From 4a37da35939b3c1bfc5b79b6ed92042af1371ebe Mon Sep 17 00:00:00 2001
From: amammad
Date: Sun, 25 Jun 2023 20:04:50 +1000
Subject: [PATCH 001/500] V1
---
.../CWE/CWE-409-DecompressionBomb/Bombs.ql | 69 +++++++++
.../DecompressionBomb.qhelp | 35 +++++
.../CWE-409-DecompressionBomb/example_bad.cpp | 30 ++++
.../example_good.cpp | 38 +++++
.../DecompressionBomb.ql | 121 +++++++++++++++
.../DecompressionBombs.qhelp | 26 ++++
.../RemoteFlowSource.qll | 62 ++++++++
.../DecompressionBombs.cs | 140 ++++++++++++++++++
.../DecompressionBombs.qlref | 1 +
9 files changed, 522 insertions(+)
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
create mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
create mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
create mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
create mode 100644 csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
create mode 100644 csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
new file mode 100644
index 00000000000..2e595bb11b8
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
@@ -0,0 +1,69 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision medium
+ * @id cpp/user-controlled-file-decompression
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * The `gzopen` function, which can perform command substitution.
+ */
+private class GzopenFunction extends Function {
+ GzopenFunction() { hasGlobalName("gzopen") }
+}
+
+/**
+ * The `gzread` function, which can perform command substitution.
+ */
+private class GzreadFunction extends Function {
+ GzreadFunction() { hasGlobalName("gzread") }
+}
+
+module ZlibTaintConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) {
+ exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
+ fc.getArgument(0) = source.asExpr()
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink) {
+ exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ not sanitizer(fc)
+ )
+ }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
+}
+
+predicate sanitizer(FunctionCall fc) {
+ exists(Expr e | fc.getTarget() instanceof GzreadFunction |
+ // a RelationalOperation which isn't compared with a Literal that using for end of read
+ TaintTracking::localExprTaint(fc, e.(RelationalOperation).getAChild*()) and
+ not e.getAChild*().(Literal).getValue() = ["0", "1", "-1"]
+ )
+}
+
+module ZlibTaint = TaintTracking::Global;
+
+import ZlibTaint::PathGraph
+
+from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
+where ZlibTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This file extraction depends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
new file mode 100644
index 00000000000..44256d36ea9
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
@@ -0,0 +1,35 @@
+
+
+
+Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks.
+Attackers can compress a huge file which created by repeated similiar byte and convert it to a small compressed file.
+
+
+
+
+When you want to decompress a user-provided compressed file you must be careful about the decompression ratio or read these files within a loop byte by byte to be able to manage the decompressed size in each cycle of the loop.
+
+
+
+
+
+Reading uncompressed Gzip file within a loop and check for a threshold size in each cycle.
+
+
+
+
+An Unsafe Approach can be this example which we don't check for uncompressed size.
+
+
+
+
+
+
+
+A great research to gain more impact by this kind of attacks
+
+
+
+
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
new file mode 100644
index 00000000000..843b200231a
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
@@ -0,0 +1,30 @@
+#include
+#include
+#include "zlib.h"
+int UnsafeRead() {
+ std::cout << "enter compressed file name!\n" << std::endl;
+ char fileName[100];
+ std::cin >> fileName;
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (inFileZ == nullptr) {
+ printf("Error: Failed to gzopen %s\n", fileName);
+ exit(0);
+ }
+ unsigned char unzipBuffer[8192];
+ unsigned int unzippedBytes;
+ std::vector unzippedData;
+ while (true) {
+ unzippedBytes = gzread(inFileZ, unzipBuffer, 8192);
+ if (unzippedBytes > 0) {
+ unzippedData.insert(unzippedData.end(), unzipBuffer, unzipBuffer + unzippedBytes);
+ } else {
+ break;
+ }
+ }
+
+ for ( auto &&i: unzippedData)
+ std::cout << i;
+ gzclose(inFileZ);
+
+ return 0;
+}
\ No newline at end of file
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
new file mode 100644
index 00000000000..3d26569bdb4
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
@@ -0,0 +1,38 @@
+#include
+#include
+#include "zlib.h"
+int SafeRead() {
+ std::cout << "enter compressed file name!\n" << std::endl;
+ char fileName[100];
+ std::cin >> fileName;
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (inFileZ == nullptr) {
+ printf("Error: Failed to gzopen %s\n", fileName);
+ exit(0);
+ }
+ unsigned char unzipBuffer[8192];
+ unsigned int unzippedBytes;
+ uint totalRead = 0;
+ std::vector unzippedData;
+ while (true) {
+ unzippedBytes = gzread(inFileZ, unzipBuffer, 8192);
+ totalRead += unzippedBytes;
+ if (unzippedBytes > 0) {
+ unzippedData.insert(unzippedData.end(), unzipBuffer, unzipBuffer + unzippedBytes);
+ if (totalRead > 1024 * 1024 * 4) {
+ std::cout << "Bombs!" << totalRead;
+ exit(1);
+ } else {
+ std::cout << "not Bomb yet!!" << totalRead << std::endl;
+ }
+ } else {
+ break;
+ }
+ }
+
+ for (auto &&i: unzippedData)
+ std::cout << i;
+ gzclose(inFileZ);
+
+ return 0;
+}
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
new file mode 100644
index 00000000000..72f81731800
--- /dev/null
+++ b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
@@ -0,0 +1,121 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision medium
+ * @id cs/user-controlled-file-decompression
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import csharp
+import semmle.code.csharp.security.dataflow.flowsources.Remote
+
+/**
+ * A data flow source for unsafe Decompression extraction.
+ */
+abstract class DecompressionSource extends DataFlow::Node { }
+
+class ZipOpenReadSource extends DecompressionSource {
+ ZipOpenReadSource() {
+ exists(MethodCall mc |
+ mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFile", ["OpenRead", "Open"]) and
+ this.asExpr() = mc.getArgument(0) and
+ not mc.getArgument(0).getType().isConst()
+ )
+ }
+}
+
+/** A path argument to a call to the `ZipArchive` constructor call. */
+class ZipArchiveArgSource extends DecompressionSource {
+ ZipArchiveArgSource() {
+ exists(ObjectCreation oc |
+ oc.getTarget().getDeclaringType().hasQualifiedName("System.IO.Compression", "ZipArchive")
+ |
+ this.asExpr() = oc.getArgument(0)
+ )
+ }
+}
+
+/**
+ * A data flow sink for unsafe zip extraction.
+ */
+abstract class DecompressionSink extends DataFlow::Node { }
+
+/** A Caller of the `ExtractToFile` method. */
+class ExtractToFileCallSink extends DecompressionSink {
+ ExtractToFileCallSink() {
+ exists(MethodCall mc |
+ mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and
+ this.asExpr() = mc.getArgumentForName("source")
+ )
+ }
+}
+
+/** A Qualifier of the `Open()` method. */
+class OpenCallSink extends DecompressionSink {
+ OpenCallSink() {
+ exists(MethodCall mc |
+ mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipArchiveEntry", "Open") and
+ this.asExpr() = mc.getQualifier()
+ )
+ }
+}
+
+/** A Call to the `GZipStreamSink` first arugument of Constructor Call . */
+class GZipStreamSink extends DecompressionSink, DecompressionSource {
+ GZipStreamSink() {
+ exists(Constructor mc |
+ mc.getDeclaringType().hasQualifiedName("System.IO.Compression", "GZipStream") and
+ this.asExpr() = mc.getACall().getArgument(0)
+ )
+ }
+}
+
+/**
+ * A taint tracking configuration for Decompression Bomb.
+ */
+private module DecompressionBombConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) {
+ source instanceof DecompressionSource
+ or
+ source instanceof RemoteFlowSource
+ }
+
+ predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionSink }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ // var node2 = new ZipArchive(node1, ZipArchiveMode.Read);
+ exists(ObjectCreation oc |
+ oc.getTarget().getDeclaringType().hasQualifiedName("System.IO.Compression", "ZipArchive") and
+ node2.asExpr() = oc and
+ node1.asExpr() = oc.getArgumentForName("stream")
+ )
+ or
+ // var node2 = node1.ExtractToFile("./output.txt", true)
+ exists(MethodCall mc |
+ mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and
+ node2.asExpr() = mc and
+ node1.asExpr() = mc.getArgumentForName("source")
+ )
+ or
+ // var node2 = node1.OpenReadStream()
+ exists(MethodCall mc |
+ mc.getTarget().hasQualifiedName("Microsoft.AspNetCore.Http", "IFormFile", "OpenReadStream") and
+ node2.asExpr() = mc and
+ node1.asExpr() = mc.getQualifier()
+ )
+ }
+}
+
+module DecompressionBomb = TaintTracking::Global;
+
+import DecompressionBomb::PathGraph
+
+from DecompressionBomb::PathNode source, DecompressionBomb::PathNode sink
+where DecompressionBomb::flowPath(source, sink)
+select sink.getNode(), source, sink, "This file extraction depends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
new file mode 100644
index 00000000000..c3c874cddf7
--- /dev/null
+++ b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
@@ -0,0 +1,26 @@
+
+
+
+Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks.
+Attackers can compress a huge file which created by repeated similiar byte and convert it to a small compressed file.
+
+
+
+
+When you want to decompress a user-provided compressed file you must be careful about the decompression ratio or read these files within a loop byte by byte to be able to manage the decompressed size in each cycle of the loop.
+
+
+
+
+A good Blog Post about decompression bombs and recommended method is already written by Gérald Barré in this blog post
+
+
+
+
+A great research to gain more impact by this kind of attack
+
+
+
+
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
new file mode 100644
index 00000000000..f849ab3f4a1
--- /dev/null
+++ b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
@@ -0,0 +1,62 @@
+import csharp
+import semmle.code.csharp.security.dataflow.flowsources.Remote
+
+/** A data flow source of remote user input by Form File (ASP.NET unvalidated request data). */
+class FormFile extends AspNetRemoteFlowSource {
+ FormFile() {
+ exists(MethodCall mc |
+ mc.getTarget()
+ .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
+ "IFormFile", ["OpenReadStream", "ContentType", "ContentDisposition", "Name", "FileName"]) and
+ this.asExpr() = mc
+ )
+ or
+ exists(MethodCall mc |
+ mc.getTarget()
+ .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
+ "IFormFile", "CopyTo") and
+ this.asParameter() = mc.getTarget().getParameter(0)
+ )
+ or
+ exists(Property fa |
+ fa.getDeclaringType()
+ .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
+ "IFormFile") and
+ fa.hasName(["ContentType", "ContentDisposition", "Name", "FileName"]) and
+ this.asExpr() = fa.getAnAccess()
+ )
+ }
+
+ override string getSourceType() {
+ result = "ASP.NET unvalidated request data from multipart request"
+ }
+}
+
+/** A data flow source of remote user input by Form (ASP.NET unvalidated request data). */
+class FormCollection extends AspNetRemoteFlowSource {
+ FormCollection() {
+ exists(Property fa |
+ fa.getDeclaringType().hasQualifiedName("Microsoft.AspNetCore.Http", "IFormCollection") and
+ fa.hasName("Keys") and
+ this.asExpr() = fa.getAnAccess()
+ )
+ }
+
+ override string getSourceType() {
+ result = "ASP.NET unvalidated request data from multipart request Form Keys"
+ }
+}
+
+/** A data flow source of remote user input by Headers (ASP.NET unvalidated request data). */
+class HeaderDictionary extends AspNetRemoteFlowSource {
+ HeaderDictionary() {
+ exists(Property fa |
+ fa.getDeclaringType().hasQualifiedName("Microsoft.AspNetCore.Http", "IHeaderDictionary") and
+ this.asExpr() = fa.getAnAccess()
+ )
+ }
+
+ override string getSourceType() {
+ result = "ASP.NET unvalidated request data from Headers of request"
+ }
+}
diff --git a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
new file mode 100644
index 00000000000..b73eac9bade
--- /dev/null
+++ b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
@@ -0,0 +1,140 @@
+using System.IO.Compression;
+using Microsoft.AspNetCore.Mvc;
+
+// For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860
+
+namespace MultipartFormWebAPITest.Controllers
+{
+ [Route("api/[controller]")]
+ [ApiController]
+ public class ZipFile1Controller : ControllerBase
+ {
+ // POST api/
+ [HttpPost]
+ public string Post(List files)
+ {
+ if (!Request.ContentType!.StartsWith("multipart/form-data"))
+ return "400";
+ if (files.Count == 0)
+ return "400";
+ foreach (var formFile in files)
+ {
+ using var readStream = formFile.OpenReadStream();
+ if (readStream.Length == 0) return "400";
+ ZipHelpers.Bomb3(readStream);
+ ZipHelpers.Bomb2(formFile.FileName);
+ ZipHelpers.Bomb1(formFile.FileName);
+ }
+ var tmp = Request.Form["aa"];
+ var tmp2 = Request.Form.Keys;
+ // when we don't have only one file as body
+ ZipHelpers.Bomb3(Request.Body);
+ ZipHelpers.Bomb2(Request.Query["param1"].ToString());
+ var headers = Request.Headers;
+ ZipHelpers.Bomb1(headers.ETag);
+ return "200";
+ }
+ }
+}
+
+internal static class ZipHelpers
+{
+ public static void Bomb3(Stream compressedFileStream)
+ {
+ // using FileStream compressedFileStream = File.Open(CompressedFileName, FileMode.Open);
+ // using FileStream outputFileStream = File.Create(DecompressedFileName);
+ using var decompressor = new GZipStream(compressedFileStream, CompressionMode.Decompress);
+ using var ms = new MemoryStream();
+ decompressor.CopyTo(ms);
+ }
+
+ public static void Bomb2(string filename)
+ {
+ using var zipToOpen = new FileStream(filename, FileMode.Open);
+ using var archive = new ZipArchive(zipToOpen, ZipArchiveMode.Read);
+ foreach (var entry in archive.Entries) entry.ExtractToFile("./output.txt", true); // Sensitive
+ }
+
+ public static void Bomb1(string filename)
+ {
+ const long maxLength = 10 * 1024 * 1024; // 10MB
+ // var filename = "/home/am/0_WorkDir/Payloads/Bombs/bombs-bones-codes-BH-2016/archives/evil-headers/10GB.zip";
+ using var zipFile = ZipFile.OpenRead(filename);
+ // Quickly check the value from the zip header
+ var declaredSize = zipFile.Entries.Sum(entry => entry.Length);
+ if (declaredSize > maxLength)
+ throw new Exception("Archive is too big");
+ foreach (var entry in zipFile.Entries)
+ {
+ using var entryStream = entry.Open();
+ // Use MaxLengthStream to ensure we don't read more than the declared length
+ using var maxLengthStream = new MaxLengthStream(entryStream, entry.Length);
+ // Be sure to use the maxLengthSteam variable to read the content of the entry, not entryStream
+ using var ms = new MemoryStream();
+ maxLengthStream.CopyTo(ms);
+ }
+ }
+}
+
+internal sealed class MaxLengthStream : Stream
+{
+ private readonly Stream _stream;
+ private long _length;
+
+ public MaxLengthStream(Stream stream, long maxLength)
+ {
+ _stream = stream ?? throw new ArgumentNullException(nameof(stream));
+ MaxLength = maxLength;
+ }
+
+ private long MaxLength { get; }
+
+ public override bool CanRead => _stream.CanRead;
+ public override bool CanSeek => false;
+ public override bool CanWrite => false;
+ public override long Length => _stream.Length;
+
+ public override long Position
+ {
+ get => _stream.Position;
+ set => throw new NotSupportedException();
+ }
+
+ public override int Read(byte[] buffer, int offset, int count)
+ {
+ var result = _stream.Read(buffer, offset, count);
+ _length += result;
+ if (_length > MaxLength)
+ throw new Exception("Stream is larger than the maximum allowed size");
+
+ return result;
+ }
+
+ // TODO ReadAsync
+
+ public override void Flush()
+ {
+ throw new NotSupportedException();
+ }
+
+ public override long Seek(long offset, SeekOrigin origin)
+ {
+ throw new NotSupportedException();
+ }
+
+ public override void SetLength(long value)
+ {
+ throw new NotSupportedException();
+ }
+
+ public override void Write(byte[] buffer, int offset, int count)
+ {
+ throw new NotSupportedException();
+ }
+
+ protected override void Dispose(bool disposing)
+ {
+ _stream.Dispose();
+ base.Dispose(disposing);
+ }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
new file mode 100644
index 00000000000..19b7ebbb843
--- /dev/null
+++ b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
@@ -0,0 +1 @@
+experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
\ No newline at end of file
From 430375e2f01859e481de54860b3eadd11c614e00 Mon Sep 17 00:00:00 2001
From: amammad
Date: Sun, 25 Jun 2023 20:28:45 +1000
Subject: [PATCH 002/500] fix a commit mistake
---
.../DecompressionBomb.ql | 121 ---------------
.../DecompressionBombs.qhelp | 26 ----
.../RemoteFlowSource.qll | 62 --------
.../DecompressionBombs.cs | 140 ------------------
.../DecompressionBombs.qlref | 1 -
5 files changed, 350 deletions(-)
delete mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
delete mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
delete mode 100644 csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
delete mode 100644 csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
delete mode 100644 csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
deleted file mode 100644
index 72f81731800..00000000000
--- a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
+++ /dev/null
@@ -1,121 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision medium
- * @id cs/user-controlled-file-decompression
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.Remote
-
-/**
- * A data flow source for unsafe Decompression extraction.
- */
-abstract class DecompressionSource extends DataFlow::Node { }
-
-class ZipOpenReadSource extends DecompressionSource {
- ZipOpenReadSource() {
- exists(MethodCall mc |
- mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFile", ["OpenRead", "Open"]) and
- this.asExpr() = mc.getArgument(0) and
- not mc.getArgument(0).getType().isConst()
- )
- }
-}
-
-/** A path argument to a call to the `ZipArchive` constructor call. */
-class ZipArchiveArgSource extends DecompressionSource {
- ZipArchiveArgSource() {
- exists(ObjectCreation oc |
- oc.getTarget().getDeclaringType().hasQualifiedName("System.IO.Compression", "ZipArchive")
- |
- this.asExpr() = oc.getArgument(0)
- )
- }
-}
-
-/**
- * A data flow sink for unsafe zip extraction.
- */
-abstract class DecompressionSink extends DataFlow::Node { }
-
-/** A Caller of the `ExtractToFile` method. */
-class ExtractToFileCallSink extends DecompressionSink {
- ExtractToFileCallSink() {
- exists(MethodCall mc |
- mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and
- this.asExpr() = mc.getArgumentForName("source")
- )
- }
-}
-
-/** A Qualifier of the `Open()` method. */
-class OpenCallSink extends DecompressionSink {
- OpenCallSink() {
- exists(MethodCall mc |
- mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipArchiveEntry", "Open") and
- this.asExpr() = mc.getQualifier()
- )
- }
-}
-
-/** A Call to the `GZipStreamSink` first arugument of Constructor Call . */
-class GZipStreamSink extends DecompressionSink, DecompressionSource {
- GZipStreamSink() {
- exists(Constructor mc |
- mc.getDeclaringType().hasQualifiedName("System.IO.Compression", "GZipStream") and
- this.asExpr() = mc.getACall().getArgument(0)
- )
- }
-}
-
-/**
- * A taint tracking configuration for Decompression Bomb.
- */
-private module DecompressionBombConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) {
- source instanceof DecompressionSource
- or
- source instanceof RemoteFlowSource
- }
-
- predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionSink }
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- // var node2 = new ZipArchive(node1, ZipArchiveMode.Read);
- exists(ObjectCreation oc |
- oc.getTarget().getDeclaringType().hasQualifiedName("System.IO.Compression", "ZipArchive") and
- node2.asExpr() = oc and
- node1.asExpr() = oc.getArgumentForName("stream")
- )
- or
- // var node2 = node1.ExtractToFile("./output.txt", true)
- exists(MethodCall mc |
- mc.getTarget().hasQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and
- node2.asExpr() = mc and
- node1.asExpr() = mc.getArgumentForName("source")
- )
- or
- // var node2 = node1.OpenReadStream()
- exists(MethodCall mc |
- mc.getTarget().hasQualifiedName("Microsoft.AspNetCore.Http", "IFormFile", "OpenReadStream") and
- node2.asExpr() = mc and
- node1.asExpr() = mc.getQualifier()
- )
- }
-}
-
-module DecompressionBomb = TaintTracking::Global;
-
-import DecompressionBomb::PathGraph
-
-from DecompressionBomb::PathNode source, DecompressionBomb::PathNode sink
-where DecompressionBomb::flowPath(source, sink)
-select sink.getNode(), source, sink, "This file extraction depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
deleted file mode 100644
index c3c874cddf7..00000000000
--- a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qhelp
+++ /dev/null
@@ -1,26 +0,0 @@
-
-
-
-Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks.
-Attackers can compress a huge file which created by repeated similiar byte and convert it to a small compressed file.
-
-
-
-
-When you want to decompress a user-provided compressed file you must be careful about the decompression ratio or read these files within a loop byte by byte to be able to manage the decompressed size in each cycle of the loop.
-
-
-
-
-A good Blog Post about decompression bombs and recommended method is already written by Gérald Barré in this blog post
-
-
-
-
-A great research to gain more impact by this kind of attack
-
-
-
-
diff --git a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll b/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
deleted file mode 100644
index f849ab3f4a1..00000000000
--- a/csharp/ql/src/experimental/CWE-502-DecompressionBombs/RemoteFlowSource.qll
+++ /dev/null
@@ -1,62 +0,0 @@
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.Remote
-
-/** A data flow source of remote user input by Form File (ASP.NET unvalidated request data). */
-class FormFile extends AspNetRemoteFlowSource {
- FormFile() {
- exists(MethodCall mc |
- mc.getTarget()
- .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
- "IFormFile", ["OpenReadStream", "ContentType", "ContentDisposition", "Name", "FileName"]) and
- this.asExpr() = mc
- )
- or
- exists(MethodCall mc |
- mc.getTarget()
- .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
- "IFormFile", "CopyTo") and
- this.asParameter() = mc.getTarget().getParameter(0)
- )
- or
- exists(Property fa |
- fa.getDeclaringType()
- .hasQualifiedName(["Microsoft.AspNetCore.Http", "Microsoft.AspNetCore.Http.Features"],
- "IFormFile") and
- fa.hasName(["ContentType", "ContentDisposition", "Name", "FileName"]) and
- this.asExpr() = fa.getAnAccess()
- )
- }
-
- override string getSourceType() {
- result = "ASP.NET unvalidated request data from multipart request"
- }
-}
-
-/** A data flow source of remote user input by Form (ASP.NET unvalidated request data). */
-class FormCollection extends AspNetRemoteFlowSource {
- FormCollection() {
- exists(Property fa |
- fa.getDeclaringType().hasQualifiedName("Microsoft.AspNetCore.Http", "IFormCollection") and
- fa.hasName("Keys") and
- this.asExpr() = fa.getAnAccess()
- )
- }
-
- override string getSourceType() {
- result = "ASP.NET unvalidated request data from multipart request Form Keys"
- }
-}
-
-/** A data flow source of remote user input by Headers (ASP.NET unvalidated request data). */
-class HeaderDictionary extends AspNetRemoteFlowSource {
- HeaderDictionary() {
- exists(Property fa |
- fa.getDeclaringType().hasQualifiedName("Microsoft.AspNetCore.Http", "IHeaderDictionary") and
- this.asExpr() = fa.getAnAccess()
- )
- }
-
- override string getSourceType() {
- result = "ASP.NET unvalidated request data from Headers of request"
- }
-}
diff --git a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
deleted file mode 100644
index b73eac9bade..00000000000
--- a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.cs
+++ /dev/null
@@ -1,140 +0,0 @@
-using System.IO.Compression;
-using Microsoft.AspNetCore.Mvc;
-
-// For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860
-
-namespace MultipartFormWebAPITest.Controllers
-{
- [Route("api/[controller]")]
- [ApiController]
- public class ZipFile1Controller : ControllerBase
- {
- // POST api/
- [HttpPost]
- public string Post(List files)
- {
- if (!Request.ContentType!.StartsWith("multipart/form-data"))
- return "400";
- if (files.Count == 0)
- return "400";
- foreach (var formFile in files)
- {
- using var readStream = formFile.OpenReadStream();
- if (readStream.Length == 0) return "400";
- ZipHelpers.Bomb3(readStream);
- ZipHelpers.Bomb2(formFile.FileName);
- ZipHelpers.Bomb1(formFile.FileName);
- }
- var tmp = Request.Form["aa"];
- var tmp2 = Request.Form.Keys;
- // when we don't have only one file as body
- ZipHelpers.Bomb3(Request.Body);
- ZipHelpers.Bomb2(Request.Query["param1"].ToString());
- var headers = Request.Headers;
- ZipHelpers.Bomb1(headers.ETag);
- return "200";
- }
- }
-}
-
-internal static class ZipHelpers
-{
- public static void Bomb3(Stream compressedFileStream)
- {
- // using FileStream compressedFileStream = File.Open(CompressedFileName, FileMode.Open);
- // using FileStream outputFileStream = File.Create(DecompressedFileName);
- using var decompressor = new GZipStream(compressedFileStream, CompressionMode.Decompress);
- using var ms = new MemoryStream();
- decompressor.CopyTo(ms);
- }
-
- public static void Bomb2(string filename)
- {
- using var zipToOpen = new FileStream(filename, FileMode.Open);
- using var archive = new ZipArchive(zipToOpen, ZipArchiveMode.Read);
- foreach (var entry in archive.Entries) entry.ExtractToFile("./output.txt", true); // Sensitive
- }
-
- public static void Bomb1(string filename)
- {
- const long maxLength = 10 * 1024 * 1024; // 10MB
- // var filename = "/home/am/0_WorkDir/Payloads/Bombs/bombs-bones-codes-BH-2016/archives/evil-headers/10GB.zip";
- using var zipFile = ZipFile.OpenRead(filename);
- // Quickly check the value from the zip header
- var declaredSize = zipFile.Entries.Sum(entry => entry.Length);
- if (declaredSize > maxLength)
- throw new Exception("Archive is too big");
- foreach (var entry in zipFile.Entries)
- {
- using var entryStream = entry.Open();
- // Use MaxLengthStream to ensure we don't read more than the declared length
- using var maxLengthStream = new MaxLengthStream(entryStream, entry.Length);
- // Be sure to use the maxLengthSteam variable to read the content of the entry, not entryStream
- using var ms = new MemoryStream();
- maxLengthStream.CopyTo(ms);
- }
- }
-}
-
-internal sealed class MaxLengthStream : Stream
-{
- private readonly Stream _stream;
- private long _length;
-
- public MaxLengthStream(Stream stream, long maxLength)
- {
- _stream = stream ?? throw new ArgumentNullException(nameof(stream));
- MaxLength = maxLength;
- }
-
- private long MaxLength { get; }
-
- public override bool CanRead => _stream.CanRead;
- public override bool CanSeek => false;
- public override bool CanWrite => false;
- public override long Length => _stream.Length;
-
- public override long Position
- {
- get => _stream.Position;
- set => throw new NotSupportedException();
- }
-
- public override int Read(byte[] buffer, int offset, int count)
- {
- var result = _stream.Read(buffer, offset, count);
- _length += result;
- if (_length > MaxLength)
- throw new Exception("Stream is larger than the maximum allowed size");
-
- return result;
- }
-
- // TODO ReadAsync
-
- public override void Flush()
- {
- throw new NotSupportedException();
- }
-
- public override long Seek(long offset, SeekOrigin origin)
- {
- throw new NotSupportedException();
- }
-
- public override void SetLength(long value)
- {
- throw new NotSupportedException();
- }
-
- public override void Write(byte[] buffer, int offset, int count)
- {
- throw new NotSupportedException();
- }
-
- protected override void Dispose(bool disposing)
- {
- _stream.Dispose();
- base.Dispose(disposing);
- }
-}
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref b/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
deleted file mode 100644
index 19b7ebbb843..00000000000
--- a/csharp/ql/test/experimental/CWE-502-DecompressionBombs/DecompressionBombs.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/CWE-502-DecompressionBombs/DecompressionBomb.ql
\ No newline at end of file
From ae98510f77671bb55e1a56f3a28b7acba4fb8205 Mon Sep 17 00:00:00 2001
From: amammad
Date: Mon, 26 Jun 2023 00:21:55 +1000
Subject: [PATCH 003/500] add more source and sinks and sanitizers
---
.../CWE/CWE-409-DecompressionBomb/Bombs.ql | 69 ---------
.../DecompressionBombsGzopen.ql | 139 ++++++++++++++++++
.../DecompressionBombsInflator.ql | 56 +++++++
.../DecompressionBombsUncompress.ql | 56 +++++++
4 files changed, 251 insertions(+), 69 deletions(-)
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
deleted file mode 100644
index 2e595bb11b8..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bombs.ql
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision medium
- * @id cpp/user-controlled-file-decompression
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * The `gzopen` function, which can perform command substitution.
- */
-private class GzopenFunction extends Function {
- GzopenFunction() { hasGlobalName("gzopen") }
-}
-
-/**
- * The `gzread` function, which can perform command substitution.
- */
-private class GzreadFunction extends Function {
- GzreadFunction() { hasGlobalName("gzread") }
-}
-
-module ZlibTaintConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
- fc.getArgument(0) = source.asExpr()
- )
- }
-
- predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
- fc.getArgument(0) = sink.asExpr() and
- not sanitizer(fc)
- )
- }
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- }
-}
-
-predicate sanitizer(FunctionCall fc) {
- exists(Expr e | fc.getTarget() instanceof GzreadFunction |
- // a RelationalOperation which isn't compared with a Literal that using for end of read
- TaintTracking::localExprTaint(fc, e.(RelationalOperation).getAChild*()) and
- not e.getAChild*().(Literal).getValue() = ["0", "1", "-1"]
- )
-}
-
-module ZlibTaint = TaintTracking::Global;
-
-import ZlibTaint::PathGraph
-
-from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
-where ZlibTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This file extraction depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
new file mode 100644
index 00000000000..644841af23e
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
@@ -0,0 +1,139 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression1
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A gzFile Variable as a Flow source
+ */
+private class GzFileVar extends VariableAccess {
+ GzFileVar() { this.getType().hasName("gzFile") }
+}
+
+/**
+ * The `gzopen` function as a Flow source
+ */
+private class GzopenFunction extends Function {
+ GzopenFunction() { hasGlobalName("gzopen") }
+}
+
+/**
+ * The `gzdopen` function as a Flow source
+ */
+private class GzdopenFunction extends Function {
+ GzdopenFunction() { hasGlobalName("gzdopen") }
+}
+
+/**
+ * The `gzfread` function is used in Flow sink
+ */
+private class GzfreadFunction extends Function {
+ GzfreadFunction() { hasGlobalName("gzfread") }
+}
+
+/**
+ * The `gzread` function is used in Flow sink
+ */
+private class GzreadFunction extends Function {
+ GzreadFunction() { hasGlobalName("gzread") }
+}
+
+module ZlibTaintConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) {
+ // gzopen(const char *path, const char *mode);
+ exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
+ fc.getArgument(0) = source.asExpr() and
+ // arg 0 can be a path string whichwe must do following check
+ not fc.getArgument(0).isConstant()
+ )
+ or
+ //gzdopen(int fd, const char *mode);
+ // IDK whether it is good to use all file decriptors function returns as source or not
+ // because we can do more sanitization from fd function sources
+ exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
+ fc.getArgument(0) = source.asExpr()
+ )
+ or
+ source.asExpr() instanceof GzFileVar
+ }
+
+ predicate isSink(DataFlow::Node sink) {
+ // gzread(gzFile file, voidp buf, unsigned len));
+ exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ not sanitizer(fc)
+ // TODO: and not sanitizer2(fc.getArgument(2))
+ )
+ or
+ // gzfread((voidp buf, z_size_t size, z_size_t nitems, gzFile file));
+ exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
+ sink.asExpr() = fc.getArgument(3)
+ )
+ }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ // gzopen(const char *path, const char *mode);
+ // gzdopen(int fd, const char *mode);
+ exists(FunctionCall fc |
+ fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
+ |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ or
+ // gzread(gzFile file, voidp buf, unsigned len);
+ exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1)
+ )
+ or
+ // gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file);
+ exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
+ node1.asExpr() = fc.getArgument(3) and
+ node2.asExpr() = fc.getArgument(0)
+ )
+ }
+}
+
+predicate sanitizer(FunctionCall fc) {
+ exists(Expr e |
+ // a RelationalOperation which isn't compared with a Literal that using for end of read
+ TaintTracking::localExprTaint(fc, e.(RelationalOperation).getAChild*()) and
+ not e.getAChild*().(Literal).getValue() = ["0", "1", "-1"]
+ )
+}
+
+// TODO:
+// predicate sanitizer2(Expr arg) {
+// exists(Expr e |
+// // a RelationalOperation which isn't compared with a Literal that using for end of read
+// TaintTracking::localExprTaint(arg, e.(RelationalOperation).getAChild*())
+// )
+// }
+// predicate test(FunctionCall fc, Expr sink) {
+// exists( | fc.getTarget() instanceof GzreadFunction |
+// // a RelationalOperation which isn't compared with a Literal that using for end of read
+// TaintTracking::localExprTaint(fc.getArgument(2).(VariableAccess), sink)
+// ) and
+// sink.getFile().getLocation().toString().matches("%main.cpp%")
+// }
+module ZlibTaint = TaintTracking::Global;
+
+import ZlibTaint::PathGraph
+
+from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
+where ZlibTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
new file mode 100644
index 00000000000..541c23c58ec
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
@@ -0,0 +1,56 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression2
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A z_stream Variable as a Flow source
+ */
+private class ZStreamVar extends VariableAccess {
+ ZStreamVar() { this.getType().hasName("z_stream") }
+}
+
+/**
+ * The `inflate`/`inflateSync` function is used in Flow sink
+ */
+private class DeflateFunction extends Function {
+ DeflateFunction() { hasGlobalName(["inflate", "inflateSync"]) }
+}
+
+module ZlibTaintConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { source.asExpr() instanceof ZStreamVar }
+
+ predicate isSink(DataFlow::Node sink) {
+ exists(FunctionCall fc | fc.getTarget() instanceof DeflateFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() instanceof DeflateFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
+}
+
+module ZlibTaint = TaintTracking::Global;
+
+import ZlibTaint::PathGraph
+
+from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
+where ZlibTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql
new file mode 100644
index 00000000000..09327616fd9
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql
@@ -0,0 +1,56 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression3
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A Bytef Variable as a Flow source
+ */
+private class BytefVar extends VariableAccess {
+ BytefVar() { this.getType().hasName("Bytef") }
+}
+
+/**
+ * The `uncompress`/`uncompress2` function is used in Flow sink
+ */
+private class UncompressFunction extends Function {
+ UncompressFunction() { hasGlobalName(["uncompress", "uncompress2"]) }
+}
+
+module ZlibTaintConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { source.asExpr() instanceof BytefVar }
+
+ predicate isSink(DataFlow::Node sink) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
+}
+
+module ZlibTaint = TaintTracking::Global;
+
+import ZlibTaint::PathGraph
+
+from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
+where ZlibTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
+ "potentially untrusted source"
From 3ddc9a8b31612ad0fb264928ab20f73411cc81a7 Mon Sep 17 00:00:00 2001
From: amammad
Date: Mon, 26 Jun 2023 05:26:30 +1000
Subject: [PATCH 004/500] fix warnings, more sinks,sources,comments
---
.../DecompressionBombsGzopen.ql | 55 +++++++++++--------
.../DecompressionBombsInflator.ql | 16 ++++--
2 files changed, 43 insertions(+), 28 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
index 644841af23e..6c0804404cd 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
@@ -16,7 +16,7 @@ import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
/**
- * A gzFile Variable as a Flow source
+ * A `gzFile` Variable as a Flow source
*/
private class GzFileVar extends VariableAccess {
GzFileVar() { this.getType().hasName("gzFile") }
@@ -24,42 +24,57 @@ private class GzFileVar extends VariableAccess {
/**
* The `gzopen` function as a Flow source
+ *
+ * `gzopen(const char *path, const char *mode)`
*/
private class GzopenFunction extends Function {
- GzopenFunction() { hasGlobalName("gzopen") }
+ GzopenFunction() { this.hasGlobalName("gzopen") }
}
/**
* The `gzdopen` function as a Flow source
+ *
+ * `gzdopen(int fd, const char *mode)`
*/
private class GzdopenFunction extends Function {
- GzdopenFunction() { hasGlobalName("gzdopen") }
+ GzdopenFunction() { this.hasGlobalName("gzdopen") }
}
/**
* The `gzfread` function is used in Flow sink
+ *
+ * `gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file)`
*/
private class GzfreadFunction extends Function {
- GzfreadFunction() { hasGlobalName("gzfread") }
+ GzfreadFunction() { this.hasGlobalName("gzfread") }
+}
+
+/**
+ * The `gzgets` function is used in Flow sink.
