Mozilla:
diff --git a/csharp/ql/src/Security Features/CWE-601/UrlRedirect.qhelp b/csharp/ql/src/Security Features/CWE-601/UrlRedirect.qhelp
index 989796b6738..3cf3cdaba6e 100644
--- a/csharp/ql/src/Security Features/CWE-601/UrlRedirect.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-601/UrlRedirect.qhelp	
@@ -32,7 +32,7 @@ It also shows how to remedy the problem by validating the user input against a k
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS
 Unvalidated Redirects and Forwards Cheat Sheet</a>.
 </li>
 <li>
diff --git a/csharp/ql/src/Security Features/CWE-611/UseXmlSecureResolver.qhelp b/csharp/ql/src/Security Features/CWE-611/UseXmlSecureResolver.qhelp
index 2e8e4fcf272..11b1136db4d 100644
--- a/csharp/ql/src/Security Features/CWE-611/UseXmlSecureResolver.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-611/UseXmlSecureResolver.qhelp	
@@ -38,7 +38,7 @@ The solution is to set the <code>DtdProcessing</code> property to <code>DtdProce
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet">XML External Entity (XXE) Prevention Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html">XML External Entity (XXE) Prevention Cheat Sheet</a>.
 </li>
 <li>
 Microsoft Docs: <a href="https://msdn.microsoft.com/en-us/library/system.xml.xmlreadersettings(v=vs.110).aspx#Anchor_6">System.XML: Security considerations</a>.
diff --git a/java/ql/src/Security/CWE/CWE-079/XSS.qhelp b/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
index 85bdfb130fd..428b44c8db9 100644
--- a/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
+++ b/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
@@ -29,7 +29,7 @@ leaving the website vulnerable to cross-site scripting.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/java/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp b/java/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp
index cab60173a62..f1ba450d4a0 100644
--- a/java/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp
+++ b/java/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp
@@ -67,7 +67,7 @@ in the environment variable or user-supplied value are not given any special tre
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html">SQL
 Injection Prevention Cheat Sheet</a>.
 </li>
 <li>The CERT Oracle Secure Coding Standard for Java:
diff --git a/java/ql/src/Security/CWE/CWE-089/SqlUnescaped.qhelp b/java/ql/src/Security/CWE/CWE-089/SqlUnescaped.qhelp
index 7415235610c..e469415d683 100644
--- a/java/ql/src/Security/CWE/CWE-089/SqlUnescaped.qhelp
+++ b/java/ql/src/Security/CWE/CWE-089/SqlUnescaped.qhelp
@@ -39,7 +39,7 @@ treatment.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html">SQL
 Injection Prevention Cheat Sheet</a>.
 </li>
 <li>The CERT Oracle Secure Coding Standard for Java:
diff --git a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.qhelp b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.qhelp
index 8b8b0eff847..2cfdca624fb 100644
--- a/java/ql/src/Security/CWE/CWE-319/HttpsUrls.qhelp
+++ b/java/ql/src/Security/CWE/CWE-319/HttpsUrls.qhelp
@@ -37,7 +37,7 @@ connection is a secure SSL connection.</p>
 Class HttpsURLConnection</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet">Transport Layer Protection Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html">Transport Layer Protection Cheat Sheet</a>.
 </li>
 
 
diff --git a/java/ql/src/Security/CWE/CWE-319/UseSSL.qhelp b/java/ql/src/Security/CWE/CWE-319/UseSSL.qhelp
index 5856086330f..cec4937c8f7 100644
--- a/java/ql/src/Security/CWE/CWE-319/UseSSL.qhelp
+++ b/java/ql/src/Security/CWE/CWE-319/UseSSL.qhelp
@@ -38,7 +38,7 @@ Class HttpsURLConnection</a>.</li>
 Class SSLSocket</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet">Transport Layer Protection Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html">Transport Layer Protection Cheat Sheet</a>.
 </li>
 
 
diff --git a/java/ql/src/Security/CWE/CWE-319/UseSSLSocketFactories.qhelp b/java/ql/src/Security/CWE/CWE-319/UseSSLSocketFactories.qhelp
index 56e9be97345..bf0dbc0bcac 100644
--- a/java/ql/src/Security/CWE/CWE-319/UseSSLSocketFactories.qhelp
+++ b/java/ql/src/Security/CWE/CWE-319/UseSSLSocketFactories.qhelp
@@ -33,7 +33,7 @@ uses explicit SSL factories, which are preferable.</p>
 Class SSLSocketFactory</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet">Transport Layer Protection Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html">Transport Layer Protection Cheat Sheet</a>.
 </li>
 
 
diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
index 4fb0ad88b45..61b50a986e3 100644
--- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
+++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
@@ -58,7 +58,7 @@ OWASP vulnerability description:
 </li>
 <li>
 OWASP guidance on deserializing objects:
-<a href="https://www.owasp.org/index.php/Deserialization_Cheat_Sheet">Deserialization Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html">Deserialization Cheat Sheet</a>.
 </li>
 <li>
 Talks by Chris Frohoff &amp; Gabriel Lawrence:
diff --git a/java/ql/src/Security/CWE/CWE-611/XXE.qhelp b/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
index 75c5a2d4d7a..93d420f7495 100644
--- a/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
+++ b/java/ql/src/Security/CWE/CWE-611/XXE.qhelp
@@ -52,7 +52,7 @@ OWASP vulnerability description:
 </li>
 <li>
 OWASP guidance on parsing xml files:
-<a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java">XXE Prevention Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#java">XXE Prevention Cheat Sheet</a>.
 </li>
 <li>
 Paper by Timothy Morgen:
diff --git a/java/ql/src/semmle/code/java/security/XmlParsers.qll b/java/ql/src/semmle/code/java/security/XmlParsers.qll
index 37a72f8128e..1f582489497 100644
--- a/java/ql/src/semmle/code/java/security/XmlParsers.qll
+++ b/java/ql/src/semmle/code/java/security/XmlParsers.qll
@@ -49,7 +49,7 @@ abstract class ParserConfig extends MethodAccess {
 }
 
 /*
- *  https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#DocumentBuilder
+ * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j
  */
 
 /** The class `javax.xml.parsers.DocumentBuilderFactory`. */
@@ -227,7 +227,7 @@ class SafeDocumentBuilder extends DocumentBuilderConstruction {
 }
 
 /*
- * https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#XMLInputFactory_.28a_StAX_parser.29
+ * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
  */
 
 /** The class `javax.xml.stream.XMLInputFactory`. */
@@ -353,7 +353,7 @@ class SafeXmlInputFactory extends VarAccess {
 }
 
 /*
- * https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#SAXBuilder
+ * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#saxbuilder
  */
 
 /**
@@ -429,7 +429,7 @@ class SafeSAXBuilder extends VarAccess {
 
 /*
  * The case in
- * https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Unmarshaller
+ * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller
  * will be split into two, one covers a SAXParser as a sink, the other the SAXSource as a sink.
  */
 
@@ -545,7 +545,7 @@ class SafeSAXParser extends MethodAccess {
   }
 }
 
-/* SAXReader: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#SAXReader */
+/* SAXReader: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#saxreader */
 /**
  * The class `org.dom4j.io.SAXReader`.
  */
@@ -621,7 +621,7 @@ class SafeSAXReader extends VarAccess {
   }
 }
 
-/* https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#XMLReader */
+/* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlreader */
 /** The class `org.xml.sax.XMLReader`. */
 class XMLReader extends RefType {
   XMLReader() { this.hasQualifiedName("org.xml.sax", "XMLReader") }
@@ -756,7 +756,7 @@ class CreatedSafeXMLReader extends Call {
 
 /*
  * SAXSource in
- * https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Unmarshaller
+ * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller
  */
 
 /** The class `javax.xml.transform.sax.SAXSource` */
@@ -811,7 +811,7 @@ class SafeSAXSource extends Expr {
   }
 }
 
-/* Transformer: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#TransformerFactory */
+/* Transformer: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory */
 /** An access to a method use for configuring a transformer or schema. */
 abstract class TransformerConfig extends MethodAccess {
   /** Holds if the configuration is disabled */
@@ -975,7 +975,7 @@ class SafeTransformer extends MethodAccess {
 }
 
 /*
- * SAXTransformer: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#SAXTransformerFactory
+ * SAXTransformer: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#saxtransformerfactory
  * Has an extra method called newFilter.
  */
 
@@ -996,7 +996,7 @@ class SAXTransformerFactoryNewXMLFilter extends XmlParserCall {
   }
 }
 
-/* Schema: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#SchemaFactory */
+/* Schema: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory */
 /** The class `javax.xml.validation.SchemaFactory`. */
 class SchemaFactory extends RefType {
   SchemaFactory() { this.hasQualifiedName("javax.xml.validation", "SchemaFactory") }
@@ -1060,7 +1060,7 @@ class SafeSchemaFactory extends VarAccess {
   }
 }
 
-/* Unmarshaller: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Unmarshaller */
+/* Unmarshaller: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller */
 /** The class `javax.xml.bind.Unmarshaller`. */
 class XmlUnmarshaller extends RefType {
   XmlUnmarshaller() { this.hasQualifiedName("javax.xml.bind", "Unmarshaller") }
@@ -1081,7 +1081,7 @@ class XmlUnmarshal extends XmlParserCall {
   override predicate isSafe() { none() }
 }
 
-/* XPathExpression: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#XPathExpression */
+/* XPathExpression: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xpathexpression */
 /** The class `javax.xml.xpath.XPathExpression`. */
 class XPathExpression extends RefType {
   XPathExpression() { this.hasQualifiedName("javax.xml.xpath", "XPathExpression") }
diff --git a/javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp b/javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
index 771c446c66f..a5e0a78b8cc 100644
--- a/javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
+++ b/javascript/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
@@ -68,6 +68,6 @@
 	<references>
 		<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions">Regular Expressions</a></li>
 		<li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
-		<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+		<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 	</references>
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp b/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
index b23557aa557..90e6f2762e2 100644
--- a/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
+++ b/javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
@@ -83,6 +83,6 @@
 
 	<references>
 		<li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
-		<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+		<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 	</references>
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.qhelp b/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.qhelp
index 807574c5898..015e510f0fb 100644
--- a/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.qhelp
+++ b/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.qhelp
@@ -71,6 +71,6 @@
 	<references>
 		<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions">Regular Expressions</a></li>
 		<li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
-		<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+		<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 	</references>
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-079/ReflectedXss.qhelp b/javascript/ql/src/Security/CWE-079/ReflectedXss.qhelp
index 0502889fba0..dcbf0ba6f07 100644
--- a/javascript/ql/src/Security/CWE-079/ReflectedXss.qhelp
+++ b/javascript/ql/src/Security/CWE-079/ReflectedXss.qhelp
@@ -37,7 +37,7 @@ Sanitizing the user-controlled data prevents the vulnerability:
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/javascript/ql/src/Security/CWE-079/StoredXss.qhelp b/javascript/ql/src/Security/CWE-079/StoredXss.qhelp
index 1c3fde01798..0e6ed6456c9 100644
--- a/javascript/ql/src/Security/CWE-079/StoredXss.qhelp
+++ b/javascript/ql/src/Security/CWE-079/StoredXss.qhelp
@@ -48,7 +48,7 @@
 <references>
 	<li>
 		OWASP:
-		<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+		<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 		(Cross Site Scripting) Prevention Cheat Sheet</a>.
 	</li>
 	<li>
diff --git a/javascript/ql/src/Security/CWE-079/Xss.qhelp b/javascript/ql/src/Security/CWE-079/Xss.qhelp
index 34ea1d821b6..c974c87b188 100644
--- a/javascript/ql/src/Security/CWE-079/Xss.qhelp
+++ b/javascript/ql/src/Security/CWE-079/Xss.qhelp
@@ -33,12 +33,12 @@ leaving the website vulnerable to cross-site scripting.
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet">DOM based
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html">DOM based
 XSS Prevention Cheat Sheet</a>.
 </li>
 <li>
 OWASP:
-<a href="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
index 9b230852919..e0ccf71572f 100644
--- a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
+++ b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
@@ -45,7 +45,7 @@
 		<li>NIST, FIPS 140 Annex a: <a href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf"> Approved Security Functions</a>.</li>
 		<li>NIST, SP 800-131A: <a href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf"> Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths</a>.</li>
 		<li>OWASP: <a
-		href="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet#Rule_-_Use_strong_approved_cryptographic_algorithms">Rule
+		href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#rule---use-strong-approved-authenticated-encryption">Rule
 		- Use strong approved cryptographic algorithms</a>.
 		</li>
 	</references>
diff --git a/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.qhelp b/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.qhelp
index ad659015d67..e73ea063b5d 100644
--- a/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.qhelp
+++ b/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.qhelp
@@ -67,7 +67,7 @@
 
     <li>
       OWASP:
-      <a href="https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet">Clickjacking Defense Cheat Sheet</a>.
+      <a href="https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html">Clickjacking Defense Cheat Sheet</a>.
     </li>
     <li>
       Mozilla:
diff --git a/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp b/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
index e7b956b10f4..5f5b77cbd7d 100644
--- a/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
+++ b/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
@@ -41,7 +41,7 @@ OWASP vulnerability description:
 </li>
 <li>
 OWASP guidance on deserializing objects:
-<a href="https://www.owasp.org/index.php/Deserialization_Cheat_Sheet">Deserialization Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html">Deserialization Cheat Sheet</a>.
 </li>
 <li>
 Neal Poole:
diff --git a/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.qhelp b/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.qhelp
index d4d36fe09bc..392df3e6cbd 100644
--- a/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.qhelp
+++ b/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.qhelp
@@ -31,7 +31,7 @@ website of their choosing, which facilitates phishing attacks:
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">
   XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 </references>
 
diff --git a/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.qhelp b/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.qhelp
index cb54477dde5..2052f16146b 100644
--- a/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.qhelp
+++ b/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.qhelp
@@ -35,7 +35,7 @@ before doing the redirection:
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">
   XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 </references>
 
diff --git a/javascript/ql/src/Security/CWE-770/MissingRateLimiting.qhelp b/javascript/ql/src/Security/CWE-770/MissingRateLimiting.qhelp
index 1832a803a77..8d4bc0ab5d0 100644
--- a/javascript/ql/src/Security/CWE-770/MissingRateLimiting.qhelp
+++ b/javascript/ql/src/Security/CWE-770/MissingRateLimiting.qhelp
@@ -36,7 +36,7 @@ can be used:
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Denial_of_Service_Cheat_Sheet">Denial of Service Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html">Denial of Service Cheat Sheet</a>.
 </li>
 <li>
 Wikipedia: <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack">Denial-of-service attack</a>.
diff --git a/javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.qhelp b/javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.qhelp
index 2b1d2b02a31..1efdbe694b1 100644
--- a/javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.qhelp
+++ b/javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.qhelp
@@ -50,6 +50,6 @@
 </example>
 
 <references>
-	<li>OWASP: <a href="https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet">Password storage</a>.</li>
+	<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html">Password storage</a>.</li>
 </references>
 </qhelp>
diff --git a/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp b/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
index b542ae252eb..8eb0f43eb01 100644
--- a/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
+++ b/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp
@@ -64,6 +64,6 @@
 
     <references>
         <li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
-        <li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+        <li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
     </references>
 </qhelp>
diff --git a/python/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp b/python/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
index 6c783a4f729..828c71153b5 100644
--- a/python/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
+++ b/python/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qhelp
@@ -80,6 +80,6 @@
 
     <references>
         <li>OWASP: <a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">SSRF</a></li>
-        <li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
+        <li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
     </references>
 </qhelp>
diff --git a/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.qhelp b/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.qhelp
index 4497437aac1..5b4d21bb37e 100644
--- a/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.qhelp
+++ b/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.qhelp
@@ -38,7 +38,7 @@ Jinja2: <a href="http://jinja.pocoo.org/docs/2.10/api/">API</a>.
 Wikipedia: <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">Cross-site scripting</a>.
 </li>
 <li>
-OWASP: <a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet">XSS (Cross Site Scripting) Prevention Cheat Sheet</a>.
+OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 </references>
 </qhelp>
diff --git a/python/ql/src/Security/CWE-079/ReflectedXss.qhelp b/python/ql/src/Security/CWE-079/ReflectedXss.qhelp
index 8cdeb4d3e79..04a83fba6b4 100644
--- a/python/ql/src/Security/CWE-079/ReflectedXss.qhelp
+++ b/python/ql/src/Security/CWE-079/ReflectedXss.qhelp
@@ -31,7 +31,7 @@ The second view is safe as <code>first_name</code> is escaped, so it is not vuln
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html">XSS
 (Cross Site Scripting) Prevention Cheat Sheet</a>.
 </li>
 <li>
diff --git a/python/ql/src/Security/CWE-089/SqlInjection.qhelp b/python/ql/src/Security/CWE-089/SqlInjection.qhelp
index 286b71a6047..63941706e84 100644
--- a/python/ql/src/Security/CWE-089/SqlInjection.qhelp
+++ b/python/ql/src/Security/CWE-089/SqlInjection.qhelp
@@ -51,6 +51,6 @@ vulnerable to SQL injection attacks. In this example, if <code>username</code> w
 
 <references>
 <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/SQL_injection">SQL injection</a>.</li>
-<li>OWASP: <a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet">SQL Injection Prevention Cheat Sheet</a>.</li>
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html">SQL Injection Prevention Cheat Sheet</a>.</li>
 </references>
 </qhelp>
diff --git a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
index 6cc787e52e4..1b4031b1cc5 100644
--- a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
+++ b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp
@@ -49,7 +49,7 @@
           <li>NIST, FIPS 140 Annex a: <a href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf"> Approved Security Functions</a>.</li>
           <li>NIST, SP 800-131A: <a href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf"> Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths</a>.</li>
           <li>OWASP: <a
-          href="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet#Rule_-_Use_strong_approved_cryptographic_algorithms">Rule
+          href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#rule---use-strong-approved-authenticated-encryption">Rule
           - Use strong approved cryptographic algorithms</a>.
           </li>
      </references>
diff --git a/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp b/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
index f298e62695f..8c2660b9865 100644
--- a/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
+++ b/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
@@ -49,7 +49,7 @@ OWASP vulnerability description:
 </li>
 <li>
 OWASP guidance on deserializing objects:
-<a href="https://www.owasp.org/index.php/Deserialization_Cheat_Sheet">Deserialization Cheat Sheet</a>.
+<a href="https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html">Deserialization Cheat Sheet</a>.
 </li>
 <li>
 Talks by Chris Frohoff &amp; Gabriel Lawrence:
diff --git a/python/ql/src/Security/CWE-601/UrlRedirect.qhelp b/python/ql/src/Security/CWE-601/UrlRedirect.qhelp
index c2e053f030b..756a43cc106 100644
--- a/python/ql/src/Security/CWE-601/UrlRedirect.qhelp
+++ b/python/ql/src/Security/CWE-601/UrlRedirect.qhelp
@@ -35,7 +35,7 @@ before doing the redirection:
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet">
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html">
   XSS Unvalidated Redirects and Forwards Cheat Sheet</a>.</li>
 </references>
 

From e314869e5cb134670d63119749abf286489af670 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Wed, 6 Nov 2019 09:06:39 +0000
Subject: [PATCH 186/232] JavaScript: Classify files with names ending in
 `_min` as minified.

We already do the same for `-min` and `.min`. [Here](https://github.com/antoniogarrote/rdfstore-js/blob/master/dist/rdfstore_min.js) is a real-world example.
---
 change-notes/1.23/analysis-javascript.md                      | 4 ++--
 javascript/ql/src/semmle/javascript/AST.qll                   | 2 +-
 .../query-tests/filters/ClassifyFiles/ClassifyFiles.expected  | 3 +++
 .../ql/test/query-tests/filters/ClassifyFiles/tst-min.js      | 0
 .../ql/test/query-tests/filters/ClassifyFiles/tst.min.js      | 0
 .../ql/test/query-tests/filters/ClassifyFiles/tst_min.js      | 0
 6 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 javascript/ql/test/query-tests/filters/ClassifyFiles/tst-min.js
 create mode 100644 javascript/ql/test/query-tests/filters/ClassifyFiles/tst.min.js
 create mode 100644 javascript/ql/test/query-tests/filters/ClassifyFiles/tst_min.js

diff --git a/change-notes/1.23/analysis-javascript.md b/change-notes/1.23/analysis-javascript.md
index 49f527af424..a7f41473eea 100644
--- a/change-notes/1.23/analysis-javascript.md
+++ b/change-notes/1.23/analysis-javascript.md
@@ -2,6 +2,8 @@
 
 ## General improvements
 
+* Automatic classification of generated and minified files has been improved, in particular files generated by Doxygen are now recognized.
+
 * Support for `globalThis` has been added.
 
 * Support for the following frameworks and libraries has been improved:
@@ -14,8 +16,6 @@
 
 * TypeScript 3.6 and 3.7 features are now supported.
 
-* Automatic classification of generated files has been improved, in particular files generated by Doxygen are now recognized.
-
 ## New queries
 
 | **Query**                                                                 | **Tags**                                                          | **Purpose**                                                                                                                                                                            |
diff --git a/javascript/ql/src/semmle/javascript/AST.qll b/javascript/ql/src/semmle/javascript/AST.qll
index efc9ef53af3..66a5155458c 100644
--- a/javascript/ql/src/semmle/javascript/AST.qll
+++ b/javascript/ql/src/semmle/javascript/AST.qll
@@ -150,7 +150,7 @@ class TopLevel extends @toplevel, StmtContainer {
   /** Holds if this toplevel is minified. */
   predicate isMinified() {
     // file name contains 'min' (not as part of a longer word)
-    getFile().getBaseName().regexpMatch(".*[^-.]*[-.]min([-.].*)?\\.\\w+")
+    getFile().getBaseName().regexpMatch(".*[^-._]*[-._]min([-._].*)?\\.\\w+")
     or
     exists(int numstmt | numstmt = strictcount(Stmt s | s.getTopLevel() = this) |
       // there are more than two statements per line on average
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/ClassifyFiles.expected b/javascript/ql/test/query-tests/filters/ClassifyFiles/ClassifyFiles.expected
index 7c583b1bf39..da235c205ee 100644
--- a/javascript/ql/test/query-tests/filters/ClassifyFiles/ClassifyFiles.expected
+++ b/javascript/ql/test/query-tests/filters/ClassifyFiles/ClassifyFiles.expected
@@ -39,8 +39,11 @@
 | textmate.html:0:0:0:0 | textmate.html | generated |
 | tmpl2.html:0:0:0:0 | tmpl2.html | template |
 | tmpl.html:0:0:0:0 | tmpl.html | template |
+| tst-min.js:0:0:0:0 | tst-min.js | generated |
 | tst.browserify.js:0:0:0:0 | tst.browserify.js | generated |
 | tst.dart.js:0:0:0:0 | tst.dart.js | generated |
+| tst.min.js:0:0:0:0 | tst.min.js | generated |
+| tst_min.js:0:0:0:0 | tst_min.js | generated |
 | twitter-text.js:0:0:0:0 | twitter-text.js | library |
 | twitter_text.js:0:0:0:0 | twitter_text.js | library |
 | unannotated-externs-1.js:0:0:0:0 | unannotated-externs-1.js | externs |
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/tst-min.js b/javascript/ql/test/query-tests/filters/ClassifyFiles/tst-min.js
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/tst.min.js b/javascript/ql/test/query-tests/filters/ClassifyFiles/tst.min.js
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/javascript/ql/test/query-tests/filters/ClassifyFiles/tst_min.js b/javascript/ql/test/query-tests/filters/ClassifyFiles/tst_min.js
new file mode 100644
index 00000000000..e69de29bb2d

From 6385528d5fe939df63bf03314206ada09ed4cc19 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Thu, 7 Nov 2019 11:30:18 +0100
Subject: [PATCH 187/232] C++/C#: Fix getIRTypeForPRValue join order

This predicate was taking 39s on a snapshot of Facebook Fizz because it
had disjuncts like this:

    43685     ~0%     {1} r34 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685     ~1%     {2} r35 = JOIN r34 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r34.<0>
    170371500 ~2%     {2} r36 = JOIN r35 WITH IRType::IRSizedType#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r35.<1>
    43685     ~6%     {2} r37 = JOIN r36 WITH IRType::IRFunctionAddressType#class#ff AS R ON FIRST 1 OUTPUT r36.<1>, r36.<0>

Instead of fixing the joins in `getIRTypeForPRValue` itself, I've
changed the `IRType::getByteSize` predicate such that the optimiser
knows how to join with it efficiently.

The disjunct shown above now looks like this instead:

    43685  ~0%     {1} r26 = JOIN Type::FunctionPointerIshType#f AS L WITH Type::Type::getUnspecifiedType_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
    43685  ~1%     {2} r27 = JOIN r26 WITH CppType::getTypeSize#ff AS R ON FIRST 1 OUTPUT R.<1>, r26.<0>
    43685  ~6%     {2} r28 = JOIN r27 WITH IRType::IRFunctionAddressType::getByteSize#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r27.<1>, R.<1>
---
 .../code/cpp/ir/implementation/IRType.qll     | 27 +++++++++++++++++--
 .../code/csharp/ir/implementation/IRType.qll  | 27 +++++++++++++++++--
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
index 0abfa14023d..cb652230d2a 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
@@ -42,6 +42,10 @@ class IRType extends TIRType {
    *
    * This will hold for all `IRType` objects except `IRUnknownType`.
    */
+  // This predicate is overridden with `pragma[noinline]` in every leaf subclass.
+  // This allows callers to ask for things like _the_ floating-point type of
+  // size 4 without getting a join that first finds all types of size 4 and
+  // _then_ restricts them to floating-point types.
   int getByteSize() { none() }
 
   /**
@@ -104,8 +108,6 @@ private class IRSizedType extends IRType {
     this = TIRFunctionAddressType(byteSize) or
     this = TIROpaqueType(_, byteSize)
   }
-
-  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -117,6 +119,9 @@ class IRBooleanType extends IRSizedType, TIRBooleanType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalBooleanType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -141,6 +146,9 @@ class IRSignedIntegerType extends IRNumericType, TIRSignedIntegerType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalSignedIntegerType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -153,6 +161,9 @@ class IRUnsignedIntegerType extends IRNumericType, TIRUnsignedIntegerType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalUnsignedIntegerType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -164,6 +175,9 @@ class IRFloatingPointType extends IRNumericType, TIRFloatingPointType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalFloatingPointType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -178,6 +192,9 @@ class IRAddressType extends IRSizedType, TIRAddressType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalAddressType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -190,6 +207,9 @@ class IRFunctionAddressType extends IRSizedType, TIRFunctionAddressType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalFunctionAddressType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -218,6 +238,9 @@ class IROpaqueType extends IRSizedType, TIROpaqueType {
    * same size.
    */
   final Language::OpaqueTypeTag getTag() { result = tag }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 module IRTypeSanity {
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
index 0abfa14023d..cb652230d2a 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/IRType.qll
@@ -42,6 +42,10 @@ class IRType extends TIRType {
    *
    * This will hold for all `IRType` objects except `IRUnknownType`.
    */
+  // This predicate is overridden with `pragma[noinline]` in every leaf subclass.
+  // This allows callers to ask for things like _the_ floating-point type of
+  // size 4 without getting a join that first finds all types of size 4 and
+  // _then_ restricts them to floating-point types.
   int getByteSize() { none() }
 
   /**
@@ -104,8 +108,6 @@ private class IRSizedType extends IRType {
     this = TIRFunctionAddressType(byteSize) or
     this = TIROpaqueType(_, byteSize)
   }
-
-  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -117,6 +119,9 @@ class IRBooleanType extends IRSizedType, TIRBooleanType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalBooleanType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -141,6 +146,9 @@ class IRSignedIntegerType extends IRNumericType, TIRSignedIntegerType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalSignedIntegerType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -153,6 +161,9 @@ class IRUnsignedIntegerType extends IRNumericType, TIRUnsignedIntegerType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalUnsignedIntegerType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -164,6 +175,9 @@ class IRFloatingPointType extends IRNumericType, TIRFloatingPointType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalFloatingPointType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -178,6 +192,9 @@ class IRAddressType extends IRSizedType, TIRAddressType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalAddressType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -190,6 +207,9 @@ class IRFunctionAddressType extends IRSizedType, TIRFunctionAddressType {
   final override Language::LanguageType getCanonicalLanguageType() {
     result = Language::getCanonicalFunctionAddressType(byteSize)
   }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 /**
@@ -218,6 +238,9 @@ class IROpaqueType extends IRSizedType, TIROpaqueType {
    * same size.
    */
   final Language::OpaqueTypeTag getTag() { result = tag }
+
+  pragma[noinline]
+  final override int getByteSize() { result = byteSize }
 }
 
 module IRTypeSanity {

From c0884e9a888ea8fcde2bb01a85a080533efcdaad Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Thu, 7 Nov 2019 10:34:59 +0000
Subject: [PATCH 188/232] C++: Update expected results.

---
 .../copy_from_prototype.expected              |   2 +-
 .../syntax-zoo/drawDifferent.expected         | 161 ++++++++++++------
 .../syntax-zoo/tellDifferent.expected         |  11 ++
 .../elements.expected                         |   4 +-
 4 files changed, 122 insertions(+), 56 deletions(-)

diff --git a/cpp/ql/test/library-tests/noexcept/copy_from_prototype/copy_from_prototype.expected b/cpp/ql/test/library-tests/noexcept/copy_from_prototype/copy_from_prototype.expected
index 9d77efe772f..f5ef2d77c98 100644
--- a/cpp/ql/test/library-tests/noexcept/copy_from_prototype/copy_from_prototype.expected
+++ b/cpp/ql/test/library-tests/noexcept/copy_from_prototype/copy_from_prototype.expected
@@ -13,7 +13,7 @@
 | copy_from_prototype.cpp:13:7:13:7 | c | c<int>::c(const c<int> &) -> void | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:13:7:13:7 | operator= | c<int>::operator=(c<int> &&) -> c<int> & | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:13:7:13:7 | operator= | c<int>::operator=(const c<int> &) -> c<int> & | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
-| copy_from_prototype.cpp:14:26:14:26 | c | c<T>::c<(unnamed)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<T> | Unknown literal |
+| copy_from_prototype.cpp:14:26:14:26 | c | c<T>::c<(unnamed)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<T> | X |
 | copy_from_prototype.cpp:14:26:14:26 | c | c<int>::c<(unnamed)>() -> void | copy_from_prototype.cpp:13:7:13:7 | c<int> | <no expr> |
 | copy_from_prototype.cpp:17:7:17:7 | d | d::d() -> void | copy_from_prototype.cpp:17:7:17:7 | d | <no expr> |
 | copy_from_prototype.cpp:17:7:17:7 | d | d::d(const d &) -> void | copy_from_prototype.cpp:17:7:17:7 | d | <no expr> |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected b/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
index 00cdd21f9ed..6e255ec81b2 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
@@ -1,53 +1,108 @@
-| staticlocals__staticlocals_f2_extractor | false | 22465 | 22465 | f2 |
-| staticlocals__staticlocals_f2_extractor | false | 22470 | 22470 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 22472 | 22472 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 22474 | 22474 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 22476 | 22476 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 22478 | 22478 | return ... |
-| staticlocals__staticlocals_f2_extractor | false | 22480 | 22480 | { ... } |
-| staticlocals__staticlocals_f2_extractor | false | 22482 | 22482 | call to C |
-| staticlocals__staticlocals_f2_extractor | false | 22484 | 22484 | initializer for c |
-| staticlocals__staticlocals_f2_extractor | false | 22486 | 22486 | call to addOne |
-| staticlocals__staticlocals_f2_extractor | false | 22490 | 22490 | 2 |
-| staticlocals__staticlocals_f2_extractor | false | 22493 | 22493 | initializer for j |
-| staticlocals__staticlocals_f2_extractor | false | 22494 | 22494 | call to addOne |
-| staticlocals__staticlocals_f2_extractor | false | 22499 | 22499 | 2 |
-| staticlocals__staticlocals_f2_extractor | false | 22500 | 22500 | initializer for two |
-| staticlocals__staticlocals_f2_extractor | false | 22503 | 22503 | two |
-| staticlocals__staticlocals_f2_extractor | false | 22508 | 22508 | initializer for i |
-| staticlocals__staticlocals_f2_extractor | true | 22470 | 22500 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22472 | 22474 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22474 | 22476 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22476 | 22478 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22478 | 22465 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22480 | 22470 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22499 | 22472 |  |
-| staticlocals__staticlocals_f2_extractor | true | 22500 | 22499 |  |
-| staticlocals__staticlocals_f2_ql | false | 22465 | 22465 | f2 |
-| staticlocals__staticlocals_f2_ql | false | 22470 | 22470 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 22472 | 22472 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 22474 | 22474 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 22476 | 22476 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 22478 | 22478 | return ... |
-| staticlocals__staticlocals_f2_ql | false | 22480 | 22480 | { ... } |
-| staticlocals__staticlocals_f2_ql | false | 22482 | 22482 | call to C |
-| staticlocals__staticlocals_f2_ql | false | 22484 | 22484 | initializer for c |
-| staticlocals__staticlocals_f2_ql | false | 22486 | 22486 | call to addOne |
-| staticlocals__staticlocals_f2_ql | false | 22490 | 22490 | 2 |
-| staticlocals__staticlocals_f2_ql | false | 22493 | 22493 | initializer for j |
-| staticlocals__staticlocals_f2_ql | false | 22494 | 22494 | call to addOne |
-| staticlocals__staticlocals_f2_ql | false | 22499 | 22499 | 2 |
-| staticlocals__staticlocals_f2_ql | false | 22500 | 22500 | initializer for two |
-| staticlocals__staticlocals_f2_ql | false | 22503 | 22503 | two |
-| staticlocals__staticlocals_f2_ql | false | 22508 | 22508 | initializer for i |
-| staticlocals__staticlocals_f2_ql | true | 22470 | 22500 |  |
-| staticlocals__staticlocals_f2_ql | true | 22472 | 22474 |  |
-| staticlocals__staticlocals_f2_ql | true | 22474 | 22476 |  |
-| staticlocals__staticlocals_f2_ql | true | 22476 | 22478 |  |
-| staticlocals__staticlocals_f2_ql | true | 22476 | 22484 |  |
-| staticlocals__staticlocals_f2_ql | true | 22478 | 22465 |  |
-| staticlocals__staticlocals_f2_ql | true | 22480 | 22470 |  |
-| staticlocals__staticlocals_f2_ql | true | 22482 | 22478 |  |
-| staticlocals__staticlocals_f2_ql | true | 22484 | 22482 |  |
-| staticlocals__staticlocals_f2_ql | true | 22499 | 22472 |  |
-| staticlocals__staticlocals_f2_ql | true | 22500 | 22499 |  |
+| pointer_to_member__pmIsConstT_extractor | false | 21747 | 21747 | pmIsConstT |
+| pointer_to_member__pmIsConstT_extractor | false | 21756 | 21756 | declaration |
+| pointer_to_member__pmIsConstT_extractor | false | 21759 | 21759 | return ... |
+| pointer_to_member__pmIsConstT_extractor | false | 21762 | 21762 | { ... } |
+| pointer_to_member__pmIsConstT_extractor | false | 21766 | 21766 | {...} |
+| pointer_to_member__pmIsConstT_extractor | false | 21773 | 21773 | x1 |
+| pointer_to_member__pmIsConstT_extractor | false | 21777 | 21777 | & ... |
+| pointer_to_member__pmIsConstT_extractor | false | 21784 | 21784 | f1 |
+| pointer_to_member__pmIsConstT_extractor | false | 21788 | 21788 | & ... |
+| pointer_to_member__pmIsConstT_extractor | false | 21791 | 21791 | initializer for pms |
+| pointer_to_member__pmIsConstT_extractor | true | 21756 | 21759 |  |
+| pointer_to_member__pmIsConstT_extractor | true | 21759 | 21747 |  |
+| pointer_to_member__pmIsConstT_extractor | true | 21762 | 21756 |  |
+| pointer_to_member__pmIsConstT_ql | false | 21747 | 21747 | pmIsConstT |
+| pointer_to_member__pmIsConstT_ql | false | 21756 | 21756 | declaration |
+| pointer_to_member__pmIsConstT_ql | false | 21759 | 21759 | return ... |
+| pointer_to_member__pmIsConstT_ql | false | 21762 | 21762 | { ... } |
+| pointer_to_member__pmIsConstT_ql | false | 21766 | 21766 | {...} |
+| pointer_to_member__pmIsConstT_ql | false | 21773 | 21773 | x1 |
+| pointer_to_member__pmIsConstT_ql | false | 21777 | 21777 | & ... |
+| pointer_to_member__pmIsConstT_ql | false | 21784 | 21784 | f1 |
+| pointer_to_member__pmIsConstT_ql | false | 21788 | 21788 | & ... |
+| pointer_to_member__pmIsConstT_ql | false | 21791 | 21791 | initializer for pms |
+| pointer_to_member__pmIsConstT_ql | true | 21756 | 21791 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21759 | 21747 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21762 | 21756 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21766 | 21759 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21773 | 21777 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21777 | 21784 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21784 | 21788 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21788 | 21766 |  |
+| pointer_to_member__pmIsConstT_ql | true | 21791 | 21773 |  |
+| staticlocals__staticlocals_f2_extractor | false | 31503 | 31503 | f2 |
+| staticlocals__staticlocals_f2_extractor | false | 31509 | 31509 | declaration |
+| staticlocals__staticlocals_f2_extractor | false | 31512 | 31512 | declaration |
+| staticlocals__staticlocals_f2_extractor | false | 31515 | 31515 | declaration |
+| staticlocals__staticlocals_f2_extractor | false | 31518 | 31518 | declaration |
+| staticlocals__staticlocals_f2_extractor | false | 31521 | 31521 | return ... |
+| staticlocals__staticlocals_f2_extractor | false | 31524 | 31524 | { ... } |
+| staticlocals__staticlocals_f2_extractor | false | 31527 | 31527 | call to C |
+| staticlocals__staticlocals_f2_extractor | false | 31530 | 31530 | initializer for c |
+| staticlocals__staticlocals_f2_extractor | false | 31533 | 31533 | call to addOne |
+| staticlocals__staticlocals_f2_extractor | false | 31539 | 31539 | 2 |
+| staticlocals__staticlocals_f2_extractor | false | 31544 | 31544 | initializer for j |
+| staticlocals__staticlocals_f2_extractor | false | 31546 | 31546 | call to addOne |
+| staticlocals__staticlocals_f2_extractor | false | 31554 | 31554 | 2 |
+| staticlocals__staticlocals_f2_extractor | false | 31556 | 31556 | initializer for two |
+| staticlocals__staticlocals_f2_extractor | false | 31560 | 31560 | two |
+| staticlocals__staticlocals_f2_extractor | false | 31568 | 31568 | initializer for i |
+| staticlocals__staticlocals_f2_extractor | true | 31509 | 31556 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31512 | 31515 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31515 | 31518 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31518 | 31521 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31521 | 31503 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31524 | 31509 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31554 | 31512 |  |
+| staticlocals__staticlocals_f2_extractor | true | 31556 | 31554 |  |
+| staticlocals__staticlocals_f2_ql | false | 31503 | 31503 | f2 |
+| staticlocals__staticlocals_f2_ql | false | 31509 | 31509 | declaration |
+| staticlocals__staticlocals_f2_ql | false | 31512 | 31512 | declaration |
+| staticlocals__staticlocals_f2_ql | false | 31515 | 31515 | declaration |
+| staticlocals__staticlocals_f2_ql | false | 31518 | 31518 | declaration |
+| staticlocals__staticlocals_f2_ql | false | 31521 | 31521 | return ... |
+| staticlocals__staticlocals_f2_ql | false | 31524 | 31524 | { ... } |
+| staticlocals__staticlocals_f2_ql | false | 31527 | 31527 | call to C |
+| staticlocals__staticlocals_f2_ql | false | 31530 | 31530 | initializer for c |
+| staticlocals__staticlocals_f2_ql | false | 31533 | 31533 | call to addOne |
+| staticlocals__staticlocals_f2_ql | false | 31539 | 31539 | 2 |
+| staticlocals__staticlocals_f2_ql | false | 31544 | 31544 | initializer for j |
+| staticlocals__staticlocals_f2_ql | false | 31546 | 31546 | call to addOne |
+| staticlocals__staticlocals_f2_ql | false | 31554 | 31554 | 2 |
+| staticlocals__staticlocals_f2_ql | false | 31556 | 31556 | initializer for two |
+| staticlocals__staticlocals_f2_ql | false | 31560 | 31560 | two |
+| staticlocals__staticlocals_f2_ql | false | 31568 | 31568 | initializer for i |
+| staticlocals__staticlocals_f2_ql | true | 31509 | 31556 |  |
+| staticlocals__staticlocals_f2_ql | true | 31512 | 31515 |  |
+| staticlocals__staticlocals_f2_ql | true | 31515 | 31518 |  |
+| staticlocals__staticlocals_f2_ql | true | 31518 | 31521 |  |
+| staticlocals__staticlocals_f2_ql | true | 31518 | 31530 |  |
+| staticlocals__staticlocals_f2_ql | true | 31521 | 31503 |  |
+| staticlocals__staticlocals_f2_ql | true | 31524 | 31509 |  |
+| staticlocals__staticlocals_f2_ql | true | 31527 | 31521 |  |
+| staticlocals__staticlocals_f2_ql | true | 31530 | 31527 |  |
+| staticlocals__staticlocals_f2_ql | true | 31554 | 31512 |  |
+| staticlocals__staticlocals_f2_ql | true | 31556 | 31554 |  |
+| staticlocals__staticlocals_f3_extractor | false | 31473 | 31473 | f3 |
+| staticlocals__staticlocals_f3_extractor | false | 31477 | 31477 | declaration |
+| staticlocals__staticlocals_f3_extractor | false | 31480 | 31480 | return ... |
+| staticlocals__staticlocals_f3_extractor | false | 31483 | 31483 | { ... } |
+| staticlocals__staticlocals_f3_extractor | false | 31492 | 31492 | value |
+| staticlocals__staticlocals_f3_extractor | false | 31496 | 31496 | (int)... |
+| staticlocals__staticlocals_f3_extractor | false | 31498 | 31498 | initializer for i |
+| staticlocals__staticlocals_f3_extractor | true | 31477 | 31480 |  |
+| staticlocals__staticlocals_f3_extractor | true | 31480 | 31473 |  |
+| staticlocals__staticlocals_f3_extractor | true | 31483 | 31477 |  |
+| staticlocals__staticlocals_f3_ql | false | 31473 | 31473 | f3 |
+| staticlocals__staticlocals_f3_ql | false | 31477 | 31477 | declaration |
+| staticlocals__staticlocals_f3_ql | false | 31480 | 31480 | return ... |
+| staticlocals__staticlocals_f3_ql | false | 31483 | 31483 | { ... } |
+| staticlocals__staticlocals_f3_ql | false | 31492 | 31492 | value |
+| staticlocals__staticlocals_f3_ql | false | 31496 | 31496 | (int)... |
+| staticlocals__staticlocals_f3_ql | false | 31498 | 31498 | initializer for i |
+| staticlocals__staticlocals_f3_ql | true | 31477 | 31480 |  |
+| staticlocals__staticlocals_f3_ql | true | 31477 | 31498 |  |
+| staticlocals__staticlocals_f3_ql | true | 31480 | 31473 |  |
+| staticlocals__staticlocals_f3_ql | true | 31483 | 31477 |  |
+| staticlocals__staticlocals_f3_ql | true | 31492 | 31480 |  |
+| staticlocals__staticlocals_f3_ql | true | 31498 | 31492 |  |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected b/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
index 0e06bb202c4..ae6f3429892 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
@@ -1,3 +1,14 @@
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:41:3:44:29 | declaration | pointer_to_member.cpp:44:11:44:28 | initializer for pms | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:41:3:44:29 | declaration | pointer_to_member.cpp:45:1:45:1 | return ... | Standard edge, only from extractor | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:11:44:28 | initializer for pms | pointer_to_member.cpp:44:14:44:18 | x1 | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:11:44:28 | {...} | pointer_to_member.cpp:45:1:45:1 | return ... | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:13:44:18 | & ... | pointer_to_member.cpp:44:22:44:26 | f1 | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:14:44:18 | x1 | pointer_to_member.cpp:44:13:44:18 | & ... | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:21:44:26 | & ... | pointer_to_member.cpp:44:11:44:28 | {...} | Standard edge, only from QL | uninstantiated |
+| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:22:44:26 | f1 | pointer_to_member.cpp:44:21:44:26 | & ... | Standard edge, only from QL | uninstantiated |
 | staticlocals__staticlocals_f2 | file://:0:0:0:0 | call to C | staticlocals.cpp:30:1:30:1 | return ... | Standard edge, only from QL |  |
 | staticlocals__staticlocals_f2 | file://:0:0:0:0 | initializer for c | file://:0:0:0:0 | call to C | Standard edge, only from QL |  |
 | staticlocals__staticlocals_f2 | staticlocals.cpp:29:5:29:17 | declaration | file://:0:0:0:0 | initializer for c | Standard edge, only from QL |  |
+| staticlocals__staticlocals_f3 | staticlocals.cpp:39:3:39:34 | declaration | staticlocals.cpp:39:18:39:33 | initializer for i | Standard edge, only from QL | uninstantiated |
+| staticlocals__staticlocals_f3 | staticlocals.cpp:39:18:39:33 | initializer for i | staticlocals.cpp:39:18:39:33 | value | Standard edge, only from QL | uninstantiated |
+| staticlocals__staticlocals_f3 | staticlocals.cpp:39:18:39:33 | value | staticlocals.cpp:40:1:40:1 | return ... | Standard edge, only from QL | uninstantiated |
diff --git a/cpp/ql/test/library-tests/templates/instantiations_functions/elements.expected b/cpp/ql/test/library-tests/templates/instantiations_functions/elements.expected
index 802903a40b6..99a6201c59c 100644
--- a/cpp/ql/test/library-tests/templates/instantiations_functions/elements.expected
+++ b/cpp/ql/test/library-tests/templates/instantiations_functions/elements.expected
@@ -317,8 +317,8 @@
 | test.cpp:19:9:19:24 | call to expression |
 | test.cpp:19:9:19:25 | ExprStmt |
 | test.cpp:19:9:19:25 | ExprStmt |
-| test.cpp:19:15:19:18 | Unknown literal |
 | test.cpp:19:15:19:18 | call to funx |
+| test.cpp:19:15:19:18 | funx |
 | test.cpp:19:20:19:23 | (reference to) |
 | test.cpp:19:20:19:23 | valx |
 | test.cpp:19:20:19:23 | valx |
@@ -356,8 +356,8 @@
 | test.cpp:30:13:30:22 | call to expression |
 | test.cpp:30:13:30:23 | ExprStmt |
 | test.cpp:30:13:30:23 | ExprStmt |
-| test.cpp:30:15:30:20 | Unknown literal |
 | test.cpp:30:15:30:20 | call to eparse |
+| test.cpp:30:15:30:20 | eparse |
 | test.cpp:31:9:31:9 | return ... |
 | test.cpp:31:9:31:9 | return ... |
 | test.cpp:34:6:34:11 | define |