+ *
+ * `gzgets(gzFile file, char *buf, int len)`
+ */
+private class GzgetsFunction extends Function {
+ GzgetsFunction() { this.hasGlobalName("gzgets") }
}
/**
* The `gzread` function is used in Flow sink
+ *
+ * `gzread(gzFile file, voidp buf, unsigned len)`
*/
private class GzreadFunction extends Function {
- GzreadFunction() { hasGlobalName("gzread") }
+ GzreadFunction() { this.hasGlobalName("gzread") }
}
module ZlibTaintConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
- // gzopen(const char *path, const char *mode);
exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
fc.getArgument(0) = source.asExpr() and
// arg 0 can be a path string whichwe must do following check
not fc.getArgument(0).isConstant()
)
or
- //gzdopen(int fd, const char *mode);
// IDK whether it is good to use all file decriptors function returns as source or not
// because we can do more sanitization from fd function sources
exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
@@ -70,22 +85,22 @@ module ZlibTaintConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) {
- // gzread(gzFile file, voidp buf, unsigned len));
exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
fc.getArgument(0) = sink.asExpr() and
not sanitizer(fc)
// TODO: and not sanitizer2(fc.getArgument(2))
)
or
- // gzfread((voidp buf, z_size_t size, z_size_t nitems, gzFile file));
exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
sink.asExpr() = fc.getArgument(3)
)
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzgetsFunction |
+ sink.asExpr() = fc.getArgument(0)
+ )
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- // gzopen(const char *path, const char *mode);
- // gzdopen(int fd, const char *mode);
exists(FunctionCall fc |
fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
|
@@ -93,17 +108,20 @@ module ZlibTaintConfig implements DataFlow::ConfigSig {
node2.asExpr() = fc
)
or
- // gzread(gzFile file, voidp buf, unsigned len);
exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
node1.asExpr() = fc.getArgument(0) and
node2.asExpr() = fc.getArgument(1)
)
or
- // gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file);
exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
node1.asExpr() = fc.getArgument(3) and
node2.asExpr() = fc.getArgument(0)
)
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzgetsFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node1.asExpr() = fc.getArgument(1)
+ )
}
}
@@ -116,19 +134,12 @@ predicate sanitizer(FunctionCall fc) {
}
// TODO:
-// predicate sanitizer2(Expr arg) {
+// predicate sanitizer2(FunctionCall fc) {
// exists(Expr e |
// // a RelationalOperation which isn't compared with a Literal that using for end of read
-// TaintTracking::localExprTaint(arg, e.(RelationalOperation).getAChild*())
+// TaintTracking::localExprTaint(fc.getArgument(2), e)
// )
// }
-// predicate test(FunctionCall fc, Expr sink) {
-// exists( | fc.getTarget() instanceof GzreadFunction |
-// // a RelationalOperation which isn't compared with a Literal that using for end of read
-// TaintTracking::localExprTaint(fc.getArgument(2).(VariableAccess), sink)
-// ) and
-// sink.getFile().getLocation().toString().matches("%main.cpp%")
-// }
module ZlibTaint = TaintTracking::Global;
import ZlibTaint::PathGraph
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
index 541c23c58ec..fdd11e1fc16 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
@@ -16,30 +16,34 @@ import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
/**
- * A z_stream Variable as a Flow source
+ * A `z_stream` Variable as a Flow source
*/
private class ZStreamVar extends VariableAccess {
ZStreamVar() { this.getType().hasName("z_stream") }
}
/**
- * The `inflate`/`inflateSync` function is used in Flow sink
+ * The `inflate`/`inflateSync` functions are used in Flow sink
+ *
+ * `inflate(z_streamp strm, int flush)`
+ *
+ * `inflateSync(z_streamp strm)`
*/
-private class DeflateFunction extends Function {
- DeflateFunction() { hasGlobalName(["inflate", "inflateSync"]) }
+private class InflateFunction extends Function {
+ InflateFunction() { this.hasGlobalName(["inflate", "inflateSync"]) }
}
module ZlibTaintConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof ZStreamVar }
predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof DeflateFunction |
+ exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
fc.getArgument(0) = sink.asExpr()
)
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc | fc.getTarget() instanceof DeflateFunction |
+ exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
node1.asExpr() = fc.getArgument(0) and
node2.asExpr() = fc
)
From f715a3437b1793dfca1941111aae1af5b420544b Mon Sep 17 00:00:00 2001
From: amammad
Date: Mon, 26 Jun 2023 05:29:16 +1000
Subject: [PATCH 005/500] better examples
---
.../CWE-409-DecompressionBomb/example_bad.cpp | 112 ++++++++++++++++--
.../example_good.cpp | 45 ++++++-
2 files changed, 143 insertions(+), 14 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
index 843b200231a..94e3e969a51 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
@@ -1,7 +1,64 @@
-#include
-#include
-#include "zlib.h"
-int UnsafeRead() {
+
+int UnsafeInflate(int argc, char *argv[]) {
+ // original string len = 36
+ char a[50] = "Hello Hello Hello Hello Hello Hello!";
+ // placeholder for the compressed (deflated) version of "a"
+ char b[50];
+ // placeholder for the Uncompressed (inflated) version of "b"
+ char c[50];
+ printf("Uncompressed size is: %lu\n", strlen(a));
+ printf("Uncompressed string is: %s\n", a);
+ printf("\n----------\n\n");
+
+ // STEP 1.
+ // zlib struct
+ z_stream defstream;
+ defstream.zalloc = Z_NULL;
+ defstream.zfree = Z_NULL;
+ defstream.opaque = Z_NULL;
+ // setup "a" as the input and "b" as the compressed output
+ defstream.avail_in = (uInt) strlen(a) + 1; // size of input, string + terminator
+ defstream.next_in = (Bytef *) a; // input char array
+ defstream.avail_out = (uInt) sizeof(b); // size of output
+ defstream.next_out = (Bytef *) b; // output char array
+
+ // the actual compression work.
+ deflateInit(&defstream, Z_BEST_COMPRESSION);
+ deflate(&defstream, Z_FINISH);
+ deflateEnd(&defstream);
+
+ // This is one way of getting the size of the output
+ printf("Compressed size is: %lu\n", strlen(b));
+ printf("Compressed string is: %s\n", b);
+ printf("\n----------\n\n");
+ // STEP 2.
+ // inflate b into c
+ // zlib struct
+ z_stream infstream;
+ infstream.zalloc = Z_NULL;
+ infstream.zfree = Z_NULL;
+ infstream.opaque = Z_NULL;
+ // setup "b" as the input and "c" as the compressed output
+ // TOTHINK: Here we can add additional step from Right operand to z_stream variable access
+ infstream.avail_in = (uInt) ((char *) defstream.next_out - b); // size of input
+ infstream.next_in = (Bytef *) b; // input char array
+ infstream.avail_out = (uInt) sizeof(c); // size of output
+ infstream.next_out = (Bytef *) c; // output char array
+
+ // uLong total_out; /* total number of bytes output so far */
+ // the actual DE-compression work.
+ inflateInit(&infstream);
+ std::cout << infstream.total_out << std::endl;
+ inflate(&infstream, Z_NO_FLUSH);
+ std::cout << infstream.total_out << std::endl;
+ inflateEnd(&infstream);
+
+ printf("Uncompressed size is: %lu\n", strlen(c));
+ printf("Uncompressed string is: %s\n", c);
+ return 0;
+}
+
+int UnsafeGzread() {
std::cout << "enter compressed file name!\n" << std::endl;
char fileName[100];
std::cin >> fileName;
@@ -21,10 +78,47 @@ int UnsafeRead() {
break;
}
}
-
- for ( auto &&i: unzippedData)
- std::cout << i;
+ for (auto &&i: unzippedData)
+ std::cout << i;
gzclose(inFileZ);
-
return 0;
-}
\ No newline at end of file
+}
+
+int UnsafeGzfread() {
+ std::cout << "enter compressed file name!\n" << std::endl;
+ char fileName[100];
+ std::cin >> fileName;
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (inFileZ == nullptr) {
+ printf("Error: Failed to gzopen %s\n", fileName);
+ exit(0);
+ }
+ while (true) {
+ char buffer[1000];
+ if (!gzfread(buffer, 999, 1, inFileZ)) {
+ break;
+ }
+ }
+ gzclose(inFileZ);
+ return 0;
+}
+
+int UnsafeGzgets() {
+ std::cout << "enter compressed file name!\n" << std::endl;
+ char fileName[100];
+ std::cin >> fileName;
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (inFileZ == nullptr) {
+ printf("Error: Failed to gzopen %s\n", fileName);
+ exit(0);
+ }
+ char *buffer = new char[4000000000];
+ char *result = gzgets(inFileZ, buffer, 1000000000);
+ while (true) {
+ result = gzgets(inFileZ, buffer, 1000000000);
+ if (result == nullptr) {
+ break;
+ }
+ }
+ return 0;
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
index 3d26569bdb4..e3a2d4b2e50 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
@@ -1,7 +1,5 @@
-#include
-#include
-#include "zlib.h"
-int SafeRead() {
+
+int SafeGzread() {
std::cout << "enter compressed file name!\n" << std::endl;
char fileName[100];
std::cin >> fileName;
@@ -35,4 +33,41 @@ int SafeRead() {
gzclose(inFileZ);
return 0;
-}
\ No newline at end of file
+}
+
+int SafeGzread2() {
+ std::cout << "enter compressed file name!\n" << std::endl;
+ char fileName[100];
+ std::cin >> fileName;
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (inFileZ == nullptr) {
+ printf("Error: Failed to gzopen %s\n", fileName);
+ exit(0);
+ }
+ const int BUFFER_SIZE = 8192;
+ unsigned char unzipBuffer[BUFFER_SIZE];
+ unsigned int unzippedBytes;
+ uint totalRead = 0;
+ std::vector unzippedData;
+ while (true) {
+ unzippedBytes = gzread(inFileZ, unzipBuffer, BUFFER_SIZE);
+ totalRead += BUFFER_SIZE;
+ if (unzippedBytes > 0) {
+ unzippedData.insert(unzippedData.end(), unzipBuffer, unzipBuffer + unzippedBytes);
+ if (totalRead > 1024 * 1024 * 4) {
+ std::cout << "Bombs!" << totalRead;
+ exit(1);
+ } else {
+ std::cout << "not Bomb yet!!" << totalRead << std::endl;
+ }
+ } else {
+ break;
+ }
+ }
+
+ for (auto &&i: unzippedData)
+ std::cout << i;
+ gzclose(inFileZ);
+
+ return 0;
+}
From 042133a9912072040f8a67ad870d69d881a8a2e2 Mon Sep 17 00:00:00 2001
From: amammad
Date: Mon, 3 Jul 2023 09:12:37 +1000
Subject: [PATCH 006/500] add queries for more popular libs
---
.../DecompressionBomb.qhelp | 6 +-
.../DecompressionBombsBrotli.ql | 107 +++++++++++++
.../DecompressionBombsBzip2.ql | 126 ++++++++++++++++
.../DecompressionBombsMiniZip.ql | 102 +++++++++++++
.../DecompressionBombsXZ.ql | 100 +++++++++++++
.../DecompressionBombsZSTD.ql | 140 ++++++++++++++++++
...pen.ql => DecompressionBombsZlibGzopen.ql} | 2 +-
...r.ql => DecompressionBombsZlibInflator.ql} | 9 +-
...ql => DecompressionBombsZlibUncompress.ql} | 9 +-
.../CWE-409-DecompressionBomb/example_bad.cpp | 5 +
.../example_good.cpp | 5 +
11 files changed, 593 insertions(+), 18 deletions(-)
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
rename cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/{DecompressionBombsGzopen.ql => DecompressionBombsZlibGzopen.ql} (98%)
rename cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/{DecompressionBombsInflator.ql => DecompressionBombsZlibInflator.ql} (84%)
rename cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/{DecompressionBombsUncompress.ql => DecompressionBombsZlibUncompress.ql} (83%)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
index 44256d36ea9..cdadabbf207 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
@@ -5,7 +5,6 @@
Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks.
Attackers can compress a huge file which created by repeated similiar byte and convert it to a small compressed file.
-
@@ -25,8 +24,13 @@ An Unsafe Approach can be this example which we don't check for uncompressed siz
+
+
+Zlib Documentation
+
+
A great research to gain more impact by this kind of attacks
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
new file mode 100644
index 00000000000..b09858d6471
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
@@ -0,0 +1,107 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-brotli
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+// https://github.com/google/brotli
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+private class PointerVar extends VariableAccess {
+ PointerVar() { this.getType() instanceof PointerType }
+}
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+private class Uint8Var extends VariableAccess {
+ Uint8Var() { this.getType() instanceof UInt8_t }
+}
+
+/**
+ * A ZSTD_inBuffer Variable is used in Flow source
+ */
+private class ZSTDinBufferVar extends VariableAccess {
+ ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
+}
+
+/**
+ * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#af68
+ */
+private class BrotliDecoderDecompressFunction extends Function {
+ BrotliDecoderDecompressFunction() { this.hasGlobalName(["BrotliDecoderDecompress"]) }
+}
+
+/**
+ * The `BrotliDecoderDecompressStream` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#a234
+ */
+private class BrotliDecoderDecompressStreamFunction extends Function {
+ BrotliDecoderDecompressStreamFunction() { this.hasGlobalName(["BrotliDecoderDecompressStream"]) }
+}
+
+module BrotliTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction |
+ fc = source.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fopenCall(fc) |
+ fc = source.asExpr() and
+ state = ""
+ )
+ or
+ source.asExpr() instanceof PointerVar and
+ state = ""
+ or
+ source.asExpr() instanceof Uint8Var and
+ state = ""
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
+ fc.getArgument(1) = sink.asExpr() and
+ state = ""
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ none()
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module BrotliTaint = TaintTracking::GlobalWithState;
+
+import BrotliTaint::PathGraph
+
+from BrotliTaint::PathNode source, BrotliTaint::PathNode sink
+where BrotliTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
new file mode 100644
index 00000000000..e9b7d60715d
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
@@ -0,0 +1,126 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-bzip2
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A `bz_stream` Variable as a Flow source
+ */
+private class BzStreamVar extends VariableAccess {
+ BzStreamVar() { this.getType().hasName("bz_stream") }
+}
+
+/**
+ * A `BZFILE` Variable as a Flow source
+ */
+private class BZFILEVar extends VariableAccess {
+ BZFILEVar() { this.getType().hasName("BZFILE") }
+}
+
+/**
+ * The `BZ2_bzopen`,`BZ2_bzdopen` functions as a Flow source
+ */
+private class BZ2BzopenFunction extends Function {
+ BZ2BzopenFunction() { this.hasGlobalName(["BZ2_bzopen", "BZ2_bzdopen"]) }
+}
+
+/**
+ * The `BZ2_bzDecompress` function as a Flow source
+ */
+private class BZ2BzDecompressFunction extends Function {
+ BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
+}
+
+/**
+ * The `BZ2_bzReadOpen` function
+ */
+private class BZ2BzReadOpenFunction extends Function {
+ BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
+}
+
+/**
+ * The `BZ2_bzRead` function is used in Flow sink
+ */
+private class BZ2BzReadFunction extends Function {
+ BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
+}
+
+/**
+ * The `BZ2_bzRead` function is used in Flow sink
+ */
+private class BZ2BzBuffToBuffDecompressFunction extends Function {
+ BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
+}
+
+/**
+ * https://www.sourceware.org/bzip2/manual/manual.html
+ */
+module Bzip2TaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ source.asExpr() instanceof BzStreamVar and
+ state = ""
+ or
+ source.asExpr() instanceof BZFILEVar and
+ state = ""
+ or
+ // will flow into BZ2BzReadOpenFunction
+ exists(FunctionCall fc | fopenCall(fc) |
+ fc = source.asExpr() and
+ state = ""
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
+ fc.getArgument(1) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
+ fc.getArgument(2) = sink.asExpr() and
+ state = ""
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadOpenFunction |
+ node1.asExpr() = fc.getArgument(1) and
+ node2.asExpr() = fc and
+ state1 = "" and
+ state2 = ""
+ )
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module Bzip2Taint = TaintTracking::GlobalWithState;
+
+import Bzip2Taint::PathGraph
+
+from Bzip2Taint::PathNode source, Bzip2Taint::PathNode sink
+where Bzip2Taint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
new file mode 100644
index 00000000000..b8cd89fc542
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
@@ -0,0 +1,102 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-minizip
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A `unzFile` Variable as a Flow source
+ */
+private class UnzFileVar extends VariableAccess {
+ UnzFileVar() { this.getType().hasName("unzFile") }
+}
+
+/**
+ * The `UnzOpen` function as a Flow source
+ */
+private class UnzOpenFunction extends Function {
+ UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
+}
+
+/**
+ * The `mz_stream_open` function is used in Flow source
+ */
+private class MzStreamOpenFunction extends Function {
+ MzStreamOpenFunction() { this.hasGlobalName("mz_stream_open") }
+}
+
+/**
+ * The `unzReadCurrentFile` function is used in Flow sink
+ */
+private class UnzReadCurrentFileFunction extends Function {
+ UnzReadCurrentFileFunction() { this.hasGlobalName(["unzReadCurrentFile"]) }
+}
+
+module MiniZipTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
+ fc.getArgument(0) = source.asExpr() and
+ state = "unzFile"
+ )
+ or
+ source.asExpr() instanceof UnzFileVar and
+ state = "unzFile"
+ or
+ // TO Check
+ exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
+ fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
+ state = "MzStream"
+ )
+ or
+ // TO Check
+ exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
+ fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
+ state = "MzStream"
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ state = "unzFile"
+ // and not sanitizer(fc)
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc and
+ state1 = "" and
+ state2 = "unzFile"
+ )
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+
+module MiniZipTaint = TaintTracking::GlobalWithState;
+
+import MiniZipTaint::PathGraph
+
+from MiniZipTaint::PathNode source, MiniZipTaint::PathNode sink
+where MiniZipTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
new file mode 100644
index 00000000000..dadbf7a5a8a
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
@@ -0,0 +1,100 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-xz
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A Pointer Variable as a Flow source
+ */
+private class Uint8Var extends VariableAccess {
+ Uint8Var() { this.getType() instanceof UInt8_t }
+}
+
+/**
+ * A `lzma_stream` Variable as a Flow source
+ */
+private class LzmaStreamVar extends VariableAccess {
+ LzmaStreamVar() { this.getType().hasName("lzma_stream") }
+}
+
+/**
+ * The `lzma_*_decoder` function is used as a required condition for decompression
+ */
+private class LzmaDecoderFunction extends Function {
+ LzmaDecoderFunction() {
+ this.hasGlobalName(["lzma_stream_decoder", "lzma_auto_decoder", "lzma_alone_decoder"])
+ }
+}
+
+/**
+ * The `lzma_code` function is used in Flow sink
+ */
+private class LzmaCodeFunction extends Function {
+ LzmaCodeFunction() { this.hasGlobalName(["lzma_code"]) }
+}
+
+/**
+ * The `lzma_stream_buffer_decode` function is used in Flow sink
+ */
+private class LzmaStreamBufferDecodeFunction extends Function {
+ LzmaStreamBufferDecodeFunction() { this.hasGlobalName(["lzma_stream_buffer_decode"]) }
+}
+
+/**
+ * https://github.com/tukaani-project/xz
+ */
+module XzTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ source.asExpr() instanceof LzmaStreamVar and
+ state = ""
+ or
+ source.asExpr() instanceof Uint8Var and
+ state = ""
+ // and not exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamDecoderFunction)
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
+ fc.getArgument(1) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ state = ""
+ ) and
+ exists(FunctionCall fc2 | fc2.getTarget() instanceof LzmaDecoderFunction)
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ none()
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module XzTaint = TaintTracking::GlobalWithState;
+
+import XzTaint::PathGraph
+
+from XzTaint::PathNode source, XzTaint::PathNode sink
+where XzTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
new file mode 100644
index 00000000000..9e984bb89e2
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
@@ -0,0 +1,140 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-zstd
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+// https://github.com/facebook/zstd/blob/dev/examples/streaming_decompression.c
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+// /**
+// * A Pointer Variable as a Flow source
+// */
+// private class PointerVar extends VariableAccess {
+// PointerVar() { this.getType() instanceof PointerType }
+// }
+/**
+ * A ZSTD_inBuffer Variable as a Flow source
+ */
+private class ZSTDinBufferVar extends VariableAccess {
+ ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
+}
+
+/**
+ * A ZSTD_inBuffer_s Variable as a Flow source
+ */
+private class ZSTDinBufferSVar extends VariableAccess {
+ ZSTDinBufferSVar() { this.getType().hasName("ZSTD_inBuffer_s") }
+}
+
+/**
+ * The `ZSTD_decompress` function is used in Flow sink
+ */
+private class ZSTDDecompressFunction extends Function {
+ ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
+}
+
+/**
+ * The `ZSTD_decompressDCtx` function is used in Flow sink
+ */
+private class ZSTDDecompressDCtxFunction extends Function {
+ ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
+}
+
+/**
+ * The `ZSTD_decompressStream` function is used in Flow sink
+ */
+private class ZSTDDecompressStreamFunction extends Function {
+ ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
+}
+
+/**
+ * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ */
+private class ZSTDDecompressUsingDictFunction extends Function {
+ ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+}
+
+/**
+ * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ */
+private class ZSTDDecompressUsingDDictFunction extends Function {
+ ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+}
+
+module ZstdTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction |
+ fc = source.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fopenCall(fc) |
+ fc = source.asExpr() and
+ state = ""
+ )
+ or
+ source.asExpr() instanceof ZSTDinBufferSVar and
+ state = ""
+ or
+ source.asExpr() instanceof ZSTDinBufferVar and
+ state = ""
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
+ fc.getArgument(2) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
+ fc.getArgument(3) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
+ fc.getArgument(3) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
+ fc.getArgument(3) = sink.asExpr() and
+ state = ""
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ none()
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module ZstdTaint = TaintTracking::GlobalWithState;
+
+import ZstdTaint::PathGraph
+
+from ZstdTaint::PathNode source, ZstdTaint::PathNode sink
+where ZstdTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
+ "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
similarity index 98%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
rename to cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
index 6c0804404cd..ce7324eded0 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsGzopen.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
@@ -5,7 +5,7 @@
* @problem.severity error
* @security-severity 7.8
* @precision high
- * @id cpp/user-controlled-file-decompression1
+ * @id cpp/user-controlled-file-zlibgz
* @tags security
* experimental
* external/cwe/cwe-409
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
similarity index 84%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
rename to cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
index fdd11e1fc16..e526b4d9273 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsInflator.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
@@ -5,7 +5,7 @@
* @problem.severity error
* @security-severity 7.8
* @precision high
- * @id cpp/user-controlled-file-decompression2
+ * @id cpp/user-controlled-file-zlibinflator
* @tags security
* experimental
* external/cwe/cwe-409
@@ -41,13 +41,6 @@ module ZlibTaintConfig implements DataFlow::ConfigSig {
fc.getArgument(0) = sink.asExpr()
)
}
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- }
}
module ZlibTaint = TaintTracking::Global;
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
similarity index 83%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql
rename to cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
index 09327616fd9..b385523f185 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsUncompress.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
@@ -5,7 +5,7 @@
* @problem.severity error
* @security-severity 7.8
* @precision high
- * @id cpp/user-controlled-file-decompression3
+ * @id cpp/user-controlled-file-zlibuncompress
* @tags security
* experimental
* external/cwe/cwe-409
@@ -37,13 +37,6 @@ module ZlibTaintConfig implements DataFlow::ConfigSig {
fc.getArgument(0) = sink.asExpr()
)
}
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- }
}
module ZlibTaint = TaintTracking::Global;
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
index 94e3e969a51..af513817386 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
@@ -1,3 +1,8 @@
+#include
+#include
+#include "zlib.h"
+#include
+#include
int UnsafeInflate(int argc, char *argv[]) {
// original string len = 36
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
index e3a2d4b2e50..7ad34658367 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
@@ -1,3 +1,8 @@
+#include
+#include
+#include "zlib.h"
+#include
+#include
int SafeGzread() {
std::cout << "enter compressed file name!\n" << std::endl;
From d4d505d7af7195a3163bcf962b652ef0148f68f2 Mon Sep 17 00:00:00 2001
From: amammad
Date: Mon, 3 Jul 2023 20:39:08 +1000
Subject: [PATCH 007/500] complete the minizip query
---
.../DecompressionBombsMiniZip.ql | 84 +++++++++++++++----
1 file changed, 67 insertions(+), 17 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
index b8cd89fc542..67999bff3d6 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
@@ -15,6 +15,43 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+/**
+ * The `mz_zip_reader_create` function as a Flow source
+ * create a `mz_zip_reader` instance
+ */
+private class Mz_zip_reader_create extends Function {
+ Mz_zip_reader_create() { this.hasGlobalName("mz_zip_reader_create") }
+}
+
+/**
+ * The `mz_zip_create` function as a Flow source
+ * create a `mz_zip` instance
+ */
+private class Mz_zip_create extends Function {
+ Mz_zip_create() { this.hasGlobalName("mz_zip_create") }
+}
+
+/**
+ * The `mz_zip_entry` function is used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
+ */
+private class Mz_zip_entry extends Function {
+ Mz_zip_entry() { this.hasGlobalName("mz_zip_entry_read") }
+}
+
+/**
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
+ */
+private class Mz_zip_reader_entry extends Function {
+ Mz_zip_reader_entry() {
+ this.hasGlobalName([
+ "mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
+ "mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all"
+ ])
+ }
+}
+
/**
* A `unzFile` Variable as a Flow source
*/
@@ -29,13 +66,6 @@ private class UnzOpenFunction extends Function {
UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
}
-/**
- * The `mz_stream_open` function is used in Flow source
- */
-private class MzStreamOpenFunction extends Function {
- MzStreamOpenFunction() { this.hasGlobalName("mz_stream_open") }
-}
-
/**
* The `unzReadCurrentFile` function is used in Flow sink
*/
@@ -55,16 +85,14 @@ module MiniZipTaintConfig implements DataFlow::StateConfigSig {
source.asExpr() instanceof UnzFileVar and
state = "unzFile"
or
- // TO Check
- exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
- fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
- state = "MzStream"
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
+ fc = source.asExpr() and
+ state = "mz_zip_reader"
)
or
- // TO Check
- exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
- fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
- state = "MzStream"
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
+ fc = source.asExpr() and
+ state = "mz_zip"
)
}
@@ -72,7 +100,16 @@ module MiniZipTaintConfig implements DataFlow::StateConfigSig {
exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
fc.getArgument(0) = sink.asExpr() and
state = "unzFile"
- // and not sanitizer(fc)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+ fc.getArgument(1) = sink.asExpr() and
+ state = "mz_zip_reader"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+ fc.getArgument(1) = sink.asExpr() and
+ state = "mz_zip"
)
}
@@ -86,12 +123,25 @@ module MiniZipTaintConfig implements DataFlow::StateConfigSig {
state1 = "" and
state2 = "unzFile"
)
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1) and
+ state1 = "" and
+ state2 = "mz_zip_reader"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1) and
+ state1 = "" and
+ state2 = "mz_zip"
+ )
}
predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
}
-
module MiniZipTaint = TaintTracking::GlobalWithState;
import MiniZipTaint::PathGraph
From 56bc32ff916f4ea0e87748fac3712bccb1058371 Mon Sep 17 00:00:00 2001
From: amammad
Date: Tue, 4 Jul 2023 01:17:22 +1000
Subject: [PATCH 008/500] add libarchive
---
.../DecompressionBombsLibArchive.ql | 75 +++++++++++++++++++
1 file changed, 75 insertions(+)
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
new file mode 100644
index 00000000000..57a9a4f72c9
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
@@ -0,0 +1,75 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-libarchive
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * The `archive_read_new` function as a Flow source
+ * create a `archive` instance
+ */
+private class Archive_read_new extends Function {
+ Archive_read_new() { this.hasGlobalName("archive_read_new") }
+}
+
+/**
+ * The `archive_read_data*` functions are used in Flow Sink
+ * [Examples](https://github.com/libarchive/libarchive/wiki/Examples)
+ */
+private class Archive_read_data_block extends Function {
+ Archive_read_data_block() {
+ this.hasGlobalName(["archive_read_data_block", "archive_read_data", "archive_read_data_into_fd"])
+ }
+}
+
+module LibArchiveTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_new |
+ fc.getArgument(0) = source.asExpr() and
+ state = "unzFile"
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
+ fc.getArgument(1) = sink.asExpr() and
+ state = "unzFile"
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1) and
+ state1 = "" and
+ state2 = "mz_zip_reader"
+ )
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module LibArchiveTaint = TaintTracking::GlobalWithState;
+
+import LibArchiveTaint::PathGraph
+
+from LibArchiveTaint::PathNode source, LibArchiveTaint::PathNode sink
+where LibArchiveTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
From 16be908cb38f35036e82ae13f112524e7b7d6d9b Mon Sep 17 00:00:00 2001
From: amammad
Date: Tue, 4 Jul 2023 06:56:30 +1000
Subject: [PATCH 009/500] add Miniz
---
.../DecompressionBombsLibMiniz.ql | 187 ++++++++++++++++++
1 file changed, 187 insertions(+)
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
new file mode 100644
index 00000000000..b7e5ea913f3
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
@@ -0,0 +1,187 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/user-controlled-file-decompression-miniz
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A unsigned char Variable is used in Flow source
+ */
+private class Uint8Var extends VariableAccess {
+ Uint8Var() { this.getType().stripType().resolveTypedefs() instanceof UnsignedCharType }
+}
+
+/**
+ * The `mz_streamp`, `z_stream` Variables are used in Flow source
+ */
+private class MzStreampVar extends VariableAccess {
+ MzStreampVar() { this.getType().hasName(["mz_streamp", "z_stream"]) }
+}
+
+/**
+ * A Char Variable is used in Flow source
+ */
+private class CharVar extends VariableAccess {
+ CharVar() { this.getType().stripType() instanceof CharType }
+}
+
+/**
+ * A `mz_zip_archive` Variable is used in Flow source
+ */
+private class MzZipArchiveVar extends VariableAccess {
+ MzZipArchiveVar() { this.getType().hasName("mz_zip_archive") }
+}
+
+/**
+ * The `mz_uncompress` functions are used in Flow Sink
+ */
+private class MzUncompress extends Function {
+ MzUncompress() { this.hasGlobalName(["uncompress", "mz_uncompress", "mz_uncompress2"]) }
+}
+
+/**
+ * The `mz_inflate` functions are used in Flow Sink
+ */
+private class MzInflate extends Function {
+ MzInflate() { this.hasGlobalName(["mz_inflate", "inflate"]) }
+}
+
+/**
+ * The `mz_inflateInit` functions are used in Flow Sink
+ */
+private class MzInflateInit extends Function {
+ MzInflateInit() { this.hasGlobalName(["inflateInit", "mz_inflateInit"]) }
+}
+
+/**
+ * The `mz_zip_reader_extract_*` functions are used in Flow Sink
+ */
+private class MzZipReaderExtract extends Function {
+ MzZipReaderExtract() {
+ this.hasGlobalName([
+ "mz_zip_reader_extract_file_to_heap", "mz_zip_reader_extract_to_heap",
+ "mz_zip_reader_extract_to_callback"
+ ])
+ }
+}
+
+/**
+ * The `mz_zip_reader_locate_file_*` functions are used in Flow Sink
+ */
+private class MzZipReaderLocateFile extends Function {
+ MzZipReaderLocateFile() {
+ this.hasGlobalName(["mz_zip_reader_locate_file", "mz_zip_reader_locate_file_v2"])
+ }
+}
+
+/**
+ * The `tinfl_decompress_mem_*` functions are used in Flow Sink
+ */
+private class TinflDecompressMem extends Function {
+ TinflDecompressMem() {
+ this.hasGlobalName([
+ "tinfl_decompress_mem_to_callback", "tinfl_decompress_mem_to_mem",
+ "tinfl_decompress_mem_to_heap"
+ ])
+ }
+}
+
+/**
+ * The `tinfl_decompress_*` functions are used in Flow Sink
+ */
+private class TinflDecompress extends Function {
+ TinflDecompress() { this.hasGlobalName(["tinfl_decompress"]) }
+}
+
+module MinizTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ source.asExpr() instanceof Uint8Var and
+ state = ""
+ or
+ source.asExpr() instanceof CharVar and
+ state = ""
+ or
+ source.asExpr() instanceof MzZipArchiveVar and
+ state = ""
+ or
+ source.asExpr() instanceof MzStreampVar and
+ state = ""
+ or
+ // source of inflate(&arg0) is OK
+ // but the sink which is a call to MzInflate Function first arg can not be determined
+ // if I debug the query we'll reach to the first arg, it is weird I think.