From ddf1ef8a7d65ceb869fae56b83be92da6a768c0c Mon Sep 17 00:00:00 2001
From: Matthew Gretton-Dann <matt@semmle.com>
Date: Thu, 7 Nov 2019 10:35:26 +0000
Subject: [PATCH 189/232] C++: Add new test case for template member change

We now output literals for accesses to members of template parameters:

So for `foo` in the following example:

```
template<typename T> void bar(T& t) {
  T.foo(1)
}
```
---
 .../CPP-172-template-members/test.cpp         | 19 +++++++++++++++++++
 .../CPP-172-template-members/test.expected    |  2 ++
 .../CPP-172-template-members/test.ql          |  4 ++++
 3 files changed, 25 insertions(+)
 create mode 100644 cpp/ql/test/library-tests/templates/CPP-172-template-members/test.cpp
 create mode 100644 cpp/ql/test/library-tests/templates/CPP-172-template-members/test.expected
 create mode 100644 cpp/ql/test/library-tests/templates/CPP-172-template-members/test.ql

diff --git a/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.cpp b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.cpp
new file mode 100644
index 00000000000..9a624d5d9f0
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.cpp
@@ -0,0 +1,19 @@
+
+
+class A {
+public:
+  void foo();
+  int k;
+};
+
+class B {
+public:
+  template <typename T>
+  B(T x) {
+    int k = x.k;
+    x.foo();
+  }
+};
+
+A a;
+B b(a);
diff --git a/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.expected b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.expected
new file mode 100644
index 00000000000..29d00dc147a
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.expected
@@ -0,0 +1,2 @@
+| test.cpp:13:15:13:15 | k |
+| test.cpp:14:7:14:9 | foo |
diff --git a/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.ql b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.ql
new file mode 100644
index 00000000000..233c7cdce8d
--- /dev/null
+++ b/cpp/ql/test/library-tests/templates/CPP-172-template-members/test.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Literal l
+select l

From db2039d8a75cdd76bc31c35be122d579d9015584 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Thu, 7 Nov 2019 13:17:57 +0000
Subject: [PATCH 190/232] docs: learn codeql terminology note

---
 docs/language/learn-ql/index.rst            | 12 +++++++++
 docs/language/learn-ql/terminology-note.rst | 27 +++++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 docs/language/learn-ql/terminology-note.rst

diff --git a/docs/language/learn-ql/index.rst b/docs/language/learn-ql/index.rst
index 76649890131..5a3c70c4580 100644
--- a/docs/language/learn-ql/index.rst
+++ b/docs/language/learn-ql/index.rst
@@ -9,6 +9,18 @@ Here, you can query open source projects directly, without having to download Co
 
 CodeQL is based on a powerful query language called QL. The following topics help you understand QL in general, as well as how to use it when analyzing code with CodeQL.
 
+.. pull-quote::
+
+   Important 
+
+   If you've previously used QL, you may notice some slight changes in terms we use to describe some important concepts. For more information, see our note about :doc:`Recent terminology changes <terminology-note>`.
+
+.. toctree::
+   :hidden:
+
+   terminology-note
+   
+
 .. _getting-started:
 
 Getting started
diff --git a/docs/language/learn-ql/terminology-note.rst b/docs/language/learn-ql/terminology-note.rst
new file mode 100644
index 00000000000..794106d5705
--- /dev/null
+++ b/docs/language/learn-ql/terminology-note.rst
@@ -0,0 +1,27 @@
+Recent terminology changes
+===========================
+
+We recently started using new terminology to make it clearer to users what our products do. 
+This note gives some information about what has changed.
+
+CodeQL
+------
+
+CodeQL is the code analysis platform formerly known as QL. 
+CodeQL treats code as data, and CodeQL analysis is based on running queries against your code to check for errors and find bugs and vulnerabilities.
+The CodeQL product includes the tools, scripts, queries, and libraries used in CodeQL analysis. 
+
+QL
+---
+
+Previously we used the term QL to refer to the whole code analysis platform, which has been renamed CodeQL. 
+The name QL now only refers to the query language that powers CodeQL analysis.
+
+The CodeQL queries and libraries used to analyze source code are written in QL.
+These queries and libraries are open source, and can be found in the `CodeQL repository <https://github.com/semmle/ql>`__.
+QL is a general-purpose, object-oriented language that can be used to query any kind of data. 
+
+CodeQL databases
+----------------
+
+QL snapshots have been renamed CodeQL databases. CodeQL databases contain relational data created and analyzed using CodeQL. They are the equivalent of QL snapshots, but have been optimized for use with the CodeQL tools.

From 8544850945898dee993de50e7f909e22f711f79c Mon Sep 17 00:00:00 2001
From: Asger F <asger@semmle.com>
Date: Tue, 5 Nov 2019 12:00:50 +0000
Subject: [PATCH 191/232] JS: Generalize StringOps::Includes to ::InclusionTest

---
 javascript/ql/src/javascript.qll              |   1 +
 .../src/semmle/javascript/InclusionTests.qll  | 173 ++++++++++++++++++
 .../ql/src/semmle/javascript/StringOps.qll    | 157 +---------------
 .../javascript/dataflow/TaintTracking.qll     |  15 +-
 4 files changed, 188 insertions(+), 158 deletions(-)
 create mode 100644 javascript/ql/src/semmle/javascript/InclusionTests.qll

diff --git a/javascript/ql/src/javascript.qll b/javascript/ql/src/javascript.qll
index 9e75e032b1c..a6df138c592 100644
--- a/javascript/ql/src/javascript.qll
+++ b/javascript/ql/src/javascript.qll
@@ -28,6 +28,7 @@ import semmle.javascript.Functions
 import semmle.javascript.GlobalAccessPaths
 import semmle.javascript.HTML
 import semmle.javascript.HtmlSanitizers
+import semmle.javascript.InclusionTests
 import semmle.javascript.JSDoc
 import semmle.javascript.JSON
 import semmle.javascript.JsonParsers
diff --git a/javascript/ql/src/semmle/javascript/InclusionTests.qll b/javascript/ql/src/semmle/javascript/InclusionTests.qll
new file mode 100644
index 00000000000..7a90dbf1583
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/InclusionTests.qll
@@ -0,0 +1,173 @@
+/**
+ * Contains classes for recognizing array and string inclusion tests.
+ */
+private import javascript
+
+/**
+ * A expression that checks if an element is contained in an array
+ * or is a substring of another string.
+ *
+ * Examples:
+ * ```
+ * A.includes(B)
+ * A.indexOf(B) !== -1
+ * A.indexOf(B) >= 0
+ * ~A.indexOf(B)
+ * ```
+ */
+class InclusionTest extends DataFlow::Node {
+  InclusionTest::Range range;
+
+  InclusionTest() { this = range }
+
+  /** Gets the `A` in `A.includes(B)`. */
+  DataFlow::Node getContainerNode() { result = range.getContainerNode() }
+
+  /** Gets the `B` in `A.includes(B)`. */
+  DataFlow::Node getContainedNode() { result = range.getContainedNode() }
+
+  /**
+   * Gets the polarity of the check.
+   *
+   * If the polarity is `false` the check returns `true` if the container does not contain
+   * the given element.
+   */
+  boolean getPolarity() { result = range.getPolarity() }
+}
+
+module InclusionTest {
+  /**
+   * A expression that is equivalent to `A.includes(B)` or `!A.includes(B)`.
+   *
+   * Note that this also includes calls to the array method named `includes`.
+   */
+  abstract class Range extends DataFlow::Node {
+    /** Gets the `A` in `A.includes(B)`. */
+    abstract DataFlow::Node getContainerNode();
+
+    /** Gets the `B` in `A.includes(B)`. */
+    abstract DataFlow::Node getContainedNode();
+
+    /**
+     * Gets the polarity of the check.
+     *
+     * If the polarity is `false` the check returns `true` if the container does not contain
+     * the given element.
+     */
+    boolean getPolarity() { result = true }
+  }
+
+  /**
+   * A call to a method named `includes`, assumed to refer to `String.prototype.includes`
+   * or `Array.prototype.includes`.
+   */
+  private class Includes_Native extends Range, DataFlow::MethodCallNode {
+    Includes_Native() {
+      getMethodName() = "includes" and
+      getNumArgument() = 1
+    }
+
+    override DataFlow::Node getContainerNode() { result = getReceiver() }
+
+    override DataFlow::Node getContainedNode() { result = getArgument(0) }
+  }
+
+  /**
+   * A call to `_.includes` or similar, assumed to operate on strings.
+   */
+  private class Includes_Library extends Range, DataFlow::CallNode {
+    Includes_Library() {
+      exists(string name |
+        this = LodashUnderscore::member(name).getACall() and
+        (name = "includes" or name = "include" or name = "contains")
+        or
+        this = Closure::moduleImport("goog.string." + name).getACall() and
+        (name = "contains" or name = "caseInsensitiveContains")
+      )
+    }
+
+    override DataFlow::Node getContainerNode() { result = getArgument(0) }
+
+    override DataFlow::Node getContainedNode() { result = getArgument(1) }
+  }
+
+  /**
+   * A check of form `A.indexOf(B) !== -1` or similar.
+   */
+  private class Includes_IndexOfEquals extends Range, DataFlow::ValueNode {
+    MethodCallExpr indexOf;
+    override EqualityTest astNode;
+
+    Includes_IndexOfEquals() {
+      exists(Expr index | astNode.hasOperands(indexOf, index) |
+        // one operand is of the form `whitelist.indexOf(x)`
+        indexOf.getMethodName() = "indexOf" and
+        // and the other one is -1
+        index.getIntValue() = -1
+      )
+    }
+
+    override DataFlow::Node getContainerNode() { result = indexOf.getReceiver().flow() }
+
+    override DataFlow::Node getContainedNode() { result = indexOf.getArgument(0).flow() }
+
+    override boolean getPolarity() { result = astNode.getPolarity().booleanNot() }
+  }
+
+  /**
+   * A check of form `A.indexOf(B) >= 0` or similar.
+   */
+  private class Includes_IndexOfRelational extends Range, DataFlow::ValueNode {
+    MethodCallExpr indexOf;
+    override RelationalComparison astNode;
+    boolean polarity;
+
+    Includes_IndexOfRelational() {
+      exists(Expr lesser, Expr greater |
+        astNode.getLesserOperand() = lesser and
+        astNode.getGreaterOperand() = greater and
+        indexOf.getMethodName() = "indexOf" and
+        indexOf.getNumArgument() = 1
+      |
+        polarity = true and
+        greater = indexOf and
+        (
+          lesser.getIntValue() = 0 and astNode.isInclusive()
+          or
+          lesser.getIntValue() = -1 and not astNode.isInclusive()
+        )
+        or
+        polarity = false and
+        lesser = indexOf and
+        (
+          greater.getIntValue() = -1 and astNode.isInclusive()
+          or
+          greater.getIntValue() = 0 and not astNode.isInclusive()
+        )
+      )
+    }
+
+    override DataFlow::Node getContainerNode() { result = indexOf.getReceiver().flow() }
+
+    override DataFlow::Node getContainedNode() { result = indexOf.getArgument(0).flow() }
+
+    override boolean getPolarity() { result = polarity }
+  }
+
+  /**
+   * An expression of form `~A.indexOf(B)` which, when coerced to a boolean, is equivalent to `A.includes(B)`.
+   */
+  private class Includes_IndexOfBitwise extends Range, DataFlow::ValueNode {
+    MethodCallExpr indexOf;
+    override BitNotExpr astNode;
+
+    Includes_IndexOfBitwise() {
+      astNode.getOperand() = indexOf and
+      indexOf.getMethodName() = "indexOf"
+    }
+
+    override DataFlow::Node getContainerNode() { result = indexOf.getReceiver().flow() }
+
+    override DataFlow::Node getContainedNode() { result = indexOf.getArgument(0).flow() }
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/StringOps.qll b/javascript/ql/src/semmle/javascript/StringOps.qll
index f33dbd9f74d..d916e8e469d 100644
--- a/javascript/ql/src/semmle/javascript/StringOps.qll
+++ b/javascript/ql/src/semmle/javascript/StringOps.qll
@@ -185,162 +185,15 @@ module StringOps {
   /**
    * A expression that is equivalent to `A.includes(B)` or `!A.includes(B)`.
    *
-   * Note that this also includes calls to the array method named `includes`.
+   * Note that this class is equivalent to `InclusionTest`, which also matches
+   * inclusion tests on array objects.
    */
-  class Includes extends DataFlow::Node {
-    Includes::Range range;
-
-    Includes() { this = range }
-
+  class Includes extends InclusionTest {
     /** Gets the `A` in `A.includes(B)`. */
-    DataFlow::Node getBaseString() { result = range.getBaseString() }
+    DataFlow::Node getBaseString() { result = getContainerNode() }
 
     /** Gets the `B` in `A.includes(B)`. */
-    DataFlow::Node getSubstring() { result = range.getSubstring() }
-
-    /**
-     * Gets the polarity of the check.
-     *
-     * If the polarity is `false` the check returns `true` if the string does not contain
-     * the given substring.
-     */
-    boolean getPolarity() { result = range.getPolarity() }
-  }
-
-  module Includes {
-    /**
-     * A expression that is equivalent to `A.includes(B)` or `!A.includes(B)`.
-     *
-     * Note that this also includes calls to the array method named `includes`.
-     */
-    abstract class Range extends DataFlow::Node {
-      /** Gets the `A` in `A.includes(B)`. */
-      abstract DataFlow::Node getBaseString();
-
-      /** Gets the `B` in `A.includes(B)`. */
-      abstract DataFlow::Node getSubstring();
-
-      /**
-       * Gets the polarity of the check.
-       *
-       * If the polarity is `false` the check returns `true` if the string does not contain
-       * the given substring.
-       */
-      boolean getPolarity() { result = true }
-    }
-
-    /**
-     * A call to a method named `includes`, assumed to refer to `String.prototype.includes`.
-     */
-    private class Includes_Native extends Range, DataFlow::MethodCallNode {
-      Includes_Native() {
-        getMethodName() = "includes" and
-        getNumArgument() = 1
-      }
-
-      override DataFlow::Node getBaseString() { result = getReceiver() }
-
-      override DataFlow::Node getSubstring() { result = getArgument(0) }
-    }
-
-    /**
-     * A call to `_.includes` or similar, assumed to operate on strings.
-     */
-    private class Includes_Library extends Range, DataFlow::CallNode {
-      Includes_Library() {
-        exists(string name |
-          this = LodashUnderscore::member(name).getACall() and
-          (name = "includes" or name = "include" or name = "contains")
-          or
-          this = Closure::moduleImport("goog.string." + name).getACall() and
-          (name = "contains" or name = "caseInsensitiveContains")
-        )
-      }
-
-      override DataFlow::Node getBaseString() { result = getArgument(0) }
-
-      override DataFlow::Node getSubstring() { result = getArgument(1) }
-    }
-
-    /**
-     * A check of form `A.indexOf(B) !== -1` or similar.
-     */
-    private class Includes_IndexOfEquals extends Range, DataFlow::ValueNode {
-      MethodCallExpr indexOf;
-      override EqualityTest astNode;
-
-      Includes_IndexOfEquals() {
-        exists(Expr index | astNode.hasOperands(indexOf, index) |
-          // one operand is of the form `whitelist.indexOf(x)`
-          indexOf.getMethodName() = "indexOf" and
-          // and the other one is -1
-          index.getIntValue() = -1
-        )
-      }
-
-      override DataFlow::Node getBaseString() { result = indexOf.getReceiver().flow() }
-
-      override DataFlow::Node getSubstring() { result = indexOf.getArgument(0).flow() }
-
-      override boolean getPolarity() { result = astNode.getPolarity().booleanNot() }
-    }
-
-    /**
-     * A check of form `A.indexOf(B) >= 0` or similar.
-     */
-    private class Includes_IndexOfRelational extends Range, DataFlow::ValueNode {
-      MethodCallExpr indexOf;
-      override RelationalComparison astNode;
-      boolean polarity;
-
-      Includes_IndexOfRelational() {
-        exists(Expr lesser, Expr greater |
-          astNode.getLesserOperand() = lesser and
-          astNode.getGreaterOperand() = greater and
-          indexOf.getMethodName() = "indexOf" and
-          indexOf.getNumArgument() = 1
-        |
-          polarity = true and
-          greater = indexOf and
-          (
-            lesser.getIntValue() = 0 and astNode.isInclusive()
-            or
-            lesser.getIntValue() = -1 and not astNode.isInclusive()
-          )
-          or
-          polarity = false and
-          lesser = indexOf and
-          (
-            greater.getIntValue() = -1 and astNode.isInclusive()
-            or
-            greater.getIntValue() = 0 and not astNode.isInclusive()
-          )
-        )
-      }
-
-      override DataFlow::Node getBaseString() { result = indexOf.getReceiver().flow() }
-
-      override DataFlow::Node getSubstring() { result = indexOf.getArgument(0).flow() }
-
-      override boolean getPolarity() { result = polarity }
-    }
-
-    /**
-     * An expression of form `~A.indexOf(B)` which, when coerced to a boolean, is equivalent to `A.includes(B)`.
-     */
-    private class Includes_IndexOfBitwise extends Range, DataFlow::ValueNode {
-      MethodCallExpr indexOf;
-      override BitNotExpr astNode;
-
-      Includes_IndexOfBitwise() {
-        astNode.getOperand() = indexOf and
-        indexOf.getMethodName() = "indexOf"
-      }
-
-      override DataFlow::Node getBaseString() { result = indexOf.getReceiver().flow() }
-
-      override DataFlow::Node getSubstring() { result = indexOf.getArgument(0).flow() }
-    }
+    DataFlow::Node getSubstring() { result = getContainedNode() }
   }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
index 06a0d904261..a8a8356e6e2 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -781,15 +781,18 @@ module TaintTracking {
     override predicate appliesTo(Configuration cfg) { any() }
   }
 
-  /** A check of the form `whitelist.includes(x)` or equivalent, which sanitizes `x` in its "then" branch. */
-  class StringInclusionSanitizer extends AdditionalSanitizerGuardNode {
-    StringOps::Includes includes;
+  /** DEPRECATED. This class has been renamed to `InclusionSanitizer`. */
+  deprecated class StringInclusionSanitizer = InclusionSanitizer;
 
-    StringInclusionSanitizer() { this = includes }
+  /** A check of the form `whitelist.includes(x)` or equivalent, which sanitizes `x` in its "then" branch. */
+  class InclusionSanitizer extends AdditionalSanitizerGuardNode {
+    InclusionTest inclusion;
+
+    InclusionSanitizer() { this = inclusion }
 
     override predicate sanitizes(boolean outcome, Expr e) {
-      outcome = includes.getPolarity() and
-      e = includes.getSubstring().asExpr()
+      outcome = inclusion.getPolarity() and
+      e = inclusion.getContainedNode().asExpr()
     }
 
     override predicate appliesTo(Configuration cfg) { any() }

From d31ec56ea68b5354d458924a360b36675222935a Mon Sep 17 00:00:00 2001
From: James Fletcher <42464962+jf205@users.noreply.github.com>
Date: Thu, 7 Nov 2019 14:39:52 +0000
Subject: [PATCH 192/232] Update docs/language/learn-ql/index.rst

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
---
 docs/language/learn-ql/index.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/language/learn-ql/index.rst b/docs/language/learn-ql/index.rst
index 5a3c70c4580..add850f5806 100644
--- a/docs/language/learn-ql/index.rst
+++ b/docs/language/learn-ql/index.rst
@@ -13,7 +13,7 @@ CodeQL is based on a powerful query language called QL. The following topics hel
 
    Important 
 
-   If you've previously used QL, you may notice some slight changes in terms we use to describe some important concepts. For more information, see our note about :doc:`Recent terminology changes <terminology-note>`.
+   If you've previously used QL, you may notice slight changes in terms we use to describe some important concepts. For more information, see our note about :doc:`Recent terminology changes <terminology-note>`.
 
 .. toctree::
    :hidden:
@@ -98,4 +98,4 @@ Search
 
 .. * :ref:`genindex` remove index for the time being as we currently have no tags
 
-* :ref:`search`
\ No newline at end of file
+* :ref:`search`

From 8178e3e67117ed4af20b7a2c5320a01ae86c811f Mon Sep 17 00:00:00 2001
From: James Fletcher <42464962+jf205@users.noreply.github.com>
Date: Thu, 7 Nov 2019 14:40:04 +0000
Subject: [PATCH 193/232] Update docs/language/learn-ql/terminology-note.rst

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
---
 docs/language/learn-ql/terminology-note.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/learn-ql/terminology-note.rst b/docs/language/learn-ql/terminology-note.rst
index 794106d5705..552d7b2789c 100644
--- a/docs/language/learn-ql/terminology-note.rst
+++ b/docs/language/learn-ql/terminology-note.rst
@@ -24,4 +24,4 @@ QL is a general-purpose, object-oriented language that can be used to query any
 CodeQL databases
 ----------------
 
-QL snapshots have been renamed CodeQL databases. CodeQL databases contain relational data created and analyzed using CodeQL. They are the equivalent of QL snapshots, but have been optimized for use with the CodeQL tools.
+QL snapshots have been renamed CodeQL databases. :doc:`CodeQL databases <database>` contain relational data created and analyzed using CodeQL. They are the equivalent of QL snapshots, but have been optimized for use with the CodeQL tools.

From b5af4e5acd50d5cd19c22c398247fc8a99b11c31 Mon Sep 17 00:00:00 2001
From: Ian Lynagh <ian@semmle.com>
Date: Thu, 7 Nov 2019 16:32:18 +0000
Subject: [PATCH 194/232] C++: Remove tests for CFG differences

Now that we have switched over, they are no longer interesting.
---
 .../syntax-zoo/drawDifferent.expected         | 108 ------------------
 .../library-tests/syntax-zoo/drawDifferent.ql |  10 --
 .../syntax-zoo/tellDifferent.expected         |  14 ---
 .../library-tests/syntax-zoo/tellDifferent.ql |  13 ---
 4 files changed, 145 deletions(-)
 delete mode 100644 cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
 delete mode 100644 cpp/ql/test/library-tests/syntax-zoo/drawDifferent.ql
 delete mode 100644 cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
 delete mode 100644 cpp/ql/test/library-tests/syntax-zoo/tellDifferent.ql

diff --git a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected b/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
deleted file mode 100644
index 6e255ec81b2..00000000000
--- a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.expected
+++ /dev/null
@@ -1,108 +0,0 @@
-| pointer_to_member__pmIsConstT_extractor | false | 21747 | 21747 | pmIsConstT |
-| pointer_to_member__pmIsConstT_extractor | false | 21756 | 21756 | declaration |
-| pointer_to_member__pmIsConstT_extractor | false | 21759 | 21759 | return ... |
-| pointer_to_member__pmIsConstT_extractor | false | 21762 | 21762 | { ... } |
-| pointer_to_member__pmIsConstT_extractor | false | 21766 | 21766 | {...} |
-| pointer_to_member__pmIsConstT_extractor | false | 21773 | 21773 | x1 |
-| pointer_to_member__pmIsConstT_extractor | false | 21777 | 21777 | & ... |
-| pointer_to_member__pmIsConstT_extractor | false | 21784 | 21784 | f1 |
-| pointer_to_member__pmIsConstT_extractor | false | 21788 | 21788 | & ... |
-| pointer_to_member__pmIsConstT_extractor | false | 21791 | 21791 | initializer for pms |
-| pointer_to_member__pmIsConstT_extractor | true | 21756 | 21759 |  |
-| pointer_to_member__pmIsConstT_extractor | true | 21759 | 21747 |  |
-| pointer_to_member__pmIsConstT_extractor | true | 21762 | 21756 |  |
-| pointer_to_member__pmIsConstT_ql | false | 21747 | 21747 | pmIsConstT |
-| pointer_to_member__pmIsConstT_ql | false | 21756 | 21756 | declaration |
-| pointer_to_member__pmIsConstT_ql | false | 21759 | 21759 | return ... |
-| pointer_to_member__pmIsConstT_ql | false | 21762 | 21762 | { ... } |
-| pointer_to_member__pmIsConstT_ql | false | 21766 | 21766 | {...} |
-| pointer_to_member__pmIsConstT_ql | false | 21773 | 21773 | x1 |
-| pointer_to_member__pmIsConstT_ql | false | 21777 | 21777 | & ... |
-| pointer_to_member__pmIsConstT_ql | false | 21784 | 21784 | f1 |
-| pointer_to_member__pmIsConstT_ql | false | 21788 | 21788 | & ... |
-| pointer_to_member__pmIsConstT_ql | false | 21791 | 21791 | initializer for pms |
-| pointer_to_member__pmIsConstT_ql | true | 21756 | 21791 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21759 | 21747 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21762 | 21756 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21766 | 21759 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21773 | 21777 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21777 | 21784 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21784 | 21788 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21788 | 21766 |  |
-| pointer_to_member__pmIsConstT_ql | true | 21791 | 21773 |  |
-| staticlocals__staticlocals_f2_extractor | false | 31503 | 31503 | f2 |
-| staticlocals__staticlocals_f2_extractor | false | 31509 | 31509 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 31512 | 31512 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 31515 | 31515 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 31518 | 31518 | declaration |
-| staticlocals__staticlocals_f2_extractor | false | 31521 | 31521 | return ... |
-| staticlocals__staticlocals_f2_extractor | false | 31524 | 31524 | { ... } |
-| staticlocals__staticlocals_f2_extractor | false | 31527 | 31527 | call to C |
-| staticlocals__staticlocals_f2_extractor | false | 31530 | 31530 | initializer for c |
-| staticlocals__staticlocals_f2_extractor | false | 31533 | 31533 | call to addOne |
-| staticlocals__staticlocals_f2_extractor | false | 31539 | 31539 | 2 |
-| staticlocals__staticlocals_f2_extractor | false | 31544 | 31544 | initializer for j |
-| staticlocals__staticlocals_f2_extractor | false | 31546 | 31546 | call to addOne |
-| staticlocals__staticlocals_f2_extractor | false | 31554 | 31554 | 2 |
-| staticlocals__staticlocals_f2_extractor | false | 31556 | 31556 | initializer for two |
-| staticlocals__staticlocals_f2_extractor | false | 31560 | 31560 | two |
-| staticlocals__staticlocals_f2_extractor | false | 31568 | 31568 | initializer for i |
-| staticlocals__staticlocals_f2_extractor | true | 31509 | 31556 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31512 | 31515 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31515 | 31518 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31518 | 31521 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31521 | 31503 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31524 | 31509 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31554 | 31512 |  |
-| staticlocals__staticlocals_f2_extractor | true | 31556 | 31554 |  |
-| staticlocals__staticlocals_f2_ql | false | 31503 | 31503 | f2 |
-| staticlocals__staticlocals_f2_ql | false | 31509 | 31509 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 31512 | 31512 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 31515 | 31515 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 31518 | 31518 | declaration |
-| staticlocals__staticlocals_f2_ql | false | 31521 | 31521 | return ... |
-| staticlocals__staticlocals_f2_ql | false | 31524 | 31524 | { ... } |
-| staticlocals__staticlocals_f2_ql | false | 31527 | 31527 | call to C |
-| staticlocals__staticlocals_f2_ql | false | 31530 | 31530 | initializer for c |
-| staticlocals__staticlocals_f2_ql | false | 31533 | 31533 | call to addOne |
-| staticlocals__staticlocals_f2_ql | false | 31539 | 31539 | 2 |
-| staticlocals__staticlocals_f2_ql | false | 31544 | 31544 | initializer for j |
-| staticlocals__staticlocals_f2_ql | false | 31546 | 31546 | call to addOne |
-| staticlocals__staticlocals_f2_ql | false | 31554 | 31554 | 2 |
-| staticlocals__staticlocals_f2_ql | false | 31556 | 31556 | initializer for two |
-| staticlocals__staticlocals_f2_ql | false | 31560 | 31560 | two |
-| staticlocals__staticlocals_f2_ql | false | 31568 | 31568 | initializer for i |
-| staticlocals__staticlocals_f2_ql | true | 31509 | 31556 |  |
-| staticlocals__staticlocals_f2_ql | true | 31512 | 31515 |  |
-| staticlocals__staticlocals_f2_ql | true | 31515 | 31518 |  |
-| staticlocals__staticlocals_f2_ql | true | 31518 | 31521 |  |
-| staticlocals__staticlocals_f2_ql | true | 31518 | 31530 |  |
-| staticlocals__staticlocals_f2_ql | true | 31521 | 31503 |  |
-| staticlocals__staticlocals_f2_ql | true | 31524 | 31509 |  |
-| staticlocals__staticlocals_f2_ql | true | 31527 | 31521 |  |
-| staticlocals__staticlocals_f2_ql | true | 31530 | 31527 |  |
-| staticlocals__staticlocals_f2_ql | true | 31554 | 31512 |  |
-| staticlocals__staticlocals_f2_ql | true | 31556 | 31554 |  |
-| staticlocals__staticlocals_f3_extractor | false | 31473 | 31473 | f3 |
-| staticlocals__staticlocals_f3_extractor | false | 31477 | 31477 | declaration |
-| staticlocals__staticlocals_f3_extractor | false | 31480 | 31480 | return ... |
-| staticlocals__staticlocals_f3_extractor | false | 31483 | 31483 | { ... } |
-| staticlocals__staticlocals_f3_extractor | false | 31492 | 31492 | value |
-| staticlocals__staticlocals_f3_extractor | false | 31496 | 31496 | (int)... |
-| staticlocals__staticlocals_f3_extractor | false | 31498 | 31498 | initializer for i |
-| staticlocals__staticlocals_f3_extractor | true | 31477 | 31480 |  |
-| staticlocals__staticlocals_f3_extractor | true | 31480 | 31473 |  |
-| staticlocals__staticlocals_f3_extractor | true | 31483 | 31477 |  |
-| staticlocals__staticlocals_f3_ql | false | 31473 | 31473 | f3 |
-| staticlocals__staticlocals_f3_ql | false | 31477 | 31477 | declaration |
-| staticlocals__staticlocals_f3_ql | false | 31480 | 31480 | return ... |
-| staticlocals__staticlocals_f3_ql | false | 31483 | 31483 | { ... } |
-| staticlocals__staticlocals_f3_ql | false | 31492 | 31492 | value |
-| staticlocals__staticlocals_f3_ql | false | 31496 | 31496 | (int)... |
-| staticlocals__staticlocals_f3_ql | false | 31498 | 31498 | initializer for i |
-| staticlocals__staticlocals_f3_ql | true | 31477 | 31480 |  |
-| staticlocals__staticlocals_f3_ql | true | 31477 | 31498 |  |
-| staticlocals__staticlocals_f3_ql | true | 31480 | 31473 |  |
-| staticlocals__staticlocals_f3_ql | true | 31483 | 31477 |  |
-| staticlocals__staticlocals_f3_ql | true | 31492 | 31480 |  |
-| staticlocals__staticlocals_f3_ql | true | 31498 | 31492 |  |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.ql b/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.ql
deleted file mode 100644
index 5b80f3c92a0..00000000000
--- a/cpp/ql/test/library-tests/syntax-zoo/drawDifferent.ql
+++ /dev/null
@@ -1,10 +0,0 @@
-// query-type: graph
-import Compare
-
-from
-  Element scopeElement, string scopeString, boolean isEdge, ControlFlowNode x, ControlFlowNode y,
-  string label
-where
-  AllCFG::qltestGraph(scopeElement, scopeString, isEdge, x, y, label) and
-  differentScope(scopeElement)
-select scopeString, isEdge, x, y, label
diff --git a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected b/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
deleted file mode 100644
index ae6f3429892..00000000000
--- a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.expected
+++ /dev/null
@@ -1,14 +0,0 @@
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:41:3:44:29 | declaration | pointer_to_member.cpp:44:11:44:28 | initializer for pms | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:41:3:44:29 | declaration | pointer_to_member.cpp:45:1:45:1 | return ... | Standard edge, only from extractor | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:11:44:28 | initializer for pms | pointer_to_member.cpp:44:14:44:18 | x1 | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:11:44:28 | {...} | pointer_to_member.cpp:45:1:45:1 | return ... | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:13:44:18 | & ... | pointer_to_member.cpp:44:22:44:26 | f1 | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:14:44:18 | x1 | pointer_to_member.cpp:44:13:44:18 | & ... | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:21:44:26 | & ... | pointer_to_member.cpp:44:11:44:28 | {...} | Standard edge, only from QL | uninstantiated |
-| pointer_to_member__pmIsConstT | pointer_to_member.cpp:44:22:44:26 | f1 | pointer_to_member.cpp:44:21:44:26 | & ... | Standard edge, only from QL | uninstantiated |
-| staticlocals__staticlocals_f2 | file://:0:0:0:0 | call to C | staticlocals.cpp:30:1:30:1 | return ... | Standard edge, only from QL |  |
-| staticlocals__staticlocals_f2 | file://:0:0:0:0 | initializer for c | file://:0:0:0:0 | call to C | Standard edge, only from QL |  |
-| staticlocals__staticlocals_f2 | staticlocals.cpp:29:5:29:17 | declaration | file://:0:0:0:0 | initializer for c | Standard edge, only from QL |  |
-| staticlocals__staticlocals_f3 | staticlocals.cpp:39:3:39:34 | declaration | staticlocals.cpp:39:18:39:33 | initializer for i | Standard edge, only from QL | uninstantiated |
-| staticlocals__staticlocals_f3 | staticlocals.cpp:39:18:39:33 | initializer for i | staticlocals.cpp:39:18:39:33 | value | Standard edge, only from QL | uninstantiated |
-| staticlocals__staticlocals_f3 | staticlocals.cpp:39:18:39:33 | value | staticlocals.cpp:40:1:40:1 | return ... | Standard edge, only from QL | uninstantiated |
diff --git a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.ql b/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.ql
deleted file mode 100644
index f4b2509c17b..00000000000
--- a/cpp/ql/test/library-tests/syntax-zoo/tellDifferent.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-import Compare
-
-string describeTemplate(ControlFlowNode node) {
-  node.isFromTemplateInstantiation(_) and
-  result = "instantiation"
-  or
-  node.isFromUninstantiatedTemplate(_) and
-  result = "uninstantiated"
-}
-
-from ControlFlowNode n1, ControlFlowNode n2, string msg
-where differentEdge(n1, n2, msg)
-select getScopeName(n1), n1, n2, msg, concat(describeTemplate(n1), ", ")

From ae1377447e925f17a4b61db23f8231dcae1f6915 Mon Sep 17 00:00:00 2001
From: Robert Marsh <rdmarsh@semmle.com>
Date: Thu, 7 Nov 2019 13:55:49 -0800
Subject: [PATCH 195/232] C++: only generate uninits when needed