+ source.asDefiningArgument() =
+ any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0) and
+ state = "inflate"
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
+ fc.getArgument(2) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
+ fc.getArgument(1) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
+ fc.getArgument(0) = sink.asExpr() and
+ state = "inflate"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
+ fc.getArgument(1) = sink.asExpr() and
+ state = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
+ fc.getArgument(0) = sink.asExpr() and
+ state = ""
+ )
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
+ node1.asExpr() = fc.getArgument(2) and
+ node2.asExpr() = fc.getArgument(0) and
+ state1 = "" and
+ state2 = ""
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderLocateFile |
+ node1.asExpr() = fc.getArgument(1) and
+ node2.asExpr() = fc.getArgument(3) and
+ state1 = "" and
+ state2 = ""
+ )
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module MinizTaint = TaintTracking::GlobalWithState;
+
+import MinizTaint::PathGraph
+
+from MinizTaint::PathNode source, MinizTaint::PathNode sink
+where MinizTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
+ "potentially untrusted source"
From 065c52761510535c976c53f3b1bf5d67006a4cfa Mon Sep 17 00:00:00 2001
From: amammad
Date: Tue, 4 Jul 2023 07:19:33 +1000
Subject: [PATCH 010/500] update Miniz
---
.../DecompressionBombsLibMiniz.ql | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
index b7e5ea913f3..9f694b07cdd 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
@@ -15,11 +15,17 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+/**
+ * A Pointer Variable is used in Flow source
+ */
+private class PointerVar extends VariableAccess {
+ PointerVar() { this.getType() instanceof PointerType }
+}
/**
* A unsigned char Variable is used in Flow source
*/
private class Uint8Var extends VariableAccess {
- Uint8Var() { this.getType().stripType().resolveTypedefs() instanceof UnsignedCharType }
+ Uint8Var() { this.getType().stripType().resolveTypedefs*() instanceof UnsignedCharType }
}
/**
@@ -33,7 +39,7 @@ private class MzStreampVar extends VariableAccess {
* A Char Variable is used in Flow source
*/
private class CharVar extends VariableAccess {
- CharVar() { this.getType().stripType() instanceof CharType }
+ CharVar() { this.getType().stripType().resolveTypedefs*() instanceof CharType }
}
/**
@@ -71,7 +77,10 @@ private class MzZipReaderExtract extends Function {
MzZipReaderExtract() {
this.hasGlobalName([
"mz_zip_reader_extract_file_to_heap", "mz_zip_reader_extract_to_heap",
- "mz_zip_reader_extract_to_callback"
+ "mz_zip_reader_extract_to_callback", "mz_zip_reader_extract_file_to_callback",
+ "mz_zip_reader_extract_to_mem", "mz_zip_reader_extract_file_to_mem",
+ "mz_zip_reader_extract_iter_read", "mz_zip_reader_extract_to_file",
+ "mz_zip_reader_extract_file_to_file"
])
}
}
@@ -111,6 +120,9 @@ module MinizTaintConfig implements DataFlow::StateConfigSig {
source.asExpr() instanceof Uint8Var and
state = ""
or
+ source.asExpr() instanceof PointerVar and
+ state = ""
+ or
source.asExpr() instanceof CharVar and
state = ""
or
From e0798b29da1e2c87d77e1e19169a9c5d01eebdb3 Mon Sep 17 00:00:00 2001
From: amammad
Date: Tue, 4 Jul 2023 18:28:00 +1000
Subject: [PATCH 011/500] stash: change sinks to zip handles and sources to the
zip handle initializers
---
.../DecompressionBombsLibMiniz.ql | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
index 9f694b07cdd..e0310704af2 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
@@ -21,6 +21,7 @@ import semmle.code.cpp.security.FlowSources
private class PointerVar extends VariableAccess {
PointerVar() { this.getType() instanceof PointerType }
}
+
/**
* A unsigned char Variable is used in Flow source
*/
@@ -56,6 +57,18 @@ private class MzUncompress extends Function {
MzUncompress() { this.hasGlobalName(["uncompress", "mz_uncompress", "mz_uncompress2"]) }
}
+/**
+ * A `zip handle` is used in Flow source
+ */
+private class MzZip extends Function {
+ MzZip() {
+ this.hasGlobalName([
+ "mz_zip_reader_open", "mz_zip_reader_open_file", "mz_zip_reader_open_file_in_memory",
+ "mz_zip_reader_open_buffer", "mz_zip_reader_entry_open"
+ ])
+ }
+}
+
/**
* The `mz_inflate` functions are used in Flow Sink
*/
@@ -138,6 +151,9 @@ module MinizTaintConfig implements DataFlow::StateConfigSig {
source.asDefiningArgument() =
any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0) and
state = "inflate"
+ or
+ source.asDefiningArgument() = any(Call call | call.getTarget() instanceof MzZip).getArgument(0) and
+ state = ""
}
predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
From e37ceac3b137e7a453a8be032692fbca061505c6 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Fri, 7 Jun 2024 05:26:51 +0200
Subject: [PATCH 012/500] merge all query files into one query file
---
.../CWE/CWE-409-DecompressionBomb/Brotli.qll | 38 ++
.../CWE/CWE-409-DecompressionBomb/Bzip2.qll | 50 +++
.../DecompressionBombs.ql | 330 ++++++++++++++++++
.../DecompressionBombsBrotli.ql | 107 ------
.../DecompressionBombsBzip2.ql | 126 -------
.../DecompressionBombsLibArchive.ql | 75 ----
.../DecompressionBombsLibMiniz.ql | 215 ------------
.../DecompressionBombsMiniZip.ql | 152 --------
.../DecompressionBombsXZ.ql | 100 ------
.../DecompressionBombsZSTD.ql | 140 --------
.../DecompressionBombsZlibGzopen.ql | 150 --------
.../DecompressionBombsZlibInflator.ql | 53 ---
.../DecompressionBombsZlibUncompress.ql | 49 ---
.../CWE-409-DecompressionBomb/LibArchive.qll | 25 ++
.../CWE-409-DecompressionBomb/LibMiniz.qll | 102 ++++++
.../CWE/CWE-409-DecompressionBomb/MiniZip.qll | 65 ++++
.../CWE/CWE-409-DecompressionBomb/XZ.qll | 37 ++
.../CWE/CWE-409-DecompressionBomb/ZSTD.qll | 57 +++
.../CWE-409-DecompressionBomb/ZlibGzopen.qll | 75 ++++
.../ZlibInflator.qll | 25 ++
.../ZlibUncompress.qll | 21 ++
21 files changed, 825 insertions(+), 1167 deletions(-)
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
delete mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll
create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll
new file mode 100644
index 00000000000..46314826a62
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll
@@ -0,0 +1,38 @@
+/**
+ * https://github.com/google/brotli
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+class PointerVar extends VariableAccess {
+ PointerVar() { this.getType() instanceof PointerType }
+}
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+class Uint8Var extends VariableAccess {
+ Uint8Var() { this.getType() instanceof UInt8_t }
+}
+
+/**
+ * The `BrotliDecoderDecompress` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#af68
+ */
+class BrotliDecoderDecompressFunction extends Function {
+ BrotliDecoderDecompressFunction() { this.hasGlobalName(["BrotliDecoderDecompress"]) }
+}
+
+/**
+ * The `BrotliDecoderDecompressStream` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#a234
+ */
+class BrotliDecoderDecompressStreamFunction extends Function {
+ BrotliDecoderDecompressStreamFunction() { this.hasGlobalName(["BrotliDecoderDecompressStream"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll
new file mode 100644
index 00000000000..662424b022a
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll
@@ -0,0 +1,50 @@
+/**
+ * https://www.sourceware.org/bzip2/manual/manual.html
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A `bz_stream` Variable as a Flow source
+ */
+class BzStreamVar extends VariableAccess {
+ BzStreamVar() { this.getType().hasName("bz_stream") }
+}
+
+/**
+ * A `BZFILE` Variable as a Flow source
+ */
+class BzFileVar extends VariableAccess {
+ BzFileVar() { this.getType().hasName("BZFILE") }
+}
+
+/**
+ * The `BZ2_bzDecompress` function as a Flow source
+ */
+class BZ2BzDecompressFunction extends Function {
+ BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
+}
+
+/**
+ * The `BZ2_bzReadOpen` function
+ */
+class BZ2BzReadOpenFunction extends Function {
+ BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
+}
+
+/**
+ * The `BZ2_bzRead` function is used in Flow sink
+ */
+class BZ2BzReadFunction extends Function {
+ BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
+}
+
+/**
+ * The `BZ2_bzBuffToBuffDecompress` function is used in Flow sink
+ */
+class BZ2BzBuffToBuffDecompressFunction extends Function {
+ BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
new file mode 100644
index 00000000000..8506dccaea7
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
@@ -0,0 +1,330 @@
+/**
+ * @name User-controlled file decompression
+ * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/data-decompression
+ * @tags security
+ * experimental
+ * external/cwe/cwe-409
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+import Bzip2
+import Brotli
+import LibArchive
+import LibMiniz
+import ZSTD
+import MiniZip
+import XZ
+import ZlibGzopen
+import ZlibUncompress
+import ZlibInflator
+import Brotli
+
+module DecompressionTaintConfig implements DataFlow::StateConfigSig {
+ class FlowState = DataFlow::FlowState;
+
+ predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
+ or
+ exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
+ or
+ source.asExpr() instanceof PointerVar
+ or
+ source.asExpr() instanceof Uint8Var
+ ) and
+ state = "brotli"
+ or
+ (
+ source.asExpr() instanceof BzStreamVar
+ or
+ source.asExpr() instanceof BzFileVar
+ or
+ exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
+ ) and
+ state = "bzip2"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_new |
+ fc.getArgument(0) = source.asExpr()
+ ) and
+ state = "libarchive"
+ or
+ (
+ source.asExpr() instanceof UnsignedCharVar
+ or
+ source.asExpr() instanceof PointerVar
+ or
+ source.asExpr() instanceof CharVar
+ or
+ source.asExpr() instanceof MzZipArchiveVar
+ or
+ source.asExpr() instanceof MzStreampVar
+ or
+ source.asDefiningArgument() =
+ any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0)
+ or
+ source.asDefiningArgument() =
+ any(Call call | call.getTarget() instanceof MzZip).getArgument(0)
+ ) and
+ state = "libminiz"
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
+ or
+ exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
+ or
+ source.asExpr() instanceof ZSTDinBufferSVar
+ or
+ source.asExpr() instanceof ZSTDinBufferVar
+ ) and
+ state = "zstd"
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
+ fc.getArgument(0) = source.asExpr()
+ )
+ or
+ source.asExpr() instanceof UnzFileVar
+ ) and
+ state = "unzFile"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
+ fc = source.asExpr() and
+ state = "mz_zip_reader"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
+ fc = source.asExpr() and
+ state = "mz_zip"
+ )
+ or
+ (
+ source.asExpr() instanceof LzmaStreamVar
+ or
+ source.asExpr() instanceof Uint8Var
+ ) and
+ state = "xz"
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
+ fc.getArgument(0) = source.asExpr() and
+ // arg 0 can be a path string whichwe must do following check
+ not fc.getArgument(0).isConstant()
+ )
+ or
+ // IDK whether it is good to use all file decriptors function returns as source or not
+ // because we can do more sanitization from fd function sources
+ exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
+ fc.getArgument(0) = source.asExpr()
+ )
+ or
+ source.asExpr() instanceof GzFileVar
+ ) and
+ state = "zlibgzopen"
+ or
+ source.asExpr() instanceof ZStreamVar and state = "zlifinflator"
+ or
+ source.asExpr() instanceof BytefVar and state = "zlibuncompress"
+ }
+
+ predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ ) and
+ state = "brotli"
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ ) and
+ state = "bzip2"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
+ fc.getArgument(0) = sink.asExpr() and
+ state = "libarchive"
+ )
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ ) and
+ state = "libminiz"
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
+ ) and
+ state = "zstd"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
+ fc.getArgument(0) = sink.asExpr() and
+ state = "unzFile"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+ fc.getArgument(1) = sink.asExpr() and
+ state = "mz_zip_reader"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+ fc.getArgument(1) = sink.asExpr() and
+ state = "mz_zip"
+ )
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ ) and
+ state = "xz" and
+ exists(FunctionCall fc2 | fc2.getTarget() instanceof LzmaDecoderFunction)
+ or
+ (
+ exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
+ sink.asExpr() = fc.getArgument(3)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
+ sink.asExpr() = fc.getArgument(0)
+ )
+ ) and
+ state = "zlibgzopen"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
+ fc.getArgument(0) = sink.asExpr()
+ ) and
+ state = "zlifinflator"
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
+ fc.getArgument(0) = sink.asExpr()
+ ) and
+ state = "zlibuncompress"
+ }
+
+ predicate isAdditionalFlowStep(
+ DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+ DataFlow::FlowState state2
+ ) {
+ exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc and
+ state1 = "" and
+ state2 = "unzFile"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1) and
+ state1 = "" and
+ state2 = "mz_zip_reader"
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1) and
+ state1 = "" and
+ state2 = "mz_zip"
+ )
+ or
+ (
+ exists(FunctionCall fc |
+ fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
+ |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
+ node1.asExpr() = fc.getArgument(3) and
+ node2.asExpr() = fc.getArgument(0)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node1.asExpr() = fc.getArgument(1)
+ )
+ ) and
+ state1 = "" and
+ state2 = "gzopen"
+ }
+
+ predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
+}
+
+module DecompressionTaint = TaintTracking::GlobalWithState;
+
+import DecompressionTaint::PathGraph
+
+from DecompressionTaint::PathNode source, DecompressionTaint::PathNode sink
+where DecompressionTaint::flowPath(source, sink)
+select sink.getNode(), source, sink, "This Decompression output $@.", source.getNode(),
+ "is not limited"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
deleted file mode 100644
index b09858d6471..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBrotli.ql
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-brotli
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-// https://github.com/google/brotli
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
-
-/**
- * A Pointer Variable is used in Flow source
- */
-private class PointerVar extends VariableAccess {
- PointerVar() { this.getType() instanceof PointerType }
-}
-
-/**
- * A Pointer Variable is used in Flow source
- */
-private class Uint8Var extends VariableAccess {
- Uint8Var() { this.getType() instanceof UInt8_t }
-}
-
-/**
- * A ZSTD_inBuffer Variable is used in Flow source
- */
-private class ZSTDinBufferVar extends VariableAccess {
- ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
-}
-
-/**
- * The `ZSTD_decompress_usingDDict` function is used in Flow sink
- * Ref: https://www.brotli.org/decode.html#af68
- */
-private class BrotliDecoderDecompressFunction extends Function {
- BrotliDecoderDecompressFunction() { this.hasGlobalName(["BrotliDecoderDecompress"]) }
-}
-
-/**
- * The `BrotliDecoderDecompressStream` function is used in Flow sink
- * Ref: https://www.brotli.org/decode.html#a234
- */
-private class BrotliDecoderDecompressStreamFunction extends Function {
- BrotliDecoderDecompressStreamFunction() { this.hasGlobalName(["BrotliDecoderDecompressStream"]) }
-}
-
-module BrotliTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction |
- fc = source.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fopenCall(fc) |
- fc = source.asExpr() and
- state = ""
- )
- or
- source.asExpr() instanceof PointerVar and
- state = ""
- or
- source.asExpr() instanceof Uint8Var and
- state = ""
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
- fc.getArgument(1) = sink.asExpr() and
- state = ""
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- none()
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module BrotliTaint = TaintTracking::GlobalWithState;
-
-import BrotliTaint::PathGraph
-
-from BrotliTaint::PathNode source, BrotliTaint::PathNode sink
-where BrotliTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
deleted file mode 100644
index e9b7d60715d..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsBzip2.ql
+++ /dev/null
@@ -1,126 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-bzip2
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
-
-/**
- * A `bz_stream` Variable as a Flow source
- */
-private class BzStreamVar extends VariableAccess {
- BzStreamVar() { this.getType().hasName("bz_stream") }
-}
-
-/**
- * A `BZFILE` Variable as a Flow source
- */
-private class BZFILEVar extends VariableAccess {
- BZFILEVar() { this.getType().hasName("BZFILE") }
-}
-
-/**
- * The `BZ2_bzopen`,`BZ2_bzdopen` functions as a Flow source
- */
-private class BZ2BzopenFunction extends Function {
- BZ2BzopenFunction() { this.hasGlobalName(["BZ2_bzopen", "BZ2_bzdopen"]) }
-}
-
-/**
- * The `BZ2_bzDecompress` function as a Flow source
- */
-private class BZ2BzDecompressFunction extends Function {
- BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
-}
-
-/**
- * The `BZ2_bzReadOpen` function
- */
-private class BZ2BzReadOpenFunction extends Function {
- BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
-}
-
-/**
- * The `BZ2_bzRead` function is used in Flow sink
- */
-private class BZ2BzReadFunction extends Function {
- BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
-}
-
-/**
- * The `BZ2_bzRead` function is used in Flow sink
- */
-private class BZ2BzBuffToBuffDecompressFunction extends Function {
- BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
-}
-
-/**
- * https://www.sourceware.org/bzip2/manual/manual.html
- */
-module Bzip2TaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- source.asExpr() instanceof BzStreamVar and
- state = ""
- or
- source.asExpr() instanceof BZFILEVar and
- state = ""
- or
- // will flow into BZ2BzReadOpenFunction
- exists(FunctionCall fc | fopenCall(fc) |
- fc = source.asExpr() and
- state = ""
- )
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
- fc.getArgument(0) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
- fc.getArgument(1) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
- fc.getArgument(2) = sink.asExpr() and
- state = ""
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadOpenFunction |
- node1.asExpr() = fc.getArgument(1) and
- node2.asExpr() = fc and
- state1 = "" and
- state2 = ""
- )
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module Bzip2Taint = TaintTracking::GlobalWithState;
-
-import Bzip2Taint::PathGraph
-
-from Bzip2Taint::PathNode source, Bzip2Taint::PathNode sink
-where Bzip2Taint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
deleted file mode 100644
index 57a9a4f72c9..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibArchive.ql
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-libarchive
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * The `archive_read_new` function as a Flow source
- * create a `archive` instance
- */
-private class Archive_read_new extends Function {
- Archive_read_new() { this.hasGlobalName("archive_read_new") }
-}
-
-/**
- * The `archive_read_data*` functions are used in Flow Sink
- * [Examples](https://github.com/libarchive/libarchive/wiki/Examples)
- */
-private class Archive_read_data_block extends Function {
- Archive_read_data_block() {
- this.hasGlobalName(["archive_read_data_block", "archive_read_data", "archive_read_data_into_fd"])
- }
-}
-
-module LibArchiveTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_new |
- fc.getArgument(0) = source.asExpr() and
- state = "unzFile"
- )
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
- fc.getArgument(1) = sink.asExpr() and
- state = "unzFile"
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1) and
- state1 = "" and
- state2 = "mz_zip_reader"
- )
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module LibArchiveTaint = TaintTracking::GlobalWithState;
-
-import LibArchiveTaint::PathGraph
-
-from LibArchiveTaint::PathNode source, LibArchiveTaint::PathNode sink
-where LibArchiveTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
deleted file mode 100644
index e0310704af2..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsLibMiniz.ql
+++ /dev/null
@@ -1,215 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-miniz
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * A Pointer Variable is used in Flow source
- */
-private class PointerVar extends VariableAccess {
- PointerVar() { this.getType() instanceof PointerType }
-}
-
-/**
- * A unsigned char Variable is used in Flow source
- */
-private class Uint8Var extends VariableAccess {
- Uint8Var() { this.getType().stripType().resolveTypedefs*() instanceof UnsignedCharType }
-}
-
-/**
- * The `mz_streamp`, `z_stream` Variables are used in Flow source
- */
-private class MzStreampVar extends VariableAccess {
- MzStreampVar() { this.getType().hasName(["mz_streamp", "z_stream"]) }
-}
-
-/**
- * A Char Variable is used in Flow source
- */
-private class CharVar extends VariableAccess {
- CharVar() { this.getType().stripType().resolveTypedefs*() instanceof CharType }
-}
-
-/**
- * A `mz_zip_archive` Variable is used in Flow source
- */
-private class MzZipArchiveVar extends VariableAccess {
- MzZipArchiveVar() { this.getType().hasName("mz_zip_archive") }
-}
-
-/**
- * The `mz_uncompress` functions are used in Flow Sink
- */
-private class MzUncompress extends Function {
- MzUncompress() { this.hasGlobalName(["uncompress", "mz_uncompress", "mz_uncompress2"]) }
-}
-
-/**
- * A `zip handle` is used in Flow source
- */
-private class MzZip extends Function {
- MzZip() {
- this.hasGlobalName([
- "mz_zip_reader_open", "mz_zip_reader_open_file", "mz_zip_reader_open_file_in_memory",
- "mz_zip_reader_open_buffer", "mz_zip_reader_entry_open"
- ])
- }
-}
-
-/**
- * The `mz_inflate` functions are used in Flow Sink
- */
-private class MzInflate extends Function {
- MzInflate() { this.hasGlobalName(["mz_inflate", "inflate"]) }
-}
-
-/**
- * The `mz_inflateInit` functions are used in Flow Sink
- */
-private class MzInflateInit extends Function {
- MzInflateInit() { this.hasGlobalName(["inflateInit", "mz_inflateInit"]) }
-}
-
-/**
- * The `mz_zip_reader_extract_*` functions are used in Flow Sink
- */
-private class MzZipReaderExtract extends Function {
- MzZipReaderExtract() {
- this.hasGlobalName([
- "mz_zip_reader_extract_file_to_heap", "mz_zip_reader_extract_to_heap",
- "mz_zip_reader_extract_to_callback", "mz_zip_reader_extract_file_to_callback",
- "mz_zip_reader_extract_to_mem", "mz_zip_reader_extract_file_to_mem",
- "mz_zip_reader_extract_iter_read", "mz_zip_reader_extract_to_file",
- "mz_zip_reader_extract_file_to_file"
- ])
- }
-}
-
-/**
- * The `mz_zip_reader_locate_file_*` functions are used in Flow Sink
- */
-private class MzZipReaderLocateFile extends Function {
- MzZipReaderLocateFile() {
- this.hasGlobalName(["mz_zip_reader_locate_file", "mz_zip_reader_locate_file_v2"])
- }
-}
-
-/**
- * The `tinfl_decompress_mem_*` functions are used in Flow Sink
- */
-private class TinflDecompressMem extends Function {
- TinflDecompressMem() {
- this.hasGlobalName([
- "tinfl_decompress_mem_to_callback", "tinfl_decompress_mem_to_mem",
- "tinfl_decompress_mem_to_heap"
- ])
- }
-}
-
-/**
- * The `tinfl_decompress_*` functions are used in Flow Sink
- */
-private class TinflDecompress extends Function {
- TinflDecompress() { this.hasGlobalName(["tinfl_decompress"]) }
-}
-
-module MinizTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- source.asExpr() instanceof Uint8Var and
- state = ""
- or
- source.asExpr() instanceof PointerVar and
- state = ""
- or
- source.asExpr() instanceof CharVar and
- state = ""
- or
- source.asExpr() instanceof MzZipArchiveVar and
- state = ""
- or
- source.asExpr() instanceof MzStreampVar and
- state = ""
- or
- // source of inflate(&arg0) is OK
- // but the sink which is a call to MzInflate Function first arg can not be determined
- // if I debug the query we'll reach to the first arg, it is weird I think.
- source.asDefiningArgument() =
- any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0) and
- state = "inflate"
- or
- source.asDefiningArgument() = any(Call call | call.getTarget() instanceof MzZip).getArgument(0) and
- state = ""
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
- fc.getArgument(2) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
- fc.getArgument(1) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
- fc.getArgument(0) = sink.asExpr() and
- state = "inflate"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
- fc.getArgument(1) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
- fc.getArgument(0) = sink.asExpr() and
- state = ""
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
- node1.asExpr() = fc.getArgument(2) and
- node2.asExpr() = fc.getArgument(0) and
- state1 = "" and
- state2 = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderLocateFile |
- node1.asExpr() = fc.getArgument(1) and
- node2.asExpr() = fc.getArgument(3) and
- state1 = "" and
- state2 = ""
- )
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module MinizTaint = TaintTracking::GlobalWithState;
-
-import MinizTaint::PathGraph
-
-from MinizTaint::PathNode source, MinizTaint::PathNode sink
-where MinizTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
deleted file mode 100644
index 67999bff3d6..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql
+++ /dev/null
@@ -1,152 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-minizip
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * The `mz_zip_reader_create` function as a Flow source
- * create a `mz_zip_reader` instance
- */
-private class Mz_zip_reader_create extends Function {
- Mz_zip_reader_create() { this.hasGlobalName("mz_zip_reader_create") }
-}
-
-/**
- * The `mz_zip_create` function as a Flow source
- * create a `mz_zip` instance
- */
-private class Mz_zip_create extends Function {
- Mz_zip_create() { this.hasGlobalName("mz_zip_create") }
-}
-
-/**
- * The `mz_zip_entry` function is used in Flow source
- * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
- */
-private class Mz_zip_entry extends Function {
- Mz_zip_entry() { this.hasGlobalName("mz_zip_entry_read") }
-}
-
-/**
- * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in Flow source
- * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
- */
-private class Mz_zip_reader_entry extends Function {
- Mz_zip_reader_entry() {
- this.hasGlobalName([
- "mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
- "mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all"
- ])
- }
-}
-
-/**
- * A `unzFile` Variable as a Flow source
- */
-private class UnzFileVar extends VariableAccess {
- UnzFileVar() { this.getType().hasName("unzFile") }
-}
-
-/**
- * The `UnzOpen` function as a Flow source
- */
-private class UnzOpenFunction extends Function {
- UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
-}
-
-/**
- * The `unzReadCurrentFile` function is used in Flow sink
- */
-private class UnzReadCurrentFileFunction extends Function {
- UnzReadCurrentFileFunction() { this.hasGlobalName(["unzReadCurrentFile"]) }
-}
-
-module MiniZipTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
- fc.getArgument(0) = source.asExpr() and
- state = "unzFile"
- )
- or
- source.asExpr() instanceof UnzFileVar and
- state = "unzFile"
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
- fc = source.asExpr() and
- state = "mz_zip_reader"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
- fc = source.asExpr() and
- state = "mz_zip"
- )
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
- fc.getArgument(0) = sink.asExpr() and
- state = "unzFile"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
- fc.getArgument(1) = sink.asExpr() and
- state = "mz_zip_reader"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
- fc.getArgument(1) = sink.asExpr() and
- state = "mz_zip"
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc and
- state1 = "" and
- state2 = "unzFile"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1) and
- state1 = "" and
- state2 = "mz_zip_reader"
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1) and
- state1 = "" and
- state2 = "mz_zip"
- )
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module MiniZipTaint = TaintTracking::GlobalWithState;
-
-import MiniZipTaint::PathGraph
-
-from MiniZipTaint::PathNode source, MiniZipTaint::PathNode sink
-where MiniZipTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
deleted file mode 100644
index dadbf7a5a8a..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsXZ.ql
+++ /dev/null
@@ -1,100 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-xz
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * A Pointer Variable as a Flow source
- */
-private class Uint8Var extends VariableAccess {
- Uint8Var() { this.getType() instanceof UInt8_t }
-}
-
-/**
- * A `lzma_stream` Variable as a Flow source
- */
-private class LzmaStreamVar extends VariableAccess {
- LzmaStreamVar() { this.getType().hasName("lzma_stream") }
-}
-
-/**
- * The `lzma_*_decoder` function is used as a required condition for decompression
- */
-private class LzmaDecoderFunction extends Function {
- LzmaDecoderFunction() {
- this.hasGlobalName(["lzma_stream_decoder", "lzma_auto_decoder", "lzma_alone_decoder"])
- }
-}
-
-/**
- * The `lzma_code` function is used in Flow sink
- */
-private class LzmaCodeFunction extends Function {
- LzmaCodeFunction() { this.hasGlobalName(["lzma_code"]) }
-}
-
-/**
- * The `lzma_stream_buffer_decode` function is used in Flow sink
- */
-private class LzmaStreamBufferDecodeFunction extends Function {
- LzmaStreamBufferDecodeFunction() { this.hasGlobalName(["lzma_stream_buffer_decode"]) }
-}
-
-/**
- * https://github.com/tukaani-project/xz
- */
-module XzTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- source.asExpr() instanceof LzmaStreamVar and
- state = ""
- or
- source.asExpr() instanceof Uint8Var and
- state = ""
- // and not exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamDecoderFunction)
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
- fc.getArgument(1) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
- fc.getArgument(0) = sink.asExpr() and
- state = ""
- ) and
- exists(FunctionCall fc2 | fc2.getTarget() instanceof LzmaDecoderFunction)
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- none()
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module XzTaint = TaintTracking::GlobalWithState;
-
-import XzTaint::PathGraph
-
-from XzTaint::PathNode source, XzTaint::PathNode sink
-where XzTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
deleted file mode 100644
index 9e984bb89e2..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZSTD.ql
+++ /dev/null
@@ -1,140 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-decompression-zstd
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-// https://github.com/facebook/zstd/blob/dev/examples/streaming_decompression.c
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
-
-// /**
-// * A Pointer Variable as a Flow source
-// */
-// private class PointerVar extends VariableAccess {
-// PointerVar() { this.getType() instanceof PointerType }
-// }
-/**
- * A ZSTD_inBuffer Variable as a Flow source
- */
-private class ZSTDinBufferVar extends VariableAccess {
- ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
-}
-
-/**
- * A ZSTD_inBuffer_s Variable as a Flow source
- */
-private class ZSTDinBufferSVar extends VariableAccess {
- ZSTDinBufferSVar() { this.getType().hasName("ZSTD_inBuffer_s") }
-}
-
-/**
- * The `ZSTD_decompress` function is used in Flow sink
- */
-private class ZSTDDecompressFunction extends Function {
- ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
-}
-
-/**
- * The `ZSTD_decompressDCtx` function is used in Flow sink
- */
-private class ZSTDDecompressDCtxFunction extends Function {
- ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
-}
-
-/**
- * The `ZSTD_decompressStream` function is used in Flow sink
- */
-private class ZSTDDecompressStreamFunction extends Function {
- ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
-}
-
-/**
- * The `ZSTD_decompress_usingDDict` function is used in Flow sink
- */
-private class ZSTDDecompressUsingDictFunction extends Function {
- ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
-}
-
-/**
- * The `ZSTD_decompress_usingDDict` function is used in Flow sink
- */
-private class ZSTDDecompressUsingDDictFunction extends Function {
- ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
-}
-
-module ZstdTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
-
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction |
- fc = source.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fopenCall(fc) |
- fc = source.asExpr() and
- state = ""
- )
- or
- source.asExpr() instanceof ZSTDinBufferSVar and
- state = ""
- or
- source.asExpr() instanceof ZSTDinBufferVar and
- state = ""
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
- fc.getArgument(2) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
- fc.getArgument(3) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
- fc.getArgument(3) = sink.asExpr() and
- state = ""
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
- fc.getArgument(3) = sink.asExpr() and
- state = ""
- )
- }
-
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
- none()
- }
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
-}
-
-module ZstdTaint = TaintTracking::GlobalWithState;
-
-import ZstdTaint::PathGraph
-
-from ZstdTaint::PathNode source, ZstdTaint::PathNode sink
-where ZstdTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
deleted file mode 100644
index ce7324eded0..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibGzopen.ql
+++ /dev/null
@@ -1,150 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-zlibgz
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * A `gzFile` Variable as a Flow source
- */
-private class GzFileVar extends VariableAccess {
- GzFileVar() { this.getType().hasName("gzFile") }
-}
-
-/**
- * The `gzopen` function as a Flow source
- *
- * `gzopen(const char *path, const char *mode)`
- */
-private class GzopenFunction extends Function {
- GzopenFunction() { this.hasGlobalName("gzopen") }
-}
-
-/**
- * The `gzdopen` function as a Flow source
- *
- * `gzdopen(int fd, const char *mode)`
- */
-private class GzdopenFunction extends Function {
- GzdopenFunction() { this.hasGlobalName("gzdopen") }
-}
-
-/**
- * The `gzfread` function is used in Flow sink
- *
- * `gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file)`
- */
-private class GzfreadFunction extends Function {
- GzfreadFunction() { this.hasGlobalName("gzfread") }
-}
-
-/**
- * The `gzgets` function is used in Flow sink.
- *
- * `gzgets(gzFile file, char *buf, int len)`
- */
-private class GzgetsFunction extends Function {
- GzgetsFunction() { this.hasGlobalName("gzgets") }
-}
-
-/**
- * The `gzread` function is used in Flow sink
- *
- * `gzread(gzFile file, voidp buf, unsigned len)`
- */
-private class GzreadFunction extends Function {
- GzreadFunction() { this.hasGlobalName("gzread") }
-}
-
-module ZlibTaintConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
- fc.getArgument(0) = source.asExpr() and
- // arg 0 can be a path string whichwe must do following check
- not fc.getArgument(0).isConstant()
- )
- or
- // IDK whether it is good to use all file decriptors function returns as source or not
- // because we can do more sanitization from fd function sources
- exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
- fc.getArgument(0) = source.asExpr()
- )
- or
- source.asExpr() instanceof GzFileVar
- }
-
- predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
- fc.getArgument(0) = sink.asExpr() and
- not sanitizer(fc)
- // TODO: and not sanitizer2(fc.getArgument(2))
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
- sink.asExpr() = fc.getArgument(3)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzgetsFunction |
- sink.asExpr() = fc.getArgument(0)
- )
- }
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc |
- fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
- |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzreadFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzfreadFunction |
- node1.asExpr() = fc.getArgument(3) and
- node2.asExpr() = fc.getArgument(0)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzgetsFunction |
- node1.asExpr() = fc.getArgument(0) and
- node1.asExpr() = fc.getArgument(1)
- )
- }
-}
-
-predicate sanitizer(FunctionCall fc) {
- exists(Expr e |
- // a RelationalOperation which isn't compared with a Literal that using for end of read
- TaintTracking::localExprTaint(fc, e.(RelationalOperation).getAChild*()) and
- not e.getAChild*().(Literal).getValue() = ["0", "1", "-1"]
- )
-}
-
-// TODO:
-// predicate sanitizer2(FunctionCall fc) {
-// exists(Expr e |
-// // a RelationalOperation which isn't compared with a Literal that using for end of read
-// TaintTracking::localExprTaint(fc.getArgument(2), e)
-// )
-// }
-module ZlibTaint = TaintTracking::Global;
-
-import ZlibTaint::PathGraph
-
-from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
-where ZlibTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompressiondepends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
deleted file mode 100644
index e526b4d9273..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibInflator.ql
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-zlibinflator
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * A `z_stream` Variable as a Flow source
- */
-private class ZStreamVar extends VariableAccess {
- ZStreamVar() { this.getType().hasName("z_stream") }
-}
-
-/**
- * The `inflate`/`inflateSync` functions are used in Flow sink
- *
- * `inflate(z_streamp strm, int flush)`
- *
- * `inflateSync(z_streamp strm)`
- */
-private class InflateFunction extends Function {
- InflateFunction() { this.hasGlobalName(["inflate", "inflateSync"]) }
-}
-
-module ZlibTaintConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source.asExpr() instanceof ZStreamVar }
-
- predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- }
-}
-
-module ZlibTaint = TaintTracking::Global;
-
-import ZlibTaint::PathGraph
-
-from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
-where ZlibTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
deleted file mode 100644
index b385523f185..00000000000
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsZlibUncompress.ql
+++ /dev/null
@@ -1,49 +0,0 @@
-/**
- * @name User-controlled file decompression
- * @description User-controlled data that flows into decompression library APIs without checking the compression rate is dangerous
- * @kind path-problem
- * @problem.severity error
- * @security-severity 7.8
- * @precision high
- * @id cpp/user-controlled-file-zlibuncompress
- * @tags security
- * experimental
- * external/cwe/cwe-409
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-
-/**
- * A Bytef Variable as a Flow source
- */
-private class BytefVar extends VariableAccess {
- BytefVar() { this.getType().hasName("Bytef") }
-}
-
-/**
- * The `uncompress`/`uncompress2` function is used in Flow sink
- */
-private class UncompressFunction extends Function {
- UncompressFunction() { hasGlobalName(["uncompress", "uncompress2"]) }
-}
-
-module ZlibTaintConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source.asExpr() instanceof BytefVar }
-
- predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- }
-}
-
-module ZlibTaint = TaintTracking::Global;
-
-import ZlibTaint::PathGraph
-
-from ZlibTaint::PathNode source, ZlibTaint::PathNode sink
-where ZlibTaint::flowPath(source, sink)
-select sink.getNode(), source, sink, "This Decompression depends on a $@.", source.getNode(),
- "potentially untrusted source"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll
new file mode 100644
index 00000000000..4d96e83c195
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll
@@ -0,0 +1,25 @@
+/**
+ * https://github.com/libarchive/libarchive/wiki
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * The `archive_read_new` function as a Flow source
+ * create a `archive` instance
+ */
+class Archive_read_new extends Function {
+ Archive_read_new() { this.hasGlobalName("archive_read_new") }
+}
+
+/**
+ * The `archive_read_data*` functions are used in Flow Sink
+ * [Examples](https://github.com/libarchive/libarchive/wiki/Examples)
+ */
+class Archive_read_data_block extends Function {
+ Archive_read_data_block() {
+ this.hasGlobalName(["archive_read_data_block", "archive_read_data", "archive_read_data_into_fd"])
+ }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll
new file mode 100644
index 00000000000..64eba1e7b28
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll
@@ -0,0 +1,102 @@
+/**
+ * https://github.com/richgel999/miniz
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A unsigned char Variable is used in Flow source
+ */
+class UnsignedCharVar extends VariableAccess {
+ UnsignedCharVar() { this.getType().stripType().resolveTypedefs*() instanceof UnsignedCharType }
+}
+
+/**
+ * The `mz_streamp`, `z_stream` Variables are used in Flow source
+ */
+class MzStreampVar extends VariableAccess {
+ MzStreampVar() { this.getType().hasName(["mz_streamp", "z_stream"]) }
+}
+
+/**
+ * A Char Variable is used in Flow source
+ */
+class CharVar extends VariableAccess {
+ CharVar() { this.getType().stripType().resolveTypedefs*() instanceof CharType }
+}
+
+/**
+ * A `mz_zip_archive` Variable is used in Flow source
+ */
+class MzZipArchiveVar extends VariableAccess {
+ MzZipArchiveVar() { this.getType().hasName("mz_zip_archive") }
+}
+
+/**
+ * The `mz_uncompress` functions are used in Flow Sink
+ */
+class MzUncompress extends Function {
+ MzUncompress() { this.hasGlobalName(["uncompress", "mz_uncompress", "mz_uncompress2"]) }
+}
+
+/**
+ * A `zip handle` is used in Flow source
+ */
+class MzZip extends Function {
+ MzZip() {
+ this.hasGlobalName([
+ "mz_zip_reader_open", "mz_zip_reader_open_file", "mz_zip_reader_open_file_in_memory",
+ "mz_zip_reader_open_buffer", "mz_zip_reader_entry_open"
+ ])
+ }
+}
+
+/**
+ * The `mz_inflate` functions are used in Flow Sink
+ */
+class MzInflate extends Function {
+ MzInflate() { this.hasGlobalName(["mz_inflate", "inflate"]) }
+}
+
+/**
+ * The `mz_inflateInit` functions are used in Flow Sink
+ */
+class MzInflateInit extends Function {
+ MzInflateInit() { this.hasGlobalName(["inflateInit", "mz_inflateInit"]) }
+}
+
+/**
+ * The `mz_zip_reader_extract_*` functions are used in Flow Sink
+ */
+class MzZipReaderExtract extends Function {
+ MzZipReaderExtract() {
+ this.hasGlobalName([
+ "mz_zip_reader_extract_file_to_heap", "mz_zip_reader_extract_to_heap",
+ "mz_zip_reader_extract_to_callback", "mz_zip_reader_extract_file_to_callback",
+ "mz_zip_reader_extract_to_mem", "mz_zip_reader_extract_file_to_mem",
+ "mz_zip_reader_extract_iter_read", "mz_zip_reader_extract_to_file",
+ "mz_zip_reader_extract_file_to_file"
+ ])
+ }
+}
+
+/**
+ * The `tinfl_decompress_mem_*` functions are used in Flow Sink
+ */
+class TinflDecompressMem extends Function {
+ TinflDecompressMem() {
+ this.hasGlobalName([
+ "tinfl_decompress_mem_to_callback", "tinfl_decompress_mem_to_mem",
+ "tinfl_decompress_mem_to_heap"
+ ])
+ }
+}
+
+/**
+ * The `tinfl_decompress_*` functions are used in Flow Sink
+ */
+class TinflDecompress extends Function {
+ TinflDecompress() { this.hasGlobalName(["tinfl_decompress"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll
new file mode 100644
index 00000000000..7d2280166e0
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll
@@ -0,0 +1,65 @@
+/**
+ * https://github.com/zlib-ng/minizip-ng
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * The `mz_zip_reader_create` function as a Flow source
+ * create a `mz_zip_reader` instance
+ */
+class Mz_zip_reader_create extends Function {
+ Mz_zip_reader_create() { this.hasGlobalName("mz_zip_reader_create") }
+}
+
+/**
+ * The `mz_zip_create` function as a Flow source
+ * create a `mz_zip` instance
+ */
+class Mz_zip_create extends Function {
+ Mz_zip_create() { this.hasGlobalName("mz_zip_create") }
+}
+
+/**
+ * The `mz_zip_entry` function is used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
+ */
+class Mz_zip_entry extends Function {
+ Mz_zip_entry() { this.hasGlobalName("mz_zip_entry_read") }
+}
+
+/**
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
+ */
+class Mz_zip_reader_entry extends Function {
+ Mz_zip_reader_entry() {
+ this.hasGlobalName([
+ "mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
+ "mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all"
+ ])
+ }
+}
+
+/**
+ * A `unzFile` Variable as a Flow source
+ */
+class UnzFileVar extends VariableAccess {
+ UnzFileVar() { this.getType().hasName("unzFile") }
+}
+
+/**
+ * The `UnzOpen` function as a Flow source
+ */
+class UnzOpenFunction extends Function {
+ UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
+}
+
+/**
+ * The `unzReadCurrentFile` function is used in Flow sink
+ */
+class UnzReadCurrentFileFunction extends Function {
+ UnzReadCurrentFileFunction() { this.hasGlobalName(["unzReadCurrentFile"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
new file mode 100644
index 00000000000..84b6a311f86
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
@@ -0,0 +1,37 @@
+/**
+ * https://github.com/tukaani-project/xz
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A `lzma_stream` Variable as a Flow source
+ */
+class LzmaStreamVar extends VariableAccess {
+ LzmaStreamVar() { this.getType().hasName("lzma_stream") }
+}
+
+/**
+ * The `lzma_*_decoder` function is used as a required condition for decompression
+ */
+class LzmaDecoderFunction extends Function {
+ LzmaDecoderFunction() {
+ this.hasGlobalName(["lzma_stream_decoder", "lzma_auto_decoder", "lzma_alone_decoder"])
+ }
+}
+
+/**
+ * The `lzma_code` function is used in Flow sink
+ */
+class LzmaCodeFunction extends Function {
+ LzmaCodeFunction() { this.hasGlobalName(["lzma_code"]) }
+}
+
+/**
+ * The `lzma_stream_buffer_decode` function is used in Flow sink
+ */
+class LzmaStreamBufferDecodeFunction extends Function {
+ LzmaStreamBufferDecodeFunction() { this.hasGlobalName(["lzma_stream_buffer_decode"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll
new file mode 100644
index 00000000000..902903efb78
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll
@@ -0,0 +1,57 @@
+/**
+ * https://github.com/facebook/zstd/blob/dev/examples/streaming_decompression.c
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A ZSTD_inBuffer Variable as a Flow source
+ */
+class ZSTDinBufferVar extends VariableAccess {
+ ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
+}
+
+/**
+ * A ZSTD_inBuffer_s Variable as a Flow source
+ */
+class ZSTDinBufferSVar extends VariableAccess {
+ ZSTDinBufferSVar() { this.getType().hasName("ZSTD_inBuffer_s") }
+}
+
+/**
+ * The `ZSTD_decompress` function is used in Flow sink
+ */
+class ZSTDDecompressFunction extends Function {
+ ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
+}
+
+/**
+ * The `ZSTD_decompressDCtx` function is used in Flow sink
+ */
+class ZSTDDecompressDCtxFunction extends Function {
+ ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
+}
+
+/**
+ * The `ZSTD_decompressStream` function is used in Flow sink
+ */
+class ZSTDDecompressStreamFunction extends Function {
+ ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
+}
+
+/**
+ * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ */
+class ZSTDDecompressUsingDictFunction extends Function {
+ ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+}
+
+/**
+ * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ */
+class ZSTDDecompressUsingDDictFunction extends Function {
+ ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll
new file mode 100644
index 00000000000..306130ac8f2
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll
@@ -0,0 +1,75 @@
+/**
+ * https://www.zlib.net/
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A `gzFile` Variable as a Flow source
+ */
+class GzFileVar extends VariableAccess {
+ GzFileVar() { this.getType().hasName("gzFile") }
+}
+
+/**
+ * The `gzopen` function as a Flow source
+ *
+ * `gzopen(const char *path, const char *mode)`
+ */
+class GzopenFunction extends Function {
+ GzopenFunction() { this.hasGlobalName("gzopen") }
+}
+
+/**
+ * The `gzdopen` function as a Flow source
+ *
+ * `gzdopen(int fd, const char *mode)`
+ */
+class GzdopenFunction extends Function {
+ GzdopenFunction() { this.hasGlobalName("gzdopen") }
+}
+
+/**
+ * The `gzfread` function is used in Flow sink
+ *
+ * `gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file)`
+ */
+class GzFreadFunction extends Function {
+ GzFreadFunction() { this.hasGlobalName("gzfread") }
+}
+
+/**
+ * The `gzgets` function is used in Flow sink.