---
 .../internal/TranslatedDeclarationEntry.qll   |   2 +-
 .../raw/internal/TranslatedInitialization.qll |   2 +-
 .../test/library-tests/ir/ir/raw_ir.expected  | 102 ++++++++--------
 .../ir/ssa/aliased_ssa_ir.expected            | 114 +++++++++---------
 .../ir/ssa/unaliased_ssa_ir.expected          | 102 ++++++++--------
 5 files changed, 158 insertions(+), 164 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
index c3572bd0e79..15b5db3ef74 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
@@ -121,7 +121,7 @@ abstract class TranslatedVariableDeclaration extends TranslatedElement, Initiali
   private predicate hasUninitializedInstruction() {
     not exists(getInitialization()) or
     getInitialization() instanceof TranslatedListInitialization or
-    getInitialization() instanceof TranslatedStringLiteralInitialization
+    getInitialization().(TranslatedStringLiteralInitialization).zeroInitRange(_, _)
   }
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
index 21ad11513bd..c6911a048c7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
@@ -340,7 +340,7 @@ class TranslatedStringLiteralInitialization extends TranslatedDirectInitializati
    * Holds if the `elementCount` array elements starting at `startIndex` must be
    * zero initialized.
    */
-  private predicate zeroInitRange(int startIndex, int elementCount) {
+  predicate zeroInitRange(int startIndex, int elementCount) {
     exists(int targetCount |
       startIndex = expr.getUnspecifiedType().(ArrayType).getArraySize() and
       targetCount = getContext().getTargetType().getUnspecifiedType().(ArrayType).getArraySize() and
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index b4480e1c580..e763b3c1263 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -2675,58 +2675,56 @@ ir.cpp:
 #  572|     r0_10(glval<char>)    = PointerAdd[1]            : r0_3, r0_9
 #  572|     mu0_11(unknown[31])   = Store                    : &:r0_10, r0_8
 #  573|     r0_12(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  573|     mu0_13(char[4])       = Uninitialized[a_nopad]   : &:r0_12
-#  573|     r0_14(glval<char[4]>) = StringConstant["foo"]    : 
-#  573|     r0_15(char[4])        = Load                     : &:r0_14, ~mu0_2
-#  573|     mu0_16(char[4])       = Store                    : &:r0_12, r0_15
-#  574|     r0_17(glval<char[5]>) = VariableAddress[a_infer] : 
-#  574|     mu0_18(char[5])       = Uninitialized[a_infer]   : &:r0_17
-#  574|     r0_19(glval<char[5]>) = StringConstant["blah"]   : 
-#  574|     r0_20(char[5])        = Load                     : &:r0_19, ~mu0_2
-#  574|     mu0_21(char[5])       = Store                    : &:r0_17, r0_20
-#  575|     r0_22(glval<char[2]>) = VariableAddress[b]       : 
-#  575|     mu0_23(char[2])       = Uninitialized[b]         : &:r0_22
-#  576|     r0_24(glval<char[2]>) = VariableAddress[c]       : 
-#  576|     mu0_25(char[2])       = Uninitialized[c]         : &:r0_24
-#  576|     r0_26(int)            = Constant[0]              : 
-#  576|     r0_27(glval<char>)    = PointerAdd[1]            : r0_24, r0_26
-#  576|     r0_28(unknown[2])     = Constant[0]              : 
-#  576|     mu0_29(unknown[2])    = Store                    : &:r0_27, r0_28
-#  577|     r0_30(glval<char[2]>) = VariableAddress[d]       : 
-#  577|     mu0_31(char[2])       = Uninitialized[d]         : &:r0_30
-#  577|     r0_32(int)            = Constant[0]              : 
-#  577|     r0_33(glval<char>)    = PointerAdd[1]            : r0_30, r0_32
-#  577|     r0_34(char)           = Constant[0]              : 
-#  577|     mu0_35(char)          = Store                    : &:r0_33, r0_34
-#  577|     r0_36(int)            = Constant[1]              : 
-#  577|     r0_37(glval<char>)    = PointerAdd[1]            : r0_30, r0_36
-#  577|     r0_38(char)           = Constant[0]              : 
-#  577|     mu0_39(char)          = Store                    : &:r0_37, r0_38
-#  578|     r0_40(glval<char[2]>) = VariableAddress[e]       : 
-#  578|     mu0_41(char[2])       = Uninitialized[e]         : &:r0_40
-#  578|     r0_42(int)            = Constant[0]              : 
-#  578|     r0_43(glval<char>)    = PointerAdd[1]            : r0_40, r0_42
-#  578|     r0_44(char)           = Constant[0]              : 
-#  578|     mu0_45(char)          = Store                    : &:r0_43, r0_44
-#  578|     r0_46(int)            = Constant[1]              : 
-#  578|     r0_47(glval<char>)    = PointerAdd[1]            : r0_40, r0_46
-#  578|     r0_48(char)           = Constant[1]              : 
-#  578|     mu0_49(char)          = Store                    : &:r0_47, r0_48
-#  579|     r0_50(glval<char[3]>) = VariableAddress[f]       : 
-#  579|     mu0_51(char[3])       = Uninitialized[f]         : &:r0_50
-#  579|     r0_52(int)            = Constant[0]              : 
-#  579|     r0_53(glval<char>)    = PointerAdd[1]            : r0_50, r0_52
-#  579|     r0_54(char)           = Constant[0]              : 
-#  579|     mu0_55(char)          = Store                    : &:r0_53, r0_54
-#  579|     r0_56(int)            = Constant[1]              : 
-#  579|     r0_57(glval<char>)    = PointerAdd[1]            : r0_50, r0_56
-#  579|     r0_58(unknown[2])     = Constant[0]              : 
-#  579|     mu0_59(unknown[2])    = Store                    : &:r0_57, r0_58
-#  580|     v0_60(void)           = NoOp                     : 
-#  571|     v0_61(void)           = ReturnVoid               : 
-#  571|     v0_62(void)           = UnmodeledUse             : mu*
-#  571|     v0_63(void)           = AliasedUse               : ~mu0_2
-#  571|     v0_64(void)           = ExitFunction             : 
+#  573|     r0_13(glval<char[4]>) = StringConstant["foo"]    : 
+#  573|     r0_14(char[4])        = Load                     : &:r0_13, ~mu0_2
+#  573|     mu0_15(char[4])       = Store                    : &:r0_12, r0_14
+#  574|     r0_16(glval<char[5]>) = VariableAddress[a_infer] : 
+#  574|     r0_17(glval<char[5]>) = StringConstant["blah"]   : 
+#  574|     r0_18(char[5])        = Load                     : &:r0_17, ~mu0_2
+#  574|     mu0_19(char[5])       = Store                    : &:r0_16, r0_18
+#  575|     r0_20(glval<char[2]>) = VariableAddress[b]       : 
+#  575|     mu0_21(char[2])       = Uninitialized[b]         : &:r0_20
+#  576|     r0_22(glval<char[2]>) = VariableAddress[c]       : 
+#  576|     mu0_23(char[2])       = Uninitialized[c]         : &:r0_22
+#  576|     r0_24(int)            = Constant[0]              : 
+#  576|     r0_25(glval<char>)    = PointerAdd[1]            : r0_22, r0_24
+#  576|     r0_26(unknown[2])     = Constant[0]              : 
+#  576|     mu0_27(unknown[2])    = Store                    : &:r0_25, r0_26
+#  577|     r0_28(glval<char[2]>) = VariableAddress[d]       : 
+#  577|     mu0_29(char[2])       = Uninitialized[d]         : &:r0_28
+#  577|     r0_30(int)            = Constant[0]              : 
+#  577|     r0_31(glval<char>)    = PointerAdd[1]            : r0_28, r0_30
+#  577|     r0_32(char)           = Constant[0]              : 
+#  577|     mu0_33(char)          = Store                    : &:r0_31, r0_32
+#  577|     r0_34(int)            = Constant[1]              : 
+#  577|     r0_35(glval<char>)    = PointerAdd[1]            : r0_28, r0_34
+#  577|     r0_36(char)           = Constant[0]              : 
+#  577|     mu0_37(char)          = Store                    : &:r0_35, r0_36
+#  578|     r0_38(glval<char[2]>) = VariableAddress[e]       : 
+#  578|     mu0_39(char[2])       = Uninitialized[e]         : &:r0_38
+#  578|     r0_40(int)            = Constant[0]              : 
+#  578|     r0_41(glval<char>)    = PointerAdd[1]            : r0_38, r0_40
+#  578|     r0_42(char)           = Constant[0]              : 
+#  578|     mu0_43(char)          = Store                    : &:r0_41, r0_42
+#  578|     r0_44(int)            = Constant[1]              : 
+#  578|     r0_45(glval<char>)    = PointerAdd[1]            : r0_38, r0_44
+#  578|     r0_46(char)           = Constant[1]              : 
+#  578|     mu0_47(char)          = Store                    : &:r0_45, r0_46
+#  579|     r0_48(glval<char[3]>) = VariableAddress[f]       : 
+#  579|     mu0_49(char[3])       = Uninitialized[f]         : &:r0_48
+#  579|     r0_50(int)            = Constant[0]              : 
+#  579|     r0_51(glval<char>)    = PointerAdd[1]            : r0_48, r0_50
+#  579|     r0_52(char)           = Constant[0]              : 
+#  579|     mu0_53(char)          = Store                    : &:r0_51, r0_52
+#  579|     r0_54(int)            = Constant[1]              : 
+#  579|     r0_55(glval<char>)    = PointerAdd[1]            : r0_48, r0_54
+#  579|     r0_56(unknown[2])     = Constant[0]              : 
+#  579|     mu0_57(unknown[2])    = Store                    : &:r0_55, r0_56
+#  580|     v0_58(void)           = NoOp                     : 
+#  571|     v0_59(void)           = ReturnVoid               : 
+#  571|     v0_60(void)           = UnmodeledUse             : mu*
+#  571|     v0_61(void)           = AliasedUse               : ~mu0_2
+#  571|     v0_62(void)           = ExitFunction             : 
 
 #  584| void VarArgs()
 #  584|   Block 0
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index bc2bea75e11..893f1a1dd19 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -887,61 +887,59 @@ ssa.cpp:
 #  214|     m0_12(unknown[31])    = Store                    : &:r0_11, r0_9
 #  214|     m0_13(char[32])       = Chi                      : total:m0_8, partial:m0_12
 #  215|     r0_14(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  215|     m0_15(char[4])        = Uninitialized[a_nopad]   : &:r0_14
-#  215|     r0_16(glval<char[4]>) = StringConstant["foo"]    : 
-#  215|     r0_17(char[4])        = Load                     : &:r0_16, ~m0_1
-#  215|     m0_18(char[4])        = Store                    : &:r0_14, r0_17
-#  216|     r0_19(glval<char[5]>) = VariableAddress[a_infer] : 
-#  216|     m0_20(char[5])        = Uninitialized[a_infer]   : &:r0_19
-#  216|     r0_21(glval<char[5]>) = StringConstant["blah"]   : 
-#  216|     r0_22(char[5])        = Load                     : &:r0_21, ~m0_1
-#  216|     m0_23(char[5])        = Store                    : &:r0_19, r0_22
-#  217|     r0_24(glval<char[2]>) = VariableAddress[b]       : 
-#  217|     m0_25(char[2])        = Uninitialized[b]         : &:r0_24
-#  218|     r0_26(glval<char[2]>) = VariableAddress[c]       : 
-#  218|     m0_27(char[2])        = Uninitialized[c]         : &:r0_26
-#  218|     r0_28(int)            = Constant[0]              : 
-#  218|     r0_29(glval<char>)    = PointerAdd[1]            : r0_26, r0_28
-#  218|     r0_30(unknown[2])     = Constant[0]              : 
-#  218|     m0_31(unknown[2])     = Store                    : &:r0_29, r0_30
-#  219|     r0_32(glval<char[2]>) = VariableAddress[d]       : 
-#  219|     m0_33(char[2])        = Uninitialized[d]         : &:r0_32
-#  219|     r0_34(int)            = Constant[0]              : 
-#  219|     r0_35(glval<char>)    = PointerAdd[1]            : r0_32, r0_34
-#  219|     r0_36(char)           = Constant[0]              : 
-#  219|     m0_37(char)           = Store                    : &:r0_35, r0_36
-#  219|     m0_38(char[2])        = Chi                      : total:m0_33, partial:m0_37
-#  219|     r0_39(int)            = Constant[1]              : 
-#  219|     r0_40(glval<char>)    = PointerAdd[1]            : r0_32, r0_39
-#  219|     r0_41(char)           = Constant[0]              : 
-#  219|     m0_42(char)           = Store                    : &:r0_40, r0_41
-#  219|     m0_43(char[2])        = Chi                      : total:m0_38, partial:m0_42
-#  220|     r0_44(glval<char[2]>) = VariableAddress[e]       : 
-#  220|     m0_45(char[2])        = Uninitialized[e]         : &:r0_44
-#  220|     r0_46(int)            = Constant[0]              : 
-#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_44, r0_46
-#  220|     r0_48(char)           = Constant[0]              : 
-#  220|     m0_49(char)           = Store                    : &:r0_47, r0_48
-#  220|     m0_50(char[2])        = Chi                      : total:m0_45, partial:m0_49
-#  220|     r0_51(int)            = Constant[1]              : 
-#  220|     r0_52(glval<char>)    = PointerAdd[1]            : r0_44, r0_51
-#  220|     r0_53(char)           = Constant[1]              : 
-#  220|     m0_54(char)           = Store                    : &:r0_52, r0_53
-#  220|     m0_55(char[2])        = Chi                      : total:m0_50, partial:m0_54
-#  221|     r0_56(glval<char[3]>) = VariableAddress[f]       : 
-#  221|     m0_57(char[3])        = Uninitialized[f]         : &:r0_56
-#  221|     r0_58(int)            = Constant[0]              : 
-#  221|     r0_59(glval<char>)    = PointerAdd[1]            : r0_56, r0_58
-#  221|     r0_60(char)           = Constant[0]              : 
-#  221|     m0_61(char)           = Store                    : &:r0_59, r0_60
-#  221|     m0_62(char[3])        = Chi                      : total:m0_57, partial:m0_61
-#  221|     r0_63(int)            = Constant[1]              : 
-#  221|     r0_64(glval<char>)    = PointerAdd[1]            : r0_56, r0_63
-#  221|     r0_65(unknown[2])     = Constant[0]              : 
-#  221|     m0_66(unknown[2])     = Store                    : &:r0_64, r0_65
-#  221|     m0_67(char[3])        = Chi                      : total:m0_62, partial:m0_66
-#  222|     v0_68(void)           = NoOp                     : 
-#  213|     v0_69(void)           = ReturnVoid               : 
-#  213|     v0_70(void)           = UnmodeledUse             : mu*
-#  213|     v0_71(void)           = AliasedUse               : ~m0_1
-#  213|     v0_72(void)           = ExitFunction             : 
+#  215|     r0_15(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_16(char[4])        = Load                     : &:r0_15, ~m0_1
+#  215|     m0_17(char[4])        = Store                    : &:r0_14, r0_16
+#  216|     r0_18(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     r0_19(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_20(char[5])        = Load                     : &:r0_19, ~m0_1
+#  216|     m0_21(char[5])        = Store                    : &:r0_18, r0_20
+#  217|     r0_22(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_23(char[2])        = Uninitialized[b]         : &:r0_22
+#  218|     r0_24(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     m0_25(char[2])        = Uninitialized[c]         : &:r0_24
+#  218|     r0_26(int)            = Constant[0]              : 
+#  218|     r0_27(glval<char>)    = PointerAdd[1]            : r0_24, r0_26
+#  218|     r0_28(unknown[2])     = Constant[0]              : 
+#  218|     m0_29(unknown[2])     = Store                    : &:r0_27, r0_28
+#  219|     r0_30(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     m0_31(char[2])        = Uninitialized[d]         : &:r0_30
+#  219|     r0_32(int)            = Constant[0]              : 
+#  219|     r0_33(glval<char>)    = PointerAdd[1]            : r0_30, r0_32
+#  219|     r0_34(char)           = Constant[0]              : 
+#  219|     m0_35(char)           = Store                    : &:r0_33, r0_34
+#  219|     m0_36(char[2])        = Chi                      : total:m0_31, partial:m0_35
+#  219|     r0_37(int)            = Constant[1]              : 
+#  219|     r0_38(glval<char>)    = PointerAdd[1]            : r0_30, r0_37
+#  219|     r0_39(char)           = Constant[0]              : 
+#  219|     m0_40(char)           = Store                    : &:r0_38, r0_39
+#  219|     m0_41(char[2])        = Chi                      : total:m0_36, partial:m0_40
+#  220|     r0_42(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     m0_43(char[2])        = Uninitialized[e]         : &:r0_42
+#  220|     r0_44(int)            = Constant[0]              : 
+#  220|     r0_45(glval<char>)    = PointerAdd[1]            : r0_42, r0_44
+#  220|     r0_46(char)           = Constant[0]              : 
+#  220|     m0_47(char)           = Store                    : &:r0_45, r0_46
+#  220|     m0_48(char[2])        = Chi                      : total:m0_43, partial:m0_47
+#  220|     r0_49(int)            = Constant[1]              : 
+#  220|     r0_50(glval<char>)    = PointerAdd[1]            : r0_42, r0_49
+#  220|     r0_51(char)           = Constant[1]              : 
+#  220|     m0_52(char)           = Store                    : &:r0_50, r0_51
+#  220|     m0_53(char[2])        = Chi                      : total:m0_48, partial:m0_52
+#  221|     r0_54(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     m0_55(char[3])        = Uninitialized[f]         : &:r0_54
+#  221|     r0_56(int)            = Constant[0]              : 
+#  221|     r0_57(glval<char>)    = PointerAdd[1]            : r0_54, r0_56
+#  221|     r0_58(char)           = Constant[0]              : 
+#  221|     m0_59(char)           = Store                    : &:r0_57, r0_58
+#  221|     m0_60(char[3])        = Chi                      : total:m0_55, partial:m0_59
+#  221|     r0_61(int)            = Constant[1]              : 
+#  221|     r0_62(glval<char>)    = PointerAdd[1]            : r0_54, r0_61
+#  221|     r0_63(unknown[2])     = Constant[0]              : 
+#  221|     m0_64(unknown[2])     = Store                    : &:r0_62, r0_63
+#  221|     m0_65(char[3])        = Chi                      : total:m0_60, partial:m0_64
+#  222|     v0_66(void)           = NoOp                     : 
+#  213|     v0_67(void)           = ReturnVoid               : 
+#  213|     v0_68(void)           = UnmodeledUse             : mu*
+#  213|     v0_69(void)           = AliasedUse               : ~m0_1
+#  213|     v0_70(void)           = ExitFunction             : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 93f27b13f02..0014e15c784 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -849,55 +849,53 @@ ssa.cpp:
 #  214|     r0_10(glval<char>)    = PointerAdd[1]            : r0_3, r0_9
 #  214|     mu0_11(unknown[31])   = Store                    : &:r0_10, r0_8
 #  215|     r0_12(glval<char[4]>) = VariableAddress[a_nopad] : 
-#  215|     m0_13(char[4])        = Uninitialized[a_nopad]   : &:r0_12
-#  215|     r0_14(glval<char[4]>) = StringConstant["foo"]    : 
-#  215|     r0_15(char[4])        = Load                     : &:r0_14, ~mu0_2
-#  215|     m0_16(char[4])        = Store                    : &:r0_12, r0_15
-#  216|     r0_17(glval<char[5]>) = VariableAddress[a_infer] : 
-#  216|     m0_18(char[5])        = Uninitialized[a_infer]   : &:r0_17
-#  216|     r0_19(glval<char[5]>) = StringConstant["blah"]   : 
-#  216|     r0_20(char[5])        = Load                     : &:r0_19, ~mu0_2
-#  216|     m0_21(char[5])        = Store                    : &:r0_17, r0_20
-#  217|     r0_22(glval<char[2]>) = VariableAddress[b]       : 
-#  217|     m0_23(char[2])        = Uninitialized[b]         : &:r0_22
-#  218|     r0_24(glval<char[2]>) = VariableAddress[c]       : 
-#  218|     mu0_25(char[2])       = Uninitialized[c]         : &:r0_24
-#  218|     r0_26(int)            = Constant[0]              : 
-#  218|     r0_27(glval<char>)    = PointerAdd[1]            : r0_24, r0_26
-#  218|     r0_28(unknown[2])     = Constant[0]              : 
-#  218|     mu0_29(unknown[2])    = Store                    : &:r0_27, r0_28
-#  219|     r0_30(glval<char[2]>) = VariableAddress[d]       : 
-#  219|     mu0_31(char[2])       = Uninitialized[d]         : &:r0_30
-#  219|     r0_32(int)            = Constant[0]              : 
-#  219|     r0_33(glval<char>)    = PointerAdd[1]            : r0_30, r0_32
-#  219|     r0_34(char)           = Constant[0]              : 
-#  219|     mu0_35(char)          = Store                    : &:r0_33, r0_34
-#  219|     r0_36(int)            = Constant[1]              : 
-#  219|     r0_37(glval<char>)    = PointerAdd[1]            : r0_30, r0_36
-#  219|     r0_38(char)           = Constant[0]              : 
-#  219|     mu0_39(char)          = Store                    : &:r0_37, r0_38
-#  220|     r0_40(glval<char[2]>) = VariableAddress[e]       : 
-#  220|     mu0_41(char[2])       = Uninitialized[e]         : &:r0_40
-#  220|     r0_42(int)            = Constant[0]              : 
-#  220|     r0_43(glval<char>)    = PointerAdd[1]            : r0_40, r0_42
-#  220|     r0_44(char)           = Constant[0]              : 
-#  220|     mu0_45(char)          = Store                    : &:r0_43, r0_44
-#  220|     r0_46(int)            = Constant[1]              : 
-#  220|     r0_47(glval<char>)    = PointerAdd[1]            : r0_40, r0_46
-#  220|     r0_48(char)           = Constant[1]              : 
-#  220|     mu0_49(char)          = Store                    : &:r0_47, r0_48
-#  221|     r0_50(glval<char[3]>) = VariableAddress[f]       : 
-#  221|     mu0_51(char[3])       = Uninitialized[f]         : &:r0_50
-#  221|     r0_52(int)            = Constant[0]              : 
-#  221|     r0_53(glval<char>)    = PointerAdd[1]            : r0_50, r0_52
-#  221|     r0_54(char)           = Constant[0]              : 
-#  221|     mu0_55(char)          = Store                    : &:r0_53, r0_54
-#  221|     r0_56(int)            = Constant[1]              : 
-#  221|     r0_57(glval<char>)    = PointerAdd[1]            : r0_50, r0_56
-#  221|     r0_58(unknown[2])     = Constant[0]              : 
-#  221|     mu0_59(unknown[2])    = Store                    : &:r0_57, r0_58
-#  222|     v0_60(void)           = NoOp                     : 
-#  213|     v0_61(void)           = ReturnVoid               : 
-#  213|     v0_62(void)           = UnmodeledUse             : mu*
-#  213|     v0_63(void)           = AliasedUse               : ~mu0_2
-#  213|     v0_64(void)           = ExitFunction             : 
+#  215|     r0_13(glval<char[4]>) = StringConstant["foo"]    : 
+#  215|     r0_14(char[4])        = Load                     : &:r0_13, ~mu0_2
+#  215|     m0_15(char[4])        = Store                    : &:r0_12, r0_14
+#  216|     r0_16(glval<char[5]>) = VariableAddress[a_infer] : 
+#  216|     r0_17(glval<char[5]>) = StringConstant["blah"]   : 
+#  216|     r0_18(char[5])        = Load                     : &:r0_17, ~mu0_2
+#  216|     m0_19(char[5])        = Store                    : &:r0_16, r0_18
+#  217|     r0_20(glval<char[2]>) = VariableAddress[b]       : 
+#  217|     m0_21(char[2])        = Uninitialized[b]         : &:r0_20
+#  218|     r0_22(glval<char[2]>) = VariableAddress[c]       : 
+#  218|     mu0_23(char[2])       = Uninitialized[c]         : &:r0_22
+#  218|     r0_24(int)            = Constant[0]              : 
+#  218|     r0_25(glval<char>)    = PointerAdd[1]            : r0_22, r0_24
+#  218|     r0_26(unknown[2])     = Constant[0]              : 
+#  218|     mu0_27(unknown[2])    = Store                    : &:r0_25, r0_26
+#  219|     r0_28(glval<char[2]>) = VariableAddress[d]       : 
+#  219|     mu0_29(char[2])       = Uninitialized[d]         : &:r0_28
+#  219|     r0_30(int)            = Constant[0]              : 
+#  219|     r0_31(glval<char>)    = PointerAdd[1]            : r0_28, r0_30
+#  219|     r0_32(char)           = Constant[0]              : 
+#  219|     mu0_33(char)          = Store                    : &:r0_31, r0_32
+#  219|     r0_34(int)            = Constant[1]              : 
+#  219|     r0_35(glval<char>)    = PointerAdd[1]            : r0_28, r0_34
+#  219|     r0_36(char)           = Constant[0]              : 
+#  219|     mu0_37(char)          = Store                    : &:r0_35, r0_36
+#  220|     r0_38(glval<char[2]>) = VariableAddress[e]       : 
+#  220|     mu0_39(char[2])       = Uninitialized[e]         : &:r0_38
+#  220|     r0_40(int)            = Constant[0]              : 
+#  220|     r0_41(glval<char>)    = PointerAdd[1]            : r0_38, r0_40
+#  220|     r0_42(char)           = Constant[0]              : 
+#  220|     mu0_43(char)          = Store                    : &:r0_41, r0_42
+#  220|     r0_44(int)            = Constant[1]              : 
+#  220|     r0_45(glval<char>)    = PointerAdd[1]            : r0_38, r0_44
+#  220|     r0_46(char)           = Constant[1]              : 
+#  220|     mu0_47(char)          = Store                    : &:r0_45, r0_46
+#  221|     r0_48(glval<char[3]>) = VariableAddress[f]       : 
+#  221|     mu0_49(char[3])       = Uninitialized[f]         : &:r0_48
+#  221|     r0_50(int)            = Constant[0]              : 
+#  221|     r0_51(glval<char>)    = PointerAdd[1]            : r0_48, r0_50
+#  221|     r0_52(char)           = Constant[0]              : 
+#  221|     mu0_53(char)          = Store                    : &:r0_51, r0_52
+#  221|     r0_54(int)            = Constant[1]              : 
+#  221|     r0_55(glval<char>)    = PointerAdd[1]            : r0_48, r0_54
+#  221|     r0_56(unknown[2])     = Constant[0]              : 
+#  221|     mu0_57(unknown[2])    = Store                    : &:r0_55, r0_56
+#  222|     v0_58(void)           = NoOp                     : 
+#  213|     v0_59(void)           = ReturnVoid               : 
+#  213|     v0_60(void)           = UnmodeledUse             : mu*
+#  213|     v0_61(void)           = AliasedUse               : ~mu0_2
+#  213|     v0_62(void)           = ExitFunction             : 

From 4ea8569081e003e4fb274c3d03e709ea7ba86fe4 Mon Sep 17 00:00:00 2001
From: Ziemowit Laski <zlaski@semmle.com>
Date: Thu, 7 Nov 2019 16:40:03 -0800
Subject: [PATCH 196/232] [CPP-434] Squelch query alerts if ALL files were
 compiled           with `-fwrapv` or `-fno-strict-overflow`

---
 cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
index bd79a114172..648846a7dc1 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	
@@ -23,5 +23,9 @@ where
   globalValueNumber(expr1) = globalValueNumber(expr2) and
   add.getUnspecifiedType().(IntegralType).isSigned() and
   not exists(MacroInvocation mi | mi.getAnAffectedElement() = add) and
-  exprMightOverflowPositively(add)
+  exprMightOverflowPositively(add) and
+  exists(Compilation c | c.getAFileCompiled() = ro.getFile() |
+    not c.getAnArgument() = "-fwrapv" and
+    not c.getAnArgument() = "-fno-strict-overflow"
+  )
 select ro, "Testing for signed overflow may produce undefined results."

From 17f76c251679acdb09ff7dc30ccc71aa6c2aa7c2 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo <dbartol@github.com>
Date: Thu, 7 Nov 2019 22:02:15 -0700
Subject: [PATCH 197/232] C++: Fix merge conflicts

---
 .../ir/ssa/aliased_ssa_ir.expected            | 26 +++++++++++++++++++
 .../ir/ssa/unaliased_ssa_ir.expected          | 25 ++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 46f8cf19aea..f306d3e14c2 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -877,3 +877,29 @@ ssa.cpp:
 #  207|     v0_27(void)          = UnmodeledUse                       : mu*
 #  207|     v0_28(void)          = AliasedUse                         : ~m0_1
 #  207|     v0_29(void)          = ExitFunction                       : 
+
+#  215| char StringLiteralAliasing()
+#  215|   Block 0
+#  215|     v0_0(void)           = EnterFunction                 : 
+#  215|     m0_1(unknown)        = AliasedDefinition             : 
+#  215|     mu0_2(unknown)       = UnmodeledDefinition           : 
+#  216|     r0_3(glval<unknown>) = FunctionAddress[ExternalFunc] : 
+#  216|     v0_4(void)           = Call                          : func:r0_3
+#  216|     m0_5(unknown)        = ^CallSideEffect               : ~m0_1
+#  216|     m0_6(unknown)        = Chi                           : total:m0_1, partial:m0_5
+#  218|     r0_7(glval<char *>)  = VariableAddress[s]            : 
+#  218|     r0_8(glval<char[8]>) = StringConstant["Literal"]     : 
+#  218|     r0_9(char *)         = Convert                       : r0_8
+#  218|     m0_10(char *)        = Store                         : &:r0_7, r0_9
+#  219|     r0_11(glval<char>)   = VariableAddress[#return]      : 
+#  219|     r0_12(glval<char *>) = VariableAddress[s]            : 
+#  219|     r0_13(char *)        = Load                          : &:r0_12, m0_10
+#  219|     r0_14(int)           = Constant[2]                   : 
+#  219|     r0_15(glval<char>)   = PointerAdd[1]                 : r0_13, r0_14
+#  219|     r0_16(char)          = Load                          : &:r0_15, ~m0_1
+#  219|     m0_17(char)          = Store                         : &:r0_11, r0_16
+#  215|     r0_18(glval<char>)   = VariableAddress[#return]      : 
+#  215|     v0_19(void)          = ReturnValue                   : &:r0_18, m0_17
+#  215|     v0_20(void)          = UnmodeledUse                  : mu*
+#  215|     v0_21(void)          = AliasedUse                    : ~m0_6
+#  215|     v0_22(void)          = ExitFunction                  : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 7aae6b70dfd..48d698a1291 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -841,3 +841,28 @@ ssa.cpp:
 #  207|     v0_24(void)          = UnmodeledUse                       : mu*
 #  207|     v0_25(void)          = AliasedUse                         : ~mu0_2
 #  207|     v0_26(void)          = ExitFunction                       : 
+
+#  215| char StringLiteralAliasing()
+#  215|   Block 0
+#  215|     v0_0(void)           = EnterFunction                 : 
+#  215|     mu0_1(unknown)       = AliasedDefinition             : 
+#  215|     mu0_2(unknown)       = UnmodeledDefinition           : 
+#  216|     r0_3(glval<unknown>) = FunctionAddress[ExternalFunc] : 
+#  216|     v0_4(void)           = Call                          : func:r0_3
+#  216|     mu0_5(unknown)       = ^CallSideEffect               : ~mu0_2
+#  218|     r0_6(glval<char *>)  = VariableAddress[s]            : 
+#  218|     r0_7(glval<char[8]>) = StringConstant["Literal"]     : 
+#  218|     r0_8(char *)         = Convert                       : r0_7
+#  218|     m0_9(char *)         = Store                         : &:r0_6, r0_8
+#  219|     r0_10(glval<char>)   = VariableAddress[#return]      : 
+#  219|     r0_11(glval<char *>) = VariableAddress[s]            : 
+#  219|     r0_12(char *)        = Load                          : &:r0_11, m0_9
+#  219|     r0_13(int)           = Constant[2]                   : 
+#  219|     r0_14(glval<char>)   = PointerAdd[1]                 : r0_12, r0_13
+#  219|     r0_15(char)          = Load                          : &:r0_14, ~mu0_2
+#  219|     m0_16(char)          = Store                         : &:r0_10, r0_15
+#  215|     r0_17(glval<char>)   = VariableAddress[#return]      : 
+#  215|     v0_18(void)          = ReturnValue                   : &:r0_17, m0_16
+#  215|     v0_19(void)          = UnmodeledUse                  : mu*
+#  215|     v0_20(void)          = AliasedUse                    : ~mu0_2
+#  215|     v0_21(void)          = ExitFunction                  : 

From e8510fe71a3c4fc1eab65e9a1f6095213dacb3b2 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Fri, 8 Nov 2019 09:17:05 +0000
Subject: [PATCH 198/232] TypeScript: Skip Touchstone files.

---
 .../semmle/js/extractor/FileExtractor.java    | 28 +++++++++++++------
 .../tests/ts/input/touchstone-file.ts         |  2 ++
 .../tests/ts/input/touchstone-file2.ts        |  1 +
 3 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 javascript/extractor/tests/ts/input/touchstone-file.ts
 create mode 100644 javascript/extractor/tests/ts/input/touchstone-file2.ts

diff --git a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
index d80ddeaf303..278a7ec2e63 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
@@ -1,5 +1,16 @@
 package com.semmle.js.extractor;
 
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileReader;
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Pattern;
+
 import com.semmle.js.extractor.ExtractionMetrics.ExtractionPhase;
 import com.semmle.js.extractor.trapcache.CachingTrapWriter;
 import com.semmle.js.extractor.trapcache.ITrapCache;
@@ -10,15 +21,6 @@ import com.semmle.util.files.FileUtil;
 import com.semmle.util.io.WholeIO;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileReader;
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.LinkedHashSet;
-import java.util.Set;
-import java.util.regex.Pattern;
 
 /**
  * The file extractor extracts a single file and handles source archive population and TRAP caching;
@@ -167,6 +169,9 @@ public class FileExtractor {
             return true;
           }
 
+          // Avoid Touchstone files
+          if (isTouchstone(bytes, length)) return true;
+
           return false;
         } catch (IOException e) {
           Exceptions.ignore(e, "Let extractor handle this one.");
@@ -198,6 +203,11 @@ public class FileExtractor {
         return false;
       }
 
+      private boolean isTouchstone(byte[] bytes, int length) {
+        String s = new String(bytes, 0, length, StandardCharsets.US_ASCII);
+        return s.startsWith("! TOUCHSTONE file ") || s.startsWith("[Version] 2.0");
+      }
+
       /**
        * Returns true if the byte sequence contains invalid UTF-8 or unprintable ASCII characters.
        */
diff --git a/javascript/extractor/tests/ts/input/touchstone-file.ts b/javascript/extractor/tests/ts/input/touchstone-file.ts
new file mode 100644
index 00000000000..a72a1dc56af
--- /dev/null
+++ b/javascript/extractor/tests/ts/input/touchstone-file.ts
@@ -0,0 +1,2 @@
+! TOUCHSTONE file generated by me
+[Version] 2.0
diff --git a/javascript/extractor/tests/ts/input/touchstone-file2.ts b/javascript/extractor/tests/ts/input/touchstone-file2.ts
new file mode 100644
index 00000000000..d642e0260b1
--- /dev/null
+++ b/javascript/extractor/tests/ts/input/touchstone-file2.ts
@@ -0,0 +1 @@
+[Version] 2.0

From 0554de06a13b5ded396d693a8f218f310587f790 Mon Sep 17 00:00:00 2001
From: james <james@semmle.com>
Date: Fri, 8 Nov 2019 09:32:20 +0000
Subject: [PATCH 199/232] docs: update banner links

---
 docs/language/global-sphinx-files/_templates/layout.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/language/global-sphinx-files/_templates/layout.html b/docs/language/global-sphinx-files/_templates/layout.html
index de3b189e1ee..000503e5798 100644
--- a/docs/language/global-sphinx-files/_templates/layout.html
+++ b/docs/language/global-sphinx-files/_templates/layout.html
@@ -62,8 +62,8 @@
             <div class="linkcontainer">
                 <div class="linkbar">
                     <a href="https://help.semmle.com/QL/learn-ql/" target="_blank">Learn CodeQL</a>
-                    <a href="https://help.semmle.com/QL/learn-ql/ql-training.html" target="_blank">QL for variant analysis</a>
-                    <a href="https://help.semmle.com/QL/ql-tools.html" target="_blank">QL tools</a>
+                    <a href="https://help.semmle.com/QL/learn-ql/ql-training.html" target="_blank">Variant analysis</a>
+                    <a href="https://help.semmle.com/QL/ql-tools.html" target="_blank">Tools</a>
                     <a href="https://help.semmle.com/QL/ql-explore-queries.html" target="_blank">Queries</a>
                     <a href="https://help.semmle.com/QL/ql-reference-topics.html" target="_blank">Reference</a>
                     <a href="https://blog.semmle.com" target="_blank">Blog</a>

From d7831d2680f7c7093873239b52a4eb5c1ef683e1 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max@semmle.com>
Date: Fri, 8 Nov 2019 10:30:53 +0000
Subject: [PATCH 200/232] JavaScript: Short-circuit bad-header check on empty
 files.

---
 .../extractor/src/com/semmle/js/extractor/FileExtractor.java   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
index 278a7ec2e63..308713c0c1a 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
@@ -156,6 +156,9 @@ public class FileExtractor {
           byte[] bytes = new byte[fileHeaderSize];
           int length = fis.read(bytes);
 
+          if (length == -1)
+            return false;
+
           // Avoid invalid or unprintable UTF-8 files.
           if (config.getDefaultEncoding().equals("UTF-8") && hasUnprintableUtf8(bytes, length)) {
             return true;

From 89a13213e276e3d0493769ecc6ade672a432d1cd Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Fri, 8 Nov 2019 13:34:54 +0100
Subject: [PATCH 201/232] Python: Accept changes in Python 2 specific tests

Due to internal PR#35123 we now actually run the tests under
`python/ql/test/2/...`

Since we haven't done this in a while, test output has changed a bit. These
changes look perfectly fine.
---
 .../test/2/library-tests/classes/attr/list_attr.expected  | 8 ++++++++
 .../query-tests/Classes/equals-hash/EqualsOrHash.expected | 4 ++--
 .../Classes/equals-hash/EqualsOrNotEquals.expected        | 4 ++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/python/ql/test/2/library-tests/classes/attr/list_attr.expected b/python/ql/test/2/library-tests/classes/attr/list_attr.expected
index b281b8f9e9a..4668766c5e5 100644
--- a/python/ql/test/2/library-tests/classes/attr/list_attr.expected
+++ b/python/ql/test/2/library-tests/classes/attr/list_attr.expected
@@ -1,9 +1,12 @@
 | builtin-class list | __add__ | Builtin-method __add__ |
+| builtin-class list | __class__ | Property __class__ |
 | builtin-class list | __contains__ | Builtin-method __contains__ |
+| builtin-class list | __delattr__ | Builtin-method __delattr__ |
 | builtin-class list | __delitem__ | Builtin-method __delitem__ |
 | builtin-class list | __delslice__ | Builtin-method __delslice__ |
 | builtin-class list | __doc__ | str b'list() -> new empty list\nlist(iterable) -> new list initialized from iterable's items' |
 | builtin-class list | __eq__ | Builtin-method __eq__ |
+| builtin-class list | __format__ | Builtin-method __format__ |
 | builtin-class list | __ge__ | Builtin-method __ge__ |
 | builtin-class list | __getattribute__ | Builtin-method __getattribute__ |
 | builtin-class list | __getitem__ | Builtin-method __getitem__ |
@@ -20,12 +23,17 @@
 | builtin-class list | __mul__ | Builtin-method __mul__ |
 | builtin-class list | __ne__ | Builtin-method __ne__ |
 | builtin-class list | __new__ | builtin_function_or_method __new__ |
+| builtin-class list | __reduce__ | Builtin-method __reduce__ |
+| builtin-class list | __reduce_ex__ | Builtin-method __reduce_ex__ |
 | builtin-class list | __repr__ | Builtin-method __repr__ |
 | builtin-class list | __reversed__ | Builtin-method __reversed__ |
 | builtin-class list | __rmul__ | Builtin-method __rmul__ |
+| builtin-class list | __setattr__ | Builtin-method __setattr__ |
 | builtin-class list | __setitem__ | Builtin-method __setitem__ |
 | builtin-class list | __setslice__ | Builtin-method __setslice__ |
 | builtin-class list | __sizeof__ | Builtin-method __sizeof__ |
+| builtin-class list | __str__ | Builtin-method __str__ |
+| builtin-class list | __subclasshook__ | classmethod_descriptor __subclasshook__ |
 | builtin-class list | append | Builtin-method append |
 | builtin-class list | count | Builtin-method count |
 | builtin-class list | extend | Builtin-method extend |
diff --git a/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrHash.expected b/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrHash.expected
index aaed9443525..916a9bb4454 100644
--- a/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrHash.expected
+++ b/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrHash.expected
@@ -1,2 +1,2 @@
-| equals_hash.py:8:5:8:28 | Function __eq__ | Class $@ implements __eq__ but does not define __hash__. | equals_hash.py:3:1:3:17 | class Eq | Eq |
-| equals_hash.py:24:5:24:23 | Function __hash__ | Class $@ implements __hash__ but does not define __eq__ or __cmp__. | equals_hash.py:19:1:19:19 | class Hash | Hash |
+| equals_hash.py:8:5:8:28 | Function Eq.__eq__ | Class $@ implements __eq__ but does not define __hash__. | equals_hash.py:3:1:3:17 | class Eq | Eq |
+| equals_hash.py:24:5:24:23 | Function Hash.__hash__ | Class $@ implements __hash__ but does not define __eq__ or __cmp__. | equals_hash.py:19:1:19:19 | class Hash | Hash |
diff --git a/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrNotEquals.expected b/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrNotEquals.expected
index a7ac0084132..04e395c668b 100644
--- a/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrNotEquals.expected
+++ b/python/ql/test/2/query-tests/Classes/equals-hash/EqualsOrNotEquals.expected
@@ -1,2 +1,2 @@
-| equals_hash.py:8:5:8:28 | Function __eq__ | Class $@ implements __eq__ but does not implement __ne__. | equals_hash.py:3:1:3:17 | class Eq | Eq |
-| equals_hash.py:16:5:16:28 | Function __ne__ | Class $@ implements __ne__ but does not implement __eq__. | equals_hash.py:11:1:11:17 | class Ne | Ne |
+| equals_hash.py:8:5:8:28 | Function Eq.__eq__ | Class $@ implements __eq__ but does not implement __ne__. | equals_hash.py:3:1:3:17 | class Eq | Eq |
+| equals_hash.py:16:5:16:28 | Function Ne.__ne__ | Class $@ implements __ne__ but does not implement __eq__. | equals_hash.py:11:1:11:17 | class Ne | Ne |

From 6c259e56081d4cc153040060f9578c5d50837957 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Fri, 8 Nov 2019 13:38:12 +0100
Subject: [PATCH 202/232] Python: Temporarily accept changes in Python 2
 specific MRO tests

Due to internal PR#35123 we now actually run the tests under
`python/ql/test/2/...`

These seems like a regression, since the tests state that N is ok, but A and J
should not be allowed.

For now we can accept them, so we don't block all other Python PRs
---
 python/ql/test/2/library-tests/classes/mro/C3.expected         | 1 -
 python/ql/test/2/library-tests/classes/mro/mro.expected        | 2 --
 python/ql/test/2/library-tests/types/classes/mro_test.expected | 2 ++
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/python/ql/test/2/library-tests/classes/mro/C3.expected b/python/ql/test/2/library-tests/classes/mro/C3.expected
index bd86482f34d..d55fae894de 100644
--- a/python/ql/test/2/library-tests/classes/mro/C3.expected
+++ b/python/ql/test/2/library-tests/classes/mro/C3.expected
@@ -3,7 +3,6 @@
 | class C | [C, BaseException, object] |
 | class D | [D, X, object] |
 | class Meta | [Meta, type, object] |
-| class N | [N, object, O] |
 | class NewStyle | [NewStyle, object] |
 | class NewStyleDerived | [NewStyleDerived, NewStyle, object] |
 | class O | [O] |
diff --git a/python/ql/test/2/library-tests/classes/mro/mro.expected b/python/ql/test/2/library-tests/classes/mro/mro.expected
index 41db9554fe1..aab6cc1a001 100644
--- a/python/ql/test/2/library-tests/classes/mro/mro.expected
+++ b/python/ql/test/2/library-tests/classes/mro/mro.expected
@@ -8,8 +8,6 @@
 | class D | class X | builtin-class object |
 | class Meta | builtin-class type | builtin-class object |
 | class Meta | class Meta | builtin-class type |
-| class N | builtin-class object | class O |
-| class N | class N | builtin-class object |
 | class NewStyle | class NewStyle | builtin-class object |
 | class NewStyleDerived | class NewStyle | builtin-class object |
 | class NewStyleDerived | class NewStyleDerived | class NewStyle |
diff --git a/python/ql/test/2/library-tests/types/classes/mro_test.expected b/python/ql/test/2/library-tests/types/classes/mro_test.expected
index b1aa3af843e..6c1d3b50bf2 100644
--- a/python/ql/test/2/library-tests/types/classes/mro_test.expected
+++ b/python/ql/test/2/library-tests/types/classes/mro_test.expected
@@ -1,3 +1,5 @@
+| class A | [A, ??, object] |
+| class J | [J, ??, object] |
 | class MyDict | [MyDict, dict, object] |
 | class MyList | [MyList, list, object] |
 | class O1 | [O1] |

From 358964b1e2b7b2408bff20eb44cbfca5bc4cdd57 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Fri, 8 Nov 2019 13:49:52 +0100
Subject: [PATCH 203/232] Python: Accept changes in Python 2 specific six tests

We don't use a locked-down version of six, so some internal things probably
changed from the version used last time, and the versoin I have installed.

Long term fix would be to use a specific version of six for tests!
---
 python/ql/test/2/library-tests/six/test.expected | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/python/ql/test/2/library-tests/six/test.expected b/python/ql/test/2/library-tests/six/test.expected
index 8462f2b2464..50ad5bc7e57 100644
--- a/python/ql/test/2/library-tests/six/test.expected
+++ b/python/ql/test/2/library-tests/six/test.expected
@@ -1,5 +1,6 @@
 | Module six | BytesIO | class StringIO |
 | Module six | Iterator | class Iterator |
+| Module six | MAXSIZE | int() |
 | Module six | PY2 | bool True |
 | Module six | PY3 | bool False |
 | Module six | StringIO | class StringIO |
@@ -45,14 +46,6 @@
 | Module six | iterlists | Function iterlists |
 | Module six | itervalues | Function itervalues |
 | Module six | moves | Module six.moves |
-| Module six | moves.__init__ | Module six.moves.__init__ |
-| Module six | moves.urllib | Module six.moves.urllib |
-| Module six | moves.urllib.__init__ | Module six.moves.urllib.__init__ |
-| Module six | moves.urllib_error | Module six.moves.urllib_error |
-| Module six | moves.urllib_parse | Module six.moves.urllib_parse |
-| Module six | moves.urllib_request | Module six.moves.urllib_request |
-| Module six | moves.urllib_response | Module six.moves.urllib_response |
-| Module six | moves.urllib_robotparser | Module six.moves.urllib_robotparser |
 | Module six | next | Builtin-function next |
 | Module six | operator | Module operator |
 | Module six | print_ | Function print_ |
@@ -67,6 +60,7 @@
 | Module six | with_metaclass | Function with_metaclass |
 | Module six.__init__ | BytesIO | class StringIO |
 | Module six.__init__ | Iterator | class Iterator |
+| Module six.__init__ | MAXSIZE | int() |
 | Module six.__init__ | PY2 | bool True |
 | Module six.__init__ | PY3 | bool False |
 | Module six.__init__ | StringIO | class StringIO |
@@ -174,7 +168,6 @@
 | Module six.moves | tkinter_tksimpledialog | Module tkSimpleDialog |
 | Module six.moves | tkinter_ttk | Module ttk |
 | Module six.moves | urllib | Module six.moves.urllib |
-| Module six.moves | urllib.__init__ | Module six.moves.urllib.__init__ |
 | Module six.moves | urllib_error | Module six.moves.urllib_error |
 | Module six.moves | urllib_parse | Module six.moves.urllib_parse |
 | Module six.moves | urllib_request | Module six.moves.urllib_request |

From 3f51260fb4f276997ac28a704d7265bbd29cbc65 Mon Sep 17 00:00:00 2001
From: shati-patel <42641846+shati-patel@users.noreply.github.com>
Date: Fri, 8 Nov 2019 14:04:44 +0000
Subject: [PATCH 204/232] Docs: Update sidebar

---
 docs/language/global-sphinx-files/_templates/layout.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/global-sphinx-files/_templates/layout.html b/docs/language/global-sphinx-files/_templates/layout.html
index 000503e5798..c5e80b3b026 100644
--- a/docs/language/global-sphinx-files/_templates/layout.html
+++ b/docs/language/global-sphinx-files/_templates/layout.html
@@ -79,7 +79,7 @@
 <div class="wrapper">
     
     <div class="navBox" >
-         <p>Start writing QL in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
+         <p>Start using CodeQL in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
              
          <div id="searchbox" style="display: none" role="search">
                 <h3>Quick search</h3>

From fe654a9c993af62fe8a89444c8ac4d546cf3b0d0 Mon Sep 17 00:00:00 2001
From: shati-patel <42641846+shati-patel@users.noreply.github.com>
Date: Fri, 8 Nov 2019 14:32:59 +0000
Subject: [PATCH 205/232] update to match support page

---
 docs/language/global-sphinx-files/_templates/layout.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/language/global-sphinx-files/_templates/layout.html b/docs/language/global-sphinx-files/_templates/layout.html
index c5e80b3b026..7faadbefbe8 100644
--- a/docs/language/global-sphinx-files/_templates/layout.html
+++ b/docs/language/global-sphinx-files/_templates/layout.html
@@ -79,7 +79,7 @@
 <div class="wrapper">
     
     <div class="navBox" >
-         <p>Start using CodeQL in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
+         <p>Start writing queries in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
              
          <div id="searchbox" style="display: none" role="search">
                 <h3>Quick search</h3>

From 144cda7dd9e6d4b8882042351ff98f7f83e478df Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 20 Sep 2019 15:59:26 +0100
Subject: [PATCH 206/232] CPP: Test for WrongTypeFormatArguments with multiple
 definitions.

---
 .../WrongTypeFormatArguments.expected            |  4 ++++
 .../Linux_signed_chars/a.c                       | 16 ++++++++++++++++
 .../Linux_signed_chars/b.c                       | 14 ++++++++++++++
 3 files changed, 34 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected
index 65f4f546976..219c185fa1d 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
@@ -1,3 +1,7 @@
+| a.c:13:39:13:42 | 1.0 | This argument should be of type 'char *' but is of type 'double' |
+| a.c:13:39:13:42 | 1.0 | This argument should be of type 'int' but is of type 'double' |
+| a.c:15:40:15:43 | 1.0 | This argument should be of type 'char *' but is of type 'double' |
+| a.c:15:40:15:43 | 1.0 | This argument should be of type 'int' but is of type 'double' |
 | format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *' |
 | format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int' |
 | format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double' |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
new file mode 100644
index 00000000000..27866e7b9ec
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
@@ -0,0 +1,16 @@
+
+__attribute__((format(printf, 1, 3)))
+void myMultiplyDefinedPrintf(const char *format, const char *extraArg, ...)
+{
+	// ...
+}
+__attribute__((format(printf, 1, 3)))
+void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
+
+void test_custom_printf1()
+{
+  myMultiplyDefinedPrintf("%i", "%s", 1); // GOOD
+  myMultiplyDefinedPrintf("%i", "%s", 1.0f); // BAD
+  myMultiplyDefinedPrintf2("%i", "%s", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%s", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c
new file mode 100644
index 00000000000..5d21a265ba5
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c	
@@ -0,0 +1,14 @@
+
+__attribute__((format(printf, 2, 3)))
+void myMultiplyDefinedPrintf(const char *extraArg, const char *format, ...); // this declaration does not match the definition
+
+__attribute__((format(printf, 2, 3)))
+void myMultiplyDefinedPrintf2(const char *extraArg, const char *format, ...);
+
+void test_custom_printf2()
+{
+  myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
+  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+}
\ No newline at end of file

From 1cf44493149780c4313179a038c07140024e732f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Sep 2019 14:51:59 +0100
Subject: [PATCH 207/232] CPP: Test for NonConstantFormat with multiple
 definitons.

---
 .../NonConstantFormat.expected                |  8 ++++++++
 .../Likely Bugs/Format/NonConstantFormat/a.c  | 19 +++++++++++++++++++
 .../Likely Bugs/Format/NonConstantFormat/b.c  | 16 ++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
index 837ac3101e7..882c9aa7815 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected	
@@ -1,5 +1,13 @@
 | NonConstantFormat.c:30:10:30:16 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | NonConstantFormat.c:41:9:41:27 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
+| a.c:15:37:15:45 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
+| a.c:16:27:16:35 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
+| a.c:17:38:17:46 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
+| a.c:18:28:18:36 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
+| b.c:12:37:12:45 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
+| b.c:13:27:13:35 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
+| b.c:14:38:14:46 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
+| b.c:15:28:15:36 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
 | nested.cpp:21:23:21:26 | fmt0 | The format string argument to snprintf should be constant to prevent security issues and other potential errors. |
 | nested.cpp:79:32:79:38 | call to get_fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
 | nested.cpp:87:18:87:20 | fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
new file mode 100644
index 00000000000..ffb49067469
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
@@ -0,0 +1,19 @@
+
+__attribute__((format(printf, 1, 3)))
+void myMultiplyDefinedPrintf(const char *format, const char *extraArg, ...)
+{
+	// ...
+}
+
+__attribute__((format(printf, 1, 3)))
+void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
+
+char *getString();
+
+void test_custom_printf1()
+{
+  myMultiplyDefinedPrintf("string", getString()); // GOOD [FALSE POSITIVE]
+  myMultiplyDefinedPrintf(getString(), "string"); // BAD
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c
new file mode 100644
index 00000000000..a6ac46932ba
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
@@ -0,0 +1,16 @@
+
+__attribute__((format(printf, 2, 3)))
+void myMultiplyDefinedPrintf(const char *extraArg, const char *format, ...); // this declaration does not match the definition
+
+__attribute__((format(printf, 2, 3)))
+void myMultiplyDefinedPrintf2(const char *extraArg, const char *format, ...);
+
+char *getString();
+
+void test_custom_printf2(char *string)
+{
+  myMultiplyDefinedPrintf("string", getString()); // GOOD [FALSE POSITIVE]
+  myMultiplyDefinedPrintf(getString(), "string"); // BAD
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+}
\ No newline at end of file

From cd3bccf73afb27e1bb182e42f04ae8de81543985 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 20 Sep 2019 16:59:01 +0100
Subject: [PATCH 208/232] CPP: Fix FPs.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 26 ++++++++++++-------
 .../NonConstantFormat.expected                |  8 ------
 .../Likely Bugs/Format/NonConstantFormat/a.c  |  8 +++---
 .../Likely Bugs/Format/NonConstantFormat/b.c  |  8 +++---
 .../WrongTypeFormatArguments.expected         |  4 ---
 .../Linux_signed_chars/a.c                    |  4 +--
 6 files changed, 27 insertions(+), 31 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index bd179fe27cc..e6436a52583 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -8,25 +8,33 @@ import semmle.code.cpp.commons.StringAnalysis
 import semmle.code.cpp.models.interfaces.FormattingFunction
 import semmle.code.cpp.models.implementations.Printf
 
+class PrintfFormatAttribute extends FormatAttribute {
+  PrintfFormatAttribute() {
+    getArchetype() = "printf" or
+    getArchetype() = "__printf__"
+  }
+}
+
 /**
  * A function that can be identified as a `printf` style formatting
  * function by its use of the GNU `format` attribute.
  */
 class AttributeFormattingFunction extends FormattingFunction {
-  FormatAttribute printf_attrib;
-
   override string getCanonicalQLClass() { result = "AttributeFormattingFunction" }
 
   AttributeFormattingFunction() {
-    printf_attrib = getAnAttribute() and
-    (
-      printf_attrib.getArchetype() = "printf" or
-      printf_attrib.getArchetype() = "__printf__"
-    ) and
-    exists(printf_attrib.getFirstFormatArgIndex()) // exclude `vprintf` style format functions
+    exists(PrintfFormatAttribute printf_attrib |
+      printf_attrib = getAnAttribute() and
+      exists(printf_attrib.getFirstFormatArgIndex()) // exclude `vprintf` style format functions
+    )
   }
 
-  override int getFormatParameterIndex() { result = printf_attrib.getFormatIndex() }
+  override int getFormatParameterIndex() {
+    forex(PrintfFormatAttribute printf_attrib |
+      printf_attrib = getAnAttribute() |
+      result = printf_attrib.getFormatIndex()
+    )
+  }
 }
 
 /**
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
index 882c9aa7815..837ac3101e7 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected	
@@ -1,13 +1,5 @@
 | NonConstantFormat.c:30:10:30:16 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
 | NonConstantFormat.c:41:9:41:27 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
-| a.c:15:37:15:45 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
-| a.c:16:27:16:35 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
-| a.c:17:38:17:46 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
-| a.c:18:28:18:36 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
-| b.c:12:37:12:45 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
-| b.c:13:27:13:35 | call to getString | The format string argument to myMultiplyDefinedPrintf should be constant to prevent security issues and other potential errors. |
-| b.c:14:38:14:46 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
-| b.c:15:28:15:36 | call to getString | The format string argument to myMultiplyDefinedPrintf2 should be constant to prevent security issues and other potential errors. |
 | nested.cpp:21:23:21:26 | fmt0 | The format string argument to snprintf should be constant to prevent security issues and other potential errors. |
 | nested.cpp:79:32:79:38 | call to get_fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
 | nested.cpp:87:18:87:20 | fmt | The format string argument to diagnostic should be constant to prevent security issues and other potential errors. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
index ffb49067469..75edda0daef 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
@@ -12,8 +12,8 @@ char *getString();
 
 void test_custom_printf1()
 {
-  myMultiplyDefinedPrintf("string", getString()); // GOOD [FALSE POSITIVE]
-  myMultiplyDefinedPrintf(getString(), "string"); // BAD
-  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
-  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+  myMultiplyDefinedPrintf("string", getString()); // GOOD
+  myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c
index a6ac46932ba..5d5044fb9ee 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
@@ -9,8 +9,8 @@ char *getString();
 
 void test_custom_printf2(char *string)
 {
-  myMultiplyDefinedPrintf("string", getString()); // GOOD [FALSE POSITIVE]
-  myMultiplyDefinedPrintf(getString(), "string"); // BAD
-  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
-  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+  myMultiplyDefinedPrintf("string", getString()); // GOOD
+  myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
 }
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected
index 219c185fa1d..65f4f546976 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
@@ -1,7 +1,3 @@
-| a.c:13:39:13:42 | 1.0 | This argument should be of type 'char *' but is of type 'double' |
-| a.c:13:39:13:42 | 1.0 | This argument should be of type 'int' but is of type 'double' |
-| a.c:15:40:15:43 | 1.0 | This argument should be of type 'char *' but is of type 'double' |
-| a.c:15:40:15:43 | 1.0 | This argument should be of type 'int' but is of type 'double' |
 | format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *' |
 | format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int' |
 | format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double' |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
index 27866e7b9ec..f830c058d91 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
@@ -10,7 +10,7 @@ void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
 void test_custom_printf1()
 {
   myMultiplyDefinedPrintf("%i", "%s", 1); // GOOD
-  myMultiplyDefinedPrintf("%i", "%s", 1.0f); // BAD
+  myMultiplyDefinedPrintf("%i", "%s", 1.0f); // BAD [NOT DETECTED]
   myMultiplyDefinedPrintf2("%i", "%s", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", "%s", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK) [FALSE POSITIVE]
+  myMultiplyDefinedPrintf2("%i", "%s", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
 }

From 0063fa29749e6440fbeaed169aad33765b9b25da Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 20 Sep 2019 18:21:50 +0100
Subject: [PATCH 209/232] CPP: Change note.

---
 change-notes/1.23/analysis-cpp.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index 2c1f53bbc38..d620b9761d0 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -23,6 +23,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
 | Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
 | Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
+| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
 
 ## Changes to libraries
 

From 73b55f019def6e832fa94a4dae81c26f92ecf0b7 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Sep 2019 16:42:13 +0100
Subject: [PATCH 210/232] CPP: Autoformat.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index e6436a52583..3ad27fa0394 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -30,8 +30,7 @@ class AttributeFormattingFunction extends FormattingFunction {
   }
 
   override int getFormatParameterIndex() {
-    forex(PrintfFormatAttribute printf_attrib |
-      printf_attrib = getAnAttribute() |
+    forex(PrintfFormatAttribute printf_attrib | printf_attrib = getAnAttribute() |
       result = printf_attrib.getFormatIndex()
     )
   }

From 821d5061a7ef58e4f76ca5636c10ebf85225f312 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 8 Nov 2019 12:30:24 +0000
Subject: [PATCH 211/232] CPP: Correct the tests.

---
 .../WrongTypeFormatArguments/Linux_signed_chars/a.c       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
index f830c058d91..84afe8507d5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
@@ -9,8 +9,8 @@ void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
 
 void test_custom_printf1()
 {
-  myMultiplyDefinedPrintf("%i", "%s", 1); // GOOD
-  myMultiplyDefinedPrintf("%i", "%s", 1.0f); // BAD [NOT DETECTED]
-  myMultiplyDefinedPrintf2("%i", "%s", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", "%s", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
+  myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
+  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
 }

From b4fb98dc7c51bd4cb181e5b55cd567478398079d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 8 Nov 2019 15:00:40 +0000
Subject: [PATCH 212/232] CPP: Fix comments.

---
 .../test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c | 4 ++--
 .../test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c | 4 ++--
 .../Format/WrongTypeFormatArguments/Linux_signed_chars/a.c    | 4 ++--
 .../Format/WrongTypeFormatArguments/Linux_signed_chars/b.c    | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
index 75edda0daef..5b31d31b9fb 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c	
@@ -14,6 +14,6 @@ void test_custom_printf1()
 {
   myMultiplyDefinedPrintf("string", getString()); // GOOD
   myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
-  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c
index 5d5044fb9ee..b0addf37881 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c	
@@ -11,6 +11,6 @@ void test_custom_printf2(char *string)
 {
   myMultiplyDefinedPrintf("string", getString()); // GOOD
   myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
-  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
index 84afe8507d5..17d1bd98fed 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c	
@@ -11,6 +11,6 @@ void test_custom_printf1()
 {
   myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
   myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
-  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c
index 5d21a265ba5..adf443c1e9d 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c	
@@ -9,6 +9,6 @@ void test_custom_printf2()
 {
   myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
   myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
-  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
-  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
+  myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
 }
\ No newline at end of file

From d434f909a510bce24f8196ada3df3e1636c0e5cc Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 8 Nov 2019 15:06:45 +0000
Subject: [PATCH 213/232] CPP: Correct change note.

---
 change-notes/1.23/analysis-cpp.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index d620b9761d0..0db9ac88287 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -23,7 +23,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | Too many arguments to formatting function (`cpp/too-many-format-arguments`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
 | Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
 | Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
-| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
+| Non-constant format string (`cpp/non-constant-format`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
 
 ## Changes to libraries
 

From 983a970c3680fbb74d8537688bfd8ef79f5723bc Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 8 Nov 2019 15:59:04 +0000
Subject: [PATCH 214/232] CPP: Autoformat.

---
 .../boostorg/TlsSettingsMisconfiguration.ql   | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql
index 85f4ca1a860..53ad71cb22d 100644
--- a/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
+++ b/cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql	
@@ -14,16 +14,14 @@ class ExistsAnyFlowConfig extends DataFlow::Configuration {
   ExistsAnyFlowConfig() { this = "ExistsAnyFlowConfig" }
 
   override predicate isSource(DataFlow::Node source) {
-  	exists(BoostorgAsio::SslContextClass c |
-  	  c.getAContructorCall() = source.asExpr()
- 	)
+    exists(BoostorgAsio::SslContextClass c | c.getAContructorCall() = source.asExpr())
   }
 
   override predicate isSink(DataFlow::Node sink) {
-  	exists(BoostorgAsio::SslSetOptionsFunction f, FunctionCall fcSetOptions |
-  	  f.getACallToThisFunction() = fcSetOptions and
-  	  fcSetOptions.getQualifier() = sink.asExpr()
-  	)
+    exists(BoostorgAsio::SslSetOptionsFunction f, FunctionCall fcSetOptions |
+      f.getACallToThisFunction() = fcSetOptions and
+      fcSetOptions.getQualifier() = sink.asExpr()
+    )
   }
 }
 
@@ -49,15 +47,12 @@ predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
 
 bindingset[flag]
 predicate isOptionNotSet(ConstructorCall cc, int flag) {
-  not exists(FunctionCall fcSetOptions |
-    isOptionSet(cc, flag, fcSetOptions)
-  )
+  not exists(FunctionCall fcSetOptions | isOptionSet(cc, flag, fcSetOptions))
 }
 
 from
-  BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
-  Expr protocolSource, Expr protocolSink,
-  ConstructorCall cc, Expr e, string msg
+  BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor, Expr protocolSource,
+  Expr protocolSink, ConstructorCall cc, Expr e, string msg
 where
   configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
   cc.getArgument(0) = protocolSink and

From 58b6fc6bbff99cc97932e5d35ed54608ddb7f5bd Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 8 Nov 2019 16:06:23 +0000
Subject: [PATCH 215/232] CPP: Autoformat.

---
 cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
index 73ccd49e2f8..e113d5e5745 100644
--- a/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/boostorg/asio/protocols.qll
@@ -137,7 +137,7 @@ module BoostorgAsio {
 
   /**
    * Gets the value for the no_sslv2 constant, right shifted by 16 bits.
-   * 
+   *
    * Note that modern versions of OpelSSL do not support SSL v2, so this option is for backwards compatibility only.
    */
   int getShiftedSslOptionsNoSsl2() {

From 25eb1d0cc9d30b847465ed5f8080ae890938f291 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Sat, 9 Nov 2019 13:44:55 +0000
Subject: [PATCH 216/232] Update for CodeQL term change and port nav changes

---
 docs/language/global-sphinx-files/_templates/layout.html | 8 ++++----
 docs/language/support/conf.py                            | 2 +-
 docs/language/support/framework-support.rst              | 2 +-
 docs/language/support/index.rst                          | 4 ++--
 docs/language/support/language-support.rst               | 3 ++-
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/docs/language/global-sphinx-files/_templates/layout.html b/docs/language/global-sphinx-files/_templates/layout.html
index d5a714aa5e1..1d5baa659d6 100644
--- a/docs/language/global-sphinx-files/_templates/layout.html
+++ b/docs/language/global-sphinx-files/_templates/layout.html
@@ -59,9 +59,9 @@
             </div>
             <div class="linkcontainer">
                 <div class="linkbar">
-                    <a href="https://help.semmle.com/QL/learn-ql/" target="_blank">Learn QL</a>
-                    <a href="https://help.semmle.com/QL/learn-ql/ql-training.html" target="_blank">QL for variant analysis</a>
-                    <a href="https://help.semmle.com/QL/ql-tools.html" target="_blank">QL tools</a>
+                    <a href="https://help.semmle.com/QL/learn-ql/" target="_blank">Learn CodeQL</a>
+                    <a href="https://help.semmle.com/QL/learn-ql/ql-training.html" target="_blank">Variant analysis</a>
+                    <a href="https://help.semmle.com/QL/ql-tools.html" target="_blank">Tools</a>
                     <a href="https://help.semmle.com/QL/ql-explore-queries.html" target="_blank">Queries</a>
                     <a href="https://help.semmle.com/QL/ql-reference-topics.html" target="_blank">Reference</a>
                     <a href="https://blog.semmle.com" target="_blank">Blog</a>
@@ -77,7 +77,7 @@
 <div class="wrapper">
     
     <div class="navBox" >
-         <p>Start writing QL in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
+         <p>Start writing queries in the <a href="https://lgtm.com/query">Query console</a> on <a href="https://lgtm.com">LGTM.com</a>.</p>
              
          <div id="searchbox" style="display: none" role="search">
                 <h3>Quick search</h3>
diff --git a/docs/language/support/conf.py b/docs/language/support/conf.py
index 2e4bbf46d64..30d7b1a3028 100644
--- a/docs/language/support/conf.py
+++ b/docs/language/support/conf.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# QL and LGTM support info build configuration file, created 
+# CodeQL and LGTM support info build configuration file, created 
 # on Tuesday 19th February.
 #
 # This file is execfile()d with the current directory set to its
diff --git a/docs/language/support/framework-support.rst b/docs/language/support/framework-support.rst
index dc1995f9345..3e3cb8557af 100644
--- a/docs/language/support/framework-support.rst
+++ b/docs/language/support/framework-support.rst
@@ -1,7 +1,7 @@
 Frameworks and libraries
 ########################
 
-The QL libraries and queries in version |version| have been explicitly checked against the libraries and frameworks listed below.
+The libraries and queries in version |version| have been explicitly checked against the libraries and frameworks listed below.
 
 .. pull-quote::
 
diff --git a/docs/language/support/index.rst b/docs/language/support/index.rst
index 5fee43da196..6236b4c1543 100644
--- a/docs/language/support/index.rst
+++ b/docs/language/support/index.rst
@@ -1,7 +1,7 @@
 Supported languages and frameworks
 ##################################
 
-These pages describe the languages and frameworks supported in the latest enterprise release of QL and LGTM. 
+These pages describe the languages and frameworks supported in the latest enterprise release of CodeQL and LGTM. (CodeQL was previously known as QL.) 
 Users of `LGTM.com <https://lgtm.com/>`_ may find that additional features are supported because it's updated more frequently.
 
 For details see:
@@ -11,4 +11,4 @@ For details see:
   language-support.rst
   framework-support.rst
 
-For details of the QL libraries, see `QL standard libraries <https://help.semmle.com/QL/ql-libraries.html>`_.
\ No newline at end of file
+For details of the CodeQL libraries, see `CodeQL standard libraries <https://help.semmle.com/QL/ql-libraries.html>`_.
\ No newline at end of file
diff --git a/docs/language/support/language-support.rst b/docs/language/support/language-support.rst
index 9fa1e60e05d..d4b1b95ba2e 100644
--- a/docs/language/support/language-support.rst
+++ b/docs/language/support/language-support.rst
@@ -1,7 +1,8 @@
 Languages and compilers
 #######################
 
-QL and LGTM version |version| support analysis of the following languages compiled by the following compilers.
+CodeQL and LGTM version |version| support analysis of the following languages compiled by the following compilers.
+(CodeQL was previously known as QL.)
 
 Note that where there are several versions or dialects of a language, the supported variants are listed.
 If your code requires a particular version of a compiler, check that this version is included below. 

From 279fc16b60c6d5e5578ab2485a70dd644397100f Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@knef.dk>
Date: Sun, 10 Nov 2019 10:35:53 +0100
Subject: [PATCH 217/232] C++: ConvertToBase -> ConvertToNonVirtualBase

This rename was done with

    perl -p -i -e's/ConvertToBase/ConvertToNonVirtualBase/g' **/*.ql* **/*.expected

followed by re-running the affected tests.
---
 .../ir/dataflow/internal/DataFlowDispatch.qll |    4 +-
 .../code/cpp/ir/implementation/Opcode.qll     |    6 +-
 .../aliased_ssa/Instruction.qll               |    4 +-
 .../aliased_ssa/internal/AliasAnalysis.qll    |    2 +-
 .../cpp/ir/implementation/raw/Instruction.qll |    4 +-
 .../raw/internal/TranslatedExpr.qll           |    2 +-
 .../raw/internal/TranslatedInitialization.qll |    2 +-
 .../unaliased_ssa/Instruction.qll             |    4 +-
 .../unaliased_ssa/internal/AliasAnalysis.qll  |    2 +-
 .../ir/escape/points_to.expected              |   12 +-
 .../test/library-tests/ir/ir/raw_ir.expected  | 1204 ++++++++---------
 .../GlobalValueNumbering/ir_gvn.expected      |   64 +-
 .../code/csharp/ir/implementation/Opcode.qll  |    6 +-
 .../ir/implementation/raw/Instruction.qll     |    4 +-
 .../unaliased_ssa/Instruction.qll             |    4 +-
 .../unaliased_ssa/internal/AliasAnalysis.qll  |    2 +-
 16 files changed, 651 insertions(+), 675 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index 9572639de59..d149f33e55e 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -57,13 +57,13 @@ private predicate overrideMayAffectCall(
  * should usually be fewer classes than calls.
  *
  * If a value is cast several classes up in the hierarchy, that will be modeled
- * as a chain of `ConvertToBaseInstruction`s and will cause the search to start
+ * as a chain of `ConvertToNonVirtualBaseInstruction`s and will cause the search to start
  * from each of them and pass through subsequent ones. There might be
  * performance to gain by stopping before a second upcast and reconstructing
  * the full chain in a "big-step" recursion after this one.
  */
 private predicate nodeMayHaveClass(Class derived, DataFlow::Node node) {
-  exists(ConvertToBaseInstruction toBase |
+  exists(ConvertToNonVirtualBaseInstruction toBase |
     derived = toBase.getDerivedClass() and
     overrideMayAffectCall(derived, _, toBase.getEnclosingFunction(), _, _) and
     node.asInstruction() = toBase
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
index eb07be7f30c..4e3039b933e 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
@@ -34,7 +34,7 @@ private newtype TOpcode =
   TPointerSub() or
   TPointerDiff() or
   TConvert() or
-  TConvertToBase() or
+  TConvertToNonVirtualBase() or
   TConvertToVirtualBase() or
   TConvertToDerived() or
   TCheckedConvertOrNull() or
@@ -302,8 +302,8 @@ module Opcode {
     final override string toString() { result = "Convert" }
   }
 
-  class ConvertToBase extends UnaryOpcode, TConvertToBase {
-    final override string toString() { result = "ConvertToBase" }
+  class ConvertToNonVirtualBase extends UnaryOpcode, TConvertToNonVirtualBase {
+    final override string toString() { result = "ConvertToNonVirtualBase" }
   }
 
   class ConvertToVirtualBase extends UnaryOpcode, TConvertToVirtualBase {
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
index 9f7cf68b065..4bdeedf2334 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -980,8 +980,8 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToBaseInstruction extends InheritanceConversionInstruction {
-  ConvertToBaseInstruction() { getOpcode() instanceof Opcode::ConvertToBase }
+class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
index 0923ec8f994..6ecfd1470bb 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -109,7 +109,7 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
     instr = operand.getUse() and
     (
       // Converting to a non-virtual base class adds the offset of the base class.
-      exists(ConvertToBaseInstruction convert |
+      exists(ConvertToNonVirtualBaseInstruction convert |
         convert = instr and
         bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
       )
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
index 9f7cf68b065..4bdeedf2334 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -980,8 +980,8 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToBaseInstruction extends InheritanceConversionInstruction {
-  ConvertToBaseInstruction() { getOpcode() instanceof Opcode::ConvertToBase }
+class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
index c9806cd03c8..9db42c742ac 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -1038,7 +1038,7 @@ class TranslatedInheritanceConversion extends TranslatedSingleInstructionConvers
     then
       if expr.(BaseClassConversion).isVirtual()
       then result instanceof Opcode::ConvertToVirtualBase
-      else result instanceof Opcode::ConvertToBase
+      else result instanceof Opcode::ConvertToNonVirtualBase
     else result instanceof Opcode::ConvertToDerived
   }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
index c6911a048c7..609f8276640 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
@@ -752,7 +752,7 @@ abstract class TranslatedBaseStructorCall extends TranslatedStructorCallFromStru
 
   final override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
     tag = OnlyInstructionTag() and
-    opcode instanceof Opcode::ConvertToBase and
+    opcode instanceof Opcode::ConvertToNonVirtualBase and
     resultType = getTypeForGLValue(call.getTarget().getDeclaringType())
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
index 9f7cf68b065..4bdeedf2334 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -980,8 +980,8 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToBaseInstruction extends InheritanceConversionInstruction {
-  ConvertToBaseInstruction() { getOpcode() instanceof Opcode::ConvertToBase }
+class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 0923ec8f994..6ecfd1470bb 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -109,7 +109,7 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
     instr = operand.getUse() and
     (
       // Converting to a non-virtual base class adds the offset of the base class.
-      exists(ConvertToBaseInstruction convert |
+      exists(ConvertToNonVirtualBaseInstruction convert |
         convert = instr and
         bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
       )
diff --git a/cpp/ql/test/library-tests/ir/escape/points_to.expected b/cpp/ql/test/library-tests/ir/escape/points_to.expected
index c58d97f7988..ac518b5dd79 100644
--- a/cpp/ql/test/library-tests/ir/escape/points_to.expected
+++ b/cpp/ql/test/library-tests/ir/escape/points_to.expected
@@ -35,15 +35,15 @@
 | escape.cpp:146:5:146:18 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:7:146:17 | CopyValue | no_Point+8:0 | no_Point+8:0 |
 | escape.cpp:146:17:146:17 | FieldAddress[z] | no_Point+8:0 | no_Point+8:0 |
-| escape.cpp:149:5:149:14 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
-| escape.cpp:149:5:149:14 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
+| escape.cpp:149:5:149:14 | ConvertToNonVirtualBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
+| escape.cpp:149:5:149:14 | ConvertToNonVirtualBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:149:16:149:16 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
-| escape.cpp:150:18:150:27 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
-| escape.cpp:150:18:150:27 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
+| escape.cpp:150:18:150:27 | ConvertToNonVirtualBase[Derived : Intermediate1] | no_Derived+0:0 | no_Derived+0:0 |
+| escape.cpp:150:18:150:27 | ConvertToNonVirtualBase[Intermediate1 : Base] | no_Derived+0:0 | no_Derived+0:0 |
 | escape.cpp:150:29:150:29 | FieldAddress[b] | no_Derived+0:0 | no_Derived+0:0 |
-| escape.cpp:151:5:151:14 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
+| escape.cpp:151:5:151:14 | ConvertToNonVirtualBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
 | escape.cpp:151:16:151:17 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
-| escape.cpp:152:19:152:28 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
+| escape.cpp:152:19:152:28 | ConvertToNonVirtualBase[Derived : Intermediate2] | no_Derived+12:0 | no_Derived+12:0 |
 | escape.cpp:152:30:152:31 | FieldAddress[i2] | no_Derived+16:0 | no_Derived+16:0 |
 | escape.cpp:155:17:155:30 | CopyValue | no_ssa_addrOf+0:0 | no_ssa_addrOf+0:0 |
 | escape.cpp:155:17:155:30 | Store | no_ssa_addrOf+0:0 | no_ssa_addrOf+0:0 |
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index ee8bae8f6c1..5078a471b2b 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -1,28 +1,4 @@
 bad_asts.cpp:
-#    9| int Bad::S::MemberFunction<int 6>(int)
-#    9|   Block 0
-#    9|     v0_0(void)        = EnterFunction            : 
-#    9|     mu0_1(unknown)    = AliasedDefinition        : 
-#    9|     mu0_2(unknown)    = UnmodeledDefinition      : 
-#    9|     r0_3(glval<S>)    = InitializeThis           : 
-#    9|     r0_4(glval<int>)  = VariableAddress[y]       : 
-#    9|     mu0_5(int)        = InitializeParameter[y]   : &:r0_4
-#   10|     r0_6(glval<int>)  = VariableAddress[#return] : 
-#   10|     r0_7(int)         = Constant[6]              : 
-#-----|     r0_8(S *)         = CopyValue                : r0_3
-#   10|     r0_9(glval<int>)  = FieldAddress[x]          : r0_8
-#   10|     r0_10(int)        = Load                     : &:r0_9, ~mu0_2
-#   10|     r0_11(int)        = Add                      : r0_7, r0_10
-#   10|     r0_12(glval<int>) = VariableAddress[y]       : 
-#   10|     r0_13(int)        = Load                     : &:r0_12, ~mu0_2
-#   10|     r0_14(int)        = Add                      : r0_11, r0_13
-#   10|     mu0_15(int)       = Store                    : &:r0_6, r0_14
-#    9|     r0_16(glval<int>) = VariableAddress[#return] : 
-#    9|     v0_17(void)       = ReturnValue              : &:r0_16, ~mu0_2
-#    9|     v0_18(void)       = UnmodeledUse             : mu*
-#    9|     v0_19(void)       = AliasedUse               : ~mu0_2
-#    9|     v0_20(void)       = ExitFunction             : 
-
 #   14| void Bad::CallBadMemberFunction()
 #   14|   Block 0
 #   14|     v0_0(void)           = EnterFunction                   : 
@@ -3478,606 +3454,606 @@ ir.cpp:
 
 #  754| Middle& Middle::operator=(Middle const&)
 #  754|   Block 0
-#  754|     v0_0(void)             = EnterFunction                   : 
-#  754|     mu0_1(unknown)         = AliasedDefinition               : 
-#  754|     mu0_2(unknown)         = UnmodeledDefinition             : 
-#  754|     r0_3(glval<Middle>)    = InitializeThis                  : 
-#-----|     r0_4(glval<Middle &>)  = VariableAddress[p#0]            : 
-#-----|     mu0_5(Middle &)        = InitializeParameter[p#0]        : &:r0_4
-#-----|     r0_6(Middle *)         = CopyValue                       : r0_3
-#-----|     r0_7(Base *)           = ConvertToBase[Middle : Base]    : r0_6
-#  754|     r0_8(glval<unknown>)   = FunctionAddress[operator=]      : 
-#-----|     r0_9(glval<Middle &>)  = VariableAddress[p#0]            : 
-#-----|     r0_10(Middle &)        = Load                            : &:r0_9, ~mu0_2
-#-----|     r0_11(glval<Middle>)   = CopyValue                       : r0_10
-#-----|     r0_12(Middle *)        = CopyValue                       : r0_11
-#-----|     r0_13(Base *)          = ConvertToBase[Middle : Base]    : r0_12
-#-----|     r0_14(glval<Base>)     = CopyValue                       : r0_13
-#-----|     r0_15(Base &)          = CopyValue                       : r0_14
-#  754|     r0_16(Base &)          = Call                            : func:r0_8, this:r0_7, 0:r0_15
-#  754|     mu0_17(unknown)        = ^CallSideEffect                 : ~mu0_2
-#-----|     v0_18(void)            = ^BufferReadSideEffect[-1]       : &:r0_7, ~mu0_2
-#-----|     v0_19(void)            = ^BufferReadSideEffect[0]        : &:r0_15, ~mu0_2
-#-----|     mu0_20(Base)           = ^IndirectMayWriteSideEffect[-1] : &:r0_7
-#-----|     mu0_21(unknown)        = ^BufferMayWriteSideEffect[0]    : &:r0_15
-#-----|     r0_22(glval<Base>)     = CopyValue                       : r0_16
-#-----|     r0_23(Middle *)        = CopyValue                       : r0_3
-#-----|     r0_24(glval<String>)   = FieldAddress[middle_s]          : r0_23
-#-----|     r0_25(String *)        = CopyValue                       : r0_24
-#  754|     r0_26(glval<unknown>)  = FunctionAddress[operator=]      : 
-#-----|     r0_27(glval<Middle &>) = VariableAddress[p#0]            : 
-#-----|     r0_28(Middle &)        = Load                            : &:r0_27, ~mu0_2
-#-----|     r0_29(glval<Middle>)   = CopyValue                       : r0_28
-#-----|     r0_30(glval<String>)   = FieldAddress[middle_s]          : r0_29
-#-----|     r0_31(String &)        = CopyValue                       : r0_30
-#  754|     r0_32(String &)        = Call                            : func:r0_26, this:r0_25, 0:r0_31
-#  754|     mu0_33(unknown)        = ^CallSideEffect                 : ~mu0_2
-#-----|     v0_34(void)            = ^BufferReadSideEffect[-1]       : &:r0_25, ~mu0_2
-#-----|     v0_35(void)            = ^BufferReadSideEffect[0]        : &:r0_31, ~mu0_2
-#-----|     mu0_36(String)         = ^IndirectMayWriteSideEffect[-1] : &:r0_25
-#-----|     mu0_37(unknown)        = ^BufferMayWriteSideEffect[0]    : &:r0_31
-#-----|     r0_38(glval<String>)   = CopyValue                       : r0_32
-#-----|     r0_39(glval<Middle &>) = VariableAddress[#return]        : 
-#-----|     r0_40(Middle *)        = CopyValue                       : r0_3
-#-----|     r0_41(glval<Middle>)   = CopyValue                       : r0_40
-#-----|     r0_42(Middle &)        = CopyValue                       : r0_41
-#-----|     mu0_43(Middle &)       = Store                           : &:r0_39, r0_42
-#  754|     r0_44(glval<Middle &>) = VariableAddress[#return]        : 
-#  754|     v0_45(void)            = ReturnValue                     : &:r0_44, ~mu0_2
-#  754|     v0_46(void)            = UnmodeledUse                    : mu*
-#  754|     v0_47(void)            = AliasedUse                      : ~mu0_2
-#  754|     v0_48(void)            = ExitFunction                    : 
+#  754|     v0_0(void)             = EnterFunction                          : 
+#  754|     mu0_1(unknown)         = AliasedDefinition                      : 
+#  754|     mu0_2(unknown)         = UnmodeledDefinition                    : 
+#  754|     r0_3(glval<Middle>)    = InitializeThis                         : 
+#-----|     r0_4(glval<Middle &>)  = VariableAddress[p#0]                   : 
+#-----|     mu0_5(Middle &)        = InitializeParameter[p#0]               : &:r0_4
+#-----|     r0_6(Middle *)         = CopyValue                              : r0_3
+#-----|     r0_7(Base *)           = ConvertToNonVirtualBase[Middle : Base] : r0_6
+#  754|     r0_8(glval<unknown>)   = FunctionAddress[operator=]             : 
+#-----|     r0_9(glval<Middle &>)  = VariableAddress[p#0]                   : 
+#-----|     r0_10(Middle &)        = Load                                   : &:r0_9, ~mu0_2
+#-----|     r0_11(glval<Middle>)   = CopyValue                              : r0_10
+#-----|     r0_12(Middle *)        = CopyValue                              : r0_11
+#-----|     r0_13(Base *)          = ConvertToNonVirtualBase[Middle : Base] : r0_12
+#-----|     r0_14(glval<Base>)     = CopyValue                              : r0_13
+#-----|     r0_15(Base &)          = CopyValue                              : r0_14
+#  754|     r0_16(Base &)          = Call                                   : func:r0_8, this:r0_7, 0:r0_15
+#  754|     mu0_17(unknown)        = ^CallSideEffect                        : ~mu0_2
+#-----|     v0_18(void)            = ^BufferReadSideEffect[-1]              : &:r0_7, ~mu0_2
+#-----|     v0_19(void)            = ^BufferReadSideEffect[0]               : &:r0_15, ~mu0_2
+#-----|     mu0_20(Base)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_7
+#-----|     mu0_21(unknown)        = ^BufferMayWriteSideEffect[0]           : &:r0_15
+#-----|     r0_22(glval<Base>)     = CopyValue                              : r0_16
+#-----|     r0_23(Middle *)        = CopyValue                              : r0_3
+#-----|     r0_24(glval<String>)   = FieldAddress[middle_s]                 : r0_23
+#-----|     r0_25(String *)        = CopyValue                              : r0_24
+#  754|     r0_26(glval<unknown>)  = FunctionAddress[operator=]             : 
+#-----|     r0_27(glval<Middle &>) = VariableAddress[p#0]                   : 
+#-----|     r0_28(Middle &)        = Load                                   : &:r0_27, ~mu0_2
+#-----|     r0_29(glval<Middle>)   = CopyValue                              : r0_28
+#-----|     r0_30(glval<String>)   = FieldAddress[middle_s]                 : r0_29
+#-----|     r0_31(String &)        = CopyValue                              : r0_30
+#  754|     r0_32(String &)        = Call                                   : func:r0_26, this:r0_25, 0:r0_31
+#  754|     mu0_33(unknown)        = ^CallSideEffect                        : ~mu0_2
+#-----|     v0_34(void)            = ^BufferReadSideEffect[-1]              : &:r0_25, ~mu0_2
+#-----|     v0_35(void)            = ^BufferReadSideEffect[0]               : &:r0_31, ~mu0_2
+#-----|     mu0_36(String)         = ^IndirectMayWriteSideEffect[-1]        : &:r0_25
+#-----|     mu0_37(unknown)        = ^BufferMayWriteSideEffect[0]           : &:r0_31
+#-----|     r0_38(glval<String>)   = CopyValue                              : r0_32
+#-----|     r0_39(glval<Middle &>) = VariableAddress[#return]               : 
+#-----|     r0_40(Middle *)        = CopyValue                              : r0_3
+#-----|     r0_41(glval<Middle>)   = CopyValue                              : r0_40
+#-----|     r0_42(Middle &)        = CopyValue                              : r0_41
+#-----|     mu0_43(Middle &)       = Store                                  : &:r0_39, r0_42
+#  754|     r0_44(glval<Middle &>) = VariableAddress[#return]               : 
+#  754|     v0_45(void)            = ReturnValue                            : &:r0_44, ~mu0_2
+#  754|     v0_46(void)            = UnmodeledUse                           : mu*
+#  754|     v0_47(void)            = AliasedUse                             : ~mu0_2
+#  754|     v0_48(void)            = ExitFunction                           : 
 