+ *
+ * `gzgets(gzFile file, char *buf, int len)`
+ */
+class GzGetsFunction extends Function {
+ GzGetsFunction() { this.hasGlobalName("gzgets") }
+}
+
+/**
+ * The `gzread` function is used in Flow sink
+ *
+ * `gzread(gzFile file, voidp buf, unsigned len)`
+ */
+class GzReadFunction extends Function {
+ GzReadFunction() { this.hasGlobalName("gzread") }
+}
+
+predicate isSource(DataFlow::Node source) {
+ exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
+ fc.getArgument(0) = source.asExpr() and
+ // arg 0 can be a path string whichwe must do following check
+ not fc.getArgument(0).isConstant()
+ )
+ or
+ // IDK whether it is good to use all file decriptors function returns as source or not
+ // because we can do more sanitization from fd function sources
+ exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
+ fc.getArgument(0) = source.asExpr()
+ )
+ or
+ source.asExpr() instanceof GzFileVar
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll
new file mode 100644
index 00000000000..b67caecfcbd
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll
@@ -0,0 +1,25 @@
+/**
+ * https://www.zlib.net/
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A `z_stream` Variable as a Flow source
+ */
+class ZStreamVar extends VariableAccess {
+ ZStreamVar() { this.getType().hasName("z_stream") }
+}
+
+/**
+ * The `inflate`/`inflateSync` functions are used in Flow sink
+ *
+ * `inflate(z_streamp strm, int flush)`
+ *
+ * `inflateSync(z_streamp strm)`
+ */
+class InflateFunction extends Function {
+ InflateFunction() { this.hasGlobalName(["inflate", "inflateSync"]) }
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
new file mode 100644
index 00000000000..3518719bc87
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
@@ -0,0 +1,21 @@
+/**
+ * https://www.zlib.net/
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+
+/**
+ * A Bytef Variable as a Flow source
+ */
+class BytefVar extends VariableAccess {
+ BytefVar() { this.getType().hasName("Bytef") }
+}
+
+/**
+ * The `uncompress`/`uncompress2` function is used in Flow sink
+ */
+class UncompressFunction extends Function {
+ UncompressFunction() { hasGlobalName(["uncompress", "uncompress2"]) }
+}
From a5363286f1a184914aaa43cdee9f937ec6def845 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Fri, 7 Jun 2024 05:37:58 +0200
Subject: [PATCH 013/500] add implicit this
---
.../Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
index 3518719bc87..1f33b065409 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
@@ -17,5 +17,5 @@ class BytefVar extends VariableAccess {
* The `uncompress`/`uncompress2` function is used in Flow sink
*/
class UncompressFunction extends Function {
- UncompressFunction() { hasGlobalName(["uncompress", "uncompress2"]) }
+ UncompressFunction() { this.hasGlobalName(["uncompress", "uncompress2"]) }
}
From 273848c8796f02c4b583c99144b6bc4ca9d7af31 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Fri, 7 Jun 2024 05:40:17 +0200
Subject: [PATCH 014/500] remove old comments
---
.../CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
index 8506dccaea7..d75eae39056 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
@@ -115,12 +115,10 @@ module DecompressionTaintConfig implements DataFlow::StateConfigSig {
(
exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
fc.getArgument(0) = source.asExpr() and
- // arg 0 can be a path string whichwe must do following check
+ // arg 0 can be a path string which we must do following check
not fc.getArgument(0).isConstant()
)
or
- // IDK whether it is good to use all file decriptors function returns as source or not
- // because we can do more sanitization from fd function sources
exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
fc.getArgument(0) = source.asExpr()
)
From 11a416ea7c80493d44cbd6e02c218cb2f0164ead Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Thu, 13 Jun 2024 03:30:07 +0200
Subject: [PATCH 015/500] add FlowSources as a common source for all sinks, so
we don't need States anymore
---
.../DecompressionBombs.ql | 350 ++++++------------
.../CWE/CWE-409-DecompressionBomb/XZ.qll | 8 -
2 files changed, 104 insertions(+), 254 deletions(-)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
index d75eae39056..03eab33a6ce 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
@@ -27,298 +27,156 @@ import ZlibUncompress
import ZlibInflator
import Brotli
-module DecompressionTaintConfig implements DataFlow::StateConfigSig {
- class FlowState = DataFlow::FlowState;
+module DecompressionTaintConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
- predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
- (
- exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
- or
- exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
- or
- source.asExpr() instanceof PointerVar
- or
- source.asExpr() instanceof Uint8Var
- ) and
- state = "brotli"
- or
- (
- source.asExpr() instanceof BzStreamVar
- or
- source.asExpr() instanceof BzFileVar
- or
- exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
- ) and
- state = "bzip2"
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_new |
- fc.getArgument(0) = source.asExpr()
- ) and
- state = "libarchive"
- or
- (
- source.asExpr() instanceof UnsignedCharVar
- or
- source.asExpr() instanceof PointerVar
- or
- source.asExpr() instanceof CharVar
- or
- source.asExpr() instanceof MzZipArchiveVar
- or
- source.asExpr() instanceof MzStreampVar
- or
- source.asDefiningArgument() =
- any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0)
- or
- source.asDefiningArgument() =
- any(Call call | call.getTarget() instanceof MzZip).getArgument(0)
- ) and
- state = "libminiz"
- or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
- or
- exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
- or
- source.asExpr() instanceof ZSTDinBufferSVar
- or
- source.asExpr() instanceof ZSTDinBufferVar
- ) and
- state = "zstd"
- or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
- fc.getArgument(0) = source.asExpr()
- )
- or
- source.asExpr() instanceof UnzFileVar
- ) and
- state = "unzFile"
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
- fc = source.asExpr() and
- state = "mz_zip_reader"
+ predicate isSink(DataFlow::Node sink) {
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr()
)
or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
- fc = source.asExpr() and
- state = "mz_zip"
+ exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
+ fc.getArgument(1) = sink.asExpr()
)
or
- (
- source.asExpr() instanceof LzmaStreamVar
- or
- source.asExpr() instanceof Uint8Var
- ) and
- state = "xz"
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
- fc.getArgument(0) = source.asExpr() and
- // arg 0 can be a path string which we must do following check
- not fc.getArgument(0).isConstant()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
- fc.getArgument(0) = source.asExpr()
- )
- or
- source.asExpr() instanceof GzFileVar
- ) and
- state = "zlibgzopen"
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
+ fc.getArgument(1) = sink.asExpr()
+ )
or
- source.asExpr() instanceof ZStreamVar and state = "zlifinflator"
- or
- source.asExpr() instanceof BytefVar and state = "zlibuncompress"
- }
-
- predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
- (
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- ) and
- state = "brotli"
- or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- ) and
- state = "bzip2"
+ exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
or
exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
- fc.getArgument(0) = sink.asExpr() and
- state = "libarchive"
+ fc.getArgument(0) = sink.asExpr()
)
or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
- fc.getArgument(0) = sink.asExpr()
- )
- ) and
- state = "libminiz"
+ exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
+ fc.getArgument(0) = sink.asExpr()
+ )
or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- ) and
- state = "zstd"
+ exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
+ fc.getArgument(1) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
+ fc.getArgument(2) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
+ fc.getArgument(3) = sink.asExpr()
+ )
or
exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
- fc.getArgument(0) = sink.asExpr() and
- state = "unzFile"
+ fc.getArgument(0) = sink.asExpr()
)
or
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
- fc.getArgument(1) = sink.asExpr() and
- state = "mz_zip_reader"
+ fc.getArgument(1) = sink.asExpr()
)
or
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
- fc.getArgument(1) = sink.asExpr() and
- state = "mz_zip"
+ fc.getArgument(1) = sink.asExpr()
)
or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- ) and
- state = "xz" and
- exists(FunctionCall fc2 | fc2.getTarget() instanceof LzmaDecoderFunction)
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
+ fc.getArgument(1) = sink.asExpr()
+ )
or
- (
- exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
- sink.asExpr() = fc.getArgument(3)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
- sink.asExpr() = fc.getArgument(0)
- )
- ) and
- state = "zlibgzopen"
+ exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
+ fc.getArgument(0) = sink.asExpr()
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
+ sink.asExpr() = fc.getArgument(3)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
+ sink.asExpr() = fc.getArgument(0)
+ )
or
exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
fc.getArgument(0) = sink.asExpr()
- ) and
- state = "zlifinflator"
+ )
or
exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
fc.getArgument(0) = sink.asExpr()
- ) and
- state = "zlibuncompress"
+ )
}
- predicate isAdditionalFlowStep(
- DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
- DataFlow::FlowState state2
- ) {
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc and
- state1 = "" and
- state2 = "unzFile"
+ node2.asExpr() = fc
)
or
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1) and
- state1 = "" and
- state2 = "mz_zip_reader"
+ node2.asExpr() = fc.getArgument(1)
)
or
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1) and
- state1 = "" and
- state2 = "mz_zip"
+ node2.asExpr() = fc.getArgument(1)
)
or
- (
- exists(FunctionCall fc |
- fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
- |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
- node1.asExpr() = fc.getArgument(3) and
- node2.asExpr() = fc.getArgument(0)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
- node1.asExpr() = fc.getArgument(0) and
- node1.asExpr() = fc.getArgument(1)
- )
- ) and
- state1 = "" and
- state2 = "gzopen"
+ exists(FunctionCall fc |
+ fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
+ |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
+ node1.asExpr() = fc.getArgument(3) and
+ node2.asExpr() = fc.getArgument(0)
+ )
+ or
+ exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
+ node1.asExpr() = fc.getArgument(0) and
+ node1.asExpr() = fc.getArgument(1)
+ )
}
-
- predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
}
-module DecompressionTaint = TaintTracking::GlobalWithState;
+module DecompressionTaint = TaintTracking::Global;
import DecompressionTaint::PathGraph
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
index 84b6a311f86..621558e07fd 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
@@ -13,14 +13,6 @@ class LzmaStreamVar extends VariableAccess {
LzmaStreamVar() { this.getType().hasName("lzma_stream") }
}
-/**
- * The `lzma_*_decoder` function is used as a required condition for decompression
- */
-class LzmaDecoderFunction extends Function {
- LzmaDecoderFunction() {
- this.hasGlobalName(["lzma_stream_decoder", "lzma_auto_decoder", "lzma_alone_decoder"])
- }
-}
/**
* The `lzma_code` function is used in Flow sink
From 13f697c0569c2266ec10f0d47979ee0a80c82a0c Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 25 Jun 2024 17:31:40 +0200
Subject: [PATCH 016/500] relocate the query
---
.../Security/CWE/CWE-409}/Brotli.qll | 0
.../Security/CWE/CWE-409}/Bzip2.qll | 0
.../Security/CWE/CWE-409}/DecompressionBomb.qhelp | 0
.../Security/CWE/CWE-409}/DecompressionBombs.ql | 0
.../Security/CWE/CWE-409}/LibArchive.qll | 0
.../Security/CWE/CWE-409}/LibMiniz.qll | 0
.../Security/CWE/CWE-409}/MiniZip.qll | 0
.../Security/CWE/CWE-409}/XZ.qll | 0
.../Security/CWE/CWE-409}/ZSTD.qll | 0
.../Security/CWE/CWE-409}/ZlibGzopen.qll | 0
.../Security/CWE/CWE-409}/ZlibInflator.qll | 0
.../Security/CWE/CWE-409}/ZlibUncompress.qll | 0
.../Security/CWE/CWE-409}/example_bad.cpp | 0
.../Security/CWE/CWE-409}/example_good.cpp | 0
14 files changed, 0 insertions(+), 0 deletions(-)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/Brotli.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/Bzip2.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/DecompressionBomb.qhelp (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/DecompressionBombs.ql (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/LibArchive.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/LibMiniz.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/MiniZip.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/XZ.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/ZSTD.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/ZlibGzopen.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/ZlibInflator.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/ZlibUncompress.qll (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/example_bad.cpp (100%)
rename cpp/ql/src/experimental/{Security/CWE/CWE-409-DecompressionBomb => query-tests/Security/CWE/CWE-409}/example_good.cpp (100%)
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qhelp
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBomb.qhelp
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qhelp
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibArchive.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/LibMiniz.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/MiniZip.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/XZ.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZSTD.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibGzopen.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibInflator.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/ZlibUncompress.qll
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/example_bad.cpp
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_bad.cpp
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/example_bad.cpp
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/example_good.cpp
similarity index 100%
rename from cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/example_good.cpp
rename to cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/example_good.cpp
From 656dc4e2760a36c3eab87475d5e450f4fa606096 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 25 Jun 2024 18:09:27 +0200
Subject: [PATCH 017/500] use abstract class for decompression sinks
---
.../Security/CWE/CWE-409/Brotli.qll | 29 ++--
.../Security/CWE/CWE-409/Bzip2.qll | 35 ++---
.../CWE/CWE-409/DecompressionBomb.qll | 8 ++
.../CWE/CWE-409/DecompressionBombs.ql | 129 +-----------------
.../Security/CWE/CWE-409/LibArchive.qll | 15 +-
.../Security/CWE/CWE-409/LibMiniz.qll | 70 ++++------
.../Security/CWE/CWE-409/MiniZip.qll | 45 ++----
.../query-tests/Security/CWE/CWE-409/XZ.qll | 21 ++-
.../query-tests/Security/CWE/CWE-409/ZSTD.qll | 45 +++---
.../Security/CWE/CWE-409/ZlibGzopen.qll | 84 +++++-------
.../Security/CWE/CWE-409/ZlibInflator.qll | 14 +-
.../Security/CWE/CWE-409/ZlibUncompress.qll | 14 +-
12 files changed, 148 insertions(+), 361 deletions(-)
create mode 100644 cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
index 46314826a62..5c19e53df07 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
@@ -6,33 +6,22 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
+import DecompressionBomb
/**
- * A Pointer Variable is used in Flow source
+ * The `BrotliDecoderDecompress` function is used in flow sink. * Ref: https://www.brotli.org/decode.html#af68
*/
-class PointerVar extends VariableAccess {
- PointerVar() { this.getType() instanceof PointerType }
-}
-
-/**
- * A Pointer Variable is used in Flow source
- */
-class Uint8Var extends VariableAccess {
- Uint8Var() { this.getType() instanceof UInt8_t }
-}
-
-/**
- * The `BrotliDecoderDecompress` function is used in Flow sink
- * Ref: https://www.brotli.org/decode.html#af68
- */
-class BrotliDecoderDecompressFunction extends Function {
+class BrotliDecoderDecompressFunction extends DecompressionFunction {
BrotliDecoderDecompressFunction() { this.hasGlobalName(["BrotliDecoderDecompress"]) }
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * The `BrotliDecoderDecompressStream` function is used in Flow sink
- * Ref: https://www.brotli.org/decode.html#a234
+ * The `BrotliDecoderDecompressStream` function is used in flow sink. * Ref: https://www.brotli.org/decode.html#a234
*/
-class BrotliDecoderDecompressStreamFunction extends Function {
+class BrotliDecoderDecompressStreamFunction extends DecompressionFunction {
BrotliDecoderDecompressStreamFunction() { this.hasGlobalName(["BrotliDecoderDecompressStream"]) }
+
+ override int getArchiveParameterIndex() { result = 2 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
index 662424b022a..7f69aa494c6 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
@@ -6,45 +6,40 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
-
-/**
- * A `bz_stream` Variable as a Flow source
- */
-class BzStreamVar extends VariableAccess {
- BzStreamVar() { this.getType().hasName("bz_stream") }
-}
-
-/**
- * A `BZFILE` Variable as a Flow source
- */
-class BzFileVar extends VariableAccess {
- BzFileVar() { this.getType().hasName("BZFILE") }
-}
+import DecompressionBomb
/**
* The `BZ2_bzDecompress` function as a Flow source
*/
-class BZ2BzDecompressFunction extends Function {
+class BZ2BzDecompressFunction extends DecompressionFunction {
BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
* The `BZ2_bzReadOpen` function
*/
-class BZ2BzReadOpenFunction extends Function {
+class BZ2BzReadOpenFunction extends DecompressionFunction {
BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
- * The `BZ2_bzRead` function is used in Flow sink
+ * The `BZ2_bzRead` function is used in flow sink.
*/
-class BZ2BzReadFunction extends Function {
+class BZ2BzReadFunction extends DecompressionFunction {
BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * The `BZ2_bzBuffToBuffDecompress` function is used in Flow sink
+ * The `BZ2_bzBuffToBuffDecompress` function is used in flow sink.
*/
-class BZ2BzBuffToBuffDecompressFunction extends Function {
+class BZ2BzBuffToBuffDecompressFunction extends DecompressionFunction {
BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
+
+ override int getArchiveParameterIndex() { result = 2 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
new file mode 100644
index 00000000000..2cca1453d2f
--- /dev/null
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
@@ -0,0 +1,8 @@
+import cpp
+
+/**
+ * The Decompression Sink instances, extend this class to defind new decompression sinks.
+ */
+abstract class DecompressionFunction extends Function {
+ abstract int getArchiveParameterIndex();
+}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
index 03eab33a6ce..b7eda35f2c7 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -15,124 +15,16 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
-import Bzip2
-import Brotli
-import LibArchive
-import LibMiniz
-import ZSTD
import MiniZip
-import XZ
import ZlibGzopen
-import ZlibUncompress
-import ZlibInflator
-import Brotli
+import DecompressionBomb
module DecompressionTaintConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
predicate isSink(DataFlow::Node sink) {
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
- fc.getArgument(2) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
- fc.getArgument(3) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
- fc.getArgument(1) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
- sink.asExpr() = fc.getArgument(3)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
- sink.asExpr() = fc.getArgument(0)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
- fc.getArgument(0) = sink.asExpr()
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
- fc.getArgument(0) = sink.asExpr()
+ exists(FunctionCall fc, DecompressionFunction f | fc.getTarget() = f |
+ fc.getArgument(f.getArchiveParameterIndex()) = sink.asExpr()
)
}
@@ -158,21 +50,6 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
node1.asExpr() = fc.getArgument(0) and
node2.asExpr() = fc
)
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
- node1.asExpr() = fc.getArgument(3) and
- node2.asExpr() = fc.getArgument(0)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
- node1.asExpr() = fc.getArgument(0) and
- node1.asExpr() = fc.getArgument(1)
- )
}
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
index 4d96e83c195..e5124006504 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
@@ -5,21 +5,16 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * The `archive_read_new` function as a Flow source
- * create a `archive` instance
- */
-class Archive_read_new extends Function {
- Archive_read_new() { this.hasGlobalName("archive_read_new") }
-}
-
-/**
- * The `archive_read_data*` functions are used in Flow Sink
+ * The `archive_read_data*` functions are used in flow sink.
* [Examples](https://github.com/libarchive/libarchive/wiki/Examples)
*/
-class Archive_read_data_block extends Function {
+class Archive_read_data_block extends DecompressionFunction {
Archive_read_data_block() {
this.hasGlobalName(["archive_read_data_block", "archive_read_data", "archive_read_data_into_fd"])
}
+
+ override int getArchiveParameterIndex() { result = 0 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll
index 64eba1e7b28..0025ecca97d 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll
@@ -5,72 +5,44 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * A unsigned char Variable is used in Flow source
+ * The `mz_uncompress` functions are used in flow sink.
*/
-class UnsignedCharVar extends VariableAccess {
- UnsignedCharVar() { this.getType().stripType().resolveTypedefs*() instanceof UnsignedCharType }
-}
-
-/**
- * The `mz_streamp`, `z_stream` Variables are used in Flow source
- */
-class MzStreampVar extends VariableAccess {
- MzStreampVar() { this.getType().hasName(["mz_streamp", "z_stream"]) }
-}
-
-/**
- * A Char Variable is used in Flow source
- */
-class CharVar extends VariableAccess {
- CharVar() { this.getType().stripType().resolveTypedefs*() instanceof CharType }
-}
-
-/**
- * A `mz_zip_archive` Variable is used in Flow source
- */
-class MzZipArchiveVar extends VariableAccess {
- MzZipArchiveVar() { this.getType().hasName("mz_zip_archive") }
-}
-
-/**
- * The `mz_uncompress` functions are used in Flow Sink
- */
-class MzUncompress extends Function {
+class MzUncompress extends DecompressionFunction {
MzUncompress() { this.hasGlobalName(["uncompress", "mz_uncompress", "mz_uncompress2"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
* A `zip handle` is used in Flow source
*/
-class MzZip extends Function {
+class MzZip extends DecompressionFunction {
MzZip() {
this.hasGlobalName([
"mz_zip_reader_open", "mz_zip_reader_open_file", "mz_zip_reader_open_file_in_memory",
"mz_zip_reader_open_buffer", "mz_zip_reader_entry_open"
])
}
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * The `mz_inflate` functions are used in Flow Sink
+ * The `mz_inflate` functions are used in flow sink.
*/
-class MzInflate extends Function {
+class MzInflate extends DecompressionFunction {
MzInflate() { this.hasGlobalName(["mz_inflate", "inflate"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
- * The `mz_inflateInit` functions are used in Flow Sink
+ * The `mz_zip_reader_extract_*` functions are used in flow sink.
*/
-class MzInflateInit extends Function {
- MzInflateInit() { this.hasGlobalName(["inflateInit", "mz_inflateInit"]) }
-}
-
-/**
- * The `mz_zip_reader_extract_*` functions are used in Flow Sink
- */
-class MzZipReaderExtract extends Function {
+class MzZipReaderExtract extends DecompressionFunction {
MzZipReaderExtract() {
this.hasGlobalName([
"mz_zip_reader_extract_file_to_heap", "mz_zip_reader_extract_to_heap",
@@ -80,23 +52,29 @@ class MzZipReaderExtract extends Function {
"mz_zip_reader_extract_file_to_file"
])
}
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * The `tinfl_decompress_mem_*` functions are used in Flow Sink
+ * The `tinfl_decompress_mem_*` functions are used in flow sink.
*/
-class TinflDecompressMem extends Function {
+class TinflDecompressMem extends DecompressionFunction {
TinflDecompressMem() {
this.hasGlobalName([
"tinfl_decompress_mem_to_callback", "tinfl_decompress_mem_to_mem",
"tinfl_decompress_mem_to_heap"
])
}
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
- * The `tinfl_decompress_*` functions are used in Flow Sink
+ * The `tinfl_decompress_*` functions are used in flow sink.
*/
-class TinflDecompress extends Function {
+class TinflDecompress extends DecompressionFunction {
TinflDecompress() { this.hasGlobalName(["tinfl_decompress"]) }
+
+ override int getArchiveParameterIndex() { result = 1 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
index 7d2280166e0..4bfa9a13b2c 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
@@ -5,61 +5,36 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * The `mz_zip_reader_create` function as a Flow source
- * create a `mz_zip_reader` instance
- */
-class Mz_zip_reader_create extends Function {
- Mz_zip_reader_create() { this.hasGlobalName("mz_zip_reader_create") }
-}
-
-/**
- * The `mz_zip_create` function as a Flow source
- * create a `mz_zip` instance
- */
-class Mz_zip_create extends Function {
- Mz_zip_create() { this.hasGlobalName("mz_zip_create") }
-}
-
-/**
- * The `mz_zip_entry` function is used in Flow source
+ * The `mz_zip_entry` function is used in flow source.
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
*/
-class Mz_zip_entry extends Function {
+class Mz_zip_entry extends DecompressionFunction {
Mz_zip_entry() { this.hasGlobalName("mz_zip_entry_read") }
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in Flow source
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow source.
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
*/
-class Mz_zip_reader_entry extends Function {
+class Mz_zip_reader_entry extends DecompressionFunction {
Mz_zip_reader_entry() {
this.hasGlobalName([
"mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
"mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all"
])
}
+
+ override int getArchiveParameterIndex() { result = 1 }
}
/**
- * A `unzFile` Variable as a Flow source
- */
-class UnzFileVar extends VariableAccess {
- UnzFileVar() { this.getType().hasName("unzFile") }
-}
-
-/**
- * The `UnzOpen` function as a Flow source
+ * The `UnzOpen` function as a flow source.
*/
class UnzOpenFunction extends Function {
UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
}
-
-/**
- * The `unzReadCurrentFile` function is used in Flow sink
- */
-class UnzReadCurrentFileFunction extends Function {
- UnzReadCurrentFileFunction() { this.hasGlobalName(["unzReadCurrentFile"]) }
-}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
index 621558e07fd..a0b17388b93 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
@@ -5,25 +5,22 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * A `lzma_stream` Variable as a Flow source
+ * The `lzma_code` function is used in flow sink.
*/
-class LzmaStreamVar extends VariableAccess {
- LzmaStreamVar() { this.getType().hasName("lzma_stream") }
-}
-
-
-/**
- * The `lzma_code` function is used in Flow sink
- */
-class LzmaCodeFunction extends Function {
+class LzmaCodeFunction extends DecompressionFunction {
LzmaCodeFunction() { this.hasGlobalName(["lzma_code"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
- * The `lzma_stream_buffer_decode` function is used in Flow sink
+ * The `lzma_stream_buffer_decode` function is used in flow sink.
*/
-class LzmaStreamBufferDecodeFunction extends Function {
+class LzmaStreamBufferDecodeFunction extends DecompressionFunction {
LzmaStreamBufferDecodeFunction() { this.hasGlobalName(["lzma_stream_buffer_decode"]) }
+
+ override int getArchiveParameterIndex() { result = 1 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
index 902903efb78..c34170df625 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
@@ -6,52 +6,49 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
+import DecompressionBomb
/**
- * A ZSTD_inBuffer Variable as a Flow source
+ * The `ZSTD_decompress` function is used in flow sink.
*/
-class ZSTDinBufferVar extends VariableAccess {
- ZSTDinBufferVar() { this.getType().hasName("ZSTD_inBuffer") }
-}
-
-/**
- * A ZSTD_inBuffer_s Variable as a Flow source
- */
-class ZSTDinBufferSVar extends VariableAccess {
- ZSTDinBufferSVar() { this.getType().hasName("ZSTD_inBuffer_s") }
-}
-
-/**
- * The `ZSTD_decompress` function is used in Flow sink
- */
-class ZSTDDecompressFunction extends Function {
+class ZSTDDecompressFunction extends DecompressionFunction {
ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
+
+ override int getArchiveParameterIndex() { result = 2 }
}
/**
- * The `ZSTD_decompressDCtx` function is used in Flow sink
+ * The `ZSTD_decompressDCtx` function is used in flow sink.
*/
-class ZSTDDecompressDCtxFunction extends Function {
+class ZSTDDecompressDCtxFunction extends DecompressionFunction {
ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
+
+ override int getArchiveParameterIndex() { result = 3 }
}
/**
- * The `ZSTD_decompressStream` function is used in Flow sink
+ * The `ZSTD_decompressStream` function is used in flow sink.
*/
-class ZSTDDecompressStreamFunction extends Function {
+class ZSTDDecompressStreamFunction extends DecompressionFunction {
ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
+
+ override int getArchiveParameterIndex() { result = 2 }
}
/**
- * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ * The `ZSTD_decompress_usingDDict` function is used in flow sink.
*/
-class ZSTDDecompressUsingDictFunction extends Function {
+class ZSTDDecompressUsingDictFunction extends DecompressionFunction {
ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+
+ override int getArchiveParameterIndex() { result = 3 }
}
/**
- * The `ZSTD_decompress_usingDDict` function is used in Flow sink
+ * The `ZSTD_decompress_usingDDict` function is used in flow sink.
*/
-class ZSTDDecompressUsingDDictFunction extends Function {
+class ZSTDDecompressUsingDDictFunction extends DecompressionFunction {
ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+
+ override int getArchiveParameterIndex() { result = 3 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
index 306130ac8f2..df2381220fd 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
@@ -5,25 +5,43 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * A `gzFile` Variable as a Flow source
- */
-class GzFileVar extends VariableAccess {
- GzFileVar() { this.getType().hasName("gzFile") }
-}
-
-/**
- * The `gzopen` function as a Flow source
+ * The `gzfread` function is used in flow sink.
*
- * `gzopen(const char *path, const char *mode)`
+ * `gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file)`
*/
-class GzopenFunction extends Function {
- GzopenFunction() { this.hasGlobalName("gzopen") }
+class GzFreadFunction extends DecompressionFunction {
+ GzFreadFunction() { this.hasGlobalName("gzfread") }
+
+ override int getArchiveParameterIndex() { result = 3 }
}
/**
- * The `gzdopen` function as a Flow source
+ * The `gzgets` function is used in flow sink.
+ *
+ * `gzgets(gzFile file, char *buf, int len)`
+ */
+class GzGetsFunction extends DecompressionFunction {
+ GzGetsFunction() { this.hasGlobalName("gzgets") }
+
+ override int getArchiveParameterIndex() { result = 0 }
+}
+
+/**
+ * The `gzread` function is used in flow sink.
+ *
+ * `gzread(gzFile file, voidp buf, unsigned len)`
+ */
+class GzReadFunction extends DecompressionFunction {
+ GzReadFunction() { this.hasGlobalName("gzread") }
+
+ override int getArchiveParameterIndex() { result = 1 }
+}
+
+/**
+ * The `gzdopen` function.
*
* `gzdopen(int fd, const char *mode)`
*/
@@ -32,44 +50,10 @@ class GzdopenFunction extends Function {
}
/**
- * The `gzfread` function is used in Flow sink
+ * The `gzopen` function.
*
- * `gzfread(voidp buf, z_size_t size, z_size_t nitems, gzFile file)`
+ * `gzopen(const char *path, const char *mode)`
*/
-class GzFreadFunction extends Function {
- GzFreadFunction() { this.hasGlobalName("gzfread") }
-}
-
-/**
- * The `gzgets` function is used in Flow sink.
- *
- * `gzgets(gzFile file, char *buf, int len)`
- */
-class GzGetsFunction extends Function {
- GzGetsFunction() { this.hasGlobalName("gzgets") }
-}
-
-/**
- * The `gzread` function is used in Flow sink
- *
- * `gzread(gzFile file, voidp buf, unsigned len)`
- */
-class GzReadFunction extends Function {
- GzReadFunction() { this.hasGlobalName("gzread") }
-}
-
-predicate isSource(DataFlow::Node source) {
- exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
- fc.getArgument(0) = source.asExpr() and
- // arg 0 can be a path string whichwe must do following check
- not fc.getArgument(0).isConstant()
- )
- or
- // IDK whether it is good to use all file decriptors function returns as source or not
- // because we can do more sanitization from fd function sources
- exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
- fc.getArgument(0) = source.asExpr()
- )
- or
- source.asExpr() instanceof GzFileVar
+class GzopenFunction extends Function {
+ GzopenFunction() { this.hasGlobalName("gzopen") }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
index b67caecfcbd..1897b8e09d3 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
@@ -5,21 +5,17 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * A `z_stream` Variable as a Flow source
- */
-class ZStreamVar extends VariableAccess {
- ZStreamVar() { this.getType().hasName("z_stream") }
-}
-
-/**
- * The `inflate`/`inflateSync` functions are used in Flow sink
+ * The `inflate` and `inflateSync` functions are used in flow sink.