 #  757| void Middle::Middle()
 #  757|   Block 0
-#  757|     v0_0(void)           = EnterFunction                : 
-#  757|     mu0_1(unknown)       = AliasedDefinition            : 
-#  757|     mu0_2(unknown)       = UnmodeledDefinition          : 
-#  757|     r0_3(glval<Middle>)  = InitializeThis               : 
-#  757|     r0_4(glval<Base>)    = ConvertToBase[Middle : Base] : r0_3
-#  757|     r0_5(glval<unknown>) = FunctionAddress[Base]        : 
-#  757|     v0_6(void)           = Call                         : func:r0_5, this:r0_4
-#  757|     mu0_7(unknown)       = ^CallSideEffect              : ~mu0_2
-#  757|     r0_8(glval<String>)  = FieldAddress[middle_s]       : r0_3
-#  757|     r0_9(glval<unknown>) = FunctionAddress[String]      : 
-#  757|     v0_10(void)          = Call                         : func:r0_9, this:r0_8
-#  757|     mu0_11(unknown)      = ^CallSideEffect              : ~mu0_2
-#  758|     v0_12(void)          = NoOp                         : 
-#  757|     v0_13(void)          = ReturnVoid                   : 
-#  757|     v0_14(void)          = UnmodeledUse                 : mu*
-#  757|     v0_15(void)          = AliasedUse                   : ~mu0_2
-#  757|     v0_16(void)          = ExitFunction                 : 
+#  757|     v0_0(void)           = EnterFunction                          : 
+#  757|     mu0_1(unknown)       = AliasedDefinition                      : 
+#  757|     mu0_2(unknown)       = UnmodeledDefinition                    : 
+#  757|     r0_3(glval<Middle>)  = InitializeThis                         : 
+#  757|     r0_4(glval<Base>)    = ConvertToNonVirtualBase[Middle : Base] : r0_3
+#  757|     r0_5(glval<unknown>) = FunctionAddress[Base]                  : 
+#  757|     v0_6(void)           = Call                                   : func:r0_5, this:r0_4
+#  757|     mu0_7(unknown)       = ^CallSideEffect                        : ~mu0_2
+#  757|     r0_8(glval<String>)  = FieldAddress[middle_s]                 : r0_3
+#  757|     r0_9(glval<unknown>) = FunctionAddress[String]                : 
+#  757|     v0_10(void)          = Call                                   : func:r0_9, this:r0_8
+#  757|     mu0_11(unknown)      = ^CallSideEffect                        : ~mu0_2
+#  758|     v0_12(void)          = NoOp                                   : 
+#  757|     v0_13(void)          = ReturnVoid                             : 
+#  757|     v0_14(void)          = UnmodeledUse                           : mu*
+#  757|     v0_15(void)          = AliasedUse                             : ~mu0_2
+#  757|     v0_16(void)          = ExitFunction                           : 
 
 #  759| void Middle::~Middle()
 #  759|   Block 0
-#  759|     v0_0(void)            = EnterFunction                : 
-#  759|     mu0_1(unknown)        = AliasedDefinition            : 
-#  759|     mu0_2(unknown)        = UnmodeledDefinition          : 
-#  759|     r0_3(glval<Middle>)   = InitializeThis               : 
-#  760|     v0_4(void)            = NoOp                         : 
-#  760|     r0_5(glval<String>)   = FieldAddress[middle_s]       : r0_3
-#  760|     r0_6(glval<unknown>)  = FunctionAddress[~String]     : 
-#  760|     v0_7(void)            = Call                         : func:r0_6, this:r0_5
-#  760|     mu0_8(unknown)        = ^CallSideEffect              : ~mu0_2
-#  760|     r0_9(glval<Base>)     = ConvertToBase[Middle : Base] : r0_3
-#  760|     r0_10(glval<unknown>) = FunctionAddress[~Base]       : 
-#  760|     v0_11(void)           = Call                         : func:r0_10, this:r0_9
-#  760|     mu0_12(unknown)       = ^CallSideEffect              : ~mu0_2
-#  759|     v0_13(void)           = ReturnVoid                   : 
-#  759|     v0_14(void)           = UnmodeledUse                 : mu*
-#  759|     v0_15(void)           = AliasedUse                   : ~mu0_2
-#  759|     v0_16(void)           = ExitFunction                 : 
+#  759|     v0_0(void)            = EnterFunction                          : 
+#  759|     mu0_1(unknown)        = AliasedDefinition                      : 
+#  759|     mu0_2(unknown)        = UnmodeledDefinition                    : 
+#  759|     r0_3(glval<Middle>)   = InitializeThis                         : 
+#  760|     v0_4(void)            = NoOp                                   : 
+#  760|     r0_5(glval<String>)   = FieldAddress[middle_s]                 : r0_3
+#  760|     r0_6(glval<unknown>)  = FunctionAddress[~String]               : 
+#  760|     v0_7(void)            = Call                                   : func:r0_6, this:r0_5
+#  760|     mu0_8(unknown)        = ^CallSideEffect                        : ~mu0_2
+#  760|     r0_9(glval<Base>)     = ConvertToNonVirtualBase[Middle : Base] : r0_3
+#  760|     r0_10(glval<unknown>) = FunctionAddress[~Base]                 : 
+#  760|     v0_11(void)           = Call                                   : func:r0_10, this:r0_9
+#  760|     mu0_12(unknown)       = ^CallSideEffect                        : ~mu0_2
+#  759|     v0_13(void)           = ReturnVoid                             : 
+#  759|     v0_14(void)           = UnmodeledUse                           : mu*
+#  759|     v0_15(void)           = AliasedUse                             : ~mu0_2
+#  759|     v0_16(void)           = ExitFunction                           : 
 
 #  763| Derived& Derived::operator=(Derived const&)
 #  763|   Block 0
-#  763|     v0_0(void)              = EnterFunction                   : 
-#  763|     mu0_1(unknown)          = AliasedDefinition               : 
-#  763|     mu0_2(unknown)          = UnmodeledDefinition             : 
-#  763|     r0_3(glval<Derived>)    = InitializeThis                  : 
-#-----|     r0_4(glval<Derived &>)  = VariableAddress[p#0]            : 
-#-----|     mu0_5(Derived &)        = InitializeParameter[p#0]        : &:r0_4
-#-----|     r0_6(Derived *)         = CopyValue                       : r0_3
-#-----|     r0_7(Middle *)          = ConvertToBase[Derived : Middle] : r0_6
-#  763|     r0_8(glval<unknown>)    = FunctionAddress[operator=]      : 
-#-----|     r0_9(glval<Derived &>)  = VariableAddress[p#0]            : 
-#-----|     r0_10(Derived &)        = Load                            : &:r0_9, ~mu0_2
-#-----|     r0_11(glval<Derived>)   = CopyValue                       : r0_10
-#-----|     r0_12(Derived *)        = CopyValue                       : r0_11
-#-----|     r0_13(Middle *)         = ConvertToBase[Derived : Middle] : r0_12
-#-----|     r0_14(glval<Middle>)    = CopyValue                       : r0_13
-#-----|     r0_15(Middle &)         = CopyValue                       : r0_14
-#  763|     r0_16(Middle &)         = Call                            : func:r0_8, this:r0_7, 0:r0_15
-#  763|     mu0_17(unknown)         = ^CallSideEffect                 : ~mu0_2
-#-----|     v0_18(void)             = ^BufferReadSideEffect[-1]       : &:r0_7, ~mu0_2
-#-----|     v0_19(void)             = ^BufferReadSideEffect[0]        : &:r0_15, ~mu0_2
-#-----|     mu0_20(Middle)          = ^IndirectMayWriteSideEffect[-1] : &:r0_7
-#-----|     mu0_21(unknown)         = ^BufferMayWriteSideEffect[0]    : &:r0_15
-#-----|     r0_22(glval<Middle>)    = CopyValue                       : r0_16
-#-----|     r0_23(Derived *)        = CopyValue                       : r0_3
-#-----|     r0_24(glval<String>)    = FieldAddress[derived_s]         : r0_23
-#-----|     r0_25(String *)         = CopyValue                       : r0_24
-#  763|     r0_26(glval<unknown>)   = FunctionAddress[operator=]      : 
-#-----|     r0_27(glval<Derived &>) = VariableAddress[p#0]            : 
-#-----|     r0_28(Derived &)        = Load                            : &:r0_27, ~mu0_2
-#-----|     r0_29(glval<Derived>)   = CopyValue                       : r0_28
-#-----|     r0_30(glval<String>)    = FieldAddress[derived_s]         : r0_29
-#-----|     r0_31(String &)         = CopyValue                       : r0_30
-#  763|     r0_32(String &)         = Call                            : func:r0_26, this:r0_25, 0:r0_31
-#  763|     mu0_33(unknown)         = ^CallSideEffect                 : ~mu0_2
-#-----|     v0_34(void)             = ^BufferReadSideEffect[-1]       : &:r0_25, ~mu0_2
-#-----|     v0_35(void)             = ^BufferReadSideEffect[0]        : &:r0_31, ~mu0_2
-#-----|     mu0_36(String)          = ^IndirectMayWriteSideEffect[-1] : &:r0_25
-#-----|     mu0_37(unknown)         = ^BufferMayWriteSideEffect[0]    : &:r0_31
-#-----|     r0_38(glval<String>)    = CopyValue                       : r0_32
-#-----|     r0_39(glval<Derived &>) = VariableAddress[#return]        : 
-#-----|     r0_40(Derived *)        = CopyValue                       : r0_3
-#-----|     r0_41(glval<Derived>)   = CopyValue                       : r0_40
-#-----|     r0_42(Derived &)        = CopyValue                       : r0_41
-#-----|     mu0_43(Derived &)       = Store                           : &:r0_39, r0_42
-#  763|     r0_44(glval<Derived &>) = VariableAddress[#return]        : 
-#  763|     v0_45(void)             = ReturnValue                     : &:r0_44, ~mu0_2
-#  763|     v0_46(void)             = UnmodeledUse                    : mu*
-#  763|     v0_47(void)             = AliasedUse                      : ~mu0_2
-#  763|     v0_48(void)             = ExitFunction                    : 
+#  763|     v0_0(void)              = EnterFunction                             : 
+#  763|     mu0_1(unknown)          = AliasedDefinition                         : 
+#  763|     mu0_2(unknown)          = UnmodeledDefinition                       : 
+#  763|     r0_3(glval<Derived>)    = InitializeThis                            : 
+#-----|     r0_4(glval<Derived &>)  = VariableAddress[p#0]                      : 
+#-----|     mu0_5(Derived &)        = InitializeParameter[p#0]                  : &:r0_4
+#-----|     r0_6(Derived *)         = CopyValue                                 : r0_3
+#-----|     r0_7(Middle *)          = ConvertToNonVirtualBase[Derived : Middle] : r0_6
+#  763|     r0_8(glval<unknown>)    = FunctionAddress[operator=]                : 
+#-----|     r0_9(glval<Derived &>)  = VariableAddress[p#0]                      : 
+#-----|     r0_10(Derived &)        = Load                                      : &:r0_9, ~mu0_2
+#-----|     r0_11(glval<Derived>)   = CopyValue                                 : r0_10
+#-----|     r0_12(Derived *)        = CopyValue                                 : r0_11
+#-----|     r0_13(Middle *)         = ConvertToNonVirtualBase[Derived : Middle] : r0_12
+#-----|     r0_14(glval<Middle>)    = CopyValue                                 : r0_13
+#-----|     r0_15(Middle &)         = CopyValue                                 : r0_14
+#  763|     r0_16(Middle &)         = Call                                      : func:r0_8, this:r0_7, 0:r0_15
+#  763|     mu0_17(unknown)         = ^CallSideEffect                           : ~mu0_2
+#-----|     v0_18(void)             = ^BufferReadSideEffect[-1]                 : &:r0_7, ~mu0_2
+#-----|     v0_19(void)             = ^BufferReadSideEffect[0]                  : &:r0_15, ~mu0_2
+#-----|     mu0_20(Middle)          = ^IndirectMayWriteSideEffect[-1]           : &:r0_7
+#-----|     mu0_21(unknown)         = ^BufferMayWriteSideEffect[0]              : &:r0_15
+#-----|     r0_22(glval<Middle>)    = CopyValue                                 : r0_16
+#-----|     r0_23(Derived *)        = CopyValue                                 : r0_3
+#-----|     r0_24(glval<String>)    = FieldAddress[derived_s]                   : r0_23
+#-----|     r0_25(String *)         = CopyValue                                 : r0_24
+#  763|     r0_26(glval<unknown>)   = FunctionAddress[operator=]                : 
+#-----|     r0_27(glval<Derived &>) = VariableAddress[p#0]                      : 
+#-----|     r0_28(Derived &)        = Load                                      : &:r0_27, ~mu0_2
+#-----|     r0_29(glval<Derived>)   = CopyValue                                 : r0_28
+#-----|     r0_30(glval<String>)    = FieldAddress[derived_s]                   : r0_29
+#-----|     r0_31(String &)         = CopyValue                                 : r0_30
+#  763|     r0_32(String &)         = Call                                      : func:r0_26, this:r0_25, 0:r0_31
+#  763|     mu0_33(unknown)         = ^CallSideEffect                           : ~mu0_2
+#-----|     v0_34(void)             = ^BufferReadSideEffect[-1]                 : &:r0_25, ~mu0_2
+#-----|     v0_35(void)             = ^BufferReadSideEffect[0]                  : &:r0_31, ~mu0_2
+#-----|     mu0_36(String)          = ^IndirectMayWriteSideEffect[-1]           : &:r0_25
+#-----|     mu0_37(unknown)         = ^BufferMayWriteSideEffect[0]              : &:r0_31
+#-----|     r0_38(glval<String>)    = CopyValue                                 : r0_32
+#-----|     r0_39(glval<Derived &>) = VariableAddress[#return]                  : 
+#-----|     r0_40(Derived *)        = CopyValue                                 : r0_3
+#-----|     r0_41(glval<Derived>)   = CopyValue                                 : r0_40
+#-----|     r0_42(Derived &)        = CopyValue                                 : r0_41
+#-----|     mu0_43(Derived &)       = Store                                     : &:r0_39, r0_42
+#  763|     r0_44(glval<Derived &>) = VariableAddress[#return]                  : 
+#  763|     v0_45(void)             = ReturnValue                               : &:r0_44, ~mu0_2
+#  763|     v0_46(void)             = UnmodeledUse                              : mu*
+#  763|     v0_47(void)             = AliasedUse                                : ~mu0_2
+#  763|     v0_48(void)             = ExitFunction                              : 
 
 #  766| void Derived::Derived()
 #  766|   Block 0
-#  766|     v0_0(void)           = EnterFunction                   : 
-#  766|     mu0_1(unknown)       = AliasedDefinition               : 
-#  766|     mu0_2(unknown)       = UnmodeledDefinition             : 
-#  766|     r0_3(glval<Derived>) = InitializeThis                  : 
-#  766|     r0_4(glval<Middle>)  = ConvertToBase[Derived : Middle] : r0_3
-#  766|     r0_5(glval<unknown>) = FunctionAddress[Middle]         : 
-#  766|     v0_6(void)           = Call                            : func:r0_5, this:r0_4
-#  766|     mu0_7(unknown)       = ^CallSideEffect                 : ~mu0_2
-#  766|     r0_8(glval<String>)  = FieldAddress[derived_s]         : r0_3
-#  766|     r0_9(glval<unknown>) = FunctionAddress[String]         : 
-#  766|     v0_10(void)          = Call                            : func:r0_9, this:r0_8
-#  766|     mu0_11(unknown)      = ^CallSideEffect                 : ~mu0_2
-#  767|     v0_12(void)          = NoOp                            : 
-#  766|     v0_13(void)          = ReturnVoid                      : 
-#  766|     v0_14(void)          = UnmodeledUse                    : mu*
-#  766|     v0_15(void)          = AliasedUse                      : ~mu0_2
-#  766|     v0_16(void)          = ExitFunction                    : 
+#  766|     v0_0(void)           = EnterFunction                             : 
+#  766|     mu0_1(unknown)       = AliasedDefinition                         : 
+#  766|     mu0_2(unknown)       = UnmodeledDefinition                       : 
+#  766|     r0_3(glval<Derived>) = InitializeThis                            : 
+#  766|     r0_4(glval<Middle>)  = ConvertToNonVirtualBase[Derived : Middle] : r0_3
+#  766|     r0_5(glval<unknown>) = FunctionAddress[Middle]                   : 
+#  766|     v0_6(void)           = Call                                      : func:r0_5, this:r0_4
+#  766|     mu0_7(unknown)       = ^CallSideEffect                           : ~mu0_2
+#  766|     r0_8(glval<String>)  = FieldAddress[derived_s]                   : r0_3
+#  766|     r0_9(glval<unknown>) = FunctionAddress[String]                   : 
+#  766|     v0_10(void)          = Call                                      : func:r0_9, this:r0_8
+#  766|     mu0_11(unknown)      = ^CallSideEffect                           : ~mu0_2
+#  767|     v0_12(void)          = NoOp                                      : 
+#  766|     v0_13(void)          = ReturnVoid                                : 
+#  766|     v0_14(void)          = UnmodeledUse                              : mu*
+#  766|     v0_15(void)          = AliasedUse                                : ~mu0_2
+#  766|     v0_16(void)          = ExitFunction                              : 
 
 #  768| void Derived::~Derived()
 #  768|   Block 0
-#  768|     v0_0(void)            = EnterFunction                   : 
-#  768|     mu0_1(unknown)        = AliasedDefinition               : 
-#  768|     mu0_2(unknown)        = UnmodeledDefinition             : 
-#  768|     r0_3(glval<Derived>)  = InitializeThis                  : 
-#  769|     v0_4(void)            = NoOp                            : 
-#  769|     r0_5(glval<String>)   = FieldAddress[derived_s]         : r0_3
-#  769|     r0_6(glval<unknown>)  = FunctionAddress[~String]        : 
-#  769|     v0_7(void)            = Call                            : func:r0_6, this:r0_5
-#  769|     mu0_8(unknown)        = ^CallSideEffect                 : ~mu0_2
-#  769|     r0_9(glval<Middle>)   = ConvertToBase[Derived : Middle] : r0_3
-#  769|     r0_10(glval<unknown>) = FunctionAddress[~Middle]        : 
-#  769|     v0_11(void)           = Call                            : func:r0_10, this:r0_9
-#  769|     mu0_12(unknown)       = ^CallSideEffect                 : ~mu0_2
-#  768|     v0_13(void)           = ReturnVoid                      : 
-#  768|     v0_14(void)           = UnmodeledUse                    : mu*
-#  768|     v0_15(void)           = AliasedUse                      : ~mu0_2
-#  768|     v0_16(void)           = ExitFunction                    : 
+#  768|     v0_0(void)            = EnterFunction                             : 
+#  768|     mu0_1(unknown)        = AliasedDefinition                         : 
+#  768|     mu0_2(unknown)        = UnmodeledDefinition                       : 
+#  768|     r0_3(glval<Derived>)  = InitializeThis                            : 
+#  769|     v0_4(void)            = NoOp                                      : 
+#  769|     r0_5(glval<String>)   = FieldAddress[derived_s]                   : r0_3
+#  769|     r0_6(glval<unknown>)  = FunctionAddress[~String]                  : 
+#  769|     v0_7(void)            = Call                                      : func:r0_6, this:r0_5
+#  769|     mu0_8(unknown)        = ^CallSideEffect                           : ~mu0_2
+#  769|     r0_9(glval<Middle>)   = ConvertToNonVirtualBase[Derived : Middle] : r0_3
+#  769|     r0_10(glval<unknown>) = FunctionAddress[~Middle]                  : 
+#  769|     v0_11(void)           = Call                                      : func:r0_10, this:r0_9
+#  769|     mu0_12(unknown)       = ^CallSideEffect                           : ~mu0_2
+#  768|     v0_13(void)           = ReturnVoid                                : 
+#  768|     v0_14(void)           = UnmodeledUse                              : mu*
+#  768|     v0_15(void)           = AliasedUse                                : ~mu0_2
+#  768|     v0_16(void)           = ExitFunction                              : 
 
 #  775| void MiddleVB1::MiddleVB1()
 #  775|   Block 0
-#  775|     v0_0(void)             = EnterFunction                   : 
-#  775|     mu0_1(unknown)         = AliasedDefinition               : 
-#  775|     mu0_2(unknown)         = UnmodeledDefinition             : 
-#  775|     r0_3(glval<MiddleVB1>) = InitializeThis                  : 
-#  775|     r0_4(glval<Base>)      = ConvertToBase[MiddleVB1 : Base] : r0_3
-#  775|     r0_5(glval<unknown>)   = FunctionAddress[Base]           : 
-#  775|     v0_6(void)             = Call                            : func:r0_5, this:r0_4
-#  775|     mu0_7(unknown)         = ^CallSideEffect                 : ~mu0_2
-#  775|     r0_8(glval<String>)    = FieldAddress[middlevb1_s]       : r0_3
-#  775|     r0_9(glval<unknown>)   = FunctionAddress[String]         : 
-#  775|     v0_10(void)            = Call                            : func:r0_9, this:r0_8
-#  775|     mu0_11(unknown)        = ^CallSideEffect                 : ~mu0_2
-#  776|     v0_12(void)            = NoOp                            : 
-#  775|     v0_13(void)            = ReturnVoid                      : 
-#  775|     v0_14(void)            = UnmodeledUse                    : mu*
-#  775|     v0_15(void)            = AliasedUse                      : ~mu0_2
-#  775|     v0_16(void)            = ExitFunction                    : 
+#  775|     v0_0(void)             = EnterFunction                             : 
+#  775|     mu0_1(unknown)         = AliasedDefinition                         : 
+#  775|     mu0_2(unknown)         = UnmodeledDefinition                       : 
+#  775|     r0_3(glval<MiddleVB1>) = InitializeThis                            : 
+#  775|     r0_4(glval<Base>)      = ConvertToNonVirtualBase[MiddleVB1 : Base] : r0_3
+#  775|     r0_5(glval<unknown>)   = FunctionAddress[Base]                     : 
+#  775|     v0_6(void)             = Call                                      : func:r0_5, this:r0_4
+#  775|     mu0_7(unknown)         = ^CallSideEffect                           : ~mu0_2
+#  775|     r0_8(glval<String>)    = FieldAddress[middlevb1_s]                 : r0_3
+#  775|     r0_9(glval<unknown>)   = FunctionAddress[String]                   : 
+#  775|     v0_10(void)            = Call                                      : func:r0_9, this:r0_8
+#  775|     mu0_11(unknown)        = ^CallSideEffect                           : ~mu0_2
+#  776|     v0_12(void)            = NoOp                                      : 
+#  775|     v0_13(void)            = ReturnVoid                                : 
+#  775|     v0_14(void)            = UnmodeledUse                              : mu*
+#  775|     v0_15(void)            = AliasedUse                                : ~mu0_2
+#  775|     v0_16(void)            = ExitFunction                              : 
 
 #  777| void MiddleVB1::~MiddleVB1()
 #  777|   Block 0
-#  777|     v0_0(void)             = EnterFunction                   : 
-#  777|     mu0_1(unknown)         = AliasedDefinition               : 
-#  777|     mu0_2(unknown)         = UnmodeledDefinition             : 
-#  777|     r0_3(glval<MiddleVB1>) = InitializeThis                  : 
-#  778|     v0_4(void)             = NoOp                            : 
-#  778|     r0_5(glval<String>)    = FieldAddress[middlevb1_s]       : r0_3
-#  778|     r0_6(glval<unknown>)   = FunctionAddress[~String]        : 
-#  778|     v0_7(void)             = Call                            : func:r0_6, this:r0_5
-#  778|     mu0_8(unknown)         = ^CallSideEffect                 : ~mu0_2
-#  778|     r0_9(glval<Base>)      = ConvertToBase[MiddleVB1 : Base] : r0_3
-#  778|     r0_10(glval<unknown>)  = FunctionAddress[~Base]          : 
-#  778|     v0_11(void)            = Call                            : func:r0_10, this:r0_9
-#  778|     mu0_12(unknown)        = ^CallSideEffect                 : ~mu0_2
-#  777|     v0_13(void)            = ReturnVoid                      : 
-#  777|     v0_14(void)            = UnmodeledUse                    : mu*
-#  777|     v0_15(void)            = AliasedUse                      : ~mu0_2
-#  777|     v0_16(void)            = ExitFunction                    : 
+#  777|     v0_0(void)             = EnterFunction                             : 
+#  777|     mu0_1(unknown)         = AliasedDefinition                         : 
+#  777|     mu0_2(unknown)         = UnmodeledDefinition                       : 
+#  777|     r0_3(glval<MiddleVB1>) = InitializeThis                            : 
+#  778|     v0_4(void)             = NoOp                                      : 
+#  778|     r0_5(glval<String>)    = FieldAddress[middlevb1_s]                 : r0_3
+#  778|     r0_6(glval<unknown>)   = FunctionAddress[~String]                  : 
+#  778|     v0_7(void)             = Call                                      : func:r0_6, this:r0_5
+#  778|     mu0_8(unknown)         = ^CallSideEffect                           : ~mu0_2
+#  778|     r0_9(glval<Base>)      = ConvertToNonVirtualBase[MiddleVB1 : Base] : r0_3
+#  778|     r0_10(glval<unknown>)  = FunctionAddress[~Base]                    : 
+#  778|     v0_11(void)            = Call                                      : func:r0_10, this:r0_9
+#  778|     mu0_12(unknown)        = ^CallSideEffect                           : ~mu0_2
+#  777|     v0_13(void)            = ReturnVoid                                : 
+#  777|     v0_14(void)            = UnmodeledUse                              : mu*
+#  777|     v0_15(void)            = AliasedUse                                : ~mu0_2
+#  777|     v0_16(void)            = ExitFunction                              : 
 
 #  784| void MiddleVB2::MiddleVB2()
 #  784|   Block 0
-#  784|     v0_0(void)             = EnterFunction                   : 
-#  784|     mu0_1(unknown)         = AliasedDefinition               : 
-#  784|     mu0_2(unknown)         = UnmodeledDefinition             : 
-#  784|     r0_3(glval<MiddleVB2>) = InitializeThis                  : 
-#  784|     r0_4(glval<Base>)      = ConvertToBase[MiddleVB2 : Base] : r0_3
-#  784|     r0_5(glval<unknown>)   = FunctionAddress[Base]           : 
-#  784|     v0_6(void)             = Call                            : func:r0_5, this:r0_4
-#  784|     mu0_7(unknown)         = ^CallSideEffect                 : ~mu0_2
-#  784|     r0_8(glval<String>)    = FieldAddress[middlevb2_s]       : r0_3
-#  784|     r0_9(glval<unknown>)   = FunctionAddress[String]         : 
-#  784|     v0_10(void)            = Call                            : func:r0_9, this:r0_8
-#  784|     mu0_11(unknown)        = ^CallSideEffect                 : ~mu0_2
-#  785|     v0_12(void)            = NoOp                            : 
-#  784|     v0_13(void)            = ReturnVoid                      : 
-#  784|     v0_14(void)            = UnmodeledUse                    : mu*
-#  784|     v0_15(void)            = AliasedUse                      : ~mu0_2
-#  784|     v0_16(void)            = ExitFunction                    : 
+#  784|     v0_0(void)             = EnterFunction                             : 
+#  784|     mu0_1(unknown)         = AliasedDefinition                         : 
+#  784|     mu0_2(unknown)         = UnmodeledDefinition                       : 
+#  784|     r0_3(glval<MiddleVB2>) = InitializeThis                            : 
+#  784|     r0_4(glval<Base>)      = ConvertToNonVirtualBase[MiddleVB2 : Base] : r0_3
+#  784|     r0_5(glval<unknown>)   = FunctionAddress[Base]                     : 
+#  784|     v0_6(void)             = Call                                      : func:r0_5, this:r0_4
+#  784|     mu0_7(unknown)         = ^CallSideEffect                           : ~mu0_2
+#  784|     r0_8(glval<String>)    = FieldAddress[middlevb2_s]                 : r0_3
+#  784|     r0_9(glval<unknown>)   = FunctionAddress[String]                   : 
+#  784|     v0_10(void)            = Call                                      : func:r0_9, this:r0_8
+#  784|     mu0_11(unknown)        = ^CallSideEffect                           : ~mu0_2
+#  785|     v0_12(void)            = NoOp                                      : 
+#  784|     v0_13(void)            = ReturnVoid                                : 
+#  784|     v0_14(void)            = UnmodeledUse                              : mu*
+#  784|     v0_15(void)            = AliasedUse                                : ~mu0_2
+#  784|     v0_16(void)            = ExitFunction                              : 
 
 #  786| void MiddleVB2::~MiddleVB2()
 #  786|   Block 0
-#  786|     v0_0(void)             = EnterFunction                   : 
-#  786|     mu0_1(unknown)         = AliasedDefinition               : 
-#  786|     mu0_2(unknown)         = UnmodeledDefinition             : 
-#  786|     r0_3(glval<MiddleVB2>) = InitializeThis                  : 
-#  787|     v0_4(void)             = NoOp                            : 
-#  787|     r0_5(glval<String>)    = FieldAddress[middlevb2_s]       : r0_3
-#  787|     r0_6(glval<unknown>)   = FunctionAddress[~String]        : 
-#  787|     v0_7(void)             = Call                            : func:r0_6, this:r0_5
-#  787|     mu0_8(unknown)         = ^CallSideEffect                 : ~mu0_2
-#  787|     r0_9(glval<Base>)      = ConvertToBase[MiddleVB2 : Base] : r0_3
-#  787|     r0_10(glval<unknown>)  = FunctionAddress[~Base]          : 
-#  787|     v0_11(void)            = Call                            : func:r0_10, this:r0_9
-#  787|     mu0_12(unknown)        = ^CallSideEffect                 : ~mu0_2
-#  786|     v0_13(void)            = ReturnVoid                      : 
-#  786|     v0_14(void)            = UnmodeledUse                    : mu*
-#  786|     v0_15(void)            = AliasedUse                      : ~mu0_2
-#  786|     v0_16(void)            = ExitFunction                    : 
+#  786|     v0_0(void)             = EnterFunction                             : 
+#  786|     mu0_1(unknown)         = AliasedDefinition                         : 
+#  786|     mu0_2(unknown)         = UnmodeledDefinition                       : 
+#  786|     r0_3(glval<MiddleVB2>) = InitializeThis                            : 
+#  787|     v0_4(void)             = NoOp                                      : 
+#  787|     r0_5(glval<String>)    = FieldAddress[middlevb2_s]                 : r0_3
+#  787|     r0_6(glval<unknown>)   = FunctionAddress[~String]                  : 
+#  787|     v0_7(void)             = Call                                      : func:r0_6, this:r0_5
+#  787|     mu0_8(unknown)         = ^CallSideEffect                           : ~mu0_2
+#  787|     r0_9(glval<Base>)      = ConvertToNonVirtualBase[MiddleVB2 : Base] : r0_3
+#  787|     r0_10(glval<unknown>)  = FunctionAddress[~Base]                    : 
+#  787|     v0_11(void)            = Call                                      : func:r0_10, this:r0_9
+#  787|     mu0_12(unknown)        = ^CallSideEffect                           : ~mu0_2
+#  786|     v0_13(void)            = ReturnVoid                                : 
+#  786|     v0_14(void)            = UnmodeledUse                              : mu*
+#  786|     v0_15(void)            = AliasedUse                                : ~mu0_2
+#  786|     v0_16(void)            = ExitFunction                              : 
 
 #  793| void DerivedVB::DerivedVB()
 #  793|   Block 0
-#  793|     v0_0(void)              = EnterFunction                        : 
-#  793|     mu0_1(unknown)          = AliasedDefinition                    : 
-#  793|     mu0_2(unknown)          = UnmodeledDefinition                  : 
-#  793|     r0_3(glval<DerivedVB>)  = InitializeThis                       : 
-#  793|     r0_4(glval<Base>)       = ConvertToBase[DerivedVB : Base]      : r0_3
-#  793|     r0_5(glval<unknown>)    = FunctionAddress[Base]                : 
-#  793|     v0_6(void)              = Call                                 : func:r0_5, this:r0_4
-#  793|     mu0_7(unknown)          = ^CallSideEffect                      : ~mu0_2
-#  793|     r0_8(glval<MiddleVB1>)  = ConvertToBase[DerivedVB : MiddleVB1] : r0_3
-#  793|     r0_9(glval<unknown>)    = FunctionAddress[MiddleVB1]           : 
-#  793|     v0_10(void)             = Call                                 : func:r0_9, this:r0_8
-#  793|     mu0_11(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  793|     r0_12(glval<MiddleVB2>) = ConvertToBase[DerivedVB : MiddleVB2] : r0_3
-#  793|     r0_13(glval<unknown>)   = FunctionAddress[MiddleVB2]           : 
-#  793|     v0_14(void)             = Call                                 : func:r0_13, this:r0_12
-#  793|     mu0_15(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  793|     r0_16(glval<String>)    = FieldAddress[derivedvb_s]            : r0_3
-#  793|     r0_17(glval<unknown>)   = FunctionAddress[String]              : 
-#  793|     v0_18(void)             = Call                                 : func:r0_17, this:r0_16
-#  793|     mu0_19(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  794|     v0_20(void)             = NoOp                                 : 
-#  793|     v0_21(void)             = ReturnVoid                           : 
-#  793|     v0_22(void)             = UnmodeledUse                         : mu*
-#  793|     v0_23(void)             = AliasedUse                           : ~mu0_2
-#  793|     v0_24(void)             = ExitFunction                         : 
+#  793|     v0_0(void)              = EnterFunction                                  : 
+#  793|     mu0_1(unknown)          = AliasedDefinition                              : 
+#  793|     mu0_2(unknown)          = UnmodeledDefinition                            : 
+#  793|     r0_3(glval<DerivedVB>)  = InitializeThis                                 : 
+#  793|     r0_4(glval<Base>)       = ConvertToNonVirtualBase[DerivedVB : Base]      : r0_3
+#  793|     r0_5(glval<unknown>)    = FunctionAddress[Base]                          : 
+#  793|     v0_6(void)              = Call                                           : func:r0_5, this:r0_4
+#  793|     mu0_7(unknown)          = ^CallSideEffect                                : ~mu0_2
+#  793|     r0_8(glval<MiddleVB1>)  = ConvertToNonVirtualBase[DerivedVB : MiddleVB1] : r0_3
+#  793|     r0_9(glval<unknown>)    = FunctionAddress[MiddleVB1]                     : 
+#  793|     v0_10(void)             = Call                                           : func:r0_9, this:r0_8
+#  793|     mu0_11(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  793|     r0_12(glval<MiddleVB2>) = ConvertToNonVirtualBase[DerivedVB : MiddleVB2] : r0_3
+#  793|     r0_13(glval<unknown>)   = FunctionAddress[MiddleVB2]                     : 
+#  793|     v0_14(void)             = Call                                           : func:r0_13, this:r0_12
+#  793|     mu0_15(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  793|     r0_16(glval<String>)    = FieldAddress[derivedvb_s]                      : r0_3
+#  793|     r0_17(glval<unknown>)   = FunctionAddress[String]                        : 
+#  793|     v0_18(void)             = Call                                           : func:r0_17, this:r0_16
+#  793|     mu0_19(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  794|     v0_20(void)             = NoOp                                           : 
+#  793|     v0_21(void)             = ReturnVoid                                     : 
+#  793|     v0_22(void)             = UnmodeledUse                                   : mu*
+#  793|     v0_23(void)             = AliasedUse                                     : ~mu0_2
+#  793|     v0_24(void)             = ExitFunction                                   : 
 
 #  795| void DerivedVB::~DerivedVB()
 #  795|   Block 0
-#  795|     v0_0(void)              = EnterFunction                        : 
-#  795|     mu0_1(unknown)          = AliasedDefinition                    : 
-#  795|     mu0_2(unknown)          = UnmodeledDefinition                  : 
-#  795|     r0_3(glval<DerivedVB>)  = InitializeThis                       : 
-#  796|     v0_4(void)              = NoOp                                 : 
-#  796|     r0_5(glval<String>)     = FieldAddress[derivedvb_s]            : r0_3
-#  796|     r0_6(glval<unknown>)    = FunctionAddress[~String]             : 
-#  796|     v0_7(void)              = Call                                 : func:r0_6, this:r0_5
-#  796|     mu0_8(unknown)          = ^CallSideEffect                      : ~mu0_2
-#  796|     r0_9(glval<MiddleVB2>)  = ConvertToBase[DerivedVB : MiddleVB2] : r0_3
-#  796|     r0_10(glval<unknown>)   = FunctionAddress[~MiddleVB2]          : 
-#  796|     v0_11(void)             = Call                                 : func:r0_10, this:r0_9
-#  796|     mu0_12(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  796|     r0_13(glval<MiddleVB1>) = ConvertToBase[DerivedVB : MiddleVB1] : r0_3
-#  796|     r0_14(glval<unknown>)   = FunctionAddress[~MiddleVB1]          : 
-#  796|     v0_15(void)             = Call                                 : func:r0_14, this:r0_13
-#  796|     mu0_16(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  796|     r0_17(glval<Base>)      = ConvertToBase[DerivedVB : Base]      : r0_3
-#  796|     r0_18(glval<unknown>)   = FunctionAddress[~Base]               : 
-#  796|     v0_19(void)             = Call                                 : func:r0_18, this:r0_17
-#  796|     mu0_20(unknown)         = ^CallSideEffect                      : ~mu0_2
-#  795|     v0_21(void)             = ReturnVoid                           : 
-#  795|     v0_22(void)             = UnmodeledUse                         : mu*
-#  795|     v0_23(void)             = AliasedUse                           : ~mu0_2
-#  795|     v0_24(void)             = ExitFunction                         : 
+#  795|     v0_0(void)              = EnterFunction                                  : 
+#  795|     mu0_1(unknown)          = AliasedDefinition                              : 
+#  795|     mu0_2(unknown)          = UnmodeledDefinition                            : 
+#  795|     r0_3(glval<DerivedVB>)  = InitializeThis                                 : 
+#  796|     v0_4(void)              = NoOp                                           : 
+#  796|     r0_5(glval<String>)     = FieldAddress[derivedvb_s]                      : r0_3
+#  796|     r0_6(glval<unknown>)    = FunctionAddress[~String]                       : 
+#  796|     v0_7(void)              = Call                                           : func:r0_6, this:r0_5
+#  796|     mu0_8(unknown)          = ^CallSideEffect                                : ~mu0_2
+#  796|     r0_9(glval<MiddleVB2>)  = ConvertToNonVirtualBase[DerivedVB : MiddleVB2] : r0_3
+#  796|     r0_10(glval<unknown>)   = FunctionAddress[~MiddleVB2]                    : 
+#  796|     v0_11(void)             = Call                                           : func:r0_10, this:r0_9
+#  796|     mu0_12(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  796|     r0_13(glval<MiddleVB1>) = ConvertToNonVirtualBase[DerivedVB : MiddleVB1] : r0_3
+#  796|     r0_14(glval<unknown>)   = FunctionAddress[~MiddleVB1]                    : 
+#  796|     v0_15(void)             = Call                                           : func:r0_14, this:r0_13
+#  796|     mu0_16(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  796|     r0_17(glval<Base>)      = ConvertToNonVirtualBase[DerivedVB : Base]      : r0_3
+#  796|     r0_18(glval<unknown>)   = FunctionAddress[~Base]                         : 
+#  796|     v0_19(void)             = Call                                           : func:r0_18, this:r0_17
+#  796|     mu0_20(unknown)         = ^CallSideEffect                                : ~mu0_2
+#  795|     v0_21(void)             = ReturnVoid                                     : 
+#  795|     v0_22(void)             = UnmodeledUse                                   : mu*
+#  795|     v0_23(void)             = AliasedUse                                     : ~mu0_2
+#  795|     v0_24(void)             = ExitFunction                                   : 
 