*
* `inflate(z_streamp strm, int flush)`
*
* `inflateSync(z_streamp strm)`
*/
-class InflateFunction extends Function {
+class InflateFunction extends DecompressionFunction {
InflateFunction() { this.hasGlobalName(["inflate", "inflateSync"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
index 1f33b065409..f69c71ec01c 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
@@ -5,17 +5,13 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
+import DecompressionBomb
/**
- * A Bytef Variable as a Flow source
+ * The `uncompress`/`uncompress2` function is used in flow sink.
*/
-class BytefVar extends VariableAccess {
- BytefVar() { this.getType().hasName("Bytef") }
-}
-
-/**
- * The `uncompress`/`uncompress2` function is used in Flow sink
- */
-class UncompressFunction extends Function {
+class UncompressFunction extends DecompressionFunction {
UncompressFunction() { this.hasGlobalName(["uncompress", "uncompress2"]) }
+
+ override int getArchiveParameterIndex() { result = 0 }
}
From 361ad6be6a663c04c4d6c6b5777129fc194c5be2 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Wed, 26 Jun 2024 12:45:31 +0200
Subject: [PATCH 018/500] use abstract class for decompression flow steps
---
.../CWE/CWE-409/DecompressionBomb.qll | 10 ++++-
.../CWE/CWE-409/DecompressionBombs.ql | 22 +---------
.../Security/CWE/CWE-409/MiniZip.qll | 41 ++++++++++++++++++-
.../Security/CWE/CWE-409/ZlibGzopen.qll | 22 ++++++++--
4 files changed, 67 insertions(+), 28 deletions(-)
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
index 2cca1453d2f..ecc32a9ba0d 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
@@ -1,8 +1,16 @@
import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
/**
- * The Decompression Sink instances, extend this class to defind new decompression sinks.
+ * The Decompression Sink instances, extend this class to define new decompression sinks.
*/
abstract class DecompressionFunction extends Function {
abstract int getArchiveParameterIndex();
}
+
+/**
+ * The Decompression Flow Steps, extend this class to define new decompression sinks.
+ */
+abstract class DecompressionFlowStep extends Function {
+ abstract predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2);
+}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
index b7eda35f2c7..6f68390fdd2 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -29,27 +29,7 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1)
- )
- or
- exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc.getArgument(1)
- )
- or
- exists(FunctionCall fc |
- fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
- |
- node1.asExpr() = fc.getArgument(0) and
- node2.asExpr() = fc
- )
+ any(DecompressionFlowStep f).isAdditionalFlowStep(node1, node2)
}
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
index 4bfa9a13b2c..a76abff8f6a 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
@@ -8,7 +8,7 @@ import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
- * The `mz_zip_entry` function is used in flow source.
+ * The `mz_zip_entry` function is used in flow sink.
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
*/
class Mz_zip_entry extends DecompressionFunction {
@@ -17,6 +17,21 @@ class Mz_zip_entry extends DecompressionFunction {
override int getArchiveParameterIndex() { result = 1 }
}
+/**
+ * The `mz_zip_entry` function is used in flow steps.
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
+ */
+class Mz_zip_entry_flow_steps extends DecompressionFlowStep {
+ Mz_zip_entry_flow_steps() { this.hasGlobalName("mz_zip_entry_read") }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1)
+ )
+ }
+}
+
/**
* The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow source.
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
@@ -32,9 +47,31 @@ class Mz_zip_reader_entry extends DecompressionFunction {
override int getArchiveParameterIndex() { result = 1 }
}
+/**
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow steps.
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
+ */
+class Mz_zip_reader_entry_flow_steps extends DecompressionFlowStep {
+ Mz_zip_reader_entry_flow_steps() { this instanceof Mz_zip_reader_entry }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc.getArgument(1)
+ )
+ }
+}
+
/**
* The `UnzOpen` function as a flow source.
*/
-class UnzOpenFunction extends Function {
+class UnzOpenFunction extends DecompressionFlowStep {
UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
index df2381220fd..5c4f367b1b4 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
@@ -41,19 +41,33 @@ class GzReadFunction extends DecompressionFunction {
}
/**
- * The `gzdopen` function.
+ * The `gzdopen` function is used in flow steps.
*
* `gzdopen(int fd, const char *mode)`
*/
-class GzdopenFunction extends Function {
+class GzdopenFunction extends DecompressionFlowStep {
GzdopenFunction() { this.hasGlobalName("gzdopen") }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
}
/**
- * The `gzopen` function.
+ * The `gzopen` function is used in flow steps.
*
* `gzopen(const char *path, const char *mode)`
*/
-class GzopenFunction extends Function {
+class GzopenFunction extends DecompressionFlowStep {
GzopenFunction() { this.hasGlobalName("gzopen") }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
}
From 87b6495c917efe78751cc80cf9bb7a353c4a82bf Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Sun, 14 Jul 2024 21:10:56 +0200
Subject: [PATCH 019/500] add zlib tests with stubs :)
---
.../CWE/CWE-409/DecompressionBombs.qlref | 1 +
.../Security/CWE/CWE-409/zlibTest.cpp | 182 ++++++++++++++++++
2 files changed, 183 insertions(+)
create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.qlref
create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.qlref
new file mode 100644
index 00000000000..b3f71c4891a
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.qlref
@@ -0,0 +1 @@
+experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
\ No newline at end of file
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
new file mode 100644
index 00000000000..c55e18475fe
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
@@ -0,0 +1,182 @@
+
+#define Z_NULL 0
+# define FAR
+typedef unsigned char Byte;
+typedef Byte FAR Bytef;
+typedef unsigned int uInt;
+#define Z_BEST_COMPRESSION 9
+#define Z_FINISH 4
+#define Z_NO_FLUSH 0
+
+
+typedef struct {
+ int *zalloc;
+ int *zfree;
+ Bytef *next_in;
+ Bytef *next_out;
+ int *opaque;
+ uInt avail_out;
+ uInt avail_in;
+} z_stream;
+
+
+void deflateInit(z_stream *defstream, int i);
+
+void deflate(z_stream *defstream, int i);
+
+void deflateEnd(z_stream *defstream);
+
+void inflateInit(z_stream *infstream);
+
+void inflate(z_stream *infstream, int i);
+
+void inflateEnd(z_stream *infstream);
+
+namespace std {
+ template
+ struct char_traits;
+
+ template >
+ class basic_ostream {
+ public:
+ typedef charT char_type;
+ };
+
+ template
+ basic_ostream &operator<<(basic_ostream &, const charT *);
+
+ typedef basic_ostream ostream;
+
+ extern ostream cout;
+}
+
+int UnsafeInflate(int argc, char *argv[]) {
+ // original string len = 36
+ char a[50] = "Hello Hello Hello Hello Hello Hello!";
+ // placeholder for the compressed (deflated) version of "a"
+ char b[50];
+ // placeholder for the Uncompressed (inflated) version of "b"
+ char c[50];
+
+
+ // STEP 1.
+ // zlib struct
+ z_stream defstream;
+ defstream.zalloc = Z_NULL;
+ defstream.zfree = Z_NULL;
+ defstream.opaque = Z_NULL;
+ // setup "a" as the input and "b" as the compressed output
+ defstream.avail_in = (uInt) 50 + 1; // size of input, string + terminator
+ defstream.next_in = (Bytef *) a; // input char array
+ defstream.avail_out = (uInt) sizeof(b); // size of output
+ defstream.next_out = (Bytef *) b; // output char array
+
+ // the actual compression work.
+ deflateInit(&defstream, Z_BEST_COMPRESSION);
+ deflate(&defstream, Z_FINISH);
+ deflateEnd(&defstream);
+
+ // This is one way of getting the size of the output
+ // STEP 2.
+ // inflate b into c
+ // zlib struct
+ z_stream infstream;
+ infstream.zalloc = Z_NULL;
+ infstream.zfree = Z_NULL;
+ infstream.opaque = Z_NULL;
+ // setup "b" as the input and "c" as the compressed output
+ // TOTHINK: Here we can add additional step from Right operand to z_stream variable access
+ infstream.avail_in = (uInt) ((char *) defstream.next_out - b); // size of input
+ infstream.next_in = (Bytef *) b; // input char array
+ infstream.avail_out = (uInt) sizeof(c); // size of output
+ infstream.next_out = (Bytef *) c; // output char array
+
+ // uLong total_out; /* total number of bytes output so far */
+ // the actual DE-compression work.
+ inflateInit(&infstream);
+ inflate(&infstream, Z_NO_FLUSH);
+ inflateEnd(&infstream);
+
+
+ return 0;
+}
+
+
+typedef struct {
+} gzFile;
+
+gzFile gzopen(char *str, const char *rb);
+
+
+void exit(int i);
+
+unsigned int gzread(gzFile gz_file, unsigned char *str, int i);
+
+void gzclose(gzFile gz_file);
+
+std::ostream operator<<(const std::ostream &lhs, unsigned char rhs);
+
+
+int send(int, const void *, int, int);
+
+
+int UnsafeGzread(char **argv) {
+ char *fileName;
+ send(0, fileName, 0, 0);
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (&inFileZ == nullptr) {
+ exit(0);
+ }
+ unsigned char unzipBuffer[8192];
+ unsigned int unzippedBytes;
+ while (true) {
+ unzippedBytes = gzread(inFileZ, unzipBuffer, 8192);
+ if (unzippedBytes > 0) {
+ std::cout << unzippedBytes;
+ } else {
+ break;
+ }
+ }
+ gzclose(inFileZ);
+ return 0;
+}
+
+bool gzfread(char *str, int i, int i1, gzFile gz_file);
+
+int UnsafeGzfread(char **argv) {
+ char *fileName;
+ send(0, fileName, 0, 0);
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (&inFileZ == nullptr) {
+ exit(0);
+ }
+ while (true) {
+ char buffer[1000];
+ if (!gzfread(buffer, 999, 1, inFileZ)) {
+ break;
+ }
+ }
+ gzclose(inFileZ);
+ return 0;
+}
+
+char *gzgets(gzFile gz_file, char *buffer, int i);
+
+int UnsafeGzgets(char **argv) {
+ char *fileName;
+ send(0, fileName, 0, 0);
+ gzFile inFileZ = gzopen(fileName, "rb");
+ if (&inFileZ == nullptr) {
+ exit(0);
+ }
+ char *buffer = new char[4000000000];
+ char *result;
+ result = gzgets(inFileZ, buffer, 1000000000);
+ while (true) {
+ result = gzgets(inFileZ, buffer, 1000000000);
+ if (result == nullptr) {
+ break;
+ }
+ }
+ return 0;
+}
From a10b5021b4b70cbc8e86817539568cd757b4132b Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Mon, 15 Jul 2024 10:13:57 +0200
Subject: [PATCH 020/500] fix tests, it is not fixed 100%
---
.../CWE/CWE-409/DecompressionBomb.qll | 10 +++++++
.../CWE/CWE-409/DecompressionBombs.ql | 2 --
.../Security/CWE/CWE-409/zlibTest.cpp | 27 ++++++++-----------
3 files changed, 21 insertions(+), 18 deletions(-)
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
index ecc32a9ba0d..c17616d020d 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
@@ -1,5 +1,15 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
+import MiniZip
+import ZlibGzopen
+import ZlibInflator
+import ZlibUncompress
+import LibArchive
+import LibMiniz
+import XZ
+import ZSTD
+import Bzip2
+import Brotli
/**
* The Decompression Sink instances, extend this class to define new decompression sinks.
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
index 6f68390fdd2..896c15f7a80 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -15,8 +15,6 @@ import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
-import MiniZip
-import ZlibGzopen
import DecompressionBomb
module DecompressionTaintConfig implements DataFlow::ConfigSig {
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
index c55e18475fe..b829cfaa61d 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
@@ -50,15 +50,12 @@ namespace std {
extern ostream cout;
}
-int UnsafeInflate(int argc, char *argv[]) {
- // original string len = 36
- char a[50] = "Hello Hello Hello Hello Hello Hello!";
+int UnsafeInflate(char *a) {
// placeholder for the compressed (deflated) version of "a"
char b[50];
// placeholder for the Uncompressed (inflated) version of "b"
char c[50];
-
// STEP 1.
// zlib struct
z_stream defstream;
@@ -117,12 +114,7 @@ void gzclose(gzFile gz_file);
std::ostream operator<<(const std::ostream &lhs, unsigned char rhs);
-int send(int, const void *, int, int);
-
-
-int UnsafeGzread(char **argv) {
- char *fileName;
- send(0, fileName, 0, 0);
+int UnsafeGzread(char *fileName) {
gzFile inFileZ = gzopen(fileName, "rb");
if (&inFileZ == nullptr) {
exit(0);
@@ -143,9 +135,7 @@ int UnsafeGzread(char **argv) {
bool gzfread(char *str, int i, int i1, gzFile gz_file);
-int UnsafeGzfread(char **argv) {
- char *fileName;
- send(0, fileName, 0, 0);
+int UnsafeGzfread(char *fileName) {
gzFile inFileZ = gzopen(fileName, "rb");
if (&inFileZ == nullptr) {
exit(0);
@@ -162,9 +152,7 @@ int UnsafeGzfread(char **argv) {
char *gzgets(gzFile gz_file, char *buffer, int i);
-int UnsafeGzgets(char **argv) {
- char *fileName;
- send(0, fileName, 0, 0);
+int UnsafeGzgets(char *fileName) {
gzFile inFileZ = gzopen(fileName, "rb");
if (&inFileZ == nullptr) {
exit(0);
@@ -180,3 +168,10 @@ int UnsafeGzgets(char **argv) {
}
return 0;
}
+
+int main(int argc, char **argv) {
+ UnsafeGzfread(argv[2]);
+ UnsafeGzgets(argv[2]);
+ UnsafeInflate(argv[2]);
+ UnsafeGzread(argv[2]);
+}
From f97b1039cd3a1f19d18ef1a775dbd66eef08bb19 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 30 Jul 2024 17:49:34 +0200
Subject: [PATCH 021/500] update test files, add one more additional flow step
for inflate function, fix gzopen additional flow step thanks to @jketema
---
.../CWE/CWE-409/DecompressionBombs.ql | 5 +--
.../Security/CWE/CWE-409/ZlibGzopen.qll | 4 +--
.../Security/CWE/CWE-409/ZlibInflator.qll | 19 +++++++++--
.../Security/CWE/CWE-409/zlibTest.cpp | 32 +++----------------
4 files changed, 26 insertions(+), 34 deletions(-)
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
index 896c15f7a80..05f39c47e13 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -22,12 +22,13 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
exists(FunctionCall fc, DecompressionFunction f | fc.getTarget() = f |
- fc.getArgument(f.getArchiveParameterIndex()) = sink.asExpr()
+ fc.getArgument(f.getArchiveParameterIndex()) = sink.asExpr()
)
}
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- any(DecompressionFlowStep f).isAdditionalFlowStep(node1, node2)
+ any(DecompressionFlowStep f).isAdditionalFlowStep(node1, node2) or
+ nextInAdditionalFlowStep(node1, node2)
}
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
index 5c4f367b1b4..edb8ef7ff68 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
@@ -37,7 +37,7 @@ class GzGetsFunction extends DecompressionFunction {
class GzReadFunction extends DecompressionFunction {
GzReadFunction() { this.hasGlobalName("gzread") }
- override int getArchiveParameterIndex() { result = 1 }
+ override int getArchiveParameterIndex() { result = 0 }
}
/**
@@ -66,7 +66,7 @@ class GzopenFunction extends DecompressionFlowStep {
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
exists(FunctionCall fc | fc.getTarget() = this |
- node1.asExpr() = fc.getArgument(0) and
+ node1.asIndirectExpr() = fc.getArgument(0) and
node2.asExpr() = fc
)
}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
index 1897b8e09d3..464dce3ac45 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
@@ -10,12 +10,27 @@ import DecompressionBomb
/**
* The `inflate` and `inflateSync` functions are used in flow sink.
*
- * `inflate(z_streamp strm, int flush)`
+ * `inflate(z_stream strm, int flush)`
*
- * `inflateSync(z_streamp strm)`
+ * `inflateSync(z_stream strm)`
*/
class InflateFunction extends DecompressionFunction {
InflateFunction() { this.hasGlobalName(["inflate", "inflateSync"]) }
override int getArchiveParameterIndex() { result = 0 }
}
+
+/**
+ * The `next_in` member of a `z_stream` variable is used in flow steps.
+ */
+predicate nextInAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(Variable nextInVar, VariableAccess zStreamAccess |
+ nextInVar.getDeclaringType().hasName("z_stream") and
+ nextInVar.hasName("next_in") and
+ zStreamAccess.getType().hasName("z_stream")
+ |
+ nextInVar.getAnAccess().getQualifier().(VariableAccess).getTarget() = zStreamAccess.getTarget() and
+ node1.asIndirectExpr() = nextInVar.getAnAssignedValue() and
+ node2.asExpr() = zStreamAccess
+ )
+}
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
index b829cfaa61d..07805f6c83f 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp
@@ -51,40 +51,17 @@ namespace std {
}
int UnsafeInflate(char *a) {
- // placeholder for the compressed (deflated) version of "a"
- char b[50];
- // placeholder for the Uncompressed (inflated) version of "b"
- char c[50];
+ // placeholder for the Uncompressed (inflated) version of "a"
+ char c[1024000];
- // STEP 1.
- // zlib struct
- z_stream defstream;
- defstream.zalloc = Z_NULL;
- defstream.zfree = Z_NULL;
- defstream.opaque = Z_NULL;
- // setup "a" as the input and "b" as the compressed output
- defstream.avail_in = (uInt) 50 + 1; // size of input, string + terminator
- defstream.next_in = (Bytef *) a; // input char array
- defstream.avail_out = (uInt) sizeof(b); // size of output
- defstream.next_out = (Bytef *) b; // output char array
-
- // the actual compression work.
- deflateInit(&defstream, Z_BEST_COMPRESSION);
- deflate(&defstream, Z_FINISH);
- deflateEnd(&defstream);
-
- // This is one way of getting the size of the output
- // STEP 2.
- // inflate b into c
- // zlib struct
z_stream infstream;
infstream.zalloc = Z_NULL;
infstream.zfree = Z_NULL;
infstream.opaque = Z_NULL;
// setup "b" as the input and "c" as the compressed output
// TOTHINK: Here we can add additional step from Right operand to z_stream variable access
- infstream.avail_in = (uInt) ((char *) defstream.next_out - b); // size of input
- infstream.next_in = (Bytef *) b; // input char array
+ infstream.avail_in = (uInt) (1000); // size of input
+ infstream.next_in = (Bytef *) a; // input char array
infstream.avail_out = (uInt) sizeof(c); // size of output
infstream.next_out = (Bytef *) c; // output char array
@@ -159,7 +136,6 @@ int UnsafeGzgets(char *fileName) {
}
char *buffer = new char[4000000000];
char *result;
- result = gzgets(inFileZ, buffer, 1000000000);
while (true) {
result = gzgets(inFileZ, buffer, 1000000000);
if (result == nullptr) {
From 89a2381165f5f183f0eefeca6353ca01cfcc7ee3 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Wed, 3 Jul 2024 10:41:40 +0200
Subject: [PATCH 022/500] C#: Adopt shared SSA data-flow integration
---
.../code/csharp/dataflow/internal/BaseSSA.qll | 2 +-
.../dataflow/internal/DataFlowPrivate.qll | 235 ++--
.../dataflow/internal/DataFlowPublic.qll | 8 +-
.../code/csharp/dataflow/internal/SsaImpl.qll | 185 +--
.../csharp7/LocalTaintFlow.expected | 74 +-
.../dataflow/barrier-guards/BarrierFlow.cs | 83 ++
.../barrier-guards/barrier-flow.expected | 18 +
.../dataflow/barrier-guards/barrier-flow.ql | 35 +
.../dataflow/local/DataFlowStep.expected | 1006 +++++++++++------
.../dataflow/local/TaintTrackingStep.expected | 1006 +++++++++++------
.../dataflow/tuples/DataFlowStep.expected | 3 +-
11 files changed, 1718 insertions(+), 937 deletions(-)
create mode 100644 csharp/ql/test/library-tests/dataflow/barrier-guards/BarrierFlow.cs
create mode 100644 csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.expected
create mode 100644 csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.ql
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
index 7a20ceb7abd..e39d26d80b2 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
@@ -29,7 +29,7 @@ module BaseSsa {
) {
exists(ControlFlow::ControlFlow::BasicBlocks::EntryBlock entry |
c = entry.getCallable() and
- // In case `c` has multiple bodies, we want each body to gets its own implicit
+ // In case `c` has multiple bodies, we want each body to get its own implicit
// entry definition. In case `c` doesn't have multiple bodies, the line below
// is simply the same as `bb = entry`, because `entry.getFirstNode().getASuccessor()`
// will be in the entry block.
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index f1c51f222d5..a1bee6b4fe8 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -267,8 +267,9 @@ module VariableCapture {
private predicate closureFlowStep(ControlFlow::Nodes::ExprNode e1, ControlFlow::Nodes::ExprNode e2) {
e1 = LocalFlow::getALastEvalNode(e2)
or
- exists(Ssa::Definition def |
- LocalFlow::ssaDefAssigns(def.getAnUltimateDefinition(), e1) and
+ exists(Ssa::Definition def, AssignableDefinition adef |
+ LocalFlow::defAssigns(adef, _, e1) and
+ def.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() = adef and
exists(def.getAReadAtNode(e2))
)
}
@@ -492,6 +493,30 @@ module VariableCapture {
}
}
+/** Provides logic related to SSA. */
+module SsaFlow {
+ private module Impl = SsaImpl::DataFlowIntegration;
+
+ Impl::Node asNode(Node n) {
+ n = TSsaNode(result)
+ or
+ result.(Impl::ExprNode).getExpr() = n.(ExprNode).getControlFlowNode()
+ or
+ result.(Impl::ExprPostUpdateNode).getExpr() =
+ n.(PostUpdateNode).getPreUpdateNode().(ExprNode).getControlFlowNode()
+ or
+ result.(Impl::ParameterNode).getParameter() = n.(ExplicitParameterNode).getSsaDefinition()
+ }
+
+ predicate localFlowStep(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo, boolean isUseStep) {
+ Impl::localFlowStep(def, asNode(nodeFrom), asNode(nodeTo), isUseStep)
+ }
+
+ predicate localMustFlowStep(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo) {
+ Impl::localMustFlowStep(def, asNode(nodeFrom), asNode(nodeTo))
+ }
+}
+
/** Provides predicates related to local data flow. */
module LocalFlow {
class LocalExprStepConfiguration extends ControlFlowReachabilityConfiguration {
@@ -617,105 +642,6 @@ module LocalFlow {
any(LocalExprStepConfiguration x).hasDefPath(_, value, def, cfnDef)
}
- predicate ssaDefAssigns(Ssa::ExplicitDefinition ssaDef, ControlFlow::Nodes::ExprNode value) {
- exists(AssignableDefinition def, ControlFlow::Node cfnDef |
- any(LocalExprStepConfiguration conf).hasDefPath(_, value, def, cfnDef) and
- ssaDef.getADefinition() = def and
- ssaDef.getControlFlowNode() = cfnDef
- )
- }
-
- /**
- * An uncertain SSA definition. Either an uncertain explicit definition or an
- * uncertain qualifier definition.
- *
- * Restricts `Ssa::UncertainDefinition` by excluding implicit call definitions,
- * as we---conservatively---consider such definitions to be certain.
- */
- class UncertainExplicitSsaDefinition extends Ssa::UncertainDefinition {
- UncertainExplicitSsaDefinition() {
- this instanceof Ssa::ExplicitDefinition
- or
- this =
- any(Ssa::ImplicitQualifierDefinition qdef |
- qdef.getQualifierDefinition() instanceof UncertainExplicitSsaDefinition
- )
- }
- }
-
- /** An SSA definition into which another SSA definition may flow. */
- private class SsaInputDefinitionExtNode extends SsaDefinitionExtNode {
- SsaInputDefinitionExtNode() {
- def instanceof Ssa::PhiNode
- or
- def instanceof SsaImpl::PhiReadNode
- or
- def instanceof LocalFlow::UncertainExplicitSsaDefinition
- }
- }
-
- /**
- * Holds if `nodeFrom` is a last node referencing SSA definition `def`, which
- * can reach `next`.
- */
- private predicate localFlowSsaInputFromDef(
- Node nodeFrom, SsaImpl::DefinitionExt def, SsaInputDefinitionExtNode next
- ) {
- exists(ControlFlow::BasicBlock bb, int i |
- SsaImpl::lastRefBeforeRedefExt(def, bb, i, next.getDefinitionExt()) and
- def.definesAt(_, bb, i, _) and
- def = getSsaDefinitionExt(nodeFrom) and
- nodeFrom != next
- )
- }
-
- /**
- * Holds if `read` is a last node reading SSA definition `def`, which
- * can reach `next`.
- */
- predicate localFlowSsaInputFromRead(
- Node read, SsaImpl::DefinitionExt def, SsaInputDefinitionExtNode next
- ) {
- exists(ControlFlow::BasicBlock bb, int i |
- SsaImpl::lastRefBeforeRedefExt(def, bb, i, next.getDefinitionExt()) and
- read.asExprAtNode(bb.getNode(i)) instanceof AssignableRead
- )
- }
-
- private SsaImpl::DefinitionExt getSsaDefinitionExt(Node n) {
- result = n.(SsaDefinitionExtNode).getDefinitionExt()
- or
- result = n.(ExplicitParameterNode).getSsaDefinition()
- }
-
- /**
- * Holds if there is a local use-use flow step from `nodeFrom` to `nodeTo`
- * involving SSA definition `def`.
- */
- predicate localSsaFlowStepUseUse(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo) {
- exists(ControlFlow::Node cfnFrom, ControlFlow::Node cfnTo |
- SsaImpl::adjacentReadPairSameVarExt(def, cfnFrom, cfnTo) and
- nodeTo = TExprNode(cfnTo) and
- nodeFrom = TExprNode(cfnFrom)
- )
- }
-
- /**
- * Holds if there is a local flow step from `nodeFrom` to `nodeTo` involving
- * SSA definition `def`.
- */
- predicate localSsaFlowStep(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo) {
- // Flow from SSA definition/parameter to first read
- def = getSsaDefinitionExt(nodeFrom) and
- SsaImpl::firstReadSameVarExt(def, nodeTo.(ExprNode).getControlFlowNode())
- or
- // Flow from read to next read
- localSsaFlowStepUseUse(def, nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
- or
- // Flow into phi (read)/uncertain SSA definition node from def
- localFlowSsaInputFromDef(nodeFrom, def, nodeTo)
- }
-
/**
* Holds if the source variable of SSA definition `def` is an instance field.
*/
@@ -800,10 +726,7 @@ module LocalFlow {
node2.asExpr() instanceof AssignExpr
)
or
- exists(SsaImpl::Definition def |
- def = getSsaDefinitionExt(node1) and
- exists(SsaImpl::getAReadAtNode(def, node2.(ExprNode).getControlFlowNode()))
- )
+ SsaFlow::localMustFlowStep(_, node1, node2)
or
node2 = node1.(LocalFunctionCreationNode).getAnAccess(true)
or
@@ -827,23 +750,14 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
(
LocalFlow::localFlowStepCommon(nodeFrom, nodeTo)
or
- exists(SsaImpl::DefinitionExt def |
+ exists(SsaImpl::DefinitionExt def, boolean isUseStep |
+ SsaFlow::localFlowStep(def, nodeFrom, nodeTo, isUseStep) and
not LocalFlow::usesInstanceField(def) and
not def instanceof VariableCapture::CapturedSsaDefinitionExt
|
- LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo)
+ isUseStep = false
or
- LocalFlow::localSsaFlowStepUseUse(def, nodeFrom, nodeTo) and
- not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _) and
- nodeFrom != nodeTo
- or
- // Flow into phi (read)/uncertain SSA definition node from read
- exists(Node read | LocalFlow::localFlowSsaInputFromRead(read, def, nodeTo) |
- nodeFrom = read and
- not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _)
- or
- nodeFrom.(PostUpdateNode).getPreUpdateNode() = read
- )
+ not FlowSummaryImpl::Private::Steps::prohibitsUseUseFlow(nodeFrom, _)
)
or
nodeTo.(ObjectCreationNode).getPreUpdateNode() = nodeFrom.(ObjectInitializerNode)
@@ -1113,11 +1027,7 @@ private module Cached {
cached
newtype TNode =
TExprNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getAstNode() instanceof Expr } or
- TSsaDefinitionExtNode(SsaImpl::DefinitionExt def) {
- // Handled by `TExplicitParameterNode` below
- not def instanceof Ssa::ImplicitParameterDefinition and
- def.getBasicBlock() = any(DataFlowCallable c).getAControlFlowNode().getBasicBlock()
- } or
+ TSsaNode(SsaImpl::DataFlowIntegration::SsaNode node) or
TAssignableDefinitionNode(AssignableDefinition def, ControlFlow::Node cfn) {
cfn = def.getExpr().getAControlFlowNode()
} or
@@ -1180,17 +1090,7 @@ private module Cached {
predicate localFlowStepImpl(Node nodeFrom, Node nodeTo) {
LocalFlow::localFlowStepCommon(nodeFrom, nodeTo)
or
- LocalFlow::localSsaFlowStepUseUse(_, nodeFrom, nodeTo) and
- nodeFrom != nodeTo
- or
- LocalFlow::localSsaFlowStep(_, nodeFrom, nodeTo)
- or
- // Flow into phi (read)/uncertain SSA definition node from read
- exists(Node read | LocalFlow::localFlowSsaInputFromRead(read, _, nodeTo) |
- nodeFrom = read
- or
- nodeFrom.(PostUpdateNode).getPreUpdateNode() = read
- )
+ SsaFlow::localFlowStep(_, nodeFrom, nodeTo, _)
or
// Simple flow through library code is included in the exposed local
// step relation, even though flow is technically inter-procedural
@@ -1254,7 +1154,7 @@ import Cached
/** Holds if `n` should be hidden from path explanations. */
predicate nodeIsHidden(Node n) {
- n instanceof SsaDefinitionExtNode
+ n instanceof SsaNode
or
exists(Parameter p | p = n.(ParameterNode).getParameter() | not p.fromSource())
or
@@ -1288,13 +1188,16 @@ predicate nodeIsHidden(Node n) {
n instanceof CaptureNode
}
-/** An SSA definition, viewed as a node in a data flow graph. */
-class SsaDefinitionExtNode extends NodeImpl, TSsaDefinitionExtNode {
+/** An SSA node. */
+abstract class SsaNode extends NodeImpl, TSsaNode {
+ SsaImpl::DataFlowIntegration::SsaNode node;
SsaImpl::DefinitionExt def;
- SsaDefinitionExtNode() { this = TSsaDefinitionExtNode(def) }
+ SsaNode() {
+ this = TSsaNode(node) and
+ def = node.getDefinitionExt()
+ }
- /** Gets the underlying SSA definition. */
SsaImpl::DefinitionExt getDefinitionExt() { result = def }
override DataFlowCallable getEnclosingCallableImpl() {
@@ -1307,9 +1210,57 @@ class SsaDefinitionExtNode extends NodeImpl, TSsaDefinitionExtNode {
result = def.(Ssa::Definition).getControlFlowNode()
}
- override Location getLocationImpl() { result = def.getLocation() }
+ override Location getLocationImpl() { result = node.getLocation() }
- override string toStringImpl() { result = def.toString() }
+ override string toStringImpl() { result = node.toString() }
+}
+
+/** An (extended) SSA definition, viewed as a node in a data flow graph. */
+class SsaDefinitionExtNode extends SsaNode {
+ override SsaImpl::DataFlowIntegration::SsaDefinitionExtNode node;
+}
+
+/**
+ * A node that represents an input to an SSA phi (read) definition.
+ *
+ * This allows for barrier guards to filter input to phi nodes. For example, in
+ *
+ * ```csharp
+ * var x = taint;
+ * if (x != "safe")
+ * {
+ * x = "safe";
+ * }
+ * sink(x);
+ * ```
+ *
+ * the `false` edge out of `x != "safe"` guards the input from `x = taint` into the
+ * `phi` node after the condition.
+ *
+ * It is also relevant to filter input into phi read nodes:
+ *
+ * ```csharp
+ * var x = taint;
+ * if (b)
+ * {
+ * if (x != "safe1")
+ * {
+ * return;
+ * }
+ * } else {
+ * if (x != "safe2")
+ * {
+ * return;
+ * }
+ * }
+ *
+ * sink(x);
+ * ```
+ *
+ * both inputs into the phi read node after the outer condition are guarded.
+ */
+class SsaInputNode extends SsaNode {
+ override SsaImpl::DataFlowIntegration::SsaInputNode node;
}
/** A definition, viewed as a node in a data flow graph. */
@@ -2907,7 +2858,7 @@ private predicate delegateCreationStep(Node nodeFrom, Node nodeTo) {
/** Extra data-flow steps needed for lambda flow analysis. */
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) {
exists(SsaImpl::DefinitionExt def |
- LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo) and
+ SsaFlow::localFlowStep(def, nodeFrom, nodeTo, _) and
preservesValue = true
|
LocalFlow::usesInstanceField(def)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
index 4d1dc25f6e9..9da884fdcb1 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -171,8 +171,14 @@ signature predicate guardChecksSig(Guard g, Expr e, AbstractValue v);
* in data flow and taint tracking.
*/
module BarrierGuard {
+ private import SsaImpl as SsaImpl
+
/** Gets a node that is safely guarded by the given guard check. */
- ExprNode getABarrierNode() {
+ pragma[nomagic]
+ Node getABarrierNode() {
+ SsaFlow::asNode(result) =
+ SsaImpl::DataFlowIntegration::BarrierGuard::getABarrierNode()
+ or
exists(Guard g, Expr e, AbstractValue v |
guardChecks(g, e, v) and
g.controlsNode(result.getControlFlowNode(), e, v)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 8fd12d90ae7..52c40b2563a 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -6,6 +6,7 @@ import csharp
private import codeql.ssa.Ssa as SsaImplCommon
private import AssignableDefinitions
private import semmle.code.csharp.controlflow.internal.PreSsa
+private import semmle.code.csharp.controlflow.Guards as Guards
private module SsaInput implements SsaImplCommon::InputSig {
class BasicBlock = ControlFlow::BasicBlock;
@@ -49,7 +50,7 @@ private module SsaInput implements SsaImplCommon::InputSig {
}
}
-private import SsaImplCommon::Make as Impl
+import SsaImplCommon::Make as Impl
class Definition = Impl::Definition;
@@ -757,24 +758,6 @@ private predicate adjacentDefReachesRead(
)
}
-private predicate adjacentDefReachesReadExt(
- DefinitionExt def, SsaInput::SourceVariable v, SsaInput::BasicBlock bb1, int i1,
- SsaInput::BasicBlock bb2, int i2
-) {
- Impl::adjacentDefReadExt(def, v, bb1, i1, bb2, i2) and
- (
- def.definesAt(v, bb1, i1, _)
- or
- SsaInput::variableRead(bb1, i1, v, true)
- )
- or
- exists(SsaInput::BasicBlock bb3, int i3 |
- adjacentDefReachesReadExt(def, v, bb1, i1, bb3, i3) and
- SsaInput::variableRead(bb3, i3, v, false) and
- Impl::adjacentDefReadExt(def, v, bb3, i3, bb2, i2)
- )
-}
-
/** Same as `adjacentDefRead`, but skips uncertain reads. */
pragma[nomagic]
private predicate adjacentDefSkipUncertainReads(
@@ -786,17 +769,6 @@ private predicate adjacentDefSkipUncertainReads(
)
}
-/** Same as `adjacentDefReadExt`, but skips uncertain reads. */
-pragma[nomagic]
-private predicate adjacentDefSkipUncertainReadsExt(
- DefinitionExt def, SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2
-) {
- exists(SsaInput::SourceVariable v |
- adjacentDefReachesReadExt(def, v, bb1, i1, bb2, i2) and
- SsaInput::variableRead(bb2, i2, v, true)
- )
-}
-
private predicate adjacentDefReachesUncertainRead(
Definition def, SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2
) {
@@ -806,16 +778,6 @@ private predicate adjacentDefReachesUncertainRead(
)
}
-pragma[nomagic]
-private predicate adjacentDefReachesUncertainReadExt(
- DefinitionExt def, SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2
-) {
- exists(SsaInput::SourceVariable v |
- adjacentDefReachesReadExt(def, v, bb1, i1, bb2, i2) and
- SsaInput::variableRead(bb2, i2, v, false)
- )
-}
-
/** Same as `lastRefRedef`, but skips uncertain reads. */
pragma[nomagic]
private predicate lastRefSkipUncertainReads(Definition def, SsaInput::BasicBlock bb, int i) {
@@ -870,7 +832,7 @@ private module Cached {
predicate implicitEntryDefinition(ControlFlow::ControlFlow::BasicBlock bb, Ssa::SourceVariable v) {
exists(ControlFlow::ControlFlow::BasicBlocks::EntryBlock entry, Callable c |
c = entry.getCallable() and
- // In case `c` has multiple bodies, we want each body to gets its own implicit
+ // In case `c` has multiple bodies, we want each body to get its own implicit
// entry definition. In case `c` doesn't have multiple bodies, the line below
// is simply the same as `bb = entry`, because `entry.getFirstNode().getASuccessor()`
// will be in the entry block.
@@ -965,19 +927,6 @@ private module Cached {
)
}
- /**
- * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
- * without passing through any other read.
- */
- cached
- predicate firstReadSameVarExt(DefinitionExt def, ControlFlow::Node cfn) {
- exists(ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2 |
- def.definesAt(_, bb1, i1, _) and
- adjacentDefSkipUncertainReadsExt(def, bb1, i1, bb2, i2) and
- cfn = bb2.getNode(i2)
- )
- }
-
/**
* Holds if the read at `cfn2` is a read of the same SSA definition `def`
* as the read at `cfn1`, and `cfn2` can be reached from `cfn1` without
@@ -993,23 +942,6 @@ private module Cached {
)
}
- /**
- * Holds if the read at `cfn2` is a read of the same SSA definition `def`
- * as the read at `cfn1`, and `cfn2` can be reached from `cfn1` without
- * passing through another read.
- */
- cached
- predicate adjacentReadPairSameVarExt(
- DefinitionExt def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
- ) {
- exists(ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2 |
- cfn1 = bb1.getNode(i1) and
- variableReadActual(bb1, i1, _) and
- adjacentDefSkipUncertainReadsExt(def, bb1, i1, bb2, i2) and
- cfn2 = bb2.getNode(i2)
- )
- }
-
cached
predicate lastRefBeforeRedef(Definition def, ControlFlow::BasicBlock bb, int i, Definition next) {
Impl::lastRefRedef(def, bb, i, next) and
@@ -1021,21 +953,6 @@ private module Cached {
)
}
- cached
- predicate lastRefBeforeRedefExt(
- DefinitionExt def, ControlFlow::BasicBlock bb, int i, DefinitionExt next
- ) {
- exists(SsaInput::SourceVariable v |
- Impl::lastRefRedefExt(def, v, bb, i, next) and
- not SsaInput::variableRead(bb, i, v, false)
- )
- or
- exists(SsaInput::BasicBlock bb0, int i0 |
- Impl::lastRefRedefExt(def, _, bb0, i0, next) and
- adjacentDefReachesUncertainReadExt(def, bb, i, bb0, i0)
- )
- }
-
cached
predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
exists(ControlFlow::BasicBlock bb, int i |
@@ -1061,6 +978,41 @@ private module Cached {
outRefExitRead(bb, i, v)
)
}
+
+ cached
+ module DataFlowIntegration {
+ import DataFlowIntegrationImpl
+
+ cached
+ predicate localFlowStep(DefinitionExt def, Node nodeFrom, Node nodeTo, boolean isUseStep) {
+ DataFlowIntegrationImpl::localFlowStep(def, nodeFrom, nodeTo, isUseStep)
+ }
+
+ cached
+ predicate localMustFlowStep(DefinitionExt def, Node nodeFrom, Node nodeTo) {
+ DataFlowIntegrationImpl::localMustFlowStep(def, nodeFrom, nodeTo)
+ }
+
+ signature predicate guardChecksSig(Guards::Guard g, Expr e, Guards::AbstractValue v);
+
+ cached // nothing is actually cached
+ module BarrierGuard {
+ private predicate guardChecksAdjTypes(
+ DataFlowIntegrationInput::Guard g, DataFlowIntegrationInput::Expr e, boolean branch
+ ) {
+ exists(Guards::AbstractValues::BooleanValue v |
+ guardChecks(g, e.getAstNode(), v) and
+ branch = v.getValue()
+ )
+ }
+
+ private Node getABarrierNodeImpl() {
+ result = DataFlowIntegrationImpl::BarrierGuard::getABarrierNode()
+ }
+
+ predicate getABarrierNode = getABarrierNodeImpl/0;
+ }
+ }
}
import Cached
@@ -1118,3 +1070,64 @@ class PhiReadNode extends DefinitionExt, Impl::PhiReadNode {
result = this.getSourceVariable().getEnclosingCallable()
}
}
+
+private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInputSig {
+ private import csharp as Cs
+ private import semmle.code.csharp.controlflow.BasicBlocks
+
+ class Expr extends ControlFlow::Node {
+ predicate hasCfgNode(ControlFlow::BasicBlock bb, int i) { this = bb.getNode(i) }
+ }
+
+ Expr getARead(Definition def) { exists(getAReadAtNode(def, result)) }
+
+ predicate ssaDefAssigns(WriteDefinition def, Expr value) {
+ // exclude flow directly from RHS to SSA definition, as we instead want to
+ // go from RHS to matching assingnable definition, and from there to SSA definition
+ none()
+ }
+
+ class Parameter = Ssa::ImplicitParameterDefinition;
+
+ predicate ssaDefInitializesParam(WriteDefinition def, Parameter p) { def = p }
+
+ /**
+ * Allows for flow into uncertain defintions that are not call definitions,
+ * as we, conservatively, consider such definitions to be certain.
+ */
+ predicate allowFlowIntoUncertainDef(UncertainWriteDefinition def) {
+ def instanceof Ssa::ExplicitDefinition
+ or
+ def =
+ any(Ssa::ImplicitQualifierDefinition qdef |
+ allowFlowIntoUncertainDef(qdef.getQualifierDefinition())
+ )
+ }
+
+ class Guard extends Guards::Guard {
+ predicate hasCfgNode(ControlFlow::BasicBlock bb, int i) {
+ this.getAControlFlowNode() = bb.getNode(i)
+ }
+ }
+
+ /** Holds if the guard `guard` controls block `bb` upon evaluating to `branch`. */
+ predicate guardControlsBlock(Guard guard, ControlFlow::BasicBlock bb, boolean branch) {
+ exists(ConditionBlock conditionBlock, ControlFlow::SuccessorTypes::ConditionalSuccessor s |
+ guard.getAControlFlowNode() = conditionBlock.getLastNode() and
+ s.getValue() = branch and
+ conditionBlock.controls(bb, s)
+ )
+ }
+
+ /** Gets an immediate conditional successor of basic block `bb`, if any. */
+ ControlFlow::BasicBlock getAConditionalBasicBlockSuccessor(
+ ControlFlow::BasicBlock bb, boolean branch
+ ) {
+ exists(ControlFlow::SuccessorTypes::ConditionalSuccessor s |
+ result = bb.getASuccessorByType(s) and
+ s.getValue() = branch
+ )
+ }
+}
+
+private module DataFlowIntegrationImpl = Impl::DataFlowIntegration;
diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
index ec78d10b35f..4a16e2491df 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
@@ -12,18 +12,21 @@
| CSharp7.cs:15:9:15:11 | SSA entry def(this.field) | CSharp7.cs:15:18:15:22 | access to field field |
| CSharp7.cs:15:9:15:11 | this | CSharp7.cs:15:18:15:22 | this access |
| CSharp7.cs:19:9:19:11 | this | CSharp7.cs:19:16:19:20 | this access |
+| CSharp7.cs:20:9:20:11 | SSA param(value) | CSharp7.cs:20:24:20:28 | access to parameter value |
| CSharp7.cs:20:9:20:11 | this | CSharp7.cs:20:16:20:20 | this access |
-| CSharp7.cs:20:9:20:11 | value | CSharp7.cs:20:24:20:28 | access to parameter value |
+| CSharp7.cs:20:9:20:11 | value | CSharp7.cs:20:9:20:11 | SSA param(value) |
| CSharp7.cs:20:24:20:28 | access to parameter value | CSharp7.cs:20:16:20:20 | access to field field |
| CSharp7.cs:23:5:23:27 | this | CSharp7.cs:14:9:14:13 | this access |
| CSharp7.cs:24:6:24:28 | this | CSharp7.cs:24:35:24:39 | this access |
-| CSharp7.cs:29:19:29:19 | i | CSharp7.cs:31:16:31:16 | access to parameter i |
+| CSharp7.cs:29:19:29:19 | SSA param(i) | CSharp7.cs:31:16:31:16 | access to parameter i |
+| CSharp7.cs:29:19:29:19 | i | CSharp7.cs:29:19:29:19 | SSA param(i) |
| CSharp7.cs:31:16:31:16 | access to parameter i | CSharp7.cs:31:16:31:20 | ... > ... |
| CSharp7.cs:31:16:31:16 | access to parameter i | CSharp7.cs:31:24:31:24 | access to parameter i |
| CSharp7.cs:31:24:31:24 | access to parameter i | CSharp7.cs:31:16:31:59 | ... ? ... : ... |
| CSharp7.cs:39:9:39:9 | access to parameter x | CSharp7.cs:39:9:39:21 | SSA def(x) |
| CSharp7.cs:39:13:39:21 | "tainted" | CSharp7.cs:39:9:39:9 | access to parameter x |
-| CSharp7.cs:42:19:42:19 | x | CSharp7.cs:44:13:44:13 | access to parameter x |
+| CSharp7.cs:42:19:42:19 | SSA param(x) | CSharp7.cs:44:13:44:13 | access to parameter x |
+| CSharp7.cs:42:19:42:19 | x | CSharp7.cs:42:19:42:19 | SSA param(x) |
| CSharp7.cs:44:9:44:9 | access to parameter y | CSharp7.cs:44:9:44:13 | SSA def(y) |
| CSharp7.cs:44:13:44:13 | access to parameter x | CSharp7.cs:44:9:44:9 | access to parameter y |
| CSharp7.cs:47:10:47:10 | this | CSharp7.cs:49:9:49:24 | this access |
@@ -86,7 +89,8 @@
| CSharp7.cs:77:22:77:28 | (..., ...) | CSharp7.cs:77:9:77:18 | (..., ...) |
| CSharp7.cs:77:23:77:24 | "" | CSharp7.cs:77:9:77:28 | ... = ... |
| CSharp7.cs:77:27:77:27 | access to local variable x | CSharp7.cs:77:9:77:28 | ... = ... |
-| CSharp7.cs:80:21:80:21 | x | CSharp7.cs:82:20:82:20 | access to parameter x |
+| CSharp7.cs:80:21:80:21 | SSA param(x) | CSharp7.cs:82:20:82:20 | access to parameter x |
+| CSharp7.cs:80:21:80:21 | x | CSharp7.cs:80:21:80:21 | SSA param(x) |
| CSharp7.cs:85:10:85:18 | this | CSharp7.cs:90:18:90:28 | this access |
| CSharp7.cs:87:13:87:14 | access to local variable t1 | CSharp7.cs:87:13:87:34 | SSA def(t1) |
| CSharp7.cs:87:13:87:34 | SSA def(t1) | CSharp7.cs:88:28:88:29 | access to local variable t1 |
@@ -133,40 +137,51 @@
| CSharp7.cs:121:28:121:36 | "DefUse3" | CSharp7.cs:121:22:121:24 | access to local variable m12 |
| CSharp7.cs:121:28:121:36 | "DefUse3" | CSharp7.cs:121:22:121:36 | ... = ... |
| CSharp7.cs:127:9:127:12 | this | CSharp7.cs:133:24:133:25 | this access |
-| CSharp7.cs:129:20:129:20 | x | CSharp7.cs:129:32:129:32 | access to parameter x |
+| CSharp7.cs:129:20:129:20 | SSA param(x) | CSharp7.cs:129:32:129:32 | access to parameter x |
+| CSharp7.cs:129:20:129:20 | x | CSharp7.cs:129:20:129:20 | SSA param(x) |
| CSharp7.cs:129:32:129:32 | access to parameter x | CSharp7.cs:129:32:129:36 | ... + ... |
| CSharp7.cs:129:36:129:36 | 1 | CSharp7.cs:129:32:129:36 | ... + ... |
-| CSharp7.cs:131:22:131:22 | t | CSharp7.cs:131:39:131:39 | access to parameter t |
+| CSharp7.cs:131:22:131:22 | SSA param(t) | CSharp7.cs:131:39:131:39 | access to parameter t |
+| CSharp7.cs:131:22:131:22 | t | CSharp7.cs:131:22:131:22 | SSA param(t) |
| CSharp7.cs:133:24:133:25 | delegate creation of type Func | CSharp7.cs:133:19:133:20 | access to local variable f4 |
| CSharp7.cs:133:24:133:25 | this access | CSharp7.cs:154:16:154:17 | this access |
-| CSharp7.cs:137:29:137:29 | x | CSharp7.cs:137:34:137:34 | access to parameter x |
+| CSharp7.cs:137:29:137:29 | SSA param(x) | CSharp7.cs:137:34:137:34 | access to parameter x |
+| CSharp7.cs:137:29:137:29 | x | CSharp7.cs:137:29:137:29 | SSA param(x) |
| CSharp7.cs:137:29:137:38 | (...) => ... | CSharp7.cs:137:24:137:25 | access to local variable f5 |
| CSharp7.cs:137:34:137:34 | access to parameter x | CSharp7.cs:137:34:137:38 | ... + ... |
| CSharp7.cs:137:38:137:38 | 1 | CSharp7.cs:137:34:137:38 | ... + ... |
-| CSharp7.cs:139:20:139:20 | x | CSharp7.cs:139:26:139:26 | access to parameter x |
+| CSharp7.cs:139:20:139:20 | SSA param(x) | CSharp7.cs:139:26:139:26 | access to parameter x |
+| CSharp7.cs:139:20:139:20 | x | CSharp7.cs:139:20:139:20 | SSA param(x) |
| CSharp7.cs:139:26:139:26 | access to parameter x | CSharp7.cs:139:26:139:30 | ... > ... |
| CSharp7.cs:139:26:139:26 | access to parameter x | CSharp7.cs:139:41:139:41 | access to parameter x |
| CSharp7.cs:139:34:139:34 | 1 | CSharp7.cs:139:34:139:46 | ... + ... |
| CSharp7.cs:139:34:139:46 | ... + ... | CSharp7.cs:139:26:139:50 | ... ? ... : ... |
| CSharp7.cs:139:38:139:46 | call to local function f7 | CSharp7.cs:139:34:139:46 | ... + ... |
| CSharp7.cs:139:50:139:50 | 0 | CSharp7.cs:139:26:139:50 | ... ? ... : ... |
-| CSharp7.cs:141:20:141:20 | x | CSharp7.cs:141:29:141:29 | access to parameter x |
-| CSharp7.cs:145:24:145:24 | x | CSharp7.cs:145:33:145:33 | access to parameter x |
+| CSharp7.cs:141:20:141:20 | SSA param(x) | CSharp7.cs:141:29:141:29 | access to parameter x |
+| CSharp7.cs:141:20:141:20 | x | CSharp7.cs:141:20:141:20 | SSA param(x) |
+| CSharp7.cs:145:24:145:24 | SSA param(x) | CSharp7.cs:145:33:145:33 | access to parameter x |
+| CSharp7.cs:145:24:145:24 | x | CSharp7.cs:145:24:145:24 | SSA param(x) |
| CSharp7.cs:149:20:152:9 | (...) => ... | CSharp7.cs:149:16:149:16 | access to local variable a |
| CSharp7.cs:157:10:157:17 | this | CSharp7.cs:169:9:169:9 | this access |
-| CSharp7.cs:160:18:160:18 | t | CSharp7.cs:160:24:160:24 | access to parameter t |
-| CSharp7.cs:162:26:162:26 | u | CSharp7.cs:166:22:166:22 | access to parameter u |
+| CSharp7.cs:160:18:160:18 | SSA param(t) | CSharp7.cs:160:24:160:24 | access to parameter t |
+| CSharp7.cs:160:18:160:18 | t | CSharp7.cs:160:18:160:18 | SSA param(t) |
+| CSharp7.cs:162:26:162:26 | SSA param(u) | CSharp7.cs:166:22:166:22 | access to parameter u |
+| CSharp7.cs:162:26:162:26 | u | CSharp7.cs:162:26:162:26 | SSA param(u) |
| CSharp7.cs:165:13:165:16 | this access | CSharp7.cs:166:20:166:20 | this access |
| CSharp7.cs:169:9:169:9 | this access | CSharp7.cs:170:9:170:9 | this access |
| CSharp7.cs:173:10:173:19 | this | CSharp7.cs:180:21:180:21 | this access |
| CSharp7.cs:175:16:175:18 | access to local variable src | CSharp7.cs:175:16:175:30 | SSA def(src) |
| CSharp7.cs:175:16:175:30 | SSA def(src) | CSharp7.cs:180:23:180:25 | access to local variable src |
| CSharp7.cs:175:22:175:30 | "tainted" | CSharp7.cs:175:16:175:18 | access to local variable src |
-| CSharp7.cs:176:25:176:25 | s | CSharp7.cs:176:33:176:33 | access to parameter s |
+| CSharp7.cs:176:25:176:25 | SSA param(s) | CSharp7.cs:176:33:176:33 | access to parameter s |
+| CSharp7.cs:176:25:176:25 | s | CSharp7.cs:176:25:176:25 | SSA param(s) |
| CSharp7.cs:176:31:176:34 | call to local function g | CSharp7.cs:176:31:176:39 | ... + ... |
| CSharp7.cs:176:38:176:39 | "" | CSharp7.cs:176:31:176:39 | ... + ... |
-| CSharp7.cs:177:25:177:25 | s | CSharp7.cs:177:31:177:31 | access to parameter s |
-| CSharp7.cs:178:25:178:25 | s | CSharp7.cs:178:37:178:37 | access to parameter s |
+| CSharp7.cs:177:25:177:25 | SSA param(s) | CSharp7.cs:177:31:177:31 | access to parameter s |
+| CSharp7.cs:177:25:177:25 | s | CSharp7.cs:177:25:177:25 | SSA param(s) |
+| CSharp7.cs:178:25:178:25 | SSA param(s) | CSharp7.cs:178:37:178:37 | access to parameter s |
+| CSharp7.cs:178:25:178:25 | s | CSharp7.cs:178:25:178:25 | SSA param(s) |
| CSharp7.cs:180:21:180:21 | this access | CSharp7.cs:181:21:181:21 | this access |
| CSharp7.cs:180:21:180:26 | call to local function f | CSharp7.cs:180:13:180:17 | access to local variable sink1 |
| CSharp7.cs:180:23:180:25 | [post] access to local variable src | CSharp7.cs:181:23:181:25 | access to local variable src |
@@ -205,8 +220,10 @@
| CSharp7.cs:198:26:198:35 | this access | CSharp7.cs:199:9:199:18 | this access |
| CSharp7.cs:198:33:198:34 | access to local variable r1 | CSharp7.cs:199:16:199:17 | access to local variable r1 |
| CSharp7.cs:199:22:199:22 | 3 | CSharp7.cs:199:9:199:22 | ... = ... |
-| CSharp7.cs:202:24:202:24 | p | CSharp7.cs:205:20:205:20 | access to parameter p |
-| CSharp7.cs:204:28:204:28 | q | CSharp7.cs:204:44:204:44 | access to parameter q |
+| CSharp7.cs:202:24:202:24 | SSA param(p) | CSharp7.cs:205:20:205:20 | access to parameter p |
+| CSharp7.cs:202:24:202:24 | p | CSharp7.cs:202:24:202:24 | SSA param(p) |
+| CSharp7.cs:204:28:204:28 | SSA param(q) | CSharp7.cs:204:44:204:44 | access to parameter q |
+| CSharp7.cs:204:28:204:28 | q | CSharp7.cs:204:28:204:28 | SSA param(q) |
| CSharp7.cs:215:9:215:9 | access to parameter x | CSharp7.cs:215:9:215:17 | SSA def(x) |
| CSharp7.cs:215:13:215:17 | false | CSharp7.cs:215:9:215:9 | access to parameter x |
| CSharp7.cs:219:10:219:13 | this | CSharp7.cs:221:13:221:20 | this access |
@@ -224,8 +241,8 @@
| CSharp7.cs:232:16:232:23 | SSA def(o) | CSharp7.cs:233:13:233:13 | access to local variable o |
| CSharp7.cs:232:20:232:23 | null | CSharp7.cs:232:16:232:16 | access to local variable o |
| CSharp7.cs:233:13:233:13 | access to local variable o | CSharp7.cs:233:18:233:23 | Int32 i1 |
+| CSharp7.cs:233:13:233:13 | access to local variable o | CSharp7.cs:235:13:235:42 | [input] SSA phi read(o) |
| CSharp7.cs:233:13:233:13 | access to local variable o | CSharp7.cs:237:18:237:18 | access to local variable o |
-| CSharp7.cs:233:13:233:13 | access to local variable o | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
| CSharp7.cs:233:13:233:23 | [false] ... is ... | CSharp7.cs:233:13:233:33 | [false] ... && ... |
| CSharp7.cs:233:13:233:23 | [true] ... is ... | CSharp7.cs:233:13:233:33 | [false] ... && ... |
| CSharp7.cs:233:13:233:23 | [true] ... is ... | CSharp7.cs:233:13:233:33 | [true] ... && ... |
@@ -235,19 +252,25 @@
| CSharp7.cs:233:28:233:29 | access to local variable i1 | CSharp7.cs:235:38:235:39 | access to local variable i1 |
| CSharp7.cs:233:28:233:33 | ... > ... | CSharp7.cs:233:13:233:33 | [false] ... && ... |
| CSharp7.cs:233:28:233:33 | ... > ... | CSharp7.cs:233:13:233:33 | [true] ... && ... |
+| CSharp7.cs:235:13:235:42 | [input] SSA phi read(o) | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
| CSharp7.cs:235:33:235:36 | "int " | CSharp7.cs:235:31:235:41 | $"..." |
| CSharp7.cs:235:38:235:39 | access to local variable i1 | CSharp7.cs:235:31:235:41 | $"..." |
| CSharp7.cs:237:18:237:18 | access to local variable o | CSharp7.cs:237:23:237:31 | String s1 |
+| CSharp7.cs:237:18:237:18 | access to local variable o | CSharp7.cs:239:13:239:45 | [input] SSA phi read(o) |
| CSharp7.cs:237:18:237:18 | access to local variable o | CSharp7.cs:241:18:241:18 | access to local variable o |
-| CSharp7.cs:237:18:237:18 | access to local variable o | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
| CSharp7.cs:237:23:237:31 | SSA def(s1) | CSharp7.cs:239:41:239:42 | access to local variable s1 |
| CSharp7.cs:237:23:237:31 | String s1 | CSharp7.cs:237:23:237:31 | SSA def(s1) |
+| CSharp7.cs:239:13:239:45 | [input] SSA phi read(o) | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
| CSharp7.cs:239:33:239:39 | "string " | CSharp7.cs:239:31:239:44 | $"..." |
| CSharp7.cs:239:41:239:42 | access to local variable s1 | CSharp7.cs:239:31:239:44 | $"..." |
+| CSharp7.cs:241:18:241:18 | access to local variable o | CSharp7.cs:242:9:243:9 | [input] SSA phi read(o) |
| CSharp7.cs:241:18:241:18 | access to local variable o | CSharp7.cs:244:18:244:18 | access to local variable o |
-| CSharp7.cs:241:18:241:18 | access to local variable o | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
+| CSharp7.cs:242:9:243:9 | [input] SSA phi read(o) | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
+| CSharp7.cs:244:18:244:18 | access to local variable o | CSharp7.cs:244:18:244:28 | [input] SSA phi read(o) |
| CSharp7.cs:244:18:244:18 | access to local variable o | CSharp7.cs:244:23:244:28 | Object v1 |
-| CSharp7.cs:244:18:244:18 | access to local variable o | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
+| CSharp7.cs:244:18:244:18 | access to local variable o | CSharp7.cs:245:9:246:9 | [input] SSA phi read(o) |
+| CSharp7.cs:244:18:244:28 | [input] SSA phi read(o) | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
+| CSharp7.cs:245:9:246:9 | [input] SSA phi read(o) | CSharp7.cs:248:9:274:9 | SSA phi read(o) |
| CSharp7.cs:248:9:274:9 | SSA phi read(o) | CSharp7.cs:248:17:248:17 | access to local variable o |
| CSharp7.cs:248:17:248:17 | access to local variable o | CSharp7.cs:254:27:254:27 | access to local variable o |
| CSharp7.cs:248:17:248:17 | access to local variable o | CSharp7.cs:257:18:257:23 | Int32 i2 |
@@ -281,14 +304,16 @@
| CSharp7.cs:283:13:283:16 | access to local variable list | CSharp7.cs:283:13:283:62 | SSA def(list) |
| CSharp7.cs:283:13:283:62 | SSA def(list) | CSharp7.cs:285:39:285:42 | access to local variable list |
| CSharp7.cs:283:20:283:62 | call to method Select,(Int32,String)> | CSharp7.cs:283:13:283:16 | access to local variable list |
-| CSharp7.cs:283:32:283:35 | item | CSharp7.cs:283:41:283:44 | access to parameter item |
+| CSharp7.cs:283:32:283:35 | SSA param(item) | CSharp7.cs:283:41:283:44 | access to parameter item |
+| CSharp7.cs:283:32:283:35 | item | CSharp7.cs:283:32:283:35 | SSA param(item) |
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:41:283:48 | access to property Key |
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:51:283:54 | access to parameter item |
| CSharp7.cs:283:51:283:54 | access to parameter item | CSharp7.cs:283:51:283:60 | access to property Value |
| CSharp7.cs:285:39:285:42 | access to local variable list | CSharp7.cs:287:36:287:39 | access to local variable list |
| CSharp7.cs:287:36:287:39 | access to local variable list | CSharp7.cs:289:32:289:35 | access to local variable list |
| CSharp7.cs:297:18:297:18 | access to local variable x | CSharp7.cs:297:18:297:22 | SSA def(x) |
-| CSharp7.cs:297:18:297:22 | SSA def(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |
+| CSharp7.cs:297:18:297:22 | SSA def(x) | CSharp7.cs:297:18:297:22 | [input] SSA phi(x) |
+| CSharp7.cs:297:18:297:22 | [input] SSA phi(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |
| CSharp7.cs:297:22:297:22 | 0 | CSharp7.cs:297:18:297:18 | access to local variable x |
| CSharp7.cs:297:25:297:25 | SSA phi(x) | CSharp7.cs:297:25:297:25 | access to local variable x |
| CSharp7.cs:297:25:297:25 | access to local variable x | CSharp7.cs:297:25:297:30 | ... < ... |
@@ -301,5 +326,6 @@
| CSharp7.cs:297:35:297:44 | [true] ... is ... | CSharp7.cs:297:25:297:44 | [true] ... && ... |
| CSharp7.cs:297:40:297:44 | Int32 y | CSharp7.cs:297:40:297:44 | SSA def(y) |
| CSharp7.cs:297:40:297:44 | SSA def(y) | CSharp7.cs:299:31:299:31 | access to local variable y |
-| CSharp7.cs:297:47:297:49 | SSA def(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |
+| CSharp7.cs:297:47:297:49 | SSA def(x) | CSharp7.cs:297:47:297:49 | [input] SSA phi(x) |
+| CSharp7.cs:297:47:297:49 | [input] SSA phi(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |
| CSharp7.cs:297:49:297:49 | access to local variable x | CSharp7.cs:297:47:297:49 | SSA def(x) |
diff --git a/csharp/ql/test/library-tests/dataflow/barrier-guards/BarrierFlow.cs b/csharp/ql/test/library-tests/dataflow/barrier-guards/BarrierFlow.cs
new file mode 100644
index 00000000000..3f3afed0a14
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/barrier-guards/BarrierFlow.cs
@@ -0,0 +1,83 @@
+class BarrierFlow
+{
+ static object Source(object source) => throw null;
+
+ public static void Sink(object o) { }
+
+
+ void M1()
+ {
+ var x = Source(1);
+
+ Sink(x); // $ hasValueFlow=1
+ }
+
+ void M2()
+ {
+ var x = Source(2);
+
+ if (x != "safe")
+ {
+ Sink(x); // $ hasValueFlow=2
+ }
+ }
+
+ void M3()
+ {
+ var x = Source(3);
+
+ if (x == "safe")
+ {
+ Sink(x);
+ }
+ }
+
+ void M4()
+ {
+ var x = Source(4);
+
+ if (x != "safe")
+ {
+ x = "safe";
+ }
+
+ Sink(x);
+ }
+
+ void M5()
+ {
+ var x = Source(5);
+
+ if (x == "safe")
+ {
+ }
+ else
+ {
+ x = "safe";
+ }
+
+ Sink(x);
+ }
+
+ void M6(bool b)
+ {
+ var x = Source(6);
+
+ if (b)
+ {
+ if (x != "safe1")
+ {
+ return;
+ }
+ }
+ else
+ {
+ if (x != "safe2")
+ {
+ return;
+ }
+ }
+
+ Sink(x);
+ }
+}
diff --git a/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.expected b/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.expected
new file mode 100644
index 00000000000..4fb1c0c3df1
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.expected
@@ -0,0 +1,18 @@
+models
+edges
+| BarrierFlow.cs:10:13:10:13 | access to local variable x : Object | BarrierFlow.cs:12:14:12:14 | access to local variable x | provenance | |
+| BarrierFlow.cs:10:17:10:25 | call to method Source : Object | BarrierFlow.cs:10:13:10:13 | access to local variable x : Object | provenance | |
+| BarrierFlow.cs:17:13:17:13 | access to local variable x : Object | BarrierFlow.cs:21:18:21:18 | access to local variable x | provenance | |
+| BarrierFlow.cs:17:17:17:25 | call to method Source : Object | BarrierFlow.cs:17:13:17:13 | access to local variable x : Object | provenance | |
+nodes
+| BarrierFlow.cs:10:13:10:13 | access to local variable x : Object | semmle.label | access to local variable x : Object |
+| BarrierFlow.cs:10:17:10:25 | call to method Source : Object | semmle.label | call to method Source : Object |
+| BarrierFlow.cs:12:14:12:14 | access to local variable x | semmle.label | access to local variable x |
+| BarrierFlow.cs:17:13:17:13 | access to local variable x : Object | semmle.label | access to local variable x : Object |
+| BarrierFlow.cs:17:17:17:25 | call to method Source : Object | semmle.label | call to method Source : Object |
+| BarrierFlow.cs:21:18:21:18 | access to local variable x | semmle.label | access to local variable x |
+subpaths
+testFailures
+#select
+| BarrierFlow.cs:12:14:12:14 | access to local variable x | BarrierFlow.cs:10:17:10:25 | call to method Source : Object | BarrierFlow.cs:12:14:12:14 | access to local variable x | $@ | BarrierFlow.cs:10:17:10:25 | call to method Source : Object | call to method Source : Object |
+| BarrierFlow.cs:21:18:21:18 | access to local variable x | BarrierFlow.cs:17:17:17:25 | call to method Source : Object | BarrierFlow.cs:21:18:21:18 | access to local variable x | $@ | BarrierFlow.cs:17:17:17:25 | call to method Source : Object | call to method Source : Object |
diff --git a/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.ql b/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.ql
new file mode 100644
index 00000000000..89bd8ff456e
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/barrier-guards/barrier-flow.ql
@@ -0,0 +1,35 @@
+/**
+ * @kind path-problem
+ */
+
+import csharp
+import semmle.code.csharp.controlflow.Guards
+
+private predicate stringConstCompare(Guard guard, Expr testedNode, AbstractValue value) {
+ guard
+ .isEquality(any(StringLiteral lit), testedNode,
+ value.(AbstractValues::BooleanValue).getValue())
+}
+
+class StringConstCompareBarrier extends DataFlow::Node {
+ StringConstCompareBarrier() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
+
+import TestUtilities.InlineFlowTest
+import PathGraph
+
+module FlowConfig implements DataFlow::ConfigSig {
+ predicate isSource = DefaultFlowConfig::isSource/1;
+
+ predicate isSink = DefaultFlowConfig::isSink/1;
+
+ predicate isBarrier(DataFlow::Node n) { n instanceof StringConstCompareBarrier }
+}
+
+import ValueFlowTest
+
+from PathNode source, PathNode sink
+where flowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
index 0e656151f08..a8b0a4d0cd5 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
@@ -10,7 +10,8 @@
| Capture.cs:51:9:51:15 | this access | Capture.cs:63:9:63:15 | this access |
| Capture.cs:58:21:58:21 | 1 | Capture.cs:58:17:58:17 | access to local variable i |
| Capture.cs:61:17:61:17 | 1 | Capture.cs:61:13:61:13 | access to local variable i |
-| LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:84:21:84:21 | access to parameter b |
+| LocalDataFlow.cs:48:24:48:24 | SSA param(b) | LocalDataFlow.cs:84:21:84:21 | access to parameter b |
+| LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:48:24:48:24 | SSA param(b) |
| LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) |
| LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | LocalDataFlow.cs:52:15:52:19 | access to local variable sink0 |
| LocalDataFlow.cs:51:21:51:34 | "taint source" | LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 |
@@ -64,16 +65,18 @@
| LocalDataFlow.cs:84:21:84:35 | [b (line 48): true] ... ? ... : ... | LocalDataFlow.cs:84:13:84:17 | access to local variable sink7 |
| LocalDataFlow.cs:84:25:84:27 | [b (line 48): true] "a" | LocalDataFlow.cs:84:21:84:35 | [b (line 48): true] ... ? ... : ... |
| LocalDataFlow.cs:84:31:84:35 | [b (line 48): false] access to local variable sink6 | LocalDataFlow.cs:84:21:84:35 | [b (line 48): false] ... ? ... : ... |
-| LocalDataFlow.cs:85:15:85:19 | [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) |
| LocalDataFlow.cs:88:9:88:16 | access to local variable nonSink0 | LocalDataFlow.cs:88:9:88:36 | SSA def(nonSink0) |
| LocalDataFlow.cs:88:9:88:36 | SSA def(nonSink0) | LocalDataFlow.cs:89:15:89:22 | access to local variable nonSink0 |
| LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... | LocalDataFlow.cs:88:9:88:16 | access to local variable nonSink0 |
| LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) | LocalDataFlow.cs:92:29:92:33 | access to local variable sink7 |
| LocalDataFlow.cs:88:24:88:28 | "abc" | LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... |
+| LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
| LocalDataFlow.cs:88:32:88:36 | "def" | LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... |
+| LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
| LocalDataFlow.cs:89:15:89:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:96:32:96:39 | access to local variable nonSink0 |
| LocalDataFlow.cs:89:15:89:22 | access to local variable nonSink0 | LocalDataFlow.cs:96:32:96:39 | access to local variable nonSink0 |
| LocalDataFlow.cs:92:13:92:17 | access to local variable sink8 | LocalDataFlow.cs:92:13:92:33 | SSA def(sink8) |
@@ -447,7 +450,7 @@
| LocalDataFlow.cs:281:13:281:34 | SSA def(sink70) | LocalDataFlow.cs:282:15:282:20 | access to local variable sink70 |
| LocalDataFlow.cs:281:22:281:26 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) |
| LocalDataFlow.cs:281:22:281:34 | ... = ... | LocalDataFlow.cs:281:13:281:18 | access to local variable sink70 |
-| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
+| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:22:313:29 | [input] SSA phi read(sink0) |
| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 |
| LocalDataFlow.cs:281:30:281:34 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:26 | access to local variable sink0 |
| LocalDataFlow.cs:281:30:281:34 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:34 | ... = ... |
@@ -477,12 +480,14 @@
| LocalDataFlow.cs:307:18:307:33 | String nonSink17 | LocalDataFlow.cs:307:18:307:33 | SSA def(nonSink17) |
| LocalDataFlow.cs:313:13:313:18 | access to local variable sink73 | LocalDataFlow.cs:313:13:313:38 | SSA def(sink73) |
| LocalDataFlow.cs:313:13:313:38 | SSA def(sink73) | LocalDataFlow.cs:315:15:315:20 | access to local variable sink73 |
+| LocalDataFlow.cs:313:22:313:29 | [input] SSA phi read(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
| LocalDataFlow.cs:313:22:313:29 | access to local variable nonSink0 | LocalDataFlow.cs:313:22:313:38 | ... ?? ... |
| LocalDataFlow.cs:313:22:313:29 | access to local variable nonSink0 | LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 |
| LocalDataFlow.cs:313:22:313:38 | ... ?? ... | LocalDataFlow.cs:313:13:313:18 | access to local variable sink73 |
| LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) | LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 |
+| LocalDataFlow.cs:313:34:313:38 | [input] SSA phi read(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:22:313:38 | ... ?? ... |
-| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
+| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:34:313:38 | [input] SSA phi read(sink0) |
| LocalDataFlow.cs:314:13:314:18 | access to local variable sink74 | LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) |
| LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) | LocalDataFlow.cs:316:15:316:20 | access to local variable sink74 |
| LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
@@ -490,37 +495,51 @@
| LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
| LocalDataFlow.cs:334:28:334:30 | SSA entry def(this.anInt) | LocalDataFlow.cs:334:41:334:45 | access to field anInt |
| LocalDataFlow.cs:334:28:334:30 | this | LocalDataFlow.cs:334:41:334:45 | this access |
+| LocalDataFlow.cs:334:50:334:52 | SSA param(value) | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
| LocalDataFlow.cs:334:50:334:52 | this | LocalDataFlow.cs:334:56:334:60 | this access |
-| LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
+| LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:50:334:52 | SSA param(value) |
| LocalDataFlow.cs:334:64:334:68 | access to parameter value | LocalDataFlow.cs:334:56:334:60 | access to field anInt |
-| LocalDataFlow.cs:340:41:340:47 | tainted | LocalDataFlow.cs:342:15:342:21 | access to parameter tainted |
-| LocalDataFlow.cs:345:44:345:53 | nonTainted | LocalDataFlow.cs:347:15:347:24 | access to parameter nonTainted |
-| LocalDataFlow.cs:350:44:350:44 | x | LocalDataFlow.cs:353:21:353:21 | access to parameter x |
-| LocalDataFlow.cs:350:67:350:68 | os | LocalDataFlow.cs:356:33:356:34 | access to parameter os |
+| LocalDataFlow.cs:340:41:340:47 | SSA param(tainted) | LocalDataFlow.cs:342:15:342:21 | access to parameter tainted |
+| LocalDataFlow.cs:340:41:340:47 | tainted | LocalDataFlow.cs:340:41:340:47 | SSA param(tainted) |
+| LocalDataFlow.cs:345:44:345:53 | SSA param(nonTainted) | LocalDataFlow.cs:347:15:347:24 | access to parameter nonTainted |
+| LocalDataFlow.cs:345:44:345:53 | nonTainted | LocalDataFlow.cs:345:44:345:53 | SSA param(nonTainted) |
+| LocalDataFlow.cs:350:44:350:44 | SSA param(x) | LocalDataFlow.cs:353:21:353:21 | access to parameter x |
+| LocalDataFlow.cs:350:44:350:44 | x | LocalDataFlow.cs:350:44:350:44 | SSA param(x) |
+| LocalDataFlow.cs:350:67:350:68 | SSA param(os) | LocalDataFlow.cs:356:33:356:34 | access to parameter os |
+| LocalDataFlow.cs:350:67:350:68 | os | LocalDataFlow.cs:350:67:350:68 | SSA param(os) |
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:17 | access to local variable x1 |
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:21 | ... = ... |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:29 | access to local variable os2 |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:34 | ... = ... |
-| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
+| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
+| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:361:41:361:44 | SSA param(args) |
| LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion | LocalDataFlow.cs:363:22:363:25 | access to local variable span |
| LocalDataFlow.cs:364:27:364:30 | call to operator implicit conversion | LocalDataFlow.cs:364:23:364:23 | access to local variable x |
-| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
-| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:367:23:367:24 | SSA param(b1) | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
+| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:367:23:367:24 | SSA param(b1) |
+| LocalDataFlow.cs:367:32:367:33 | SSA param(b2) | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:367:32:367:33 | SSA param(b2) |
| LocalDataFlow.cs:369:17:369:18 | "" | LocalDataFlow.cs:369:13:369:13 | access to local variable x |
| LocalDataFlow.cs:373:13:373:13 | access to local variable x | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:374:17:374:18 | [input] SSA phi(x) |
| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
-| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:13 | access to local variable x |
+| LocalDataFlow.cs:374:17:374:18 | [input] SSA phi(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:381:13:381:13 | access to local variable x | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
-| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:381:13:381:29 | [input] SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | [input] SSA phi(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:13 | access to local variable x |
| LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
+| SSA.cs:5:17:5:17 | [input] SSA def(this.S) | SSA.cs:136:23:136:28 | SSA def(this.S) |
+| SSA.cs:5:17:5:17 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
-| SSA.cs:5:26:5:32 | tainted | SSA.cs:8:24:8:30 | access to parameter tainted |
-| SSA.cs:5:42:5:51 | nonTainted | SSA.cs:12:24:12:33 | access to parameter nonTainted |
+| SSA.cs:5:26:5:32 | SSA param(tainted) | SSA.cs:8:24:8:30 | access to parameter tainted |
+| SSA.cs:5:26:5:32 | tainted | SSA.cs:5:26:5:32 | SSA param(tainted) |
+| SSA.cs:5:42:5:51 | SSA param(nonTainted) | SSA.cs:12:24:12:33 | access to parameter nonTainted |
+| SSA.cs:5:42:5:51 | nonTainted | SSA.cs:5:42:5:51 | SSA param(nonTainted) |
| SSA.cs:8:13:8:20 | access to local variable ssaSink0 | SSA.cs:8:13:8:30 | SSA def(ssaSink0) |
| SSA.cs:8:13:8:30 | SSA def(ssaSink0) | SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
| SSA.cs:8:24:8:30 | access to parameter tainted | SSA.cs:8:13:8:20 | access to local variable ssaSink0 |
@@ -533,78 +552,110 @@
| SSA.cs:12:24:12:33 | access to parameter nonTainted | SSA.cs:23:13:23:22 | access to parameter nonTainted |
| SSA.cs:13:15:13:22 | [post] access to local variable nonSink0 | SSA.cs:19:13:19:20 | access to local variable nonSink0 |
| SSA.cs:13:15:13:22 | access to local variable nonSink0 | SSA.cs:19:13:19:20 | access to local variable nonSink0 |
+| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:24:24:24:31 | access to local variable ssaSink0 |
-| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:24:24:24:31 | access to local variable ssaSink0 |
-| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:30:24:30:31 | access to local variable nonSink0 |
-| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:30:24:30:31 | access to local variable nonSink0 |
-| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
| SSA.cs:22:16:22:23 | access to local variable ssaSink1 | SSA.cs:22:16:22:28 | SSA def(ssaSink1) |
-| SSA.cs:22:16:22:28 | SSA def(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
+| SSA.cs:22:16:22:28 | SSA def(ssaSink1) | SSA.cs:23:13:23:33 | [input] SSA phi(ssaSink1) |
| SSA.cs:22:27:22:28 | "" | SSA.cs:22:16:22:23 | access to local variable ssaSink1 |
| SSA.cs:23:13:23:22 | [post] access to parameter nonTainted | SSA.cs:29:13:29:22 | access to parameter nonTainted |
| SSA.cs:23:13:23:22 | access to parameter nonTainted | SSA.cs:29:13:29:22 | access to parameter nonTainted |
+| SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:23:13:23:33 | [input] SSA phi(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
| SSA.cs:24:13:24:20 | access to local variable ssaSink1 | SSA.cs:24:13:24:31 | SSA def(ssaSink1) |
-| SSA.cs:24:13:24:31 | SSA def(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
+| SSA.cs:24:13:24:31 | SSA def(ssaSink1) | SSA.cs:24:13:24:31 | [input] SSA phi(ssaSink1) |
+| SSA.cs:24:13:24:31 | [input] SSA phi read(ssaSink0) | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:24:13:24:31 | [input] SSA phi(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:24:13:24:20 | access to local variable ssaSink1 |
-| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:24:13:24:31 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:35:13:35:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:37:24:37:31 | access to local variable ssaSink0 |
-| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
| SSA.cs:25:9:25:24 | SSA phi(ssaSink1) | SSA.cs:25:15:25:22 | access to local variable ssaSink1 |
| SSA.cs:28:16:28:23 | access to local variable nonSink1 | SSA.cs:28:16:28:28 | SSA def(nonSink1) |
-| SSA.cs:28:16:28:28 | SSA def(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
+| SSA.cs:28:16:28:28 | SSA def(nonSink1) | SSA.cs:29:13:29:33 | [input] SSA phi(nonSink1) |
| SSA.cs:28:27:28:28 | "" | SSA.cs:28:16:28:23 | access to local variable nonSink1 |