 #  799| void HierarchyConversions()
 #  799|   Block 0
-#  799|     v0_0(void)                 = EnterFunction                          : 
-#  799|     mu0_1(unknown)             = AliasedDefinition                      : 
-#  799|     mu0_2(unknown)             = UnmodeledDefinition                    : 
-#  800|     r0_3(glval<Base>)          = VariableAddress[b]                     : 
-#  800|     r0_4(glval<unknown>)       = FunctionAddress[Base]                  : 
-#  800|     v0_5(void)                 = Call                                   : func:r0_4, this:r0_3
-#  800|     mu0_6(unknown)             = ^CallSideEffect                        : ~mu0_2
-#  801|     r0_7(glval<Middle>)        = VariableAddress[m]                     : 
-#  801|     r0_8(glval<unknown>)       = FunctionAddress[Middle]                : 
-#  801|     v0_9(void)                 = Call                                   : func:r0_8, this:r0_7
-#  801|     mu0_10(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  802|     r0_11(glval<Derived>)      = VariableAddress[d]                     : 
-#  802|     r0_12(glval<unknown>)      = FunctionAddress[Derived]               : 
-#  802|     v0_13(void)                = Call                                   : func:r0_12, this:r0_11
-#  802|     mu0_14(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  804|     r0_15(glval<Base *>)       = VariableAddress[pb]                    : 
-#  804|     r0_16(glval<Base>)         = VariableAddress[b]                     : 
-#  804|     r0_17(Base *)              = CopyValue                              : r0_16
-#  804|     mu0_18(Base *)             = Store                                  : &:r0_15, r0_17
-#  805|     r0_19(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  805|     r0_20(glval<Middle>)       = VariableAddress[m]                     : 
-#  805|     r0_21(Middle *)            = CopyValue                              : r0_20
-#  805|     mu0_22(Middle *)           = Store                                  : &:r0_19, r0_21
-#  806|     r0_23(glval<Derived *>)    = VariableAddress[pd]                    : 
-#  806|     r0_24(glval<Derived>)      = VariableAddress[d]                     : 
-#  806|     r0_25(Derived *)           = CopyValue                              : r0_24
-#  806|     mu0_26(Derived *)          = Store                                  : &:r0_23, r0_25
-#  808|     r0_27(glval<Base>)         = VariableAddress[b]                     : 
-#  808|     r0_28(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  808|     r0_29(glval<Middle>)       = VariableAddress[m]                     : 
-#  808|     r0_30(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_29
-#  808|     r0_31(Base &)              = CopyValue                              : r0_30
-#  808|     r0_32(Base &)              = Call                                   : func:r0_28, this:r0_27, 0:r0_31
-#  808|     mu0_33(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  808|     v0_34(void)                = ^BufferReadSideEffect[-1]              : &:r0_27, ~mu0_2
-#  808|     v0_35(void)                = ^BufferReadSideEffect[0]               : &:r0_31, ~mu0_2
-#  808|     mu0_36(Base)               = ^IndirectMayWriteSideEffect[-1]        : &:r0_27
-#  808|     mu0_37(unknown)            = ^BufferMayWriteSideEffect[0]           : &:r0_31
-#  808|     r0_38(glval<Base>)         = CopyValue                              : r0_32
-#  809|     r0_39(glval<Base>)         = VariableAddress[b]                     : 
-#  809|     r0_40(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  809|     r0_41(glval<unknown>)      = FunctionAddress[Base]                  : 
-#  809|     r0_42(glval<Middle>)       = VariableAddress[m]                     : 
-#  809|     r0_43(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_42
-#  809|     r0_44(Base &)              = CopyValue                              : r0_43
-#  809|     v0_45(void)                = Call                                   : func:r0_41, 0:r0_44
-#  809|     mu0_46(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  809|     v0_47(void)                = ^BufferReadSideEffect[0]               : &:r0_44, ~mu0_2
-#  809|     mu0_48(unknown)            = ^BufferMayWriteSideEffect[0]           : &:r0_44
-#  809|     r0_49(glval<Base>)         = Convert                                : v0_45
-#  809|     r0_50(Base &)              = CopyValue                              : r0_49
-#  809|     r0_51(Base &)              = Call                                   : func:r0_40, this:r0_39, 0:r0_50
-#  809|     mu0_52(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  809|     v0_53(void)                = ^BufferReadSideEffect[-1]              : &:r0_39, ~mu0_2
-#  809|     v0_54(void)                = ^BufferReadSideEffect[0]               : &:r0_50, ~mu0_2
-#  809|     mu0_55(Base)               = ^IndirectMayWriteSideEffect[-1]        : &:r0_39
-#  809|     mu0_56(unknown)            = ^BufferMayWriteSideEffect[0]           : &:r0_50
-#  809|     r0_57(glval<Base>)         = CopyValue                              : r0_51
-#  810|     r0_58(glval<Base>)         = VariableAddress[b]                     : 
-#  810|     r0_59(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  810|     r0_60(glval<unknown>)      = FunctionAddress[Base]                  : 
-#  810|     r0_61(glval<Middle>)       = VariableAddress[m]                     : 
-#  810|     r0_62(glval<Base>)         = ConvertToBase[Middle : Base]           : r0_61
-#  810|     r0_63(Base &)              = CopyValue                              : r0_62
-#  810|     v0_64(void)                = Call                                   : func:r0_60, 0:r0_63
-#  810|     mu0_65(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  810|     v0_66(void)                = ^BufferReadSideEffect[0]               : &:r0_63, ~mu0_2
-#  810|     mu0_67(unknown)            = ^BufferMayWriteSideEffect[0]           : &:r0_63
-#  810|     r0_68(glval<Base>)         = Convert                                : v0_64
-#  810|     r0_69(Base &)              = CopyValue                              : r0_68
-#  810|     r0_70(Base &)              = Call                                   : func:r0_59, this:r0_58, 0:r0_69
-#  810|     mu0_71(unknown)            = ^CallSideEffect                        : ~mu0_2
-#  810|     v0_72(void)                = ^BufferReadSideEffect[-1]              : &:r0_58, ~mu0_2
-#  810|     v0_73(void)                = ^BufferReadSideEffect[0]               : &:r0_69, ~mu0_2
-#  810|     mu0_74(Base)               = ^IndirectMayWriteSideEffect[-1]        : &:r0_58
-#  810|     mu0_75(unknown)            = ^BufferMayWriteSideEffect[0]           : &:r0_69
-#  810|     r0_76(glval<Base>)         = CopyValue                              : r0_70
-#  811|     r0_77(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  811|     r0_78(Middle *)            = Load                                   : &:r0_77, ~mu0_2
-#  811|     r0_79(Base *)              = ConvertToBase[Middle : Base]           : r0_78
-#  811|     r0_80(glval<Base *>)       = VariableAddress[pb]                    : 
-#  811|     mu0_81(Base *)             = Store                                  : &:r0_80, r0_79
-#  812|     r0_82(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  812|     r0_83(Middle *)            = Load                                   : &:r0_82, ~mu0_2
-#  812|     r0_84(Base *)              = ConvertToBase[Middle : Base]           : r0_83
-#  812|     r0_85(glval<Base *>)       = VariableAddress[pb]                    : 
-#  812|     mu0_86(Base *)             = Store                                  : &:r0_85, r0_84
-#  813|     r0_87(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  813|     r0_88(Middle *)            = Load                                   : &:r0_87, ~mu0_2
-#  813|     r0_89(Base *)              = ConvertToBase[Middle : Base]           : r0_88
-#  813|     r0_90(glval<Base *>)       = VariableAddress[pb]                    : 
-#  813|     mu0_91(Base *)             = Store                                  : &:r0_90, r0_89
-#  814|     r0_92(glval<Middle *>)     = VariableAddress[pm]                    : 
-#  814|     r0_93(Middle *)            = Load                                   : &:r0_92, ~mu0_2
-#  814|     r0_94(Base *)              = Convert                                : r0_93
-#  814|     r0_95(glval<Base *>)       = VariableAddress[pb]                    : 
-#  814|     mu0_96(Base *)             = Store                                  : &:r0_95, r0_94
-#  816|     r0_97(glval<Middle>)       = VariableAddress[m]                     : 
-#  816|     r0_98(glval<unknown>)      = FunctionAddress[operator=]             : 
-#  816|     r0_99(glval<Base>)         = VariableAddress[b]                     : 
-#  816|     r0_100(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_99
-#  816|     r0_101(glval<Middle>)      = Convert                                : r0_100
-#  816|     r0_102(Middle &)           = CopyValue                              : r0_101
-#  816|     r0_103(Middle &)           = Call                                   : func:r0_98, this:r0_97, 0:r0_102
-#  816|     mu0_104(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  816|     v0_105(void)               = ^BufferReadSideEffect[-1]              : &:r0_97, ~mu0_2
-#  816|     v0_106(void)               = ^BufferReadSideEffect[0]               : &:r0_102, ~mu0_2
-#  816|     mu0_107(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_97
-#  816|     mu0_108(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_102
-#  816|     r0_109(glval<Middle>)      = CopyValue                              : r0_103
-#  817|     r0_110(glval<Middle>)      = VariableAddress[m]                     : 
-#  817|     r0_111(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  817|     r0_112(glval<Base>)        = VariableAddress[b]                     : 
-#  817|     r0_113(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_112
-#  817|     r0_114(glval<Middle>)      = Convert                                : r0_113
-#  817|     r0_115(Middle &)           = CopyValue                              : r0_114
-#  817|     r0_116(Middle &)           = Call                                   : func:r0_111, this:r0_110, 0:r0_115
-#  817|     mu0_117(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  817|     v0_118(void)               = ^BufferReadSideEffect[-1]              : &:r0_110, ~mu0_2
-#  817|     v0_119(void)               = ^BufferReadSideEffect[0]               : &:r0_115, ~mu0_2
-#  817|     mu0_120(Middle)            = ^IndirectMayWriteSideEffect[-1]        : &:r0_110
-#  817|     mu0_121(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_115
-#  817|     r0_122(glval<Middle>)      = CopyValue                              : r0_116
-#  818|     r0_123(glval<Base *>)      = VariableAddress[pb]                    : 
-#  818|     r0_124(Base *)             = Load                                   : &:r0_123, ~mu0_2
-#  818|     r0_125(Middle *)           = ConvertToDerived[Middle : Base]        : r0_124
-#  818|     r0_126(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  818|     mu0_127(Middle *)          = Store                                  : &:r0_126, r0_125
-#  819|     r0_128(glval<Base *>)      = VariableAddress[pb]                    : 
-#  819|     r0_129(Base *)             = Load                                   : &:r0_128, ~mu0_2
-#  819|     r0_130(Middle *)           = ConvertToDerived[Middle : Base]        : r0_129
-#  819|     r0_131(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  819|     mu0_132(Middle *)          = Store                                  : &:r0_131, r0_130
-#  820|     r0_133(glval<Base *>)      = VariableAddress[pb]                    : 
-#  820|     r0_134(Base *)             = Load                                   : &:r0_133, ~mu0_2
-#  820|     r0_135(Middle *)           = Convert                                : r0_134
-#  820|     r0_136(glval<Middle *>)    = VariableAddress[pm]                    : 
-#  820|     mu0_137(Middle *)          = Store                                  : &:r0_136, r0_135
-#  822|     r0_138(glval<Base>)        = VariableAddress[b]                     : 
-#  822|     r0_139(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  822|     r0_140(glval<Derived>)     = VariableAddress[d]                     : 
-#  822|     r0_141(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_140
-#  822|     r0_142(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_141
-#  822|     r0_143(Base &)             = CopyValue                              : r0_142
-#  822|     r0_144(Base &)             = Call                                   : func:r0_139, this:r0_138, 0:r0_143
-#  822|     mu0_145(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  822|     v0_146(void)               = ^BufferReadSideEffect[-1]              : &:r0_138, ~mu0_2
-#  822|     v0_147(void)               = ^BufferReadSideEffect[0]               : &:r0_143, ~mu0_2
-#  822|     mu0_148(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_138
-#  822|     mu0_149(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_143
-#  822|     r0_150(glval<Base>)        = CopyValue                              : r0_144
-#  823|     r0_151(glval<Base>)        = VariableAddress[b]                     : 
-#  823|     r0_152(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  823|     r0_153(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  823|     r0_154(glval<Derived>)     = VariableAddress[d]                     : 
-#  823|     r0_155(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_154
-#  823|     r0_156(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_155
-#  823|     r0_157(Base &)             = CopyValue                              : r0_156
-#  823|     v0_158(void)               = Call                                   : func:r0_153, 0:r0_157
-#  823|     mu0_159(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     v0_160(void)               = ^BufferReadSideEffect[0]               : &:r0_157, ~mu0_2
-#  823|     mu0_161(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_157
-#  823|     r0_162(glval<Base>)        = Convert                                : v0_158
-#  823|     r0_163(Base &)             = CopyValue                              : r0_162
-#  823|     r0_164(Base &)             = Call                                   : func:r0_152, this:r0_151, 0:r0_163
-#  823|     mu0_165(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  823|     v0_166(void)               = ^BufferReadSideEffect[-1]              : &:r0_151, ~mu0_2
-#  823|     v0_167(void)               = ^BufferReadSideEffect[0]               : &:r0_163, ~mu0_2
-#  823|     mu0_168(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_151
-#  823|     mu0_169(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_163
-#  823|     r0_170(glval<Base>)        = CopyValue                              : r0_164
-#  824|     r0_171(glval<Base>)        = VariableAddress[b]                     : 
-#  824|     r0_172(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  824|     r0_173(glval<unknown>)     = FunctionAddress[Base]                  : 
-#  824|     r0_174(glval<Derived>)     = VariableAddress[d]                     : 
-#  824|     r0_175(glval<Middle>)      = ConvertToBase[Derived : Middle]        : r0_174
-#  824|     r0_176(glval<Base>)        = ConvertToBase[Middle : Base]           : r0_175
-#  824|     r0_177(Base &)             = CopyValue                              : r0_176
-#  824|     v0_178(void)               = Call                                   : func:r0_173, 0:r0_177
-#  824|     mu0_179(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     v0_180(void)               = ^BufferReadSideEffect[0]               : &:r0_177, ~mu0_2
-#  824|     mu0_181(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_177
-#  824|     r0_182(glval<Base>)        = Convert                                : v0_178
-#  824|     r0_183(Base &)             = CopyValue                              : r0_182
-#  824|     r0_184(Base &)             = Call                                   : func:r0_172, this:r0_171, 0:r0_183
-#  824|     mu0_185(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  824|     v0_186(void)               = ^BufferReadSideEffect[-1]              : &:r0_171, ~mu0_2
-#  824|     v0_187(void)               = ^BufferReadSideEffect[0]               : &:r0_183, ~mu0_2
-#  824|     mu0_188(Base)              = ^IndirectMayWriteSideEffect[-1]        : &:r0_171
-#  824|     mu0_189(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_183
-#  824|     r0_190(glval<Base>)        = CopyValue                              : r0_184
-#  825|     r0_191(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  825|     r0_192(Derived *)          = Load                                   : &:r0_191, ~mu0_2
-#  825|     r0_193(Middle *)           = ConvertToBase[Derived : Middle]        : r0_192
-#  825|     r0_194(Base *)             = ConvertToBase[Middle : Base]           : r0_193
-#  825|     r0_195(glval<Base *>)      = VariableAddress[pb]                    : 
-#  825|     mu0_196(Base *)            = Store                                  : &:r0_195, r0_194
-#  826|     r0_197(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  826|     r0_198(Derived *)          = Load                                   : &:r0_197, ~mu0_2
-#  826|     r0_199(Middle *)           = ConvertToBase[Derived : Middle]        : r0_198
-#  826|     r0_200(Base *)             = ConvertToBase[Middle : Base]           : r0_199
-#  826|     r0_201(glval<Base *>)      = VariableAddress[pb]                    : 
-#  826|     mu0_202(Base *)            = Store                                  : &:r0_201, r0_200
-#  827|     r0_203(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  827|     r0_204(Derived *)          = Load                                   : &:r0_203, ~mu0_2
-#  827|     r0_205(Middle *)           = ConvertToBase[Derived : Middle]        : r0_204
-#  827|     r0_206(Base *)             = ConvertToBase[Middle : Base]           : r0_205
-#  827|     r0_207(glval<Base *>)      = VariableAddress[pb]                    : 
-#  827|     mu0_208(Base *)            = Store                                  : &:r0_207, r0_206
-#  828|     r0_209(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  828|     r0_210(Derived *)          = Load                                   : &:r0_209, ~mu0_2
-#  828|     r0_211(Base *)             = Convert                                : r0_210
-#  828|     r0_212(glval<Base *>)      = VariableAddress[pb]                    : 
-#  828|     mu0_213(Base *)            = Store                                  : &:r0_212, r0_211
-#  830|     r0_214(glval<Derived>)     = VariableAddress[d]                     : 
-#  830|     r0_215(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  830|     r0_216(glval<Base>)        = VariableAddress[b]                     : 
-#  830|     r0_217(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_216
-#  830|     r0_218(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_217
-#  830|     r0_219(glval<Derived>)     = Convert                                : r0_218
-#  830|     r0_220(Derived &)          = CopyValue                              : r0_219
-#  830|     r0_221(Derived &)          = Call                                   : func:r0_215, this:r0_214, 0:r0_220
-#  830|     mu0_222(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  830|     v0_223(void)               = ^BufferReadSideEffect[-1]              : &:r0_214, ~mu0_2
-#  830|     v0_224(void)               = ^BufferReadSideEffect[0]               : &:r0_220, ~mu0_2
-#  830|     mu0_225(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_214
-#  830|     mu0_226(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_220
-#  830|     r0_227(glval<Derived>)     = CopyValue                              : r0_221
-#  831|     r0_228(glval<Derived>)     = VariableAddress[d]                     : 
-#  831|     r0_229(glval<unknown>)     = FunctionAddress[operator=]             : 
-#  831|     r0_230(glval<Base>)        = VariableAddress[b]                     : 
-#  831|     r0_231(glval<Middle>)      = ConvertToDerived[Middle : Base]        : r0_230
-#  831|     r0_232(glval<Derived>)     = ConvertToDerived[Derived : Middle]     : r0_231
-#  831|     r0_233(glval<Derived>)     = Convert                                : r0_232
-#  831|     r0_234(Derived &)          = CopyValue                              : r0_233
-#  831|     r0_235(Derived &)          = Call                                   : func:r0_229, this:r0_228, 0:r0_234
-#  831|     mu0_236(unknown)           = ^CallSideEffect                        : ~mu0_2
-#  831|     v0_237(void)               = ^BufferReadSideEffect[-1]              : &:r0_228, ~mu0_2
-#  831|     v0_238(void)               = ^BufferReadSideEffect[0]               : &:r0_234, ~mu0_2
-#  831|     mu0_239(Derived)           = ^IndirectMayWriteSideEffect[-1]        : &:r0_228
-#  831|     mu0_240(unknown)           = ^BufferMayWriteSideEffect[0]           : &:r0_234
-#  831|     r0_241(glval<Derived>)     = CopyValue                              : r0_235
-#  832|     r0_242(glval<Base *>)      = VariableAddress[pb]                    : 
-#  832|     r0_243(Base *)             = Load                                   : &:r0_242, ~mu0_2
-#  832|     r0_244(Middle *)           = ConvertToDerived[Middle : Base]        : r0_243
-#  832|     r0_245(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_244
-#  832|     r0_246(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  832|     mu0_247(Derived *)         = Store                                  : &:r0_246, r0_245
-#  833|     r0_248(glval<Base *>)      = VariableAddress[pb]                    : 
-#  833|     r0_249(Base *)             = Load                                   : &:r0_248, ~mu0_2
-#  833|     r0_250(Middle *)           = ConvertToDerived[Middle : Base]        : r0_249
-#  833|     r0_251(Derived *)          = ConvertToDerived[Derived : Middle]     : r0_250
-#  833|     r0_252(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  833|     mu0_253(Derived *)         = Store                                  : &:r0_252, r0_251
-#  834|     r0_254(glval<Base *>)      = VariableAddress[pb]                    : 
-#  834|     r0_255(Base *)             = Load                                   : &:r0_254, ~mu0_2
-#  834|     r0_256(Derived *)          = Convert                                : r0_255
-#  834|     r0_257(glval<Derived *>)   = VariableAddress[pd]                    : 
-#  834|     mu0_258(Derived *)         = Store                                  : &:r0_257, r0_256
-#  836|     r0_259(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  836|     r0_260(MiddleVB1 *)        = Constant[0]                            : 
-#  836|     mu0_261(MiddleVB1 *)       = Store                                  : &:r0_259, r0_260
-#  837|     r0_262(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  837|     r0_263(DerivedVB *)        = Constant[0]                            : 
-#  837|     mu0_264(DerivedVB *)       = Store                                  : &:r0_262, r0_263
-#  838|     r0_265(glval<MiddleVB1 *>) = VariableAddress[pmv]                   : 
-#  838|     r0_266(MiddleVB1 *)        = Load                                   : &:r0_265, ~mu0_2
-#  838|     r0_267(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base] : r0_266
-#  838|     r0_268(glval<Base *>)      = VariableAddress[pb]                    : 
-#  838|     mu0_269(Base *)            = Store                                  : &:r0_268, r0_267
-#  839|     r0_270(glval<DerivedVB *>) = VariableAddress[pdv]                   : 
-#  839|     r0_271(DerivedVB *)        = Load                                   : &:r0_270, ~mu0_2
-#  839|     r0_272(Base *)             = ConvertToVirtualBase[DerivedVB : Base] : r0_271
-#  839|     r0_273(glval<Base *>)      = VariableAddress[pb]                    : 
-#  839|     mu0_274(Base *)            = Store                                  : &:r0_273, r0_272
-#  840|     v0_275(void)               = NoOp                                   : 
-#  799|     v0_276(void)               = ReturnVoid                             : 
-#  799|     v0_277(void)               = UnmodeledUse                           : mu*
-#  799|     v0_278(void)               = AliasedUse                             : ~mu0_2
-#  799|     v0_279(void)               = ExitFunction                           : 
+#  799|     v0_0(void)                 = EnterFunction                             : 
+#  799|     mu0_1(unknown)             = AliasedDefinition                         : 
+#  799|     mu0_2(unknown)             = UnmodeledDefinition                       : 
+#  800|     r0_3(glval<Base>)          = VariableAddress[b]                        : 
+#  800|     r0_4(glval<unknown>)       = FunctionAddress[Base]                     : 
+#  800|     v0_5(void)                 = Call                                      : func:r0_4, this:r0_3
+#  800|     mu0_6(unknown)             = ^CallSideEffect                           : ~mu0_2
+#  801|     r0_7(glval<Middle>)        = VariableAddress[m]                        : 
+#  801|     r0_8(glval<unknown>)       = FunctionAddress[Middle]                   : 
+#  801|     v0_9(void)                 = Call                                      : func:r0_8, this:r0_7
+#  801|     mu0_10(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  802|     r0_11(glval<Derived>)      = VariableAddress[d]                        : 
+#  802|     r0_12(glval<unknown>)      = FunctionAddress[Derived]                  : 
+#  802|     v0_13(void)                = Call                                      : func:r0_12, this:r0_11
+#  802|     mu0_14(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  804|     r0_15(glval<Base *>)       = VariableAddress[pb]                       : 
+#  804|     r0_16(glval<Base>)         = VariableAddress[b]                        : 
+#  804|     r0_17(Base *)              = CopyValue                                 : r0_16
+#  804|     mu0_18(Base *)             = Store                                     : &:r0_15, r0_17
+#  805|     r0_19(glval<Middle *>)     = VariableAddress[pm]                       : 
+#  805|     r0_20(glval<Middle>)       = VariableAddress[m]                        : 
+#  805|     r0_21(Middle *)            = CopyValue                                 : r0_20
+#  805|     mu0_22(Middle *)           = Store                                     : &:r0_19, r0_21
+#  806|     r0_23(glval<Derived *>)    = VariableAddress[pd]                       : 
+#  806|     r0_24(glval<Derived>)      = VariableAddress[d]                        : 
+#  806|     r0_25(Derived *)           = CopyValue                                 : r0_24
+#  806|     mu0_26(Derived *)          = Store                                     : &:r0_23, r0_25
+#  808|     r0_27(glval<Base>)         = VariableAddress[b]                        : 
+#  808|     r0_28(glval<unknown>)      = FunctionAddress[operator=]                : 
+#  808|     r0_29(glval<Middle>)       = VariableAddress[m]                        : 
+#  808|     r0_30(glval<Base>)         = ConvertToNonVirtualBase[Middle : Base]    : r0_29
+#  808|     r0_31(Base &)              = CopyValue                                 : r0_30
+#  808|     r0_32(Base &)              = Call                                      : func:r0_28, this:r0_27, 0:r0_31
+#  808|     mu0_33(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  808|     v0_34(void)                = ^BufferReadSideEffect[-1]                 : &:r0_27, ~mu0_2
+#  808|     v0_35(void)                = ^BufferReadSideEffect[0]                  : &:r0_31, ~mu0_2
+#  808|     mu0_36(Base)               = ^IndirectMayWriteSideEffect[-1]           : &:r0_27
+#  808|     mu0_37(unknown)            = ^BufferMayWriteSideEffect[0]              : &:r0_31
+#  808|     r0_38(glval<Base>)         = CopyValue                                 : r0_32
+#  809|     r0_39(glval<Base>)         = VariableAddress[b]                        : 
+#  809|     r0_40(glval<unknown>)      = FunctionAddress[operator=]                : 
+#  809|     r0_41(glval<unknown>)      = FunctionAddress[Base]                     : 
+#  809|     r0_42(glval<Middle>)       = VariableAddress[m]                        : 
+#  809|     r0_43(glval<Base>)         = ConvertToNonVirtualBase[Middle : Base]    : r0_42
+#  809|     r0_44(Base &)              = CopyValue                                 : r0_43
+#  809|     v0_45(void)                = Call                                      : func:r0_41, 0:r0_44
+#  809|     mu0_46(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  809|     v0_47(void)                = ^BufferReadSideEffect[0]                  : &:r0_44, ~mu0_2
+#  809|     mu0_48(unknown)            = ^BufferMayWriteSideEffect[0]              : &:r0_44
+#  809|     r0_49(glval<Base>)         = Convert                                   : v0_45
+#  809|     r0_50(Base &)              = CopyValue                                 : r0_49
+#  809|     r0_51(Base &)              = Call                                      : func:r0_40, this:r0_39, 0:r0_50
+#  809|     mu0_52(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  809|     v0_53(void)                = ^BufferReadSideEffect[-1]                 : &:r0_39, ~mu0_2
+#  809|     v0_54(void)                = ^BufferReadSideEffect[0]                  : &:r0_50, ~mu0_2
+#  809|     mu0_55(Base)               = ^IndirectMayWriteSideEffect[-1]           : &:r0_39
+#  809|     mu0_56(unknown)            = ^BufferMayWriteSideEffect[0]              : &:r0_50
+#  809|     r0_57(glval<Base>)         = CopyValue                                 : r0_51
+#  810|     r0_58(glval<Base>)         = VariableAddress[b]                        : 
+#  810|     r0_59(glval<unknown>)      = FunctionAddress[operator=]                : 
+#  810|     r0_60(glval<unknown>)      = FunctionAddress[Base]                     : 
+#  810|     r0_61(glval<Middle>)       = VariableAddress[m]                        : 
+#  810|     r0_62(glval<Base>)         = ConvertToNonVirtualBase[Middle : Base]    : r0_61
+#  810|     r0_63(Base &)              = CopyValue                                 : r0_62
+#  810|     v0_64(void)                = Call                                      : func:r0_60, 0:r0_63
+#  810|     mu0_65(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  810|     v0_66(void)                = ^BufferReadSideEffect[0]                  : &:r0_63, ~mu0_2
+#  810|     mu0_67(unknown)            = ^BufferMayWriteSideEffect[0]              : &:r0_63
+#  810|     r0_68(glval<Base>)         = Convert                                   : v0_64
+#  810|     r0_69(Base &)              = CopyValue                                 : r0_68
+#  810|     r0_70(Base &)              = Call                                      : func:r0_59, this:r0_58, 0:r0_69
+#  810|     mu0_71(unknown)            = ^CallSideEffect                           : ~mu0_2
+#  810|     v0_72(void)                = ^BufferReadSideEffect[-1]                 : &:r0_58, ~mu0_2
+#  810|     v0_73(void)                = ^BufferReadSideEffect[0]                  : &:r0_69, ~mu0_2
+#  810|     mu0_74(Base)               = ^IndirectMayWriteSideEffect[-1]           : &:r0_58
+#  810|     mu0_75(unknown)            = ^BufferMayWriteSideEffect[0]              : &:r0_69
+#  810|     r0_76(glval<Base>)         = CopyValue                                 : r0_70
+#  811|     r0_77(glval<Middle *>)     = VariableAddress[pm]                       : 
+#  811|     r0_78(Middle *)            = Load                                      : &:r0_77, ~mu0_2
+#  811|     r0_79(Base *)              = ConvertToNonVirtualBase[Middle : Base]    : r0_78
+#  811|     r0_80(glval<Base *>)       = VariableAddress[pb]                       : 
+#  811|     mu0_81(Base *)             = Store                                     : &:r0_80, r0_79
+#  812|     r0_82(glval<Middle *>)     = VariableAddress[pm]                       : 
+#  812|     r0_83(Middle *)            = Load                                      : &:r0_82, ~mu0_2
+#  812|     r0_84(Base *)              = ConvertToNonVirtualBase[Middle : Base]    : r0_83
+#  812|     r0_85(glval<Base *>)       = VariableAddress[pb]                       : 
+#  812|     mu0_86(Base *)             = Store                                     : &:r0_85, r0_84
+#  813|     r0_87(glval<Middle *>)     = VariableAddress[pm]                       : 
+#  813|     r0_88(Middle *)            = Load                                      : &:r0_87, ~mu0_2
+#  813|     r0_89(Base *)              = ConvertToNonVirtualBase[Middle : Base]    : r0_88
+#  813|     r0_90(glval<Base *>)       = VariableAddress[pb]                       : 
+#  813|     mu0_91(Base *)             = Store                                     : &:r0_90, r0_89
+#  814|     r0_92(glval<Middle *>)     = VariableAddress[pm]                       : 
+#  814|     r0_93(Middle *)            = Load                                      : &:r0_92, ~mu0_2
+#  814|     r0_94(Base *)              = Convert                                   : r0_93
+#  814|     r0_95(glval<Base *>)       = VariableAddress[pb]                       : 
+#  814|     mu0_96(Base *)             = Store                                     : &:r0_95, r0_94
+#  816|     r0_97(glval<Middle>)       = VariableAddress[m]                        : 
+#  816|     r0_98(glval<unknown>)      = FunctionAddress[operator=]                : 
+#  816|     r0_99(glval<Base>)         = VariableAddress[b]                        : 
+#  816|     r0_100(glval<Middle>)      = ConvertToDerived[Middle : Base]           : r0_99
+#  816|     r0_101(glval<Middle>)      = Convert                                   : r0_100
+#  816|     r0_102(Middle &)           = CopyValue                                 : r0_101
+#  816|     r0_103(Middle &)           = Call                                      : func:r0_98, this:r0_97, 0:r0_102
+#  816|     mu0_104(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  816|     v0_105(void)               = ^BufferReadSideEffect[-1]                 : &:r0_97, ~mu0_2
+#  816|     v0_106(void)               = ^BufferReadSideEffect[0]                  : &:r0_102, ~mu0_2
+#  816|     mu0_107(Middle)            = ^IndirectMayWriteSideEffect[-1]           : &:r0_97
+#  816|     mu0_108(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_102
+#  816|     r0_109(glval<Middle>)      = CopyValue                                 : r0_103
+#  817|     r0_110(glval<Middle>)      = VariableAddress[m]                        : 
+#  817|     r0_111(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  817|     r0_112(glval<Base>)        = VariableAddress[b]                        : 
+#  817|     r0_113(glval<Middle>)      = ConvertToDerived[Middle : Base]           : r0_112
+#  817|     r0_114(glval<Middle>)      = Convert                                   : r0_113
+#  817|     r0_115(Middle &)           = CopyValue                                 : r0_114
+#  817|     r0_116(Middle &)           = Call                                      : func:r0_111, this:r0_110, 0:r0_115
+#  817|     mu0_117(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  817|     v0_118(void)               = ^BufferReadSideEffect[-1]                 : &:r0_110, ~mu0_2
+#  817|     v0_119(void)               = ^BufferReadSideEffect[0]                  : &:r0_115, ~mu0_2
+#  817|     mu0_120(Middle)            = ^IndirectMayWriteSideEffect[-1]           : &:r0_110
+#  817|     mu0_121(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_115
+#  817|     r0_122(glval<Middle>)      = CopyValue                                 : r0_116
+#  818|     r0_123(glval<Base *>)      = VariableAddress[pb]                       : 
+#  818|     r0_124(Base *)             = Load                                      : &:r0_123, ~mu0_2
+#  818|     r0_125(Middle *)           = ConvertToDerived[Middle : Base]           : r0_124
+#  818|     r0_126(glval<Middle *>)    = VariableAddress[pm]                       : 
+#  818|     mu0_127(Middle *)          = Store                                     : &:r0_126, r0_125
+#  819|     r0_128(glval<Base *>)      = VariableAddress[pb]                       : 
+#  819|     r0_129(Base *)             = Load                                      : &:r0_128, ~mu0_2
+#  819|     r0_130(Middle *)           = ConvertToDerived[Middle : Base]           : r0_129
+#  819|     r0_131(glval<Middle *>)    = VariableAddress[pm]                       : 
+#  819|     mu0_132(Middle *)          = Store                                     : &:r0_131, r0_130
+#  820|     r0_133(glval<Base *>)      = VariableAddress[pb]                       : 
+#  820|     r0_134(Base *)             = Load                                      : &:r0_133, ~mu0_2
+#  820|     r0_135(Middle *)           = Convert                                   : r0_134
+#  820|     r0_136(glval<Middle *>)    = VariableAddress[pm]                       : 
+#  820|     mu0_137(Middle *)          = Store                                     : &:r0_136, r0_135
+#  822|     r0_138(glval<Base>)        = VariableAddress[b]                        : 
+#  822|     r0_139(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  822|     r0_140(glval<Derived>)     = VariableAddress[d]                        : 
+#  822|     r0_141(glval<Middle>)      = ConvertToNonVirtualBase[Derived : Middle] : r0_140
+#  822|     r0_142(glval<Base>)        = ConvertToNonVirtualBase[Middle : Base]    : r0_141
+#  822|     r0_143(Base &)             = CopyValue                                 : r0_142
+#  822|     r0_144(Base &)             = Call                                      : func:r0_139, this:r0_138, 0:r0_143
+#  822|     mu0_145(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  822|     v0_146(void)               = ^BufferReadSideEffect[-1]                 : &:r0_138, ~mu0_2
+#  822|     v0_147(void)               = ^BufferReadSideEffect[0]                  : &:r0_143, ~mu0_2
+#  822|     mu0_148(Base)              = ^IndirectMayWriteSideEffect[-1]           : &:r0_138
+#  822|     mu0_149(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_143
+#  822|     r0_150(glval<Base>)        = CopyValue                                 : r0_144
+#  823|     r0_151(glval<Base>)        = VariableAddress[b]                        : 
+#  823|     r0_152(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  823|     r0_153(glval<unknown>)     = FunctionAddress[Base]                     : 
+#  823|     r0_154(glval<Derived>)     = VariableAddress[d]                        : 
+#  823|     r0_155(glval<Middle>)      = ConvertToNonVirtualBase[Derived : Middle] : r0_154
+#  823|     r0_156(glval<Base>)        = ConvertToNonVirtualBase[Middle : Base]    : r0_155
+#  823|     r0_157(Base &)             = CopyValue                                 : r0_156
+#  823|     v0_158(void)               = Call                                      : func:r0_153, 0:r0_157
+#  823|     mu0_159(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  823|     v0_160(void)               = ^BufferReadSideEffect[0]                  : &:r0_157, ~mu0_2
+#  823|     mu0_161(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_157
+#  823|     r0_162(glval<Base>)        = Convert                                   : v0_158
+#  823|     r0_163(Base &)             = CopyValue                                 : r0_162
+#  823|     r0_164(Base &)             = Call                                      : func:r0_152, this:r0_151, 0:r0_163
+#  823|     mu0_165(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  823|     v0_166(void)               = ^BufferReadSideEffect[-1]                 : &:r0_151, ~mu0_2
+#  823|     v0_167(void)               = ^BufferReadSideEffect[0]                  : &:r0_163, ~mu0_2
+#  823|     mu0_168(Base)              = ^IndirectMayWriteSideEffect[-1]           : &:r0_151
+#  823|     mu0_169(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_163
+#  823|     r0_170(glval<Base>)        = CopyValue                                 : r0_164
+#  824|     r0_171(glval<Base>)        = VariableAddress[b]                        : 
+#  824|     r0_172(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  824|     r0_173(glval<unknown>)     = FunctionAddress[Base]                     : 
+#  824|     r0_174(glval<Derived>)     = VariableAddress[d]                        : 
+#  824|     r0_175(glval<Middle>)      = ConvertToNonVirtualBase[Derived : Middle] : r0_174
+#  824|     r0_176(glval<Base>)        = ConvertToNonVirtualBase[Middle : Base]    : r0_175
+#  824|     r0_177(Base &)             = CopyValue                                 : r0_176
+#  824|     v0_178(void)               = Call                                      : func:r0_173, 0:r0_177
+#  824|     mu0_179(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  824|     v0_180(void)               = ^BufferReadSideEffect[0]                  : &:r0_177, ~mu0_2
+#  824|     mu0_181(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_177
+#  824|     r0_182(glval<Base>)        = Convert                                   : v0_178
+#  824|     r0_183(Base &)             = CopyValue                                 : r0_182
+#  824|     r0_184(Base &)             = Call                                      : func:r0_172, this:r0_171, 0:r0_183
+#  824|     mu0_185(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  824|     v0_186(void)               = ^BufferReadSideEffect[-1]                 : &:r0_171, ~mu0_2
+#  824|     v0_187(void)               = ^BufferReadSideEffect[0]                  : &:r0_183, ~mu0_2
+#  824|     mu0_188(Base)              = ^IndirectMayWriteSideEffect[-1]           : &:r0_171
+#  824|     mu0_189(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_183
+#  824|     r0_190(glval<Base>)        = CopyValue                                 : r0_184
+#  825|     r0_191(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  825|     r0_192(Derived *)          = Load                                      : &:r0_191, ~mu0_2
+#  825|     r0_193(Middle *)           = ConvertToNonVirtualBase[Derived : Middle] : r0_192
+#  825|     r0_194(Base *)             = ConvertToNonVirtualBase[Middle : Base]    : r0_193
+#  825|     r0_195(glval<Base *>)      = VariableAddress[pb]                       : 
+#  825|     mu0_196(Base *)            = Store                                     : &:r0_195, r0_194
+#  826|     r0_197(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  826|     r0_198(Derived *)          = Load                                      : &:r0_197, ~mu0_2
+#  826|     r0_199(Middle *)           = ConvertToNonVirtualBase[Derived : Middle] : r0_198
+#  826|     r0_200(Base *)             = ConvertToNonVirtualBase[Middle : Base]    : r0_199
+#  826|     r0_201(glval<Base *>)      = VariableAddress[pb]                       : 
+#  826|     mu0_202(Base *)            = Store                                     : &:r0_201, r0_200
+#  827|     r0_203(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  827|     r0_204(Derived *)          = Load                                      : &:r0_203, ~mu0_2
+#  827|     r0_205(Middle *)           = ConvertToNonVirtualBase[Derived : Middle] : r0_204
+#  827|     r0_206(Base *)             = ConvertToNonVirtualBase[Middle : Base]    : r0_205
+#  827|     r0_207(glval<Base *>)      = VariableAddress[pb]                       : 
+#  827|     mu0_208(Base *)            = Store                                     : &:r0_207, r0_206
+#  828|     r0_209(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  828|     r0_210(Derived *)          = Load                                      : &:r0_209, ~mu0_2
+#  828|     r0_211(Base *)             = Convert                                   : r0_210
+#  828|     r0_212(glval<Base *>)      = VariableAddress[pb]                       : 
+#  828|     mu0_213(Base *)            = Store                                     : &:r0_212, r0_211
+#  830|     r0_214(glval<Derived>)     = VariableAddress[d]                        : 
+#  830|     r0_215(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  830|     r0_216(glval<Base>)        = VariableAddress[b]                        : 
+#  830|     r0_217(glval<Middle>)      = ConvertToDerived[Middle : Base]           : r0_216
+#  830|     r0_218(glval<Derived>)     = ConvertToDerived[Derived : Middle]        : r0_217
+#  830|     r0_219(glval<Derived>)     = Convert                                   : r0_218
+#  830|     r0_220(Derived &)          = CopyValue                                 : r0_219
+#  830|     r0_221(Derived &)          = Call                                      : func:r0_215, this:r0_214, 0:r0_220
+#  830|     mu0_222(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  830|     v0_223(void)               = ^BufferReadSideEffect[-1]                 : &:r0_214, ~mu0_2
+#  830|     v0_224(void)               = ^BufferReadSideEffect[0]                  : &:r0_220, ~mu0_2
+#  830|     mu0_225(Derived)           = ^IndirectMayWriteSideEffect[-1]           : &:r0_214
+#  830|     mu0_226(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_220
+#  830|     r0_227(glval<Derived>)     = CopyValue                                 : r0_221
+#  831|     r0_228(glval<Derived>)     = VariableAddress[d]                        : 
+#  831|     r0_229(glval<unknown>)     = FunctionAddress[operator=]                : 
+#  831|     r0_230(glval<Base>)        = VariableAddress[b]                        : 
+#  831|     r0_231(glval<Middle>)      = ConvertToDerived[Middle : Base]           : r0_230
+#  831|     r0_232(glval<Derived>)     = ConvertToDerived[Derived : Middle]        : r0_231
+#  831|     r0_233(glval<Derived>)     = Convert                                   : r0_232
+#  831|     r0_234(Derived &)          = CopyValue                                 : r0_233
+#  831|     r0_235(Derived &)          = Call                                      : func:r0_229, this:r0_228, 0:r0_234
+#  831|     mu0_236(unknown)           = ^CallSideEffect                           : ~mu0_2
+#  831|     v0_237(void)               = ^BufferReadSideEffect[-1]                 : &:r0_228, ~mu0_2
+#  831|     v0_238(void)               = ^BufferReadSideEffect[0]                  : &:r0_234, ~mu0_2
+#  831|     mu0_239(Derived)           = ^IndirectMayWriteSideEffect[-1]           : &:r0_228
+#  831|     mu0_240(unknown)           = ^BufferMayWriteSideEffect[0]              : &:r0_234
+#  831|     r0_241(glval<Derived>)     = CopyValue                                 : r0_235
+#  832|     r0_242(glval<Base *>)      = VariableAddress[pb]                       : 
+#  832|     r0_243(Base *)             = Load                                      : &:r0_242, ~mu0_2
+#  832|     r0_244(Middle *)           = ConvertToDerived[Middle : Base]           : r0_243
+#  832|     r0_245(Derived *)          = ConvertToDerived[Derived : Middle]        : r0_244
+#  832|     r0_246(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  832|     mu0_247(Derived *)         = Store                                     : &:r0_246, r0_245
+#  833|     r0_248(glval<Base *>)      = VariableAddress[pb]                       : 
+#  833|     r0_249(Base *)             = Load                                      : &:r0_248, ~mu0_2
+#  833|     r0_250(Middle *)           = ConvertToDerived[Middle : Base]           : r0_249
+#  833|     r0_251(Derived *)          = ConvertToDerived[Derived : Middle]        : r0_250
+#  833|     r0_252(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  833|     mu0_253(Derived *)         = Store                                     : &:r0_252, r0_251
+#  834|     r0_254(glval<Base *>)      = VariableAddress[pb]                       : 
+#  834|     r0_255(Base *)             = Load                                      : &:r0_254, ~mu0_2
+#  834|     r0_256(Derived *)          = Convert                                   : r0_255
+#  834|     r0_257(glval<Derived *>)   = VariableAddress[pd]                       : 
+#  834|     mu0_258(Derived *)         = Store                                     : &:r0_257, r0_256
+#  836|     r0_259(glval<MiddleVB1 *>) = VariableAddress[pmv]                      : 
+#  836|     r0_260(MiddleVB1 *)        = Constant[0]                               : 
+#  836|     mu0_261(MiddleVB1 *)       = Store                                     : &:r0_259, r0_260
+#  837|     r0_262(glval<DerivedVB *>) = VariableAddress[pdv]                      : 
+#  837|     r0_263(DerivedVB *)        = Constant[0]                               : 
+#  837|     mu0_264(DerivedVB *)       = Store                                     : &:r0_262, r0_263
+#  838|     r0_265(glval<MiddleVB1 *>) = VariableAddress[pmv]                      : 
+#  838|     r0_266(MiddleVB1 *)        = Load                                      : &:r0_265, ~mu0_2
+#  838|     r0_267(Base *)             = ConvertToVirtualBase[MiddleVB1 : Base]    : r0_266
+#  838|     r0_268(glval<Base *>)      = VariableAddress[pb]                       : 
+#  838|     mu0_269(Base *)            = Store                                     : &:r0_268, r0_267
+#  839|     r0_270(glval<DerivedVB *>) = VariableAddress[pdv]                      : 
+#  839|     r0_271(DerivedVB *)        = Load                                      : &:r0_270, ~mu0_2
+#  839|     r0_272(Base *)             = ConvertToVirtualBase[DerivedVB : Base]    : r0_271
+#  839|     r0_273(glval<Base *>)      = VariableAddress[pb]                       : 
+#  839|     mu0_274(Base *)            = Store                                     : &:r0_273, r0_272
+#  840|     v0_275(void)               = NoOp                                      : 
+#  799|     v0_276(void)               = ReturnVoid                                : 
+#  799|     v0_277(void)               = UnmodeledUse                              : mu*
+#  799|     v0_278(void)               = AliasedUse                                : ~mu0_2
+#  799|     v0_279(void)               = ExitFunction                              : 
 
 #  842| void PolymorphicBase::PolymorphicBase()
 #  842|   Block 0
@@ -4093,35 +4069,35 @@ ir.cpp:
 
 #  846| void PolymorphicDerived::PolymorphicDerived()
 #  846|   Block 0
-#  846|     v0_0(void)                      = EnterFunction                                       : 
-#  846|     mu0_1(unknown)                  = AliasedDefinition                                   : 
-#  846|     mu0_2(unknown)                  = UnmodeledDefinition                                 : 
-#  846|     r0_3(glval<PolymorphicDerived>) = InitializeThis                                      : 
-#  846|     r0_4(glval<PolymorphicBase>)    = ConvertToBase[PolymorphicDerived : PolymorphicBase] : r0_3
-#  846|     r0_5(glval<unknown>)            = FunctionAddress[PolymorphicBase]                    : 
-#  846|     v0_6(void)                      = Call                                                : func:r0_5, this:r0_4
-#  846|     mu0_7(unknown)                  = ^CallSideEffect                                     : ~mu0_2
-#  846|     v0_8(void)                      = NoOp                                                : 
-#  846|     v0_9(void)                      = ReturnVoid                                          : 
-#  846|     v0_10(void)                     = UnmodeledUse                                        : mu*
-#  846|     v0_11(void)                     = AliasedUse                                          : ~mu0_2
-#  846|     v0_12(void)                     = ExitFunction                                        : 
+#  846|     v0_0(void)                      = EnterFunction                                                 : 
+#  846|     mu0_1(unknown)                  = AliasedDefinition                                             : 
+#  846|     mu0_2(unknown)                  = UnmodeledDefinition                                           : 
+#  846|     r0_3(glval<PolymorphicDerived>) = InitializeThis                                                : 
+#  846|     r0_4(glval<PolymorphicBase>)    = ConvertToNonVirtualBase[PolymorphicDerived : PolymorphicBase] : r0_3
+#  846|     r0_5(glval<unknown>)            = FunctionAddress[PolymorphicBase]                              : 
+#  846|     v0_6(void)                      = Call                                                          : func:r0_5, this:r0_4
+#  846|     mu0_7(unknown)                  = ^CallSideEffect                                               : ~mu0_2
+#  846|     v0_8(void)                      = NoOp                                                          : 
+#  846|     v0_9(void)                      = ReturnVoid                                                    : 
+#  846|     v0_10(void)                     = UnmodeledUse                                                  : mu*
+#  846|     v0_11(void)                     = AliasedUse                                                    : ~mu0_2
+#  846|     v0_12(void)                     = ExitFunction                                                  : 
 
 #  846| void PolymorphicDerived::~PolymorphicDerived()
 #  846|   Block 0
-#  846|     v0_0(void)                      = EnterFunction                                       : 
-#  846|     mu0_1(unknown)                  = AliasedDefinition                                   : 
-#  846|     mu0_2(unknown)                  = UnmodeledDefinition                                 : 
-#  846|     r0_3(glval<PolymorphicDerived>) = InitializeThis                                      : 
-#-----|     v0_4(void)                      = NoOp                                                : 
-#  846|     r0_5(glval<PolymorphicBase>)    = ConvertToBase[PolymorphicDerived : PolymorphicBase] : r0_3
-#  846|     r0_6(glval<unknown>)            = FunctionAddress[~PolymorphicBase]                   : 
-#  846|     v0_7(void)                      = Call                                                : func:r0_6, this:r0_5
-#  846|     mu0_8(unknown)                  = ^CallSideEffect                                     : ~mu0_2
-#  846|     v0_9(void)                      = ReturnVoid                                          : 
-#  846|     v0_10(void)                     = UnmodeledUse                                        : mu*
-#  846|     v0_11(void)                     = AliasedUse                                          : ~mu0_2
-#  846|     v0_12(void)                     = ExitFunction                                        : 
+#  846|     v0_0(void)                      = EnterFunction                                                 : 
+#  846|     mu0_1(unknown)                  = AliasedDefinition                                             : 
+#  846|     mu0_2(unknown)                  = UnmodeledDefinition                                           : 
+#  846|     r0_3(glval<PolymorphicDerived>) = InitializeThis                                                : 
+#-----|     v0_4(void)                      = NoOp                                                          : 
+#  846|     r0_5(glval<PolymorphicBase>)    = ConvertToNonVirtualBase[PolymorphicDerived : PolymorphicBase] : r0_3
+#  846|     r0_6(glval<unknown>)            = FunctionAddress[~PolymorphicBase]                             : 
+#  846|     v0_7(void)                      = Call                                                          : func:r0_6, this:r0_5
+#  846|     mu0_8(unknown)                  = ^CallSideEffect                                               : ~mu0_2
+#  846|     v0_9(void)                      = ReturnVoid                                                    : 
+#  846|     v0_10(void)                     = UnmodeledUse                                                  : mu*
+#  846|     v0_11(void)                     = AliasedUse                                                    : ~mu0_2
+#  846|     v0_12(void)                     = ExitFunction                                                  : 
 
 #  849| void DynamicCast()
 #  849|   Block 0
diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
index c37bf5c8bfc..4180c41eb5f 100644
--- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
+++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected
@@ -700,65 +700,65 @@ test.cpp:
 
 #  104| int inheritanceConversions(Derived*)
 #  104|   Block 0
-#  104|     v0_0(void)              = EnterFunction                 : 
-#  104|     m0_1(unknown)           = AliasedDefinition             : 
+#  104|     v0_0(void)              = EnterFunction                           : 
+#  104|     m0_1(unknown)           = AliasedDefinition                       : 
 #  104|         valnum = unique
-#  104|     mu0_2(unknown)          = UnmodeledDefinition           : 
+#  104|     mu0_2(unknown)          = UnmodeledDefinition                     : 
 #  104|         valnum = unique
-#  104|     r0_3(glval<Derived *>)  = VariableAddress[pd]           : 
+#  104|     r0_3(glval<Derived *>)  = VariableAddress[pd]                     : 
 #  104|         valnum = r0_3
-#  104|     m0_4(Derived *)         = InitializeParameter[pd]       : &:r0_3
+#  104|     m0_4(Derived *)         = InitializeParameter[pd]                 : &:r0_3
 #  104|         valnum = m0_4
-#  105|     r0_5(glval<int>)        = VariableAddress[x]            : 
+#  105|     r0_5(glval<int>)        = VariableAddress[x]                      : 
 #  105|         valnum = unique
-#  105|     r0_6(glval<Derived *>)  = VariableAddress[pd]           : 
+#  105|     r0_6(glval<Derived *>)  = VariableAddress[pd]                     : 
 #  105|         valnum = r0_3
-#  105|     r0_7(Derived *)         = Load                          : &:r0_6, m0_4
+#  105|     r0_7(Derived *)         = Load                                    : &:r0_6, m0_4
 #  105|         valnum = m0_4
-#  105|     r0_8(Base *)            = ConvertToBase[Derived : Base] : r0_7
+#  105|     r0_8(Base *)            = ConvertToNonVirtualBase[Derived : Base] : r0_7
 #  105|         valnum = r0_8
-#  105|     r0_9(glval<int>)        = FieldAddress[b]               : r0_8
+#  105|     r0_9(glval<int>)        = FieldAddress[b]                         : r0_8
 #  105|         valnum = r0_9
-#  105|     r0_10(int)              = Load                          : &:r0_9, ~m0_1
+#  105|     r0_10(int)              = Load                                    : &:r0_9, ~m0_1
 #  105|         valnum = r0_10
-#  105|     m0_11(int)              = Store                         : &:r0_5, r0_10
+#  105|     m0_11(int)              = Store                                   : &:r0_5, r0_10
 #  105|         valnum = r0_10
-#  106|     r0_12(glval<Base *>)    = VariableAddress[pb]           : 
+#  106|     r0_12(glval<Base *>)    = VariableAddress[pb]                     : 
 #  106|         valnum = r0_12
-#  106|     r0_13(glval<Derived *>) = VariableAddress[pd]           : 
+#  106|     r0_13(glval<Derived *>) = VariableAddress[pd]                     : 
 #  106|         valnum = r0_3
-#  106|     r0_14(Derived *)        = Load                          : &:r0_13, m0_4
+#  106|     r0_14(Derived *)        = Load                                    : &:r0_13, m0_4
 #  106|         valnum = m0_4
-#  106|     r0_15(Base *)           = ConvertToBase[Derived : Base] : r0_14
+#  106|     r0_15(Base *)           = ConvertToNonVirtualBase[Derived : Base] : r0_14
 #  106|         valnum = r0_8
-#  106|     m0_16(Base *)           = Store                         : &:r0_12, r0_15
+#  106|     m0_16(Base *)           = Store                                   : &:r0_12, r0_15
 #  106|         valnum = r0_8
-#  107|     r0_17(glval<int>)       = VariableAddress[y]            : 
+#  107|     r0_17(glval<int>)       = VariableAddress[y]                      : 
 #  107|         valnum = r0_17
-#  107|     r0_18(glval<Base *>)    = VariableAddress[pb]           : 
+#  107|     r0_18(glval<Base *>)    = VariableAddress[pb]                     : 
 #  107|         valnum = r0_12
-#  107|     r0_19(Base *)           = Load                          : &:r0_18, m0_16
+#  107|     r0_19(Base *)           = Load                                    : &:r0_18, m0_16
 #  107|         valnum = r0_8
-#  107|     r0_20(glval<int>)       = FieldAddress[b]               : r0_19
+#  107|     r0_20(glval<int>)       = FieldAddress[b]                         : r0_19
 #  107|         valnum = r0_9
-#  107|     r0_21(int)              = Load                          : &:r0_20, ~m0_1
+#  107|     r0_21(int)              = Load                                    : &:r0_20, ~m0_1
 #  107|         valnum = r0_21
-#  107|     m0_22(int)              = Store                         : &:r0_17, r0_21
+#  107|     m0_22(int)              = Store                                   : &:r0_17, r0_21
 #  107|         valnum = r0_21
-#  109|     r0_23(glval<int>)       = VariableAddress[#return]      : 
+#  109|     r0_23(glval<int>)       = VariableAddress[#return]                : 
 #  109|         valnum = r0_23
-#  109|     r0_24(glval<int>)       = VariableAddress[y]            : 
+#  109|     r0_24(glval<int>)       = VariableAddress[y]                      : 
 #  109|         valnum = r0_17
-#  109|     r0_25(int)              = Load                          : &:r0_24, m0_22
+#  109|     r0_25(int)              = Load                                    : &:r0_24, m0_22
 #  109|         valnum = r0_21
-#  109|     m0_26(int)              = Store                         : &:r0_23, r0_25
+#  109|     m0_26(int)              = Store                                   : &:r0_23, r0_25
 #  109|         valnum = r0_21
-#  104|     r0_27(glval<int>)       = VariableAddress[#return]      : 
+#  104|     r0_27(glval<int>)       = VariableAddress[#return]                : 
 #  104|         valnum = r0_23
-#  104|     v0_28(void)             = ReturnValue                   : &:r0_27, m0_26
-#  104|     v0_29(void)             = UnmodeledUse                  : mu*
-#  104|     v0_30(void)             = AliasedUse                    : ~m0_1
-#  104|     v0_31(void)             = ExitFunction                  : 
+#  104|     v0_28(void)             = ReturnValue                             : &:r0_27, m0_26
+#  104|     v0_29(void)             = UnmodeledUse                            : mu*
+#  104|     v0_30(void)             = AliasedUse                              : ~m0_1
+#  104|     v0_31(void)             = ExitFunction                            : 
 
 #  112| void test06()
 #  112|   Block 0
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
index eb07be7f30c..4e3039b933e 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
@@ -34,7 +34,7 @@ private newtype TOpcode =
   TPointerSub() or
   TPointerDiff() or
   TConvert() or
-  TConvertToBase() or
+  TConvertToNonVirtualBase() or
   TConvertToVirtualBase() or
   TConvertToDerived() or
   TCheckedConvertOrNull() or
@@ -302,8 +302,8 @@ module Opcode {
     final override string toString() { result = "Convert" }
   }
 
-  class ConvertToBase extends UnaryOpcode, TConvertToBase {
-    final override string toString() { result = "ConvertToBase" }
+  class ConvertToNonVirtualBase extends UnaryOpcode, TConvertToNonVirtualBase {
+    final override string toString() { result = "ConvertToNonVirtualBase" }
   }
 
   class ConvertToVirtualBase extends UnaryOpcode, TConvertToVirtualBase {
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
index 9f7cf68b065..4bdeedf2334 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
@@ -980,8 +980,8 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToBaseInstruction extends InheritanceConversionInstruction {
-  ConvertToBaseInstruction() { getOpcode() instanceof Opcode::ConvertToBase }
+class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
index 9f7cf68b065..4bdeedf2334 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -980,8 +980,8 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToBaseInstruction extends InheritanceConversionInstruction {
-  ConvertToBaseInstruction() { getOpcode() instanceof Opcode::ConvertToBase }
+class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
index 1f5064f6766..a90eec8c17c 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -105,7 +105,7 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset) {
     (
       // REVIEW: See the REVIEW comment bellow
       //      // Converting to a non-virtual base class adds the offset of the base class.
-      //      exists(ConvertToBaseInstruction convert |
+      //      exists(ConvertToNonVirtualBaseInstruction convert |
       //        convert = instr and
       //        bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
       //      )

From 7758b43e34fd9c6050b7fd0b6dddfe46f4d66f85 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@knef.dk>
Date: Sun, 10 Nov 2019 11:09:54 +0100
Subject: [PATCH 218/232] C++: Add ConvertToBase{Opcode,Instruction} classes

These should make it easy to match base-class conversions when it's not
important whether the base class is virtual.
---
 .../src/semmle/code/cpp/ir/implementation/Opcode.qll |  6 ++++--
 .../ir/implementation/aliased_ssa/Instruction.qll    | 12 ++++++++++--
 .../code/cpp/ir/implementation/raw/Instruction.qll   | 12 ++++++++++--
 .../ir/implementation/unaliased_ssa/Instruction.qll  | 12 ++++++++++--
 .../semmle/code/csharp/ir/implementation/Opcode.qll  |  6 ++++--
 .../csharp/ir/implementation/raw/Instruction.qll     | 12 ++++++++++--
 .../ir/implementation/unaliased_ssa/Instruction.qll  | 12 ++++++++++--
 7 files changed, 58 insertions(+), 14 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
index 4e3039b933e..0e4f800bb1b 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
@@ -110,6 +110,8 @@ abstract class RelationalOpcode extends CompareOpcode { }
 
 abstract class CopyOpcode extends Opcode { }
 
+abstract class ConvertToBaseOpcode extends UnaryOpcode { }
+
 abstract class MemoryAccessOpcode extends Opcode { }
 
 abstract class ReturnOpcode extends Opcode { }
@@ -302,11 +304,11 @@ module Opcode {
     final override string toString() { result = "Convert" }
   }
 
-  class ConvertToNonVirtualBase extends UnaryOpcode, TConvertToNonVirtualBase {
+  class ConvertToNonVirtualBase extends ConvertToBaseOpcode, TConvertToNonVirtualBase {
     final override string toString() { result = "ConvertToNonVirtualBase" }
   }
 
-  class ConvertToVirtualBase extends UnaryOpcode, TConvertToVirtualBase {
+  class ConvertToVirtualBase extends ConvertToBaseOpcode, TConvertToVirtualBase {
     final override string toString() { result = "ConvertToVirtualBase" }
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
index 4bdeedf2334..6cc1127c4bd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -980,7 +980,15 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToBaseInstruction() { getOpcode() instanceof ConvertToBaseOpcode }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToNonVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
@@ -988,7 +996,7 @@ class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstructio
  * Represents an instruction that converts from the address of a derived class
  * to the address of a virtual base class.
  */
-class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToVirtualBase }
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
index 4bdeedf2334..6cc1127c4bd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -980,7 +980,15 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToBaseInstruction() { getOpcode() instanceof ConvertToBaseOpcode }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToNonVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
@@ -988,7 +996,7 @@ class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstructio
  * Represents an instruction that converts from the address of a derived class
  * to the address of a virtual base class.
  */
-class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToVirtualBase }
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
index 4bdeedf2334..6cc1127c4bd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -980,7 +980,15 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToBaseInstruction() { getOpcode() instanceof ConvertToBaseOpcode }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToNonVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
@@ -988,7 +996,7 @@ class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstructio
  * Represents an instruction that converts from the address of a derived class
  * to the address of a virtual base class.
  */
-class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToVirtualBase }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
index 4e3039b933e..0e4f800bb1b 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
@@ -110,6 +110,8 @@ abstract class RelationalOpcode extends CompareOpcode { }
 
 abstract class CopyOpcode extends Opcode { }
 
+abstract class ConvertToBaseOpcode extends UnaryOpcode { }
+
 abstract class MemoryAccessOpcode extends Opcode { }
 
 abstract class ReturnOpcode extends Opcode { }
@@ -302,11 +304,11 @@ module Opcode {
     final override string toString() { result = "Convert" }
   }
 
-  class ConvertToNonVirtualBase extends UnaryOpcode, TConvertToNonVirtualBase {
+  class ConvertToNonVirtualBase extends ConvertToBaseOpcode, TConvertToNonVirtualBase {
     final override string toString() { result = "ConvertToNonVirtualBase" }
   }
 
-  class ConvertToVirtualBase extends UnaryOpcode, TConvertToVirtualBase {
+  class ConvertToVirtualBase extends ConvertToBaseOpcode, TConvertToVirtualBase {
     final override string toString() { result = "ConvertToVirtualBase" }
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
index 4bdeedf2334..6cc1127c4bd 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll
@@ -980,7 +980,15 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToBaseInstruction() { getOpcode() instanceof ConvertToBaseOpcode }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToNonVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
@@ -988,7 +996,7 @@ class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstructio
  * Represents an instruction that converts from the address of a derived class
  * to the address of a virtual base class.
  */
-class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToVirtualBase }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
index 4bdeedf2334..6cc1127c4bd 100644
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -980,7 +980,15 @@ class InheritanceConversionInstruction extends UnaryInstruction {
  * Represents an instruction that converts from the address of a derived class
  * to the address of a direct non-virtual base class.
  */
-class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+  ConvertToBaseInstruction() { getOpcode() instanceof ConvertToBaseOpcode }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToNonVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToNonVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToNonVirtualBase }
 }
 
@@ -988,7 +996,7 @@ class ConvertToNonVirtualBaseInstruction extends InheritanceConversionInstructio
  * Represents an instruction that converts from the address of a derived class
  * to the address of a virtual base class.
  */
-class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+class ConvertToVirtualBaseInstruction extends ConvertToBaseInstruction {
   ConvertToVirtualBaseInstruction() { getOpcode() instanceof Opcode::ConvertToVirtualBase }
 }
 

From 751263db919110e73e882e3a80222da6bcc8130b Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@knef.dk>
Date: Sun, 10 Nov 2019 11:17:35 +0100
Subject: [PATCH 219/232] C++: Use ConvertToBaseInstruction in IR data flow

This should make virtual dispatch work also for virtual bases.
---
 .../semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index d149f33e55e..9572639de59 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -57,13 +57,13 @@ private predicate overrideMayAffectCall(
  * should usually be fewer classes than calls.
  *
  * If a value is cast several classes up in the hierarchy, that will be modeled
- * as a chain of `ConvertToNonVirtualBaseInstruction`s and will cause the search to start
+ * as a chain of `ConvertToBaseInstruction`s and will cause the search to start
  * from each of them and pass through subsequent ones. There might be
  * performance to gain by stopping before a second upcast and reconstructing
  * the full chain in a "big-step" recursion after this one.
  */
 private predicate nodeMayHaveClass(Class derived, DataFlow::Node node) {
-  exists(ConvertToNonVirtualBaseInstruction toBase |
+  exists(ConvertToBaseInstruction toBase |
     derived = toBase.getDerivedClass() and
     overrideMayAffectCall(derived, _, toBase.getEnclosingFunction(), _, _) and
     node.asInstruction() = toBase

From 9151a7e43311b213c15e986e1081d27c7b4fa018 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@semmle.com>
Date: Wed, 30 Oct 2019 13:19:02 +0100
Subject: [PATCH 220/232] Python: Always enable legacy taint tracking
 configuration

If the legacy configuration is only enabled if there are no other
configurations, defining a configuration in an imported library can lead to
unwanted results. For example, code that uses `any(MyTaintKind t).taints(node)`
would *stop* working, if it did not define its own configuration. (this actually
happened to us)

We performed a dist-compare to ensure there is not a performance deg ration by
doing this. Results at https://git.semmle.com/gist/rasmuswl/a1eca07f3a92f5f65ee78d733e5d260e

Tests that were affected by this:

- RockPaperScissors + Simple: new edges because no configuration was defined for
  SqlInjectionTaint or CommandInjectionTaint
- CleartextLogging + CleartextStorage: new edges because no configuration was
  defined before, AND duplicate deges.
- TestNode: new edges because no configuration was defined before

- PathInjection: Duplicate edges
- TarSlip: Duplicate edges
- CommandInjection: Duplicate edges
- ReflectedXss: Duplicate edges
- SqlInjection: Duplicate edges
- CodeInjection: Duplicate edges
- StackTraceExposure: Duplicate edges
- UnsafeDeserialization: Duplicate edges
- UrlRedirect: Duplicate edges
---
 python/ql/src/semmle/python/dataflow/Legacy.qll     | 11 -----------
 .../taint/config/RockPaperScissors.expected         |  6 ++++++
 .../test/library-tests/taint/config/Simple.expected |  6 ++++++
 .../Security/CWE-022/PathInjection.expected         | 13 +++++++++++++
 .../query-tests/Security/CWE-022/TarSlip.expected   |  8 ++++++++
 .../Security/CWE-078/CommandInjection.expected      | 12 ++++++++++++
 .../Security/CWE-079/ReflectedXss.expected          |  5 +++++
 .../Security/CWE-089/SqlInjection.expected          |  8 ++++++++
 .../Security/CWE-094/CodeInjection.expected         |  5 +++++
 .../Security/CWE-209/StackTraceExposure.expected    |  2 ++
 .../Security/CWE-312/CleartextLogging.expected      |  3 +++
 .../Security/CWE-312/CleartextStorage.expected      |  3 +++
 .../query-tests/Security/CWE-327/TestNode.expected  |  5 +++++
 .../Security/CWE-502/UnsafeDeserialization.expected |  5 +++++
 .../Security/CWE-601/UrlRedirect.expected           |  2 ++
 15 files changed, 83 insertions(+), 11 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/Legacy.qll b/python/ql/src/semmle/python/dataflow/Legacy.qll
index d401fc1a418..94dd55e20fa 100644
--- a/python/ql/src/semmle/python/dataflow/Legacy.qll
+++ b/python/ql/src/semmle/python/dataflow/Legacy.qll
@@ -33,26 +33,18 @@ private class LegacyConfiguration extends TaintTracking::Configuration {
     }
 
     override predicate isSource(TaintSource src) {
-        isValid() and
         src = src
     }
 
     override predicate isSink(TaintSink sink) {
-        isValid() and
         sink = sink
     }
 
     override predicate isSanitizer(Sanitizer sanitizer) {
-        isValid() and
         sanitizer = sanitizer
     }
 
-    private predicate isValid() {
-        not exists(TaintTracking::Configuration config | config != this)
-    }
-
     override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest) {
-        isValid() and
         exists(DataFlowExtension::DataFlowNode legacyExtension |
             src.asCfgNode() = legacyExtension
             |
@@ -67,7 +59,6 @@ private class LegacyConfiguration extends TaintTracking::Configuration {
     }
 
     override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest, TaintKind srckind, TaintKind destkind) {
-        isValid() and
         exists(DataFlowExtension::DataFlowNode legacyExtension |
             src.asCfgNode() = legacyExtension
             |
@@ -76,7 +67,6 @@ private class LegacyConfiguration extends TaintTracking::Configuration {
     }
 
     override predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest) {
-        isValid() and
         (
             exists(DataFlowExtension::DataFlowVariable legacyExtension |
                 src.asVariable() = legacyExtension and
@@ -91,4 +81,3 @@ private class LegacyConfiguration extends TaintTracking::Configuration {
     }
 
 }
-
diff --git a/python/ql/test/library-tests/taint/config/RockPaperScissors.expected b/python/ql/test/library-tests/taint/config/RockPaperScissors.expected
index 9e8ed503047..0639e4bf227 100644
--- a/python/ql/test/library-tests/taint/config/RockPaperScissors.expected
+++ b/python/ql/test/library-tests/taint/config/RockPaperScissors.expected
@@ -28,6 +28,12 @@ edges
 | rockpaperscissors.py:25:9:25:9 | rock | rockpaperscissors.py:25:9:25:16 | scissors |
 | rockpaperscissors.py:25:9:25:16 | scissors | rockpaperscissors.py:25:9:25:23 | paper |
 | rockpaperscissors.py:25:9:25:23 | paper | rockpaperscissors.py:26:14:26:14 | paper |
+| sanitizer.py:9:9:9:20 | SQL injection | sanitizer.py:13:19:13:19 | SQL injection |
+| sanitizer.py:16:9:16:20 | Command injection | sanitizer.py:20:20:20:20 | Command injection |
+| sanitizer.py:24:9:24:20 | SQL injection | sanitizer.py:26:19:26:19 | SQL injection |
+| sanitizer.py:24:9:24:20 | SQL injection | sanitizer.py:28:19:28:19 | SQL injection |
+| sanitizer.py:31:9:31:20 | Command injection | sanitizer.py:33:20:33:20 | Command injection |
+| sanitizer.py:31:9:31:20 | Command injection | sanitizer.py:35:20:35:20 | Command injection |
 | test.py:6:9:6:14 | simple.test | test.py:7:10:7:10 | simple.test |
 | test.py:10:12:10:17 | simple.test | test.py:16:9:16:16 | simple.test |
 | test.py:10:12:10:17 | simple.test | test.py:24:9:24:16 | simple.test |
diff --git a/python/ql/test/library-tests/taint/config/Simple.expected b/python/ql/test/library-tests/taint/config/Simple.expected
index 6c2b87aa31e..108f0f12015 100644
--- a/python/ql/test/library-tests/taint/config/Simple.expected
+++ b/python/ql/test/library-tests/taint/config/Simple.expected
@@ -28,6 +28,12 @@ edges
 | rockpaperscissors.py:25:9:25:9 | rock | rockpaperscissors.py:25:9:25:16 | scissors |
 | rockpaperscissors.py:25:9:25:16 | scissors | rockpaperscissors.py:25:9:25:23 | paper |
 | rockpaperscissors.py:25:9:25:23 | paper | rockpaperscissors.py:26:14:26:14 | paper |
+| sanitizer.py:9:9:9:20 | SQL injection | sanitizer.py:13:19:13:19 | SQL injection |
+| sanitizer.py:16:9:16:20 | Command injection | sanitizer.py:20:20:20:20 | Command injection |
+| sanitizer.py:24:9:24:20 | SQL injection | sanitizer.py:26:19:26:19 | SQL injection |
+| sanitizer.py:24:9:24:20 | SQL injection | sanitizer.py:28:19:28:19 | SQL injection |
+| sanitizer.py:31:9:31:20 | Command injection | sanitizer.py:33:20:33:20 | Command injection |
+| sanitizer.py:31:9:31:20 | Command injection | sanitizer.py:35:20:35:20 | Command injection |
 | test.py:6:9:6:14 | simple.test | test.py:7:10:7:10 | simple.test |
 | test.py:10:12:10:17 | simple.test | test.py:16:9:16:16 | simple.test |
 | test.py:10:12:10:17 | simple.test | test.py:24:9:24:16 | simple.test |
diff --git a/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected b/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
index 646b22edea4..3cf398a025e 100644
--- a/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
@@ -1,16 +1,29 @@
 edges
 | path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:9:12:9:39 | externally controlled string |
+| path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:9:12:9:39 | externally controlled string |
+| path_injection.py:9:12:9:39 | externally controlled string | path_injection.py:10:40:10:43 | externally controlled string |
 | path_injection.py:9:12:9:39 | externally controlled string | path_injection.py:10:40:10:43 | externally controlled string |
 | path_injection.py:10:40:10:43 | externally controlled string | path_injection.py:10:14:10:44 | externally controlled string |
+| path_injection.py:10:40:10:43 | externally controlled string | path_injection.py:10:14:10:44 | externally controlled string |
+| path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:15:12:15:39 | externally controlled string |
 | path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:15:12:15:39 | externally controlled string |
 | path_injection.py:15:12:15:39 | externally controlled string | path_injection.py:16:56:16:59 | externally controlled string |
+| path_injection.py:15:12:15:39 | externally controlled string | path_injection.py:16:56:16:59 | externally controlled string |
+| path_injection.py:16:13:16:61 | normalized path | path_injection.py:17:14:17:18 | normalized path |
 | path_injection.py:16:13:16:61 | normalized path | path_injection.py:17:14:17:18 | normalized path |
 | path_injection.py:16:30:16:60 | externally controlled string | path_injection.py:16:13:16:61 | normalized path |
+| path_injection.py:16:30:16:60 | externally controlled string | path_injection.py:16:13:16:61 | normalized path |
+| path_injection.py:16:56:16:59 | externally controlled string | path_injection.py:16:30:16:60 | externally controlled string |
 | path_injection.py:16:56:16:59 | externally controlled string | path_injection.py:16:30:16:60 | externally controlled string |
 | path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:24:12:24:39 | externally controlled string |
+| path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:24:12:24:39 | externally controlled string |
+| path_injection.py:24:12:24:39 | externally controlled string | path_injection.py:25:56:25:59 | externally controlled string |
 | path_injection.py:24:12:24:39 | externally controlled string | path_injection.py:25:56:25:59 | externally controlled string |
 | path_injection.py:25:13:25:61 | normalized path | path_injection.py:28:14:28:18 | normalized path |
+| path_injection.py:25:13:25:61 | normalized path | path_injection.py:28:14:28:18 | normalized path |
 | path_injection.py:25:30:25:60 | externally controlled string | path_injection.py:25:13:25:61 | normalized path |
+| path_injection.py:25:30:25:60 | externally controlled string | path_injection.py:25:13:25:61 | normalized path |
+| path_injection.py:25:56:25:59 | externally controlled string | path_injection.py:25:30:25:60 | externally controlled string |
 | path_injection.py:25:56:25:59 | externally controlled string | path_injection.py:25:30:25:60 | externally controlled string |
 #select
 | path_injection.py:10:14:10:44 | Attribute() | path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:10:14:10:44 | externally controlled string | This path depends on $@. | path_injection.py:9:12:9:23 | Attribute | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-022/TarSlip.expected b/python/ql/test/query-tests/Security/CWE-022/TarSlip.expected
index d1ddd948a43..73e28287dcf 100644
--- a/python/ql/test/query-tests/Security/CWE-022/TarSlip.expected
+++ b/python/ql/test/query-tests/Security/CWE-022/TarSlip.expected
@@ -1,11 +1,19 @@
 edges
 | tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open |
+| tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open |
+| tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:17:14:17:16 | tarfile.open |
 | tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:17:14:17:16 | tarfile.open |
 | tarslip.py:17:1:17:17 | tarfile.entry | tarslip.py:18:17:18:21 | tarfile.entry |
+| tarslip.py:17:1:17:17 | tarfile.entry | tarslip.py:18:17:18:21 | tarfile.entry |
+| tarslip.py:17:14:17:16 | tarfile.open | tarslip.py:17:1:17:17 | tarfile.entry |
 | tarslip.py:17:14:17:16 | tarfile.open | tarslip.py:17:1:17:17 | tarfile.entry |
 | tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:34:14:34:16 | tarfile.open |
+| tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:34:14:34:16 | tarfile.open |
+| tarslip.py:34:1:34:17 | tarfile.entry | tarslip.py:37:17:37:21 | tarfile.entry |
 | tarslip.py:34:1:34:17 | tarfile.entry | tarslip.py:37:17:37:21 | tarfile.entry |
 | tarslip.py:34:14:34:16 | tarfile.open | tarslip.py:34:1:34:17 | tarfile.entry |
+| tarslip.py:34:14:34:16 | tarfile.open | tarslip.py:34:1:34:17 | tarfile.entry |
+| tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:24:41:26 | tarfile.open |
 | tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:24:41:26 | tarfile.open |
 #select
 | tarslip.py:13:1:13:3 | tar | tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open | Extraction of tarfile from $@ | tarslip.py:12:7:12:39 | Attribute() | a potentially untrusted source |
diff --git a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected b/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
index d3b67cc239d..3d1cf22a2d1 100644
--- a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
@@ -1,15 +1,27 @@
 edges
 | command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:10:13:10:41 | externally controlled string |
+| command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:10:13:10:41 | externally controlled string |
+| command_injection.py:10:13:10:41 | externally controlled string | command_injection.py:12:23:12:27 | externally controlled string |
 | command_injection.py:10:13:10:41 | externally controlled string | command_injection.py:12:23:12:27 | externally controlled string |
 | command_injection.py:12:23:12:27 | externally controlled string | command_injection.py:12:15:12:27 | externally controlled string |
+| command_injection.py:12:23:12:27 | externally controlled string | command_injection.py:12:15:12:27 | externally controlled string |
+| command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:17:13:17:41 | externally controlled string |
 | command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:17:13:17:41 | externally controlled string |
 | command_injection.py:17:13:17:41 | externally controlled string | command_injection.py:19:29:19:33 | externally controlled string |
+| command_injection.py:17:13:17:41 | externally controlled string | command_injection.py:19:29:19:33 | externally controlled string |
+| command_injection.py:19:29:19:33 | externally controlled string | command_injection.py:19:22:19:34 | sequence of externally controlled string |
 | command_injection.py:19:29:19:33 | externally controlled string | command_injection.py:19:22:19:34 | sequence of externally controlled string |
 | command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:24:11:24:37 | externally controlled string |
+| command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:24:11:24:37 | externally controlled string |
+| command_injection.py:24:11:24:37 | externally controlled string | command_injection.py:25:23:25:25 | externally controlled string |
 | command_injection.py:24:11:24:37 | externally controlled string | command_injection.py:25:23:25:25 | externally controlled string |
 | command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string |
+| command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string |
+| command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:30:13:30:41 | externally controlled string |
 | command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:30:13:30:41 | externally controlled string |
 | command_injection.py:30:13:30:41 | externally controlled string | command_injection.py:32:22:32:26 | externally controlled string |
+| command_injection.py:30:13:30:41 | externally controlled string | command_injection.py:32:22:32:26 | externally controlled string |
+| command_injection.py:32:22:32:26 | externally controlled string | command_injection.py:32:14:32:26 | externally controlled string |
 | command_injection.py:32:22:32:26 | externally controlled string | command_injection.py:32:14:32:26 | externally controlled string |
 #select
 | command_injection.py:12:15:12:27 | BinaryExpr | command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:12:15:12:27 | externally controlled string | This command depends on $@. | command_injection.py:10:13:10:24 | Attribute | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected b/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
index d23198b92a7..46236de24ed 100644
--- a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
+++ b/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
@@ -1,8 +1,13 @@
 edges
 | ../lib/flask/__init__.py:14:19:14:20 | externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string |
+| ../lib/flask/__init__.py:14:19:14:20 | externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string |
+| reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:7:18:7:45 | externally controlled string |
 | reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:7:18:7:45 | externally controlled string |
 | reflected_xss.py:7:18:7:45 | externally controlled string | reflected_xss.py:8:44:8:53 | externally controlled string |
+| reflected_xss.py:7:18:7:45 | externally controlled string | reflected_xss.py:8:44:8:53 | externally controlled string |
 | reflected_xss.py:8:26:8:53 | externally controlled string | ../lib/flask/__init__.py:14:19:14:20 | externally controlled string |
+| reflected_xss.py:8:26:8:53 | externally controlled string | ../lib/flask/__init__.py:14:19:14:20 | externally controlled string |
+| reflected_xss.py:8:44:8:53 | externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string |
 | reflected_xss.py:8:44:8:53 | externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string |
 #select
 | ../lib/flask/__init__.py:16:25:16:26 | rv | reflected_xss.py:7:18:7:29 | dict of externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string | Cross-site scripting vulnerability due to $@. | reflected_xss.py:7:18:7:29 | Attribute | user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected b/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
index 461d42fccf1..c137359a683 100644
--- a/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
@@ -1,11 +1,19 @@
 edges
 | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:70:19:77 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:70:19:77 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:88:22:95 | externally controlled string |
 | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:22:88:22:95 | externally controlled string |
 | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:76:23:83 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:23:76:23:83 | externally controlled string |
+| sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:78:24:85 | externally controlled string |
 | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:24:78:24:85 | externally controlled string |
 | sql_injection.py:19:70:19:77 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string |
+| sql_injection.py:19:70:19:77 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string |
+| sql_injection.py:22:88:22:95 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string |
 | sql_injection.py:22:88:22:95 | externally controlled string | sql_injection.py:22:38:22:95 | externally controlled string |
 | sql_injection.py:23:76:23:83 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string |
+| sql_injection.py:23:76:23:83 | externally controlled string | sql_injection.py:23:26:23:83 | externally controlled string |
+| sql_injection.py:24:78:24:85 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string |
 | sql_injection.py:24:78:24:85 | externally controlled string | sql_injection.py:24:28:24:85 | externally controlled string |
 #select
 | sql_injection.py:19:24:19:77 | BinaryExpr | sql_injection.py:12:24:12:31 | externally controlled string | sql_injection.py:19:24:19:77 | externally controlled string | This SQL query depends on $@. | sql_injection.py:12:24:12:31 | username | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected b/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
index e01d6b651e3..17430312cf6 100644
--- a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
@@ -1,8 +1,13 @@
 edges
 | code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:6:22:6:28 | django.request.HttpRequest |
+| code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:6:22:6:28 | django.request.HttpRequest |
+| code_injection.py:6:22:6:28 | django.request.HttpRequest | code_injection.py:6:22:6:33 | django.http.request.QueryDict |
 | code_injection.py:6:22:6:28 | django.request.HttpRequest | code_injection.py:6:22:6:33 | django.http.request.QueryDict |
 | code_injection.py:6:22:6:33 | django.http.request.QueryDict | code_injection.py:6:22:6:55 | externally controlled string |
+| code_injection.py:6:22:6:33 | django.http.request.QueryDict | code_injection.py:6:22:6:55 | externally controlled string |
 | code_injection.py:6:22:6:55 | externally controlled string | code_injection.py:7:34:7:43 | externally controlled string |
+| code_injection.py:6:22:6:55 | externally controlled string | code_injection.py:7:34:7:43 | externally controlled string |
+| code_injection.py:7:34:7:43 | externally controlled string | code_injection.py:7:14:7:44 | externally controlled string |
 | code_injection.py:7:34:7:43 | externally controlled string | code_injection.py:7:14:7:44 | externally controlled string |
 #select
 | code_injection.py:7:14:7:44 | Attribute() | code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:7:14:7:44 | externally controlled string | $@ flows to here and is interpreted as code. | code_injection.py:4:20:4:26 | request | User-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected b/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
index c714bd52fa5..8bf682bf052 100644
--- a/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
+++ b/python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
@@ -1,5 +1,7 @@
 edges
 | test.py:33:15:33:36 | exception info | test.py:34:29:34:31 | exception info |
+| test.py:33:15:33:36 | exception info | test.py:34:29:34:31 | exception info |
+| test.py:34:29:34:31 | exception info | test.py:34:16:34:32 | exception info |
 | test.py:34:29:34:31 | exception info | test.py:34:16:34:32 | exception info |
 #select
 | test.py:16:16:16:37 | Attribute() | test.py:16:16:16:37 | exception info | test.py:16:16:16:37 | exception info | $@ may be exposed to an external user | test.py:16:16:16:37 | Attribute() | Error information |
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected b/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
index cb6106aa395..7681eb91319 100644
--- a/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
+++ b/python/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
@@ -1,5 +1,8 @@
 edges
+| password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password |
 | test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password |
+| test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password |
+| test.py:20:12:20:21 | a certificate or key | test.py:22:20:22:23 | a certificate or key |
 #select
 | test.py:8:35:8:42 | password | test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password | Sensitive data returned by $@ is logged here. | test.py:7:16:7:29 | get_password() | a call returning a password |
 | test.py:14:30:14:39 | get_cert() | test.py:14:30:14:39 | a certificate or key | test.py:14:30:14:39 | a certificate or key | Sensitive data returned by $@ is logged here. | test.py:14:30:14:39 | get_cert() | a call returning a certificate or key |
diff --git a/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected b/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
index 23459c0980e..75bedd7187e 100644
--- a/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
+++ b/python/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
@@ -1,5 +1,8 @@
 edges
 | password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password |
+| password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password |
+| test.py:7:16:7:29 | a password | test.py:8:35:8:42 | a password |
+| test.py:20:12:20:21 | a certificate or key | test.py:22:20:22:23 | a certificate or key |
 | test.py:20:12:20:21 | a certificate or key | test.py:22:20:22:23 | a certificate or key |
 #select
 | password_in_cookie.py:9:33:9:40 | password | password_in_cookie.py:7:16:7:43 | a password | password_in_cookie.py:9:33:9:40 | a password | Sensitive data from $@ is stored here. | password_in_cookie.py:7:16:7:43 | Attribute() | a request parameter containing a password |
diff --git a/python/ql/test/query-tests/Security/CWE-327/TestNode.expected b/python/ql/test/query-tests/Security/CWE-327/TestNode.expected
index f49293eddec..c79f7a9d195 100644
--- a/python/ql/test/query-tests/Security/CWE-327/TestNode.expected
+++ b/python/ql/test/query-tests/Security/CWE-327/TestNode.expected
@@ -5,3 +5,8 @@
 | Taint cryptography.encryptor.RC4 | test_cryptography.py:7:17:7:34 | test_cryptography.py:7 | test_cryptography.py:7:17:7:34 | Attribute() |  |
 | Taint cryptography.encryptor.RC4 | test_cryptography.py:8:12:8:20 | test_cryptography.py:8 | test_cryptography.py:8:12:8:20 | encryptor |  |
 | Taint cryptography.encryptor.RC4 | test_cryptography.py:8:42:8:50 | test_cryptography.py:8 | test_cryptography.py:8:42:8:50 | encryptor |  |
+| Taint sensitive.data.password | test_cryptography.py:5:17:5:30 | test_cryptography.py:5 | test_cryptography.py:5:17:5:30 | get_password() |  |
+| Taint sensitive.data.password | test_cryptography.py:8:29:8:37 | test_cryptography.py:8 | test_cryptography.py:8:29:8:37 | dangerous |  |
+| Taint sensitive.data.password | test_cryptography.py:8:42:8:50 | test_cryptography.py:8 | test_cryptography.py:8:42:8:50 | encryptor |  |
+| Taint sensitive.data.password | test_pycrypto.py:5:17:5:30 | test_pycrypto.py:5 | test_pycrypto.py:5:17:5:30 | get_password() |  |
+| Taint sensitive.data.password | test_pycrypto.py:7:27:7:35 | test_pycrypto.py:7 | test_pycrypto.py:7:27:7:35 | dangerous |  |
diff --git a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected b/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
index af91773ca1d..29618f5dd68 100644
--- a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
+++ b/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
@@ -1,8 +1,13 @@
 edges
 | test.py:11:15:11:26 | dict of externally controlled string | test.py:11:15:11:41 | externally controlled string |
+| test.py:11:15:11:26 | dict of externally controlled string | test.py:11:15:11:41 | externally controlled string |
+| test.py:11:15:11:41 | externally controlled string | test.py:12:18:12:24 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:12:18:12:24 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
+| test.py:11:15:11:41 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
+| test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
+| test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
 #select
 | test.py:12:18:12:24 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:12:18:12:24 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
diff --git a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected b/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
index 94f878414da..b9deb72bd40 100644
--- a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
+++ b/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
@@ -1,5 +1,7 @@
 edges
 | test.py:7:22:7:33 | dict of externally controlled string | test.py:7:22:7:51 | externally controlled string |
+| test.py:7:22:7:33 | dict of externally controlled string | test.py:7:22:7:51 | externally controlled string |
+| test.py:7:22:7:51 | externally controlled string | test.py:8:21:8:26 | externally controlled string |
 | test.py:7:22:7:51 | externally controlled string | test.py:8:21:8:26 | externally controlled string |
 #select
 | test.py:8:21:8:26 | target | test.py:7:22:7:33 | dict of externally controlled string | test.py:8:21:8:26 | externally controlled string | Untrusted URL redirection due to $@. | test.py:7:22:7:33 | Attribute | a user-provided value |