| SSA.cs:29:13:29:22 | [post] access to parameter nonTainted | SSA.cs:35:13:35:22 | access to parameter nonTainted |
| SSA.cs:29:13:29:22 | access to parameter nonTainted | SSA.cs:35:13:35:22 | access to parameter nonTainted |
+| SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:29:13:29:33 | [input] SSA phi(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
| SSA.cs:30:13:30:20 | access to local variable nonSink1 | SSA.cs:30:13:30:31 | SSA def(nonSink1) |
-| SSA.cs:30:13:30:31 | SSA def(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
+| SSA.cs:30:13:30:31 | SSA def(nonSink1) | SSA.cs:30:13:30:31 | [input] SSA phi(nonSink1) |
+| SSA.cs:30:13:30:31 | [input] SSA phi read(nonSink0) | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:30:13:30:31 | [input] SSA phi(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:30:13:30:20 | access to local variable nonSink1 |
-| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:30:13:30:31 | [input] SSA phi read(nonSink0) |
+| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:47:13:47:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:49:24:49:31 | access to local variable nonSink0 |
-| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
| SSA.cs:31:9:31:24 | SSA phi(nonSink1) | SSA.cs:31:15:31:22 | access to local variable nonSink1 |
| SSA.cs:34:16:34:23 | access to local variable ssaSink2 | SSA.cs:34:16:34:28 | SSA def(ssaSink2) |
-| SSA.cs:34:16:34:28 | SSA def(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:34:16:34:28 | SSA def(ssaSink2) | SSA.cs:35:13:35:33 | [input] SSA phi(ssaSink2) |
| SSA.cs:34:27:34:28 | "" | SSA.cs:34:16:34:23 | access to local variable ssaSink2 |
+| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:38:17:38:26 | access to parameter nonTainted |
-| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:38:17:38:26 | access to parameter nonTainted |
-| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:35:13:35:33 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:35:13:35:33 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
| SSA.cs:37:13:37:20 | access to local variable ssaSink2 | SSA.cs:37:13:37:31 | SSA def(ssaSink2) |
| SSA.cs:37:13:37:31 | SSA def(ssaSink2) | SSA.cs:39:21:39:28 | access to local variable ssaSink2 |
| SSA.cs:37:13:37:31 | SSA def(ssaSink2) | SSA.cs:41:21:41:28 | access to local variable ssaSink2 |
| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:37:13:37:20 | access to local variable ssaSink2 |
-| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
-| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
-| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
-| SSA.cs:39:21:39:28 | [post] access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:39:21:39:28 | access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:41:21:41:28 | [post] access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:41:21:41:28 | access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:39:17:39:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:41:17:41:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:39:17:39:29 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:39:21:39:28 | [post] access to local variable ssaSink2 | SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:39:21:39:28 | access to local variable ssaSink2 | SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:41:17:41:29 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:41:21:41:28 | [post] access to local variable ssaSink2 | SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:41:21:41:28 | access to local variable ssaSink2 | SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) |
| SSA.cs:43:9:43:24 | SSA phi read(nonTainted) | SSA.cs:47:13:47:22 | access to parameter nonTainted |
+| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:89:13:89:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:91:24:91:31 | access to local variable ssaSink0 |
-| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
| SSA.cs:43:9:43:24 | SSA phi(ssaSink2) | SSA.cs:43:15:43:22 | access to local variable ssaSink2 |
| SSA.cs:46:16:46:23 | access to local variable nonSink2 | SSA.cs:46:16:46:28 | SSA def(nonSink2) |
-| SSA.cs:46:16:46:28 | SSA def(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:46:16:46:28 | SSA def(nonSink2) | SSA.cs:47:13:47:33 | [input] SSA phi(nonSink2) |
| SSA.cs:46:27:46:28 | "" | SSA.cs:46:16:46:23 | access to local variable nonSink2 |
+| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:50:17:50:26 | access to parameter nonTainted |
-| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:50:17:50:26 | access to parameter nonTainted |
-| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:47:13:47:33 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:47:13:47:33 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
| SSA.cs:49:13:49:20 | access to local variable nonSink2 | SSA.cs:49:13:49:31 | SSA def(nonSink2) |
| SSA.cs:49:13:49:31 | SSA def(nonSink2) | SSA.cs:51:21:51:28 | access to local variable nonSink2 |
| SSA.cs:49:13:49:31 | SSA def(nonSink2) | SSA.cs:53:21:53:28 | access to local variable nonSink2 |
| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:49:13:49:20 | access to local variable nonSink2 |
-| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
-| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
-| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
-| SSA.cs:51:21:51:28 | [post] access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:51:21:51:28 | access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:53:21:53:28 | [post] access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:53:21:53:28 | access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:51:17:51:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:53:17:53:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:51:17:51:29 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:51:21:51:28 | [post] access to local variable nonSink2 | SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:51:21:51:28 | access to local variable nonSink2 | SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:53:17:53:29 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:53:21:53:28 | [post] access to local variable nonSink2 | SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:53:21:53:28 | access to local variable nonSink2 | SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) |
| SSA.cs:55:9:55:24 | SSA phi read(nonSink0) | SSA.cs:63:23:63:30 | access to local variable nonSink0 |
| SSA.cs:55:9:55:24 | SSA phi read(nonTainted) | SSA.cs:89:13:89:22 | access to parameter nonTainted |
| SSA.cs:55:9:55:24 | SSA phi(nonSink2) | SSA.cs:55:15:55:22 | access to local variable nonSink2 |
@@ -613,28 +664,28 @@
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:58:16:58:23 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:67:32:67:38 | access to parameter tainted |
| SSA.cs:59:23:59:30 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
-| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
-| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) |
| SSA.cs:63:23:63:30 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
-| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
-| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) |
| SSA.cs:67:9:67:12 | [post] this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:12 | this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:14 | [post] access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:14 | access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:28 | access to field SsaFieldSink0 | SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) |
-| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
+| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:67:9:67:28 | access to field SsaFieldSink0 |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:77:20:77:26 | access to parameter tainted |
| SSA.cs:68:23:68:26 | [post] this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:26 | this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:28 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
-| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
-| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:68:23:68:28 | access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:69:15:69:18 | [post] this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:18 | this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:20 | [post] access to field S | SSA.cs:72:9:72:14 | access to field S |
@@ -644,15 +695,15 @@
| SSA.cs:72:9:72:14 | [post] access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:14 | access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 | SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) |
-| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:35:72:36 | "" | SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:26 | [post] this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:26 | this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:28 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
-| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
-| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:73:23:73:28 | access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:74:15:74:18 | [post] this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:18 | this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:20 | [post] access to field S | SSA.cs:80:9:80:14 | access to field S |
@@ -663,10 +714,10 @@
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:80:35:80:41 | access to parameter tainted |
| SSA.cs:78:21:78:28 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:21:78:28 | SSA def(nonSink0) |
+| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
-| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
-| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
| SSA.cs:80:9:80:12 | [post] this access | SSA.cs:81:21:81:24 | this access |
| SSA.cs:80:9:80:12 | this access | SSA.cs:81:21:81:24 | this access |
| SSA.cs:80:9:80:14 | [post] access to field S | SSA.cs:81:21:81:26 | access to field S |
@@ -695,70 +746,105 @@
| SSA.cs:85:15:85:20 | [post] access to field S | SSA.cs:114:9:114:14 | access to field S |
| SSA.cs:85:15:85:20 | access to field S | SSA.cs:114:9:114:14 | access to field S |
| SSA.cs:88:16:88:23 | access to local variable ssaSink4 | SSA.cs:88:16:88:28 | SSA def(ssaSink4) |
-| SSA.cs:88:16:88:28 | SSA def(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:88:16:88:28 | SSA def(ssaSink4) | SSA.cs:89:13:89:33 | [input] SSA phi(ssaSink4) |
| SSA.cs:88:27:88:28 | "" | SSA.cs:88:16:88:23 | access to local variable ssaSink4 |
+| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:92:17:92:26 | access to parameter nonTainted |
-| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:92:17:92:26 | access to parameter nonTainted |
-| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:89:13:89:33 | [input] SSA def(this.S) | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:89:13:89:33 | [input] SSA def(this.S) | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:89:13:89:33 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:91:13:91:20 | access to local variable ssaSink4 | SSA.cs:91:13:91:31 | SSA def(ssaSink4) |
| SSA.cs:91:13:91:31 | SSA def(ssaSink4) | SSA.cs:93:21:93:28 | access to local variable ssaSink4 |
| SSA.cs:91:13:91:31 | SSA def(ssaSink4) | SSA.cs:95:21:95:28 | access to local variable ssaSink4 |
| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:91:13:91:20 | access to local variable ssaSink4 |
-| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
-| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
-| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
-| SSA.cs:93:21:93:28 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:93:17:93:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:95:17:95:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:93:17:93:29 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:93:21:93:28 | [post] access to local variable ssaSink4 | SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:95:17:95:29 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) |
| SSA.cs:97:9:97:32 | SSA phi read(nonTainted) | SSA.cs:102:13:102:22 | access to parameter nonTainted |
| SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) | SSA.cs:117:36:117:43 | access to local variable ssaSink0 |
| SSA.cs:97:9:97:32 | SSA phi(ssaSink4) | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
-| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
-| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) |
| SSA.cs:101:16:101:23 | access to local variable nonSink3 | SSA.cs:101:16:101:28 | SSA def(nonSink3) |
-| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:102:13:102:33 | [input] SSA phi(nonSink3) |
| SSA.cs:101:27:101:28 | "" | SSA.cs:101:16:101:23 | access to local variable nonSink3 |
+| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:105:17:105:26 | access to parameter nonTainted |
-| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:105:17:105:26 | access to parameter nonTainted |
-| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:102:13:102:33 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
| SSA.cs:104:13:104:20 | access to local variable nonSink3 | SSA.cs:104:13:104:31 | SSA def(nonSink3) |
| SSA.cs:104:13:104:31 | SSA def(nonSink3) | SSA.cs:106:21:106:28 | access to local variable nonSink3 |
| SSA.cs:104:13:104:31 | SSA def(nonSink3) | SSA.cs:108:21:108:28 | access to local variable nonSink3 |
| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:104:13:104:20 | access to local variable nonSink3 |
-| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
-| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
-| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
-| SSA.cs:106:21:106:28 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:106:17:106:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:108:17:108:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:106:17:106:29 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:106:21:106:28 | [post] access to local variable nonSink3 | SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:108:17:108:29 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) |
| SSA.cs:110:9:110:32 | SSA phi read(nonSink0) | SSA.cs:130:39:130:46 | access to local variable nonSink0 |
| SSA.cs:110:9:110:32 | SSA phi read(nonTainted) | SSA.cs:115:13:115:22 | access to parameter nonTainted |
| SSA.cs:110:9:110:32 | SSA phi(nonSink3) | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
-| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
-| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:123:23:123:26 | this access |
+| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:117:13:117:18 | access to field S |
-| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:114:9:114:14 | access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:117:13:117:18 | access to field S |
-| SSA.cs:114:9:114:14 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
| SSA.cs:114:9:114:28 | access to field SsaFieldSink1 | SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) |
-| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:115:13:115:33 | [input] SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:114:32:114:33 | "" | SSA.cs:114:9:114:28 | access to field SsaFieldSink1 |
+| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
-| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
-| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:115:13:115:33 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:117:13:117:16 | [post] this access | SSA.cs:119:21:119:24 | this access |
| SSA.cs:117:13:117:16 | [post] this access | SSA.cs:121:21:121:24 | this access |
| SSA.cs:117:13:117:16 | this access | SSA.cs:119:21:119:24 | this access |
@@ -771,30 +857,38 @@
| SSA.cs:117:13:117:43 | SSA def(this.S.SsaFieldSink1) | SSA.cs:119:21:119:40 | access to field SsaFieldSink1 |
| SSA.cs:117:13:117:43 | SSA def(this.S.SsaFieldSink1) | SSA.cs:121:21:121:40 | access to field SsaFieldSink1 |
| SSA.cs:117:36:117:43 | access to local variable ssaSink0 | SSA.cs:117:13:117:32 | access to field SsaFieldSink1 |
-| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
-| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:119:21:119:24 | this access | SSA.cs:123:23:123:26 | this access |
-| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:119:21:119:26 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
-| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) |
+| SSA.cs:119:21:119:26 | access to field S | SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) |
+| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:24 | this access | SSA.cs:123:23:123:26 | this access |
-| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:121:21:121:26 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
-| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) |
+| SSA.cs:121:21:121:26 | access to field S | SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) |
+| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:123:9:123:30 | SSA phi read(nonTainted) | SSA.cs:128:13:128:22 | access to parameter nonTainted |
| SSA.cs:123:9:123:30 | SSA phi read(this.S) | SSA.cs:123:23:123:28 | access to field S |
-| SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
+| SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) | SSA.cs:128:13:128:33 | [input] SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:123:23:123:26 | [post] this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:26 | this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:28 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
-| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
-| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:128:13:128:33 | [input] SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:123:23:123:28 | access to field S | SSA.cs:128:13:128:33 | [input] SSA def(this.S) |
| SSA.cs:124:15:124:18 | [post] this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:18 | this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:20 | [post] access to field S | SSA.cs:127:9:127:14 | access to field S |
@@ -803,15 +897,19 @@
| SSA.cs:127:9:127:12 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:127:9:127:12 | this access | SSA.cs:130:13:130:16 | this access |
| SSA.cs:127:9:127:12 | this access | SSA.cs:136:23:136:26 | this access |
+| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:130:13:130:18 | access to field S |
-| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:127:9:127:14 | access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:130:13:130:18 | access to field S |
-| SSA.cs:127:9:127:14 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
| SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 | SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) |
-| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:128:13:128:33 | [input] SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:127:35:127:36 | "" | SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 |
| SSA.cs:128:13:128:22 | [post] access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
| SSA.cs:128:13:128:22 | access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
+| SSA.cs:128:13:128:33 | [input] SSA def(this.S) | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:128:13:128:33 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:128:13:128:33 | [input] SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:130:13:130:16 | [post] this access | SSA.cs:132:21:132:24 | this access |
| SSA.cs:130:13:130:16 | [post] this access | SSA.cs:134:21:134:24 | this access |
| SSA.cs:130:13:130:16 | this access | SSA.cs:132:21:132:24 | this access |
@@ -824,66 +922,86 @@
| SSA.cs:130:13:130:46 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 |
| SSA.cs:130:13:130:46 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 |
| SSA.cs:130:39:130:46 | access to local variable nonSink0 | SSA.cs:130:13:130:35 | access to field SsaFieldNonSink0 |
+| SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:132:21:132:24 | this access | SSA.cs:136:23:136:26 | this access |
-| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:132:21:132:26 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
-| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) |
+| SSA.cs:132:21:132:26 | access to field S | SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) |
+| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:24 | this access | SSA.cs:136:23:136:26 | this access |
-| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:134:21:134:26 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
-| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) |
+| SSA.cs:134:21:134:26 | access to field S | SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) |
+| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:136:9:136:30 | SSA phi read(this.S) | SSA.cs:136:23:136:28 | access to field S |
-| SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:5:17:5:17 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:136:23:136:26 | [post] this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:26 | this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:28 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
-| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
+| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:5:17:5:17 | [input] SSA def(this.S) |
+| SSA.cs:136:23:136:28 | access to field S | SSA.cs:5:17:5:17 | [input] SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
-| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
-| SSA.cs:144:34:144:34 | t | SSA.cs:146:13:146:13 | access to parameter t |
+| SSA.cs:144:34:144:34 | SSA param(t) | SSA.cs:146:13:146:13 | access to parameter t |
+| SSA.cs:144:34:144:34 | t | SSA.cs:144:34:144:34 | SSA param(t) |
| SSA.cs:146:13:146:13 | access to parameter t | SSA.cs:146:13:146:13 | (...) ... |
| SSA.cs:146:13:146:13 | access to parameter t | SSA.cs:149:17:149:17 | access to parameter t |
| SSA.cs:147:13:147:13 | access to parameter t | SSA.cs:147:13:147:26 | SSA def(t) |
-| SSA.cs:147:13:147:26 | SSA def(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
+| SSA.cs:147:13:147:26 | SSA def(t) | SSA.cs:147:13:147:26 | [input] SSA phi(t) |
+| SSA.cs:147:13:147:26 | [input] SSA phi(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
| SSA.cs:147:17:147:26 | default(...) | SSA.cs:147:13:147:13 | access to parameter t |
| SSA.cs:149:13:149:13 | access to parameter t | SSA.cs:149:13:149:17 | SSA def(t) |
-| SSA.cs:149:13:149:17 | SSA def(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
+| SSA.cs:149:13:149:17 | SSA def(t) | SSA.cs:149:13:149:17 | [input] SSA phi(t) |
+| SSA.cs:149:13:149:17 | [input] SSA phi(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
| SSA.cs:149:17:149:17 | access to parameter t | SSA.cs:149:13:149:13 | access to parameter t |
-| SSA.cs:152:36:152:36 | t | SSA.cs:154:13:154:13 | access to parameter t |
-| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:152:36:152:36 | SSA param(t) | SSA.cs:154:13:154:13 | access to parameter t |
+| SSA.cs:152:36:152:36 | t | SSA.cs:152:36:152:36 | SSA param(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:13 | (...) ... |
+| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:21 | [input] SSA phi(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
-| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:154:13:154:21 | [input] SSA phi(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:155:13:155:26 | [input] SSA phi(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:155:13:155:26 | [input] SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:25:155:25 | SSA def(t) |
| SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
| SSA.cs:166:28:166:31 | null | SSA.cs:166:19:166:24 | access to field S |
-| SSA.cs:168:22:168:28 | tainted | SSA.cs:173:24:173:30 | access to parameter tainted |
-| SSA.cs:168:35:168:35 | i | SSA.cs:171:13:171:13 | access to parameter i |
+| SSA.cs:168:22:168:28 | SSA param(tainted) | SSA.cs:173:24:173:30 | access to parameter tainted |
+| SSA.cs:168:22:168:28 | tainted | SSA.cs:168:22:168:28 | SSA param(tainted) |
+| SSA.cs:168:35:168:35 | SSA param(i) | SSA.cs:171:13:171:13 | access to parameter i |
+| SSA.cs:168:35:168:35 | i | SSA.cs:168:35:168:35 | SSA param(i) |
| SSA.cs:170:16:170:23 | access to local variable ssaSink5 | SSA.cs:170:16:170:28 | SSA def(ssaSink5) |
-| SSA.cs:170:16:170:28 | SSA def(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
+| SSA.cs:170:16:170:28 | SSA def(ssaSink5) | SSA.cs:171:13:171:19 | [input] SSA phi(ssaSink5) |
| SSA.cs:170:27:170:28 | "" | SSA.cs:170:16:170:23 | access to local variable ssaSink5 |
| SSA.cs:171:13:171:13 | access to parameter i | SSA.cs:171:13:171:15 | SSA def(i) |
-| SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:13:178:13 | [input] SSA phi(i) |
+| SSA.cs:171:13:171:19 | [input] SSA phi(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:173:13:173:20 | access to local variable ssaSink5 | SSA.cs:173:13:173:30 | SSA def(ssaSink5) |
-| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:174:13:178:13 | [input] SSA phi read(ssaSink5) |
| SSA.cs:173:24:173:30 | access to parameter tainted | SSA.cs:173:13:173:20 | access to local variable ssaSink5 |
+| SSA.cs:174:13:178:13 | [input] SSA phi read(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:174:13:178:13 | [input] SSA phi(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:174:20:174:26 | [input] SSA phi(ssaSink5) |
| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:176:21:176:28 | access to local variable ssaSink5 |
-| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:174:20:174:20 | SSA phi(i) | SSA.cs:174:20:174:20 | access to parameter i |
| SSA.cs:174:20:174:20 | access to parameter i | SSA.cs:174:20:174:22 | SSA def(i) |
-| SSA.cs:174:20:174:22 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:174:20:174:22 | SSA def(i) | SSA.cs:177:17:177:29 | [input] SSA phi(i) |
+| SSA.cs:174:20:174:26 | [input] SSA phi(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:176:21:176:28 | [post] access to local variable ssaSink5 | SSA.cs:177:21:177:28 | access to local variable ssaSink5 |
| SSA.cs:176:21:176:28 | access to local variable ssaSink5 | SSA.cs:177:21:177:28 | access to local variable ssaSink5 |
-| SSA.cs:177:21:177:28 | [post] access to local variable ssaSink5 | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
-| SSA.cs:177:21:177:28 | access to local variable ssaSink5 | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:177:17:177:29 | [input] SSA phi(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:177:21:177:28 | [post] access to local variable ssaSink5 | SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) |
+| SSA.cs:177:21:177:28 | access to local variable ssaSink5 | SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) |
| SSA.cs:180:9:180:24 | SSA phi(ssaSink5) | SSA.cs:180:15:180:22 | access to local variable ssaSink5 |
-| Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b |
-| Splitting.cs:3:28:3:34 | tainted | Splitting.cs:5:17:5:23 | access to parameter tainted |
+| Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:6:13:6:13 | access to parameter b |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) |
+| Splitting.cs:3:28:3:34 | SSA param(tainted) | Splitting.cs:5:17:5:23 | access to parameter tainted |
+| Splitting.cs:3:28:3:34 | tainted | Splitting.cs:3:28:3:34 | SSA param(tainted) |
| Splitting.cs:5:13:5:13 | access to local variable x | Splitting.cs:5:13:5:23 | SSA def(x) |
| Splitting.cs:5:13:5:23 | SSA def(x) | Splitting.cs:8:19:8:19 | [b (line 3): true] access to local variable x |
| Splitting.cs:5:13:5:23 | SSA def(x) | Splitting.cs:12:15:12:15 | [b (line 3): false] access to local variable x |
@@ -895,7 +1013,8 @@
| Splitting.cs:9:17:9:17 | [b (line 3): true] access to local variable x | Splitting.cs:12:15:12:15 | [b (line 3): true] access to local variable x |
| Splitting.cs:12:15:12:15 | [b (line 3): true] access to local variable x | Splitting.cs:14:19:14:19 | access to local variable x |
| Splitting.cs:12:15:12:15 | [post] [b (line 3): true] access to local variable x | Splitting.cs:14:19:14:19 | access to local variable x |
-| Splitting.cs:17:18:17:18 | b | Splitting.cs:20:13:20:13 | access to parameter b |
+| Splitting.cs:17:18:17:18 | SSA param(b) | Splitting.cs:20:13:20:13 | access to parameter b |
+| Splitting.cs:17:18:17:18 | b | Splitting.cs:17:18:17:18 | SSA param(b) |
| Splitting.cs:19:13:19:13 | access to local variable x | Splitting.cs:19:13:19:18 | SSA def(x) |
| Splitting.cs:19:13:19:18 | SSA def(x) | Splitting.cs:22:19:22:19 | [b (line 17): true] access to local variable x |
| Splitting.cs:19:13:19:18 | SSA def(x) | Splitting.cs:25:15:25:15 | [b (line 17): false] access to local variable x |
@@ -909,7 +1028,8 @@
| Splitting.cs:25:15:25:15 | [b (line 17): true] access to local variable x | Splitting.cs:27:19:27:19 | access to local variable x |
| Splitting.cs:25:15:25:15 | [post] [b (line 17): false] access to local variable x | Splitting.cs:29:19:29:19 | access to local variable x |
| Splitting.cs:25:15:25:15 | [post] [b (line 17): true] access to local variable x | Splitting.cs:27:19:27:19 | access to local variable x |
-| Splitting.cs:32:18:32:18 | b | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:32:18:32:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:32:18:32:18 | b | Splitting.cs:32:18:32:18 | SSA param(b) |
| Splitting.cs:34:17:34:18 | "" | Splitting.cs:34:13:34:13 | access to local variable x |
| Splitting.cs:35:13:35:13 | access to parameter b | Splitting.cs:39:15:39:15 | [b (line 32): false] access to parameter b |
| Splitting.cs:35:13:35:13 | access to parameter b | Splitting.cs:39:15:39:15 | [b (line 32): true] access to parameter b |
@@ -936,7 +1056,8 @@
| Splitting.cs:41:19:41:21 | [b (line 32): false] "d" | Splitting.cs:41:15:41:21 | [b (line 32): false] ... = ... |
| Splitting.cs:41:19:41:21 | [b (line 32): true] "d" | Splitting.cs:41:15:41:15 | access to local variable x |
| Splitting.cs:41:19:41:21 | [b (line 32): true] "d" | Splitting.cs:41:15:41:21 | [b (line 32): true] ... = ... |
-| Splitting.cs:46:18:46:18 | b | Splitting.cs:49:13:49:13 | access to parameter b |
+| Splitting.cs:46:18:46:18 | SSA param(b) | Splitting.cs:49:13:49:13 | access to parameter b |
+| Splitting.cs:46:18:46:18 | b | Splitting.cs:46:18:46:18 | SSA param(b) |
| Splitting.cs:48:13:48:13 | access to local variable x | Splitting.cs:48:13:48:18 | SSA def(x) |
| Splitting.cs:48:13:48:18 | SSA def(x) | Splitting.cs:53:13:53:13 | [b (line 46): false] access to local variable x |
| Splitting.cs:48:17:48:18 | "" | Splitting.cs:48:13:48:13 | access to local variable x |
@@ -994,6 +1115,7 @@
| UseUseExplosion.cs:21:10:21:10 | SSA entry def(this.Prop) | UseUseExplosion.cs:24:13:24:16 | access to property Prop |
| UseUseExplosion.cs:21:10:21:10 | this | UseUseExplosion.cs:24:13:24:16 | this access |
| UseUseExplosion.cs:23:13:23:13 | access to local variable x | UseUseExplosion.cs:23:13:23:17 | SSA def(x) |
+| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(x) |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1712:24:1712 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1727:24:1727 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1742:24:1742 | access to local variable x |
@@ -1094,907 +1216,1109 @@
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3167:24:3167 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3182:24:3182 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3197:24:3197 | access to local variable x |
-| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:23:17:23:17 | 0 | UseUseExplosion.cs:23:13:23:13 | access to local variable x |
| UseUseExplosion.cs:24:13:24:16 | [post] this access | UseUseExplosion.cs:24:31:24:34 | this access |
| UseUseExplosion.cs:24:13:24:16 | [post] this access | UseUseExplosion.cs:24:3193:24:3198 | this access |
| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:24:31:24:34 | access to property Prop |
-| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:13:24:16 | this access | UseUseExplosion.cs:24:31:24:34 | this access |
| UseUseExplosion.cs:24:13:24:16 | this access | UseUseExplosion.cs:24:3193:24:3198 | this access |
| UseUseExplosion.cs:24:31:24:34 | [post] this access | UseUseExplosion.cs:24:48:24:51 | this access |
| UseUseExplosion.cs:24:31:24:34 | [post] this access | UseUseExplosion.cs:24:3178:24:3183 | this access |
| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:24:48:24:51 | access to property Prop |
-| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:31:24:34 | this access | UseUseExplosion.cs:24:48:24:51 | this access |
| UseUseExplosion.cs:24:31:24:34 | this access | UseUseExplosion.cs:24:3178:24:3183 | this access |
| UseUseExplosion.cs:24:48:24:51 | [post] this access | UseUseExplosion.cs:24:65:24:68 | this access |
| UseUseExplosion.cs:24:48:24:51 | [post] this access | UseUseExplosion.cs:24:3163:24:3168 | this access |
| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:24:65:24:68 | access to property Prop |
-| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:48:24:51 | this access | UseUseExplosion.cs:24:65:24:68 | this access |
| UseUseExplosion.cs:24:48:24:51 | this access | UseUseExplosion.cs:24:3163:24:3168 | this access |
| UseUseExplosion.cs:24:65:24:68 | [post] this access | UseUseExplosion.cs:24:82:24:85 | this access |
| UseUseExplosion.cs:24:65:24:68 | [post] this access | UseUseExplosion.cs:24:3148:24:3153 | this access |
| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:24:82:24:85 | access to property Prop |
-| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:65:24:68 | this access | UseUseExplosion.cs:24:82:24:85 | this access |
| UseUseExplosion.cs:24:65:24:68 | this access | UseUseExplosion.cs:24:3148:24:3153 | this access |
| UseUseExplosion.cs:24:82:24:85 | [post] this access | UseUseExplosion.cs:24:99:24:102 | this access |
| UseUseExplosion.cs:24:82:24:85 | [post] this access | UseUseExplosion.cs:24:3133:24:3138 | this access |
| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:24:99:24:102 | access to property Prop |
-| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:82:24:85 | this access | UseUseExplosion.cs:24:99:24:102 | this access |
| UseUseExplosion.cs:24:82:24:85 | this access | UseUseExplosion.cs:24:3133:24:3138 | this access |
| UseUseExplosion.cs:24:99:24:102 | [post] this access | UseUseExplosion.cs:24:116:24:119 | this access |
| UseUseExplosion.cs:24:99:24:102 | [post] this access | UseUseExplosion.cs:24:3118:24:3123 | this access |
| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:24:116:24:119 | access to property Prop |
-| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:99:24:102 | this access | UseUseExplosion.cs:24:116:24:119 | this access |
| UseUseExplosion.cs:24:99:24:102 | this access | UseUseExplosion.cs:24:3118:24:3123 | this access |
| UseUseExplosion.cs:24:116:24:119 | [post] this access | UseUseExplosion.cs:24:133:24:136 | this access |
| UseUseExplosion.cs:24:116:24:119 | [post] this access | UseUseExplosion.cs:24:3103:24:3108 | this access |
| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:24:133:24:136 | access to property Prop |
-| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:116:24:119 | this access | UseUseExplosion.cs:24:133:24:136 | this access |
| UseUseExplosion.cs:24:116:24:119 | this access | UseUseExplosion.cs:24:3103:24:3108 | this access |
| UseUseExplosion.cs:24:133:24:136 | [post] this access | UseUseExplosion.cs:24:150:24:153 | this access |
| UseUseExplosion.cs:24:133:24:136 | [post] this access | UseUseExplosion.cs:24:3088:24:3093 | this access |
| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:24:150:24:153 | access to property Prop |
-| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:133:24:136 | this access | UseUseExplosion.cs:24:150:24:153 | this access |
| UseUseExplosion.cs:24:133:24:136 | this access | UseUseExplosion.cs:24:3088:24:3093 | this access |
| UseUseExplosion.cs:24:150:24:153 | [post] this access | UseUseExplosion.cs:24:167:24:170 | this access |
| UseUseExplosion.cs:24:150:24:153 | [post] this access | UseUseExplosion.cs:24:3073:24:3078 | this access |
| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:24:167:24:170 | access to property Prop |
-| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:150:24:153 | this access | UseUseExplosion.cs:24:167:24:170 | this access |
| UseUseExplosion.cs:24:150:24:153 | this access | UseUseExplosion.cs:24:3073:24:3078 | this access |
| UseUseExplosion.cs:24:167:24:170 | [post] this access | UseUseExplosion.cs:24:184:24:187 | this access |
| UseUseExplosion.cs:24:167:24:170 | [post] this access | UseUseExplosion.cs:24:3058:24:3063 | this access |
| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:24:184:24:187 | access to property Prop |
-| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:167:24:170 | this access | UseUseExplosion.cs:24:184:24:187 | this access |
| UseUseExplosion.cs:24:167:24:170 | this access | UseUseExplosion.cs:24:3058:24:3063 | this access |
| UseUseExplosion.cs:24:184:24:187 | [post] this access | UseUseExplosion.cs:24:201:24:204 | this access |
| UseUseExplosion.cs:24:184:24:187 | [post] this access | UseUseExplosion.cs:24:3043:24:3048 | this access |
| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:24:201:24:204 | access to property Prop |
-| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:184:24:187 | this access | UseUseExplosion.cs:24:201:24:204 | this access |
| UseUseExplosion.cs:24:184:24:187 | this access | UseUseExplosion.cs:24:3043:24:3048 | this access |
| UseUseExplosion.cs:24:201:24:204 | [post] this access | UseUseExplosion.cs:24:218:24:221 | this access |
| UseUseExplosion.cs:24:201:24:204 | [post] this access | UseUseExplosion.cs:24:3028:24:3033 | this access |
| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:24:218:24:221 | access to property Prop |
-| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:201:24:204 | this access | UseUseExplosion.cs:24:218:24:221 | this access |
| UseUseExplosion.cs:24:201:24:204 | this access | UseUseExplosion.cs:24:3028:24:3033 | this access |