From 281d5121784a3ac2bb3076102c90df7eff8466c1 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Mon, 11 Nov 2019 11:57:35 +0100
Subject: [PATCH 221/232] C++: Add tests for self-comparison template FP

---
 .../PointlessSelfComparison.expected          |  6 +++++
 .../BadAdditionOverflowCheck/templates.cpp    | 22 +++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected
index 2318c286c60..fd62129db77 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected	
@@ -1,3 +1,9 @@
+| templates.cpp:20:5:20:25 | ... < ... | Self comparison. |
+| templates.cpp:21:5:21:25 | ... < ... | Self comparison. |
+| templates.cpp:21:5:21:25 | ... < ... | Self comparison. |
+| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
+| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
+| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
 | test.cpp:13:11:13:21 | ... == ... | Self comparison. |
 | test.cpp:79:11:79:32 | ... == ... | Self comparison. |
 | test.cpp:83:10:83:15 | ... == ... | Self comparison. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp
new file mode 100644
index 00000000000..c625b4ff843
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp	
@@ -0,0 +1,22 @@
+struct C1 {
+  static const int value = 5;
+};
+
+struct C2 {
+  static const int value = 6;
+};
+
+template<typename T1, typename T2>
+bool compareValues() {
+  // Not all instantiations have T1 and T2 equal. Even if that's the case for
+  // all instantiations in the program, there could still be more such
+  // instantiations outside.
+  return
+    T1::value < T2::value || // GOOD [FALSE POSITIVE]
+    T1::value < T1::value || // BAD
+    C1::value < C1::value ; // BAD
+}
+
+bool callCompareValues() {
+  return compareValues<C1, C2> || compareValues<C1, C1>();
+}

From 97cc0ebc8c46b63680d121e369c4c2161f85d7c9 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Mon, 11 Nov 2019 13:53:43 +0100
Subject: [PATCH 222/232] C++: Suppress PointlessSelfComparison on templates

It's a bit crude to suppress all results in instantiations, but we're
already using this kind of suppression in `PointlessComparison.ql`
(without the `Self`) because there is no convenient alternative. It
means we lose some good results but also suppress a new false positive
in Boost that surfaced after we added support for non-type template
parameters.
---
 .../src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql  | 1 +
 .../PointlessSelfComparison.expected                       | 7 +------
 .../Arithmetic/BadAdditionOverflowCheck/templates.cpp      | 4 ++--
 3 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql b/cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql
index afe49a1053b..c89ba211bbc 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql	
@@ -19,6 +19,7 @@ where
   pointlessSelfComparison(cmp) and
   not nanTest(cmp) and
   not overflowTest(cmp) and
+  not cmp.isFromTemplateInstantiation(_) and
   not exists(MacroInvocation mi |
     // cmp is in mi
     mi.getAnExpandedElement() = cmp and
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected
index fd62129db77..8d1911edfcd 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.expected	
@@ -1,9 +1,4 @@
-| templates.cpp:20:5:20:25 | ... < ... | Self comparison. |
-| templates.cpp:21:5:21:25 | ... < ... | Self comparison. |
-| templates.cpp:21:5:21:25 | ... < ... | Self comparison. |
-| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
-| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
-| templates.cpp:22:5:22:25 | ... < ... | Self comparison. |
+| templates.cpp:17:5:17:25 | ... < ... | Self comparison. |
 | test.cpp:13:11:13:21 | ... == ... | Self comparison. |
 | test.cpp:79:11:79:32 | ... == ... | Self comparison. |
 | test.cpp:83:10:83:15 | ... == ... | Self comparison. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp
index c625b4ff843..0fbd2643404 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp	
@@ -12,8 +12,8 @@ bool compareValues() {
   // all instantiations in the program, there could still be more such
   // instantiations outside.
   return
-    T1::value < T2::value || // GOOD [FALSE POSITIVE]
-    T1::value < T1::value || // BAD
+    T1::value < T2::value || // GOOD
+    T1::value < T1::value || // BAD [NOT DETECTED]
     C1::value < C1::value ; // BAD
 }
 

From 37c78bf1ea771815f38fb8d434cc1278779b4adb Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicity@semmle.com>
Date: Mon, 11 Nov 2019 13:11:28 +0000
Subject: [PATCH 223/232] Fix poor conflict resolution in training slides

---
 docs/language/ql-training/cpp/bad-overflow-guard.rst           | 1 -
 docs/language/ql-training/cpp/control-flow-cpp.rst             | 1 -
 docs/language/ql-training/cpp/global-data-flow-cpp.rst         | 1 -
 docs/language/ql-training/cpp/intro-ql-cpp.rst                 | 1 -
 docs/language/ql-training/cpp/program-representation-cpp.rst   | 1 -
 docs/language/ql-training/cpp/snprintf.rst                     | 1 -
 docs/language/ql-training/java/global-data-flow-java.rst       | 1 -
 docs/language/ql-training/java/intro-ql-java.rst               | 1 -
 docs/language/ql-training/java/program-representation-java.rst | 1 -
 docs/language/ql-training/java/query-injection-java.rst        | 1 -
 10 files changed, 10 deletions(-)

diff --git a/docs/language/ql-training/cpp/bad-overflow-guard.rst b/docs/language/ql-training/cpp/bad-overflow-guard.rst
index 562a5e5c2d2..dceeec3320f 100644
--- a/docs/language/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/language/ql-training/cpp/bad-overflow-guard.rst
@@ -3,7 +3,6 @@ Example: Bad overflow guard
 ===========================
 
 CodeQL for C/C++
-================
 
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/cpp/control-flow-cpp.rst b/docs/language/ql-training/cpp/control-flow-cpp.rst
index 7ebbc40840c..f72633b714f 100644
--- a/docs/language/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/control-flow-cpp.rst
@@ -3,7 +3,6 @@ Analyzing control flow
 ======================
 
 CodeQL for C/C++
-================
 
 .. Include information slides here
 
diff --git a/docs/language/ql-training/cpp/global-data-flow-cpp.rst b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
index 4756aca75e3..aaa567e7a8e 100644
--- a/docs/language/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/language/ql-training/cpp/global-data-flow-cpp.rst
@@ -3,7 +3,6 @@ Introduction to global data flow
 ================================
 
 CodeQL for C/C++
-================
    
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/cpp/intro-ql-cpp.rst b/docs/language/ql-training/cpp/intro-ql-cpp.rst
index 0005916fd88..4e2cd4ca0b4 100644
--- a/docs/language/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/language/ql-training/cpp/intro-ql-cpp.rst
@@ -3,7 +3,6 @@ Introduction to variant analysis
 ================================
 
 CodeQL for C/C++
-================
 
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/cpp/program-representation-cpp.rst b/docs/language/ql-training/cpp/program-representation-cpp.rst
index f935f0a13d9..7048251aa02 100644
--- a/docs/language/ql-training/cpp/program-representation-cpp.rst
+++ b/docs/language/ql-training/cpp/program-representation-cpp.rst
@@ -3,7 +3,6 @@ Program representation
 ======================
 
 CodeQL for C/C++
-================
 
 .. rst-class:: agenda
 
diff --git a/docs/language/ql-training/cpp/snprintf.rst b/docs/language/ql-training/cpp/snprintf.rst
index 4aae094ccae..c15bf74d286 100644
--- a/docs/language/ql-training/cpp/snprintf.rst
+++ b/docs/language/ql-training/cpp/snprintf.rst
@@ -3,7 +3,6 @@ Exercise: ``snprintf`` overflow
 ===============================
 
 CodeQL for C/C++
-================
 
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/java/global-data-flow-java.rst b/docs/language/ql-training/java/global-data-flow-java.rst
index c75dfef3481..9edacde93c3 100644
--- a/docs/language/ql-training/java/global-data-flow-java.rst
+++ b/docs/language/ql-training/java/global-data-flow-java.rst
@@ -3,7 +3,6 @@ Introduction to global data flow
 ================================
 
 CodeQL for Java
-===============
 
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/java/intro-ql-java.rst b/docs/language/ql-training/java/intro-ql-java.rst
index 9ffc0cb8b2f..1666d9caca8 100644
--- a/docs/language/ql-training/java/intro-ql-java.rst
+++ b/docs/language/ql-training/java/intro-ql-java.rst
@@ -3,7 +3,6 @@ Introduction to variant analysis
 ================================
 
 CodeQL for Java
-===============
 
 .. rst-class:: setup
 
diff --git a/docs/language/ql-training/java/program-representation-java.rst b/docs/language/ql-training/java/program-representation-java.rst
index c041f1f1c41..a66a81d6083 100644
--- a/docs/language/ql-training/java/program-representation-java.rst
+++ b/docs/language/ql-training/java/program-representation-java.rst
@@ -3,7 +3,6 @@ Program representation
 ======================
 
 CodeQL for Java
-===============
 
 .. rst-class:: agenda
 
diff --git a/docs/language/ql-training/java/query-injection-java.rst b/docs/language/ql-training/java/query-injection-java.rst
index 17f346f1495..799c99e5209 100644
--- a/docs/language/ql-training/java/query-injection-java.rst
+++ b/docs/language/ql-training/java/query-injection-java.rst
@@ -3,7 +3,6 @@ Example: Query injection
 ========================
 
 CodeQL for Java
-===============
 
 .. rst-class:: setup
 

From eb55d964a8896e4421433ed79a9a07bc261de499 Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jbj@github.com>
Date: Mon, 11 Nov 2019 15:39:53 +0100
Subject: [PATCH 224/232] C++: Fix semantic merge conflict

This test output must have been wrong because I produced it with an
extractor that didn't have #2153 applied.
---
 .../test/library-tests/ir/ir/raw_ir.expected  | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 5078a471b2b..1fedd09d5a6 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -1,4 +1,28 @@
 bad_asts.cpp:
+#    9| int Bad::S::MemberFunction<int 6>(int)
+#    9|   Block 0
+#    9|     v0_0(void)        = EnterFunction            : 
+#    9|     mu0_1(unknown)    = AliasedDefinition        : 
+#    9|     mu0_2(unknown)    = UnmodeledDefinition      : 
+#    9|     r0_3(glval<S>)    = InitializeThis           : 
+#    9|     r0_4(glval<int>)  = VariableAddress[y]       : 
+#    9|     mu0_5(int)        = InitializeParameter[y]   : &:r0_4
+#   10|     r0_6(glval<int>)  = VariableAddress[#return] : 
+#   10|     r0_7(int)         = Constant[6]              : 
+#-----|     r0_8(S *)         = CopyValue                : r0_3
+#   10|     r0_9(glval<int>)  = FieldAddress[x]          : r0_8
+#   10|     r0_10(int)        = Load                     : &:r0_9, ~mu0_2
+#   10|     r0_11(int)        = Add                      : r0_7, r0_10
+#   10|     r0_12(glval<int>) = VariableAddress[y]       : 
+#   10|     r0_13(int)        = Load                     : &:r0_12, ~mu0_2
+#   10|     r0_14(int)        = Add                      : r0_11, r0_13
+#   10|     mu0_15(int)       = Store                    : &:r0_6, r0_14
+#    9|     r0_16(glval<int>) = VariableAddress[#return] : 
+#    9|     v0_17(void)       = ReturnValue              : &:r0_16, ~mu0_2
+#    9|     v0_18(void)       = UnmodeledUse             : mu*
+#    9|     v0_19(void)       = AliasedUse               : ~mu0_2
+#    9|     v0_20(void)       = ExitFunction             : 
+
 #   14| void Bad::CallBadMemberFunction()
 #   14|   Block 0
 #   14|     v0_0(void)           = EnterFunction                   : 

From 760884051cb2f1d5e9afdcb343f52890103dc8c1 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 29 Oct 2019 16:14:34 +0000
Subject: [PATCH 225/232] CPP: Add test cases using various combinations of
 width and precision specifiers, positional arguments, and flags.

---
 .../WrongTypeFormatArguments.expected         | 31 +++++++
 .../Linux_signed_chars/printf1.h              | 83 +++++++++++++++++++
 2 files changed, 114 insertions(+)

diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected
index 65f4f546976..441b62b1c2d 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
@@ -16,6 +16,37 @@
 | printf1.h:114:18:114:18 | d | This argument should be of type 'long double' but is of type 'double' |
 | printf1.h:147:19:147:19 | i | This argument should be of type 'long long' but is of type 'int' |
 | printf1.h:148:19:148:20 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int' |
+| printf1.h:159:18:159:18 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:160:18:160:18 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:167:17:167:17 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:168:18:168:18 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:169:19:169:19 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:174:17:174:17 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:175:18:175:18 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:176:19:176:19 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:180:17:180:17 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:181:20:181:20 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:183:18:183:18 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:184:21:184:21 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:186:19:186:19 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:187:22:187:22 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:189:19:189:19 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:190:22:190:22 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:192:19:192:19 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:193:22:193:22 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:194:25:194:25 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:213:28:213:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:214:28:214:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:215:28:215:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:216:28:216:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:221:18:221:18 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:222:20:222:20 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:233:22:233:22 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:233:25:233:25 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:234:22:234:22 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:234:25:234:25 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:235:22:235:22 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:235:25:235:25 | i | This argument should be of type 'char *' but is of type 'int' |
 | real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *' |
 | real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *' |
 | real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *' |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h
index ab9a9e18635..6713648267e 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h	
@@ -151,3 +151,86 @@ void fun4()
   printf("%qi\n", ll); // GOOD
   printf("%qu\n", ull); // GOOD
 }
+
+void complexFormatSymbols(int i, const char *s)
+{
+  // positional arguments
+  printf("%1$i", i, s); // GOOD
+  printf("%2$s", i, s); // GOOD [FALSE POSITIVE]
+  printf("%1$s", i, s); // BAD
+  printf("%2$i", i, s); // BAD [NOT DETECTED]
+
+  // width / precision
+  printf("%4i", i); // GOOD
+  printf("%.4i", i); // GOOD
+  printf("%4.4i", i); // GOOD
+  printf("%4s", i); // BAD
+  printf("%.4s", i); // BAD
+  printf("%4.4s", i); // BAD
+
+  printf("%4s", s); // GOOD
+  printf("%.4s", s); // GOOD
+  printf("%4.4s", s); // GOOD
+  printf("%4i", s); // BAD
+  printf("%.4i", s); // BAD
+  printf("%4.4i", s); // BAD
+
+  // variable width / precision
+  printf("%*s", i, s); // GOOD
+  printf("%*s", s, s); // BAD
+  printf("%*s", i, i); // BAD
+  printf("%.*s", i, s); // GOOD
+  printf("%.*s", s, s); // BAD
+  printf("%.*s", i, i); // BAD
+  printf("%*.4s", i, s); // GOOD
+  printf("%*.4s", s, s); // BAD
+  printf("%*.4s", i, i); // BAD
+  printf("%4.*s", i, s); // GOOD
+  printf("%4.*s", s, s); // BAD
+  printf("%4.*s", i, i); // BAD
+  printf("%*.*s", i, i, s); // GOOD
+  printf("%*.*s", s, i, s); // BAD
+  printf("%*.*s", i, s, s); // BAD
+  printf("%*.*s", i, i, i); // BAD
+
+  // positional arguments mixed with variable width / precision
+  printf("%2$*1$s", i, s); // GOOD
+  printf("%2$*2$s", i, s); // BAD [NOT DETECTED]
+  printf("%1$*1$s", i, s); // BAD [NOT DETECTED]
+
+  printf("%2$*1$.4s", i, s); // GOOD
+  printf("%2$*2$.4s", i, s); // BAD [NOT DETECTED]
+  printf("%1$*1$.4s", i, s); // BAD [NOT DETECTED]
+
+  printf("%2$.*1$s", i, s); // GOOD
+  printf("%2$.*2$s", i, s); // BAD [NOT DETECTED]
+  printf("%1$.*1$s", i, s); // BAD [NOT DETECTED]
+
+  printf("%2$4.*1$s", i, s); // GOOD
+  printf("%2$4.*2$s", i, s); // BAD [NOT DETECTED]
+  printf("%1$4.*1$s", i, s); // BAD [NOT DETECTED]
+
+  printf("%2$*1$.*1$s", i, s); // GOOD [FALSE POSITIVE]
+  printf("%2$*2$.*1$s", i, s); // BAD
+  printf("%2$*1$.*2$s", i, s); // BAD
+  printf("%1$*1$.*1$s", i, s); // BAD
+
+  // left justify flag
+  printf("%-4s", s); // GOOD
+  printf("%1$-4s", s); // GOOD
+  printf("%-4i", s); // BAD
+  printf("%1$-4i", s); // BAD
+
+  printf("%1$-4s", s, i); // GOOD
+  printf("%2$-4s", s, i); // BAD [NOT DETECTED]
+
+  printf("%1$-.4s", s, i); // GOOD
+  printf("%2$-.4s", s, i); // BAD [NOT DETECTED]
+
+  printf("%1$-4.4s", s, i); // GOOD
+  printf("%2$-4.4s", s, i); // BAD [NOT DETECTED]
+ 
+  printf("%1$-*2$s", s, i); // GOOD [FALSE POSITIVE x2]
+  printf("%2$-*2$s", s, i); // BAD [ADDITIONAL RESULT IS A FALSE POSITIVE]
+  printf("%1$-*1$s", s, i); // BAD [ADDITIONAL RESULT IS A FALSE POSITIVE]
+}

From 27478640f2f1e9cded995baab01c3811c86b6b5a Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 30 Oct 2019 14:01:44 +0000
Subject: [PATCH 226/232] CPP: Bring the logic for argument indices together in
 getFormatArgumentIndexFor.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 76 ++++++++++++-------
 1 file changed, 48 insertions(+), 28 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index 3ad27fa0394..e6948e6a4c3 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -131,16 +131,11 @@ class FormattingFunctionCall extends Expr {
   }
 
   /**
-   * Gets the argument corresponding to the nth conversion specifier
+   * Gets the argument corresponding to the nth conversion specifier.
    */
   Expr getConversionArgument(int n) {
-    exists(FormatLiteral fl, int b, int o |
-      fl = this.getFormat() and
-      b = sum(int i, int toSum | i < n and toSum = fl.getNumArgNeeded(i) | toSum) and
-      o = fl.getNumArgNeeded(n) and
-      o > 0 and
-      result = this.getFormatArgument(b + o - 1)
-    )
+    result = this
+          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 2))
   }
 
   /**
@@ -149,12 +144,8 @@ class FormattingFunctionCall extends Expr {
    * an explicit minimum field width).
    */
   Expr getMinFieldWidthArgument(int n) {
-    exists(FormatLiteral fl, int b |
-      fl = this.getFormat() and
-      b = sum(int i, int toSum | i < n and toSum = fl.getNumArgNeeded(i) | toSum) and
-      fl.hasImplicitMinFieldWidth(n) and
-      result = this.getFormatArgument(b)
-    )
+    result = this
+          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 0))
   }
 
   /**
@@ -163,13 +154,8 @@ class FormattingFunctionCall extends Expr {
    * precision).
    */
   Expr getPrecisionArgument(int n) {
-    exists(FormatLiteral fl, int b, int o |
-      fl = this.getFormat() and
-      b = sum(int i, int toSum | i < n and toSum = fl.getNumArgNeeded(i) | toSum) and
-      (if fl.hasImplicitMinFieldWidth(n) then o = 1 else o = 0) and
-      fl.hasImplicitPrecision(n) and
-      result = this.getFormatArgument(b + o)
-    )
+    result = this
+          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 1))
   }
 
   /**
@@ -784,19 +770,53 @@ class FormatLiteral extends Literal {
     )
   }
 
+  /**
+   * Holds if the nth conversion specifier of this format string (if `mode = 2`), it's
+   * minimum field width (if `mode = 0`) or it's precision (if `mode = 1`) requires a
+   * format argument.
+   *
+   * Most conversion specifiers require a format argument, whereas minimum field width
+   * and precision only require a format argument if they are present and a `*` was
+   * used for it's value in the format string.
+   */
+  private predicate hasFormatArgumentIndexFor(int n, int mode) {
+    mode = 0 and
+    this.hasImplicitMinFieldWidth(n)
+    or
+    mode = 1 and
+    this.hasImplicitPrecision(n)
+    or
+    mode = 2 and
+    exists(this.getConvSpecOffset(n)) and
+    not this.getConversionChar(n) = "m"
+  }
+
+  /**
+   * Gets the format argument index for the nth conversion specifier of this format
+   * string (if `mode = 2`), it's minimum field width (if `mode = 0`) or it's
+   * precision (if `mode = 1`).  Has no result if that element is not present.  Does
+   * not account for positional arguments (`$`).
+   */
+  int getFormatArgumentIndexFor(int n, int mode) {
+    hasFormatArgumentIndexFor(n, mode) and
+    result = count(int n2, int mode2 |
+      hasFormatArgumentIndexFor(n2, mode2) and
+      (
+        n2 < n
+        or
+        n2 = n and
+        mode2 < mode
+      )
+    )
+  }
+
   /**
    * Gets the number of arguments required by the nth conversion specifier
    * of this format string.
    */
   int getNumArgNeeded(int n) {
     exists(this.getConvSpecOffset(n)) and
-    not this.getConversionChar(n) = "%" and
-    exists(int n1, int n2, int n3 |
-      (if this.hasImplicitMinFieldWidth(n) then n1 = 1 else n1 = 0) and
-      (if this.hasImplicitPrecision(n) then n2 = 1 else n2 = 0) and
-      (if this.getConversionChar(n) = "m" then n3 = 0 else n3 = 1) and
-      result = n1 + n2 + n3
-    )
+    result = count(int mode | hasFormatArgumentIndexFor(n, mode))
   }
 
   /**

From 2430bf4c83b3a3537f4702b6595902bacf2248ba Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 30 Oct 2019 14:03:57 +0000
Subject: [PATCH 227/232] CPP: Deprecate helper version of getNumArgNeeded.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index e6948e6a4c3..678a32736ca 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -800,21 +800,24 @@ class FormatLiteral extends Literal {
   int getFormatArgumentIndexFor(int n, int mode) {
     hasFormatArgumentIndexFor(n, mode) and
     result = count(int n2, int mode2 |
-      hasFormatArgumentIndexFor(n2, mode2) and
-      (
-        n2 < n
-        or
-        n2 = n and
-        mode2 < mode
+        hasFormatArgumentIndexFor(n2, mode2) and
+        (
+          n2 < n
+          or
+          n2 = n and
+          mode2 < mode
+        )
       )
-    )
   }
 
   /**
    * Gets the number of arguments required by the nth conversion specifier
    * of this format string.
+   *
+   * DEPRECATED.  This was a helper function for `getNumArgNeeded` and is no
+   * longer required.
    */
-  int getNumArgNeeded(int n) {
+  deprecated int getNumArgNeeded(int n) {
     exists(this.getConvSpecOffset(n)) and
     result = count(int mode | hasFormatArgumentIndexFor(n, mode))
   }
@@ -828,7 +831,7 @@ class FormatLiteral extends Literal {
       // At least one conversion specifier has a parameter field, in which case,
       // they all should have.
       result = max(string s | this.getParameterField(_) = s + "$" | s.toInt())
-    else result = sum(int n, int toSum | toSum = this.getNumArgNeeded(n) | toSum)
+    else result = count(int n, int mode | hasFormatArgumentIndexFor(n, mode))
   }
 
   /**

From dff21e02dbb952bf24dc60115bf337432802bfdd Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 30 Oct 2019 15:03:53 +0000
Subject: [PATCH 228/232] CPP: Fully support positional arguments.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 57 +++++++++++++++++--
 .../WrongTypeFormatArguments.expected         | 20 ++++---
 .../Linux_signed_chars/printf1.h              | 36 ++++++------
 3 files changed, 82 insertions(+), 31 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index 678a32736ca..7919c8c83d0 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -134,8 +134,15 @@ class FormattingFunctionCall extends Expr {
    * Gets the argument corresponding to the nth conversion specifier.
    */
   Expr getConversionArgument(int n) {
-    result = this
-          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 2))
+    exists(FormatLiteral fl |
+      fl = this.getFormat() and
+      (
+        result = this.getFormatArgument(fl.getParameterFieldPositional(n))
+        or
+        result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 2)) and
+        not exists(fl.getParameterFieldPositional(n))
+      )
+    )
   }
 
   /**
@@ -144,8 +151,15 @@ class FormattingFunctionCall extends Expr {
    * an explicit minimum field width).
    */
   Expr getMinFieldWidthArgument(int n) {
-    result = this
-          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 0))
+    exists(FormatLiteral fl |
+      fl = this.getFormat() and
+      (
+        result = this.getFormatArgument(fl.getMinFieldWidthPositional(n))
+        or
+        result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 0)) and
+        not exists(fl.getMinFieldWidthPositional(n))
+      )
+    )
   }
 
   /**
@@ -154,8 +168,15 @@ class FormattingFunctionCall extends Expr {
    * precision).
    */
   Expr getPrecisionArgument(int n) {
-    result = this
-          .getFormatArgument(this.getFormat().(FormatLiteral).getFormatArgumentIndexFor(n, 1))
+    exists(FormatLiteral fl |
+      fl = this.getFormat() and
+      (
+        result = this.getFormatArgument(fl.getPrecisionPositional(n))
+        or
+        result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 1)) and
+        not exists(fl.getPrecisionPositional(n))
+      )
+    )
   }
 
   /**
@@ -354,6 +375,14 @@ class FormatLiteral extends Literal {
    */
   string getParameterField(int n) { this.parseConvSpec(n, _, result, _, _, _, _, _) }
 
+  /**
+   * Gets the parameter field of the nth conversion specifier (if it has one) as a
+   * zero-based number.
+   */
+  int getParameterFieldPositional(int n) {
+    result = this.getParameterField(n).regexpCapture("([0-9]*)\\$", 1).toInt() - 1
+  }
+
   /**
    * Gets the flags of the nth conversion specifier.
    */
@@ -423,6 +452,14 @@ class FormatLiteral extends Literal {
    */
   int getMinFieldWidth(int n) { result = this.getMinFieldWidthOpt(n).toInt() }
 
+  /**
+   * Gets the zero-based parameter number of the minimum field width of the nth
+   * conversion specifier, if it is implicit and uses a positional parameter.
+   */
+  int getMinFieldWidthPositional(int n) {
+    result = this.getMinFieldWidthOpt(n).regexpCapture("\\*([0-9]*)\\$", 1).toInt() - 1
+  }
+
   /**
    * Gets the precision of the nth conversion specifier (empty string if none is given).
    */
@@ -453,6 +490,14 @@ class FormatLiteral extends Literal {
     else result = this.getPrecisionOpt(n).regexpCapture("\\.([0-9]*)", 1).toInt()
   }
 
+  /**
+   * Gets the zero-based parameter number of the precision of the nth conversion
+   * specifier, if it is implicit and uses a positional parameter.
+   */
+  int getPrecisionPositional(int n) {
+    result = this.getPrecisionOpt(n).regexpCapture("\\.\\*([0-9]*)\\$", 1).toInt() - 1
+  }
+
   /**
    * Gets the length flag of the nth conversion specifier.
    */
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected
index 441b62b1c2d..c67057710bb 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected	
@@ -16,8 +16,8 @@
 | printf1.h:114:18:114:18 | d | This argument should be of type 'long double' but is of type 'double' |
 | printf1.h:147:19:147:19 | i | This argument should be of type 'long long' but is of type 'int' |
 | printf1.h:148:19:148:20 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int' |
-| printf1.h:159:18:159:18 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:160:18:160:18 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:161:21:161:21 | s | This argument should be of type 'int' but is of type 'char *' |
 | printf1.h:167:17:167:17 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:168:18:168:18 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:169:19:169:19 | i | This argument should be of type 'char *' but is of type 'int' |
@@ -35,18 +35,24 @@
 | printf1.h:192:19:192:19 | s | This argument should be of type 'int' but is of type 'char *' |
 | printf1.h:193:22:193:22 | s | This argument should be of type 'int' but is of type 'char *' |
 | printf1.h:194:25:194:25 | i | This argument should be of type 'char *' but is of type 'int' |
-| printf1.h:213:28:213:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:198:24:198:24 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:199:21:199:21 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:202:26:202:26 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:203:23:203:23 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:206:25:206:25 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:207:22:207:22 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:210:26:210:26 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:211:23:211:23 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:214:28:214:28 | s | This argument should be of type 'int' but is of type 'char *' |
 | printf1.h:215:28:215:28 | s | This argument should be of type 'int' but is of type 'char *' |
-| printf1.h:216:28:216:28 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:216:25:216:25 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:221:18:221:18 | s | This argument should be of type 'int' but is of type 'char *' |
 | printf1.h:222:20:222:20 | s | This argument should be of type 'int' but is of type 'char *' |
-| printf1.h:233:22:233:22 | s | This argument should be of type 'int' but is of type 'char *' |
-| printf1.h:233:25:233:25 | i | This argument should be of type 'char *' but is of type 'int' |
-| printf1.h:234:22:234:22 | s | This argument should be of type 'int' but is of type 'char *' |
+| printf1.h:225:23:225:23 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:228:24:228:24 | i | This argument should be of type 'char *' but is of type 'int' |
+| printf1.h:231:25:231:25 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:234:25:234:25 | i | This argument should be of type 'char *' but is of type 'int' |
 | printf1.h:235:22:235:22 | s | This argument should be of type 'int' but is of type 'char *' |
-| printf1.h:235:25:235:25 | i | This argument should be of type 'char *' but is of type 'int' |
 | real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *' |
 | real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *' |
 | real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *' |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h
index 6713648267e..4517cfadf56 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h	
@@ -156,9 +156,9 @@ void complexFormatSymbols(int i, const char *s)
 {
   // positional arguments
   printf("%1$i", i, s); // GOOD
-  printf("%2$s", i, s); // GOOD [FALSE POSITIVE]
+  printf("%2$s", i, s); // GOOD
   printf("%1$s", i, s); // BAD
-  printf("%2$i", i, s); // BAD [NOT DETECTED]
+  printf("%2$i", i, s); // BAD
 
   // width / precision
   printf("%4i", i); // GOOD
@@ -195,22 +195,22 @@ void complexFormatSymbols(int i, const char *s)
 
   // positional arguments mixed with variable width / precision
   printf("%2$*1$s", i, s); // GOOD
-  printf("%2$*2$s", i, s); // BAD [NOT DETECTED]
-  printf("%1$*1$s", i, s); // BAD [NOT DETECTED]
+  printf("%2$*2$s", i, s); // BAD
+  printf("%1$*1$s", i, s); // BAD
 
   printf("%2$*1$.4s", i, s); // GOOD
-  printf("%2$*2$.4s", i, s); // BAD [NOT DETECTED]
-  printf("%1$*1$.4s", i, s); // BAD [NOT DETECTED]
+  printf("%2$*2$.4s", i, s); // BAD
+  printf("%1$*1$.4s", i, s); // BAD
 
   printf("%2$.*1$s", i, s); // GOOD
-  printf("%2$.*2$s", i, s); // BAD [NOT DETECTED]
-  printf("%1$.*1$s", i, s); // BAD [NOT DETECTED]
+  printf("%2$.*2$s", i, s); // BAD
+  printf("%1$.*1$s", i, s); // BAD
 
   printf("%2$4.*1$s", i, s); // GOOD
-  printf("%2$4.*2$s", i, s); // BAD [NOT DETECTED]
-  printf("%1$4.*1$s", i, s); // BAD [NOT DETECTED]
+  printf("%2$4.*2$s", i, s); // BAD
+  printf("%1$4.*1$s", i, s); // BAD
 
-  printf("%2$*1$.*1$s", i, s); // GOOD [FALSE POSITIVE]
+  printf("%2$*1$.*1$s", i, s); // GOOD
   printf("%2$*2$.*1$s", i, s); // BAD
   printf("%2$*1$.*2$s", i, s); // BAD
   printf("%1$*1$.*1$s", i, s); // BAD
@@ -222,15 +222,15 @@ void complexFormatSymbols(int i, const char *s)
   printf("%1$-4i", s); // BAD
 
   printf("%1$-4s", s, i); // GOOD
-  printf("%2$-4s", s, i); // BAD [NOT DETECTED]
+  printf("%2$-4s", s, i); // BAD
 
   printf("%1$-.4s", s, i); // GOOD
-  printf("%2$-.4s", s, i); // BAD [NOT DETECTED]
+  printf("%2$-.4s", s, i); // BAD
 
   printf("%1$-4.4s", s, i); // GOOD
-  printf("%2$-4.4s", s, i); // BAD [NOT DETECTED]
- 
-  printf("%1$-*2$s", s, i); // GOOD [FALSE POSITIVE x2]
-  printf("%2$-*2$s", s, i); // BAD [ADDITIONAL RESULT IS A FALSE POSITIVE]
-  printf("%1$-*1$s", s, i); // BAD [ADDITIONAL RESULT IS A FALSE POSITIVE]
+  printf("%2$-4.4s", s, i); // BAD
+
+  printf("%1$-*2$s", s, i); // GOOD
+  printf("%2$-*2$s", s, i); // BAD
+  printf("%1$-*1$s", s, i); // BAD
 }

From a9fbe221bac76831fb86f4152a4477f74b3751dc Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 30 Oct 2019 15:44:41 +0000
Subject: [PATCH 229/232] CPP: Try to make the predicate names and qldoc a bit
 more consistent.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index 7919c8c83d0..c91923e30cf 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -137,10 +137,10 @@ class FormattingFunctionCall extends Expr {
     exists(FormatLiteral fl |
       fl = this.getFormat() and
       (
-        result = this.getFormatArgument(fl.getParameterFieldPositional(n))
+        result = this.getFormatArgument(fl.getParameterFieldValue(n))
         or
         result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 2)) and
-        not exists(fl.getParameterFieldPositional(n))
+        not exists(fl.getParameterFieldValue(n))
       )
     )
   }
@@ -154,10 +154,10 @@ class FormattingFunctionCall extends Expr {
     exists(FormatLiteral fl |
       fl = this.getFormat() and
       (
-        result = this.getFormatArgument(fl.getMinFieldWidthPositional(n))
+        result = this.getFormatArgument(fl.getMinFieldWidthParameterFieldValue(n))
         or
         result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 0)) and
-        not exists(fl.getMinFieldWidthPositional(n))
+        not exists(fl.getMinFieldWidthParameterFieldValue(n))
       )
     )
   }
@@ -171,10 +171,10 @@ class FormattingFunctionCall extends Expr {
     exists(FormatLiteral fl |
       fl = this.getFormat() and
       (
-        result = this.getFormatArgument(fl.getPrecisionPositional(n))
+        result = this.getFormatArgument(fl.getPrecisionParameterFieldValue(n))
         or
         result = this.getFormatArgument(fl.getFormatArgumentIndexFor(n, 1)) and
-        not exists(fl.getPrecisionPositional(n))
+        not exists(fl.getPrecisionParameterFieldValue(n))
       )
     )
   }
@@ -379,7 +379,7 @@ class FormatLiteral extends Literal {
    * Gets the parameter field of the nth conversion specifier (if it has one) as a
    * zero-based number.
    */
-  int getParameterFieldPositional(int n) {
+  int getParameterFieldValue(int n) {
     result = this.getParameterField(n).regexpCapture("([0-9]*)\\$", 1).toInt() - 1
   }
 
@@ -454,9 +454,9 @@ class FormatLiteral extends Literal {
 
   /**
    * Gets the zero-based parameter number of the minimum field width of the nth
-   * conversion specifier, if it is implicit and uses a positional parameter.
+   * conversion specifier, if it is implicit and uses a parameter field (such as `*1$`).
    */
-  int getMinFieldWidthPositional(int n) {
+  int getMinFieldWidthParameterFieldValue(int n) {
     result = this.getMinFieldWidthOpt(n).regexpCapture("\\*([0-9]*)\\$", 1).toInt() - 1
   }
 
@@ -492,9 +492,9 @@ class FormatLiteral extends Literal {
 
   /**
    * Gets the zero-based parameter number of the precision of the nth conversion
-   * specifier, if it is implicit and uses a positional parameter.
+   * specifier, if it is implicit and uses a parameter field (such as `*1$`).
    */
-  int getPrecisionPositional(int n) {
+  int getPrecisionParameterFieldValue(int n) {
     result = this.getPrecisionOpt(n).regexpCapture("\\.\\*([0-9]*)\\$", 1).toInt() - 1
   }
 
@@ -837,8 +837,8 @@ class FormatLiteral extends Literal {
   }
 
   /**
-   * Gets the format argument index for the nth conversion specifier of this format
-   * string (if `mode = 2`), it's minimum field width (if `mode = 0`) or it's
+   * Gets the computed format argument index for the nth conversion specifier of this
+   * format string (if `mode = 2`), it's minimum field width (if `mode = 0`) or it's
    * precision (if `mode = 1`).  Has no result if that element is not present.  Does
    * not account for positional arguments (`$`).
    */

From 695d4ff511c935b6fa4367eba887d73a52f8fa14 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 30 Oct 2019 15:51:29 +0000
Subject: [PATCH 230/232] CPP: Change note.

---
 change-notes/1.23/analysis-cpp.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.23/analysis-cpp.md b/change-notes/1.23/analysis-cpp.md
index c0b38ac0bf4..9a78476a2c5 100644
--- a/change-notes/1.23/analysis-cpp.md
+++ b/change-notes/1.23/analysis-cpp.md
@@ -25,6 +25,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
 | Unclear comparison precedence (`cpp/comparison-precedence`) | Fewer false positive results | False positives involving template classes and functions have been fixed. |
 | Comparison of narrow type with wide type in loop condition (`cpp/comparison-with-wider-type`) | Higher precision | The precision of this query has been increased to "high" as the alerts from this query have proved to be valuable on real-world projects. With this precision, results are now displayed by default in LGTM. |
 | Non-constant format string (`cpp/non-constant-format`) | Fewer false positive results | Fixed false positives resulting from mistmatching declarations of a formatting function. |
+| Wrong type of arguments to formatting function (`cpp/wrong-type-format-argument`) | More correct results and fewer false positive results | This query now understands explicitly specified argument numbers in format strings, such as the `1$` in `%1$s`. |
 
 ## Changes to libraries
 

From ed87f2588629a8e575436bee45b7e6fd89f2f4f8 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 4 Nov 2019 15:16:58 +0000
Subject: [PATCH 231/232] CPP: Performance improvement.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index c91923e30cf..8200cb7fb9c 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -844,14 +844,10 @@ class FormatLiteral extends Literal {
    */
   int getFormatArgumentIndexFor(int n, int mode) {
     hasFormatArgumentIndexFor(n, mode) and
-    result = count(int n2, int mode2 |
-        hasFormatArgumentIndexFor(n2, mode2) and
-        (
-          n2 < n
-          or
-          n2 = n and
-          mode2 < mode
-        )
+    (3 * n) + mode = rank[result + 1](int n2, int mode2 |
+        hasFormatArgumentIndexFor(n2, mode2)
+      |
+        (3 * n2) + mode2
       )
   }
 

From a4250be72f70361b2f88c89d9e0bd1b115b13f49 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 4 Nov 2019 15:54:55 +0000
Subject: [PATCH 232/232] CPP: Un-deprecate getNumArgNeeded(n).  Turns out I
 missed a place where it's used.

---
 cpp/ql/src/semmle/code/cpp/commons/Printf.qll | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
index 8200cb7fb9c..5bb60564c1b 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -854,11 +854,8 @@ class FormatLiteral extends Literal {
   /**
    * Gets the number of arguments required by the nth conversion specifier
    * of this format string.
-   *
-   * DEPRECATED.  This was a helper function for `getNumArgNeeded` and is no
-   * longer required.
    */
-  deprecated int getNumArgNeeded(int n) {
+  int getNumArgNeeded(int n) {
     exists(this.getConvSpecOffset(n)) and
     result = count(int mode | hasFormatArgumentIndexFor(n, mode))
   }