| UseUseExplosion.cs:24:218:24:221 | [post] this access | UseUseExplosion.cs:24:235:24:238 | this access |
| UseUseExplosion.cs:24:218:24:221 | [post] this access | UseUseExplosion.cs:24:3013:24:3018 | this access |
| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:24:235:24:238 | access to property Prop |
-| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:218:24:221 | this access | UseUseExplosion.cs:24:235:24:238 | this access |
| UseUseExplosion.cs:24:218:24:221 | this access | UseUseExplosion.cs:24:3013:24:3018 | this access |
| UseUseExplosion.cs:24:235:24:238 | [post] this access | UseUseExplosion.cs:24:252:24:255 | this access |
| UseUseExplosion.cs:24:235:24:238 | [post] this access | UseUseExplosion.cs:24:2998:24:3003 | this access |
| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:24:252:24:255 | access to property Prop |
-| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:235:24:238 | this access | UseUseExplosion.cs:24:252:24:255 | this access |
| UseUseExplosion.cs:24:235:24:238 | this access | UseUseExplosion.cs:24:2998:24:3003 | this access |
| UseUseExplosion.cs:24:252:24:255 | [post] this access | UseUseExplosion.cs:24:269:24:272 | this access |
| UseUseExplosion.cs:24:252:24:255 | [post] this access | UseUseExplosion.cs:24:2983:24:2988 | this access |
| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:24:269:24:272 | access to property Prop |
-| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:252:24:255 | this access | UseUseExplosion.cs:24:269:24:272 | this access |
| UseUseExplosion.cs:24:252:24:255 | this access | UseUseExplosion.cs:24:2983:24:2988 | this access |
| UseUseExplosion.cs:24:269:24:272 | [post] this access | UseUseExplosion.cs:24:286:24:289 | this access |
| UseUseExplosion.cs:24:269:24:272 | [post] this access | UseUseExplosion.cs:24:2968:24:2973 | this access |
| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:24:286:24:289 | access to property Prop |
-| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:269:24:272 | this access | UseUseExplosion.cs:24:286:24:289 | this access |
| UseUseExplosion.cs:24:269:24:272 | this access | UseUseExplosion.cs:24:2968:24:2973 | this access |
| UseUseExplosion.cs:24:286:24:289 | [post] this access | UseUseExplosion.cs:24:303:24:306 | this access |
| UseUseExplosion.cs:24:286:24:289 | [post] this access | UseUseExplosion.cs:24:2953:24:2958 | this access |
| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:24:303:24:306 | access to property Prop |
-| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:286:24:289 | this access | UseUseExplosion.cs:24:303:24:306 | this access |
| UseUseExplosion.cs:24:286:24:289 | this access | UseUseExplosion.cs:24:2953:24:2958 | this access |
| UseUseExplosion.cs:24:303:24:306 | [post] this access | UseUseExplosion.cs:24:320:24:323 | this access |
| UseUseExplosion.cs:24:303:24:306 | [post] this access | UseUseExplosion.cs:24:2938:24:2943 | this access |
| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:24:320:24:323 | access to property Prop |
-| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:303:24:306 | this access | UseUseExplosion.cs:24:320:24:323 | this access |
| UseUseExplosion.cs:24:303:24:306 | this access | UseUseExplosion.cs:24:2938:24:2943 | this access |
| UseUseExplosion.cs:24:320:24:323 | [post] this access | UseUseExplosion.cs:24:337:24:340 | this access |
| UseUseExplosion.cs:24:320:24:323 | [post] this access | UseUseExplosion.cs:24:2923:24:2928 | this access |
| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:24:337:24:340 | access to property Prop |
-| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:320:24:323 | this access | UseUseExplosion.cs:24:337:24:340 | this access |
| UseUseExplosion.cs:24:320:24:323 | this access | UseUseExplosion.cs:24:2923:24:2928 | this access |
| UseUseExplosion.cs:24:337:24:340 | [post] this access | UseUseExplosion.cs:24:354:24:357 | this access |
| UseUseExplosion.cs:24:337:24:340 | [post] this access | UseUseExplosion.cs:24:2908:24:2913 | this access |
| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:24:354:24:357 | access to property Prop |
-| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:337:24:340 | this access | UseUseExplosion.cs:24:354:24:357 | this access |
| UseUseExplosion.cs:24:337:24:340 | this access | UseUseExplosion.cs:24:2908:24:2913 | this access |
| UseUseExplosion.cs:24:354:24:357 | [post] this access | UseUseExplosion.cs:24:371:24:374 | this access |
| UseUseExplosion.cs:24:354:24:357 | [post] this access | UseUseExplosion.cs:24:2893:24:2898 | this access |
| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:24:371:24:374 | access to property Prop |
-| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:354:24:357 | this access | UseUseExplosion.cs:24:371:24:374 | this access |
| UseUseExplosion.cs:24:354:24:357 | this access | UseUseExplosion.cs:24:2893:24:2898 | this access |
| UseUseExplosion.cs:24:371:24:374 | [post] this access | UseUseExplosion.cs:24:388:24:391 | this access |
| UseUseExplosion.cs:24:371:24:374 | [post] this access | UseUseExplosion.cs:24:2878:24:2883 | this access |
| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:24:388:24:391 | access to property Prop |
-| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:371:24:374 | this access | UseUseExplosion.cs:24:388:24:391 | this access |
| UseUseExplosion.cs:24:371:24:374 | this access | UseUseExplosion.cs:24:2878:24:2883 | this access |
| UseUseExplosion.cs:24:388:24:391 | [post] this access | UseUseExplosion.cs:24:405:24:408 | this access |
| UseUseExplosion.cs:24:388:24:391 | [post] this access | UseUseExplosion.cs:24:2863:24:2868 | this access |
| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:24:405:24:408 | access to property Prop |
-| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:388:24:391 | this access | UseUseExplosion.cs:24:405:24:408 | this access |
| UseUseExplosion.cs:24:388:24:391 | this access | UseUseExplosion.cs:24:2863:24:2868 | this access |
| UseUseExplosion.cs:24:405:24:408 | [post] this access | UseUseExplosion.cs:24:422:24:425 | this access |
| UseUseExplosion.cs:24:405:24:408 | [post] this access | UseUseExplosion.cs:24:2848:24:2853 | this access |
| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:24:422:24:425 | access to property Prop |
-| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:405:24:408 | this access | UseUseExplosion.cs:24:422:24:425 | this access |
| UseUseExplosion.cs:24:405:24:408 | this access | UseUseExplosion.cs:24:2848:24:2853 | this access |
| UseUseExplosion.cs:24:422:24:425 | [post] this access | UseUseExplosion.cs:24:439:24:442 | this access |
| UseUseExplosion.cs:24:422:24:425 | [post] this access | UseUseExplosion.cs:24:2833:24:2838 | this access |
| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:24:439:24:442 | access to property Prop |
-| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:422:24:425 | this access | UseUseExplosion.cs:24:439:24:442 | this access |
| UseUseExplosion.cs:24:422:24:425 | this access | UseUseExplosion.cs:24:2833:24:2838 | this access |
| UseUseExplosion.cs:24:439:24:442 | [post] this access | UseUseExplosion.cs:24:456:24:459 | this access |
| UseUseExplosion.cs:24:439:24:442 | [post] this access | UseUseExplosion.cs:24:2818:24:2823 | this access |
| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:24:456:24:459 | access to property Prop |
-| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:439:24:442 | this access | UseUseExplosion.cs:24:456:24:459 | this access |
| UseUseExplosion.cs:24:439:24:442 | this access | UseUseExplosion.cs:24:2818:24:2823 | this access |
| UseUseExplosion.cs:24:456:24:459 | [post] this access | UseUseExplosion.cs:24:473:24:476 | this access |
| UseUseExplosion.cs:24:456:24:459 | [post] this access | UseUseExplosion.cs:24:2803:24:2808 | this access |
| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:24:473:24:476 | access to property Prop |
-| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:456:24:459 | this access | UseUseExplosion.cs:24:473:24:476 | this access |
| UseUseExplosion.cs:24:456:24:459 | this access | UseUseExplosion.cs:24:2803:24:2808 | this access |
| UseUseExplosion.cs:24:473:24:476 | [post] this access | UseUseExplosion.cs:24:490:24:493 | this access |
| UseUseExplosion.cs:24:473:24:476 | [post] this access | UseUseExplosion.cs:24:2788:24:2793 | this access |
| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:24:490:24:493 | access to property Prop |
-| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:473:24:476 | this access | UseUseExplosion.cs:24:490:24:493 | this access |
| UseUseExplosion.cs:24:473:24:476 | this access | UseUseExplosion.cs:24:2788:24:2793 | this access |
| UseUseExplosion.cs:24:490:24:493 | [post] this access | UseUseExplosion.cs:24:507:24:510 | this access |
| UseUseExplosion.cs:24:490:24:493 | [post] this access | UseUseExplosion.cs:24:2773:24:2778 | this access |
| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:24:507:24:510 | access to property Prop |
-| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:490:24:493 | this access | UseUseExplosion.cs:24:507:24:510 | this access |
| UseUseExplosion.cs:24:490:24:493 | this access | UseUseExplosion.cs:24:2773:24:2778 | this access |
| UseUseExplosion.cs:24:507:24:510 | [post] this access | UseUseExplosion.cs:24:524:24:527 | this access |
| UseUseExplosion.cs:24:507:24:510 | [post] this access | UseUseExplosion.cs:24:2758:24:2763 | this access |
| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:24:524:24:527 | access to property Prop |
-| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:507:24:510 | this access | UseUseExplosion.cs:24:524:24:527 | this access |
| UseUseExplosion.cs:24:507:24:510 | this access | UseUseExplosion.cs:24:2758:24:2763 | this access |
| UseUseExplosion.cs:24:524:24:527 | [post] this access | UseUseExplosion.cs:24:541:24:544 | this access |
| UseUseExplosion.cs:24:524:24:527 | [post] this access | UseUseExplosion.cs:24:2743:24:2748 | this access |
| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:24:541:24:544 | access to property Prop |
-| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:524:24:527 | this access | UseUseExplosion.cs:24:541:24:544 | this access |
| UseUseExplosion.cs:24:524:24:527 | this access | UseUseExplosion.cs:24:2743:24:2748 | this access |
| UseUseExplosion.cs:24:541:24:544 | [post] this access | UseUseExplosion.cs:24:558:24:561 | this access |
| UseUseExplosion.cs:24:541:24:544 | [post] this access | UseUseExplosion.cs:24:2728:24:2733 | this access |
| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:24:558:24:561 | access to property Prop |
-| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:541:24:544 | this access | UseUseExplosion.cs:24:558:24:561 | this access |
| UseUseExplosion.cs:24:541:24:544 | this access | UseUseExplosion.cs:24:2728:24:2733 | this access |
| UseUseExplosion.cs:24:558:24:561 | [post] this access | UseUseExplosion.cs:24:575:24:578 | this access |
| UseUseExplosion.cs:24:558:24:561 | [post] this access | UseUseExplosion.cs:24:2713:24:2718 | this access |
| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:24:575:24:578 | access to property Prop |
-| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:558:24:561 | this access | UseUseExplosion.cs:24:575:24:578 | this access |
| UseUseExplosion.cs:24:558:24:561 | this access | UseUseExplosion.cs:24:2713:24:2718 | this access |
| UseUseExplosion.cs:24:575:24:578 | [post] this access | UseUseExplosion.cs:24:592:24:595 | this access |
| UseUseExplosion.cs:24:575:24:578 | [post] this access | UseUseExplosion.cs:24:2698:24:2703 | this access |
| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:24:592:24:595 | access to property Prop |
-| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:575:24:578 | this access | UseUseExplosion.cs:24:592:24:595 | this access |
| UseUseExplosion.cs:24:575:24:578 | this access | UseUseExplosion.cs:24:2698:24:2703 | this access |
| UseUseExplosion.cs:24:592:24:595 | [post] this access | UseUseExplosion.cs:24:609:24:612 | this access |
| UseUseExplosion.cs:24:592:24:595 | [post] this access | UseUseExplosion.cs:24:2683:24:2688 | this access |
| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:24:609:24:612 | access to property Prop |
-| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:592:24:595 | this access | UseUseExplosion.cs:24:609:24:612 | this access |
| UseUseExplosion.cs:24:592:24:595 | this access | UseUseExplosion.cs:24:2683:24:2688 | this access |
| UseUseExplosion.cs:24:609:24:612 | [post] this access | UseUseExplosion.cs:24:626:24:629 | this access |
| UseUseExplosion.cs:24:609:24:612 | [post] this access | UseUseExplosion.cs:24:2668:24:2673 | this access |
| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:24:626:24:629 | access to property Prop |
-| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:609:24:612 | this access | UseUseExplosion.cs:24:626:24:629 | this access |
| UseUseExplosion.cs:24:609:24:612 | this access | UseUseExplosion.cs:24:2668:24:2673 | this access |
| UseUseExplosion.cs:24:626:24:629 | [post] this access | UseUseExplosion.cs:24:643:24:646 | this access |
| UseUseExplosion.cs:24:626:24:629 | [post] this access | UseUseExplosion.cs:24:2653:24:2658 | this access |
| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:24:643:24:646 | access to property Prop |
-| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:626:24:629 | this access | UseUseExplosion.cs:24:643:24:646 | this access |
| UseUseExplosion.cs:24:626:24:629 | this access | UseUseExplosion.cs:24:2653:24:2658 | this access |
| UseUseExplosion.cs:24:643:24:646 | [post] this access | UseUseExplosion.cs:24:660:24:663 | this access |
| UseUseExplosion.cs:24:643:24:646 | [post] this access | UseUseExplosion.cs:24:2638:24:2643 | this access |
| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:24:660:24:663 | access to property Prop |
-| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:643:24:646 | this access | UseUseExplosion.cs:24:660:24:663 | this access |
| UseUseExplosion.cs:24:643:24:646 | this access | UseUseExplosion.cs:24:2638:24:2643 | this access |
| UseUseExplosion.cs:24:660:24:663 | [post] this access | UseUseExplosion.cs:24:677:24:680 | this access |
| UseUseExplosion.cs:24:660:24:663 | [post] this access | UseUseExplosion.cs:24:2623:24:2628 | this access |
| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:24:677:24:680 | access to property Prop |
-| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:660:24:663 | this access | UseUseExplosion.cs:24:677:24:680 | this access |
| UseUseExplosion.cs:24:660:24:663 | this access | UseUseExplosion.cs:24:2623:24:2628 | this access |
| UseUseExplosion.cs:24:677:24:680 | [post] this access | UseUseExplosion.cs:24:694:24:697 | this access |
| UseUseExplosion.cs:24:677:24:680 | [post] this access | UseUseExplosion.cs:24:2608:24:2613 | this access |
| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:24:694:24:697 | access to property Prop |
-| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:677:24:680 | this access | UseUseExplosion.cs:24:694:24:697 | this access |
| UseUseExplosion.cs:24:677:24:680 | this access | UseUseExplosion.cs:24:2608:24:2613 | this access |
| UseUseExplosion.cs:24:694:24:697 | [post] this access | UseUseExplosion.cs:24:711:24:714 | this access |
| UseUseExplosion.cs:24:694:24:697 | [post] this access | UseUseExplosion.cs:24:2593:24:2598 | this access |
| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:24:711:24:714 | access to property Prop |
-| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:694:24:697 | this access | UseUseExplosion.cs:24:711:24:714 | this access |
| UseUseExplosion.cs:24:694:24:697 | this access | UseUseExplosion.cs:24:2593:24:2598 | this access |
| UseUseExplosion.cs:24:711:24:714 | [post] this access | UseUseExplosion.cs:24:728:24:731 | this access |
| UseUseExplosion.cs:24:711:24:714 | [post] this access | UseUseExplosion.cs:24:2578:24:2583 | this access |
| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:24:728:24:731 | access to property Prop |
-| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:711:24:714 | this access | UseUseExplosion.cs:24:728:24:731 | this access |
| UseUseExplosion.cs:24:711:24:714 | this access | UseUseExplosion.cs:24:2578:24:2583 | this access |
| UseUseExplosion.cs:24:728:24:731 | [post] this access | UseUseExplosion.cs:24:745:24:748 | this access |
| UseUseExplosion.cs:24:728:24:731 | [post] this access | UseUseExplosion.cs:24:2563:24:2568 | this access |
| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:24:745:24:748 | access to property Prop |
-| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:728:24:731 | this access | UseUseExplosion.cs:24:745:24:748 | this access |
| UseUseExplosion.cs:24:728:24:731 | this access | UseUseExplosion.cs:24:2563:24:2568 | this access |
| UseUseExplosion.cs:24:745:24:748 | [post] this access | UseUseExplosion.cs:24:762:24:765 | this access |
| UseUseExplosion.cs:24:745:24:748 | [post] this access | UseUseExplosion.cs:24:2548:24:2553 | this access |
| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:24:762:24:765 | access to property Prop |
-| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:745:24:748 | this access | UseUseExplosion.cs:24:762:24:765 | this access |
| UseUseExplosion.cs:24:745:24:748 | this access | UseUseExplosion.cs:24:2548:24:2553 | this access |
| UseUseExplosion.cs:24:762:24:765 | [post] this access | UseUseExplosion.cs:24:779:24:782 | this access |
| UseUseExplosion.cs:24:762:24:765 | [post] this access | UseUseExplosion.cs:24:2533:24:2538 | this access |
| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:24:779:24:782 | access to property Prop |
-| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:762:24:765 | this access | UseUseExplosion.cs:24:779:24:782 | this access |
| UseUseExplosion.cs:24:762:24:765 | this access | UseUseExplosion.cs:24:2533:24:2538 | this access |
| UseUseExplosion.cs:24:779:24:782 | [post] this access | UseUseExplosion.cs:24:796:24:799 | this access |
| UseUseExplosion.cs:24:779:24:782 | [post] this access | UseUseExplosion.cs:24:2518:24:2523 | this access |
| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:24:796:24:799 | access to property Prop |
-| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:779:24:782 | this access | UseUseExplosion.cs:24:796:24:799 | this access |
| UseUseExplosion.cs:24:779:24:782 | this access | UseUseExplosion.cs:24:2518:24:2523 | this access |
| UseUseExplosion.cs:24:796:24:799 | [post] this access | UseUseExplosion.cs:24:813:24:816 | this access |
| UseUseExplosion.cs:24:796:24:799 | [post] this access | UseUseExplosion.cs:24:2503:24:2508 | this access |
| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:24:813:24:816 | access to property Prop |
-| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:796:24:799 | this access | UseUseExplosion.cs:24:813:24:816 | this access |
| UseUseExplosion.cs:24:796:24:799 | this access | UseUseExplosion.cs:24:2503:24:2508 | this access |
| UseUseExplosion.cs:24:813:24:816 | [post] this access | UseUseExplosion.cs:24:830:24:833 | this access |
| UseUseExplosion.cs:24:813:24:816 | [post] this access | UseUseExplosion.cs:24:2488:24:2493 | this access |
| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:24:830:24:833 | access to property Prop |
-| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:813:24:816 | this access | UseUseExplosion.cs:24:830:24:833 | this access |
| UseUseExplosion.cs:24:813:24:816 | this access | UseUseExplosion.cs:24:2488:24:2493 | this access |
| UseUseExplosion.cs:24:830:24:833 | [post] this access | UseUseExplosion.cs:24:847:24:850 | this access |
| UseUseExplosion.cs:24:830:24:833 | [post] this access | UseUseExplosion.cs:24:2473:24:2478 | this access |
| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:24:847:24:850 | access to property Prop |
-| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:830:24:833 | this access | UseUseExplosion.cs:24:847:24:850 | this access |
| UseUseExplosion.cs:24:830:24:833 | this access | UseUseExplosion.cs:24:2473:24:2478 | this access |
| UseUseExplosion.cs:24:847:24:850 | [post] this access | UseUseExplosion.cs:24:864:24:867 | this access |
| UseUseExplosion.cs:24:847:24:850 | [post] this access | UseUseExplosion.cs:24:2458:24:2463 | this access |
| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:24:864:24:867 | access to property Prop |
-| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:847:24:850 | this access | UseUseExplosion.cs:24:864:24:867 | this access |
| UseUseExplosion.cs:24:847:24:850 | this access | UseUseExplosion.cs:24:2458:24:2463 | this access |
| UseUseExplosion.cs:24:864:24:867 | [post] this access | UseUseExplosion.cs:24:881:24:884 | this access |
| UseUseExplosion.cs:24:864:24:867 | [post] this access | UseUseExplosion.cs:24:2443:24:2448 | this access |
| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:24:881:24:884 | access to property Prop |
-| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:864:24:867 | this access | UseUseExplosion.cs:24:881:24:884 | this access |
| UseUseExplosion.cs:24:864:24:867 | this access | UseUseExplosion.cs:24:2443:24:2448 | this access |
| UseUseExplosion.cs:24:881:24:884 | [post] this access | UseUseExplosion.cs:24:898:24:901 | this access |
| UseUseExplosion.cs:24:881:24:884 | [post] this access | UseUseExplosion.cs:24:2428:24:2433 | this access |
| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:24:898:24:901 | access to property Prop |
-| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:881:24:884 | this access | UseUseExplosion.cs:24:898:24:901 | this access |
| UseUseExplosion.cs:24:881:24:884 | this access | UseUseExplosion.cs:24:2428:24:2433 | this access |
| UseUseExplosion.cs:24:898:24:901 | [post] this access | UseUseExplosion.cs:24:915:24:918 | this access |
| UseUseExplosion.cs:24:898:24:901 | [post] this access | UseUseExplosion.cs:24:2413:24:2418 | this access |
| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:24:915:24:918 | access to property Prop |
-| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:898:24:901 | this access | UseUseExplosion.cs:24:915:24:918 | this access |
| UseUseExplosion.cs:24:898:24:901 | this access | UseUseExplosion.cs:24:2413:24:2418 | this access |
| UseUseExplosion.cs:24:915:24:918 | [post] this access | UseUseExplosion.cs:24:932:24:935 | this access |
| UseUseExplosion.cs:24:915:24:918 | [post] this access | UseUseExplosion.cs:24:2398:24:2403 | this access |
| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:24:932:24:935 | access to property Prop |
-| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:915:24:918 | this access | UseUseExplosion.cs:24:932:24:935 | this access |
| UseUseExplosion.cs:24:915:24:918 | this access | UseUseExplosion.cs:24:2398:24:2403 | this access |
| UseUseExplosion.cs:24:932:24:935 | [post] this access | UseUseExplosion.cs:24:949:24:952 | this access |
| UseUseExplosion.cs:24:932:24:935 | [post] this access | UseUseExplosion.cs:24:2383:24:2388 | this access |
| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:24:949:24:952 | access to property Prop |
-| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:932:24:935 | this access | UseUseExplosion.cs:24:949:24:952 | this access |
| UseUseExplosion.cs:24:932:24:935 | this access | UseUseExplosion.cs:24:2383:24:2388 | this access |
| UseUseExplosion.cs:24:949:24:952 | [post] this access | UseUseExplosion.cs:24:966:24:969 | this access |
| UseUseExplosion.cs:24:949:24:952 | [post] this access | UseUseExplosion.cs:24:2368:24:2373 | this access |
| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:24:966:24:969 | access to property Prop |
-| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:949:24:952 | this access | UseUseExplosion.cs:24:966:24:969 | this access |
| UseUseExplosion.cs:24:949:24:952 | this access | UseUseExplosion.cs:24:2368:24:2373 | this access |
| UseUseExplosion.cs:24:966:24:969 | [post] this access | UseUseExplosion.cs:24:983:24:986 | this access |
| UseUseExplosion.cs:24:966:24:969 | [post] this access | UseUseExplosion.cs:24:2353:24:2358 | this access |
| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:24:983:24:986 | access to property Prop |
-| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:966:24:969 | this access | UseUseExplosion.cs:24:983:24:986 | this access |
| UseUseExplosion.cs:24:966:24:969 | this access | UseUseExplosion.cs:24:2353:24:2358 | this access |
| UseUseExplosion.cs:24:983:24:986 | [post] this access | UseUseExplosion.cs:24:1000:24:1003 | this access |
| UseUseExplosion.cs:24:983:24:986 | [post] this access | UseUseExplosion.cs:24:2338:24:2343 | this access |
| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:24:1000:24:1003 | access to property Prop |
-| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:983:24:986 | this access | UseUseExplosion.cs:24:1000:24:1003 | this access |
| UseUseExplosion.cs:24:983:24:986 | this access | UseUseExplosion.cs:24:2338:24:2343 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | [post] this access | UseUseExplosion.cs:24:1017:24:1020 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | [post] this access | UseUseExplosion.cs:24:2323:24:2328 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:24:1017:24:1020 | access to property Prop |
-| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1000:24:1003 | this access | UseUseExplosion.cs:24:1017:24:1020 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | this access | UseUseExplosion.cs:24:2323:24:2328 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | [post] this access | UseUseExplosion.cs:24:1034:24:1037 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | [post] this access | UseUseExplosion.cs:24:2308:24:2313 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:24:1034:24:1037 | access to property Prop |
-| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1017:24:1020 | this access | UseUseExplosion.cs:24:1034:24:1037 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | this access | UseUseExplosion.cs:24:2308:24:2313 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | [post] this access | UseUseExplosion.cs:24:1051:24:1054 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | [post] this access | UseUseExplosion.cs:24:2293:24:2298 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:24:1051:24:1054 | access to property Prop |
-| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1034:24:1037 | this access | UseUseExplosion.cs:24:1051:24:1054 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | this access | UseUseExplosion.cs:24:2293:24:2298 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | [post] this access | UseUseExplosion.cs:24:1068:24:1071 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | [post] this access | UseUseExplosion.cs:24:2278:24:2283 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:24:1068:24:1071 | access to property Prop |
-| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1051:24:1054 | this access | UseUseExplosion.cs:24:1068:24:1071 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | this access | UseUseExplosion.cs:24:2278:24:2283 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | [post] this access | UseUseExplosion.cs:24:1085:24:1088 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | [post] this access | UseUseExplosion.cs:24:2263:24:2268 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:24:1085:24:1088 | access to property Prop |
-| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1068:24:1071 | this access | UseUseExplosion.cs:24:1085:24:1088 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | this access | UseUseExplosion.cs:24:2263:24:2268 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | [post] this access | UseUseExplosion.cs:24:1102:24:1105 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | [post] this access | UseUseExplosion.cs:24:2248:24:2253 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:24:1102:24:1105 | access to property Prop |
-| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1085:24:1088 | this access | UseUseExplosion.cs:24:1102:24:1105 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | this access | UseUseExplosion.cs:24:2248:24:2253 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | [post] this access | UseUseExplosion.cs:24:1119:24:1122 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | [post] this access | UseUseExplosion.cs:24:2233:24:2238 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:24:1119:24:1122 | access to property Prop |
-| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1102:24:1105 | this access | UseUseExplosion.cs:24:1119:24:1122 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | this access | UseUseExplosion.cs:24:2233:24:2238 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | [post] this access | UseUseExplosion.cs:24:1136:24:1139 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | [post] this access | UseUseExplosion.cs:24:2218:24:2223 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:24:1136:24:1139 | access to property Prop |
-| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1119:24:1122 | this access | UseUseExplosion.cs:24:1136:24:1139 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | this access | UseUseExplosion.cs:24:2218:24:2223 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | [post] this access | UseUseExplosion.cs:24:1153:24:1156 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | [post] this access | UseUseExplosion.cs:24:2203:24:2208 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:24:1153:24:1156 | access to property Prop |
-| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1136:24:1139 | this access | UseUseExplosion.cs:24:1153:24:1156 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | this access | UseUseExplosion.cs:24:2203:24:2208 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | [post] this access | UseUseExplosion.cs:24:1170:24:1173 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | [post] this access | UseUseExplosion.cs:24:2188:24:2193 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:24:1170:24:1173 | access to property Prop |
-| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1153:24:1156 | this access | UseUseExplosion.cs:24:1170:24:1173 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | this access | UseUseExplosion.cs:24:2188:24:2193 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | [post] this access | UseUseExplosion.cs:24:1187:24:1190 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | [post] this access | UseUseExplosion.cs:24:2173:24:2178 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:24:1187:24:1190 | access to property Prop |
-| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1170:24:1173 | this access | UseUseExplosion.cs:24:1187:24:1190 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | this access | UseUseExplosion.cs:24:2173:24:2178 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | [post] this access | UseUseExplosion.cs:24:1204:24:1207 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | [post] this access | UseUseExplosion.cs:24:2158:24:2163 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:24:1204:24:1207 | access to property Prop |
-| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1187:24:1190 | this access | UseUseExplosion.cs:24:1204:24:1207 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | this access | UseUseExplosion.cs:24:2158:24:2163 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | [post] this access | UseUseExplosion.cs:24:1221:24:1224 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | [post] this access | UseUseExplosion.cs:24:2143:24:2148 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:24:1221:24:1224 | access to property Prop |
-| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1204:24:1207 | this access | UseUseExplosion.cs:24:1221:24:1224 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | this access | UseUseExplosion.cs:24:2143:24:2148 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | [post] this access | UseUseExplosion.cs:24:1238:24:1241 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | [post] this access | UseUseExplosion.cs:24:2128:24:2133 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:24:1238:24:1241 | access to property Prop |
-| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1221:24:1224 | this access | UseUseExplosion.cs:24:1238:24:1241 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | this access | UseUseExplosion.cs:24:2128:24:2133 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | [post] this access | UseUseExplosion.cs:24:1255:24:1258 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | [post] this access | UseUseExplosion.cs:24:2113:24:2118 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:24:1255:24:1258 | access to property Prop |
-| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1238:24:1241 | this access | UseUseExplosion.cs:24:1255:24:1258 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | this access | UseUseExplosion.cs:24:2113:24:2118 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | [post] this access | UseUseExplosion.cs:24:1272:24:1275 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | [post] this access | UseUseExplosion.cs:24:2098:24:2103 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:24:1272:24:1275 | access to property Prop |
-| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1255:24:1258 | this access | UseUseExplosion.cs:24:1272:24:1275 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | this access | UseUseExplosion.cs:24:2098:24:2103 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | [post] this access | UseUseExplosion.cs:24:1289:24:1292 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | [post] this access | UseUseExplosion.cs:24:2083:24:2088 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:24:1289:24:1292 | access to property Prop |
-| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1272:24:1275 | this access | UseUseExplosion.cs:24:1289:24:1292 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | this access | UseUseExplosion.cs:24:2083:24:2088 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | [post] this access | UseUseExplosion.cs:24:1306:24:1309 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | [post] this access | UseUseExplosion.cs:24:2068:24:2073 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:24:1306:24:1309 | access to property Prop |
-| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1289:24:1292 | this access | UseUseExplosion.cs:24:1306:24:1309 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | this access | UseUseExplosion.cs:24:2068:24:2073 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | [post] this access | UseUseExplosion.cs:24:1323:24:1326 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | [post] this access | UseUseExplosion.cs:24:2053:24:2058 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:24:1323:24:1326 | access to property Prop |
-| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1306:24:1309 | this access | UseUseExplosion.cs:24:1323:24:1326 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | this access | UseUseExplosion.cs:24:2053:24:2058 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | [post] this access | UseUseExplosion.cs:24:1340:24:1343 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | [post] this access | UseUseExplosion.cs:24:2038:24:2043 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:24:1340:24:1343 | access to property Prop |
-| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1323:24:1326 | this access | UseUseExplosion.cs:24:1340:24:1343 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | this access | UseUseExplosion.cs:24:2038:24:2043 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | [post] this access | UseUseExplosion.cs:24:1357:24:1360 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | [post] this access | UseUseExplosion.cs:24:2023:24:2028 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:24:1357:24:1360 | access to property Prop |
-| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1340:24:1343 | this access | UseUseExplosion.cs:24:1357:24:1360 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | this access | UseUseExplosion.cs:24:2023:24:2028 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | [post] this access | UseUseExplosion.cs:24:1374:24:1377 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | [post] this access | UseUseExplosion.cs:24:2008:24:2013 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:24:1374:24:1377 | access to property Prop |
-| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1357:24:1360 | this access | UseUseExplosion.cs:24:1374:24:1377 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | this access | UseUseExplosion.cs:24:2008:24:2013 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | [post] this access | UseUseExplosion.cs:24:1391:24:1394 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | [post] this access | UseUseExplosion.cs:24:1993:24:1998 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:24:1391:24:1394 | access to property Prop |
-| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1374:24:1377 | this access | UseUseExplosion.cs:24:1391:24:1394 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | this access | UseUseExplosion.cs:24:1993:24:1998 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | [post] this access | UseUseExplosion.cs:24:1408:24:1411 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | [post] this access | UseUseExplosion.cs:24:1978:24:1983 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:24:1408:24:1411 | access to property Prop |
-| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1391:24:1394 | this access | UseUseExplosion.cs:24:1408:24:1411 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | this access | UseUseExplosion.cs:24:1978:24:1983 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | [post] this access | UseUseExplosion.cs:24:1425:24:1428 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | [post] this access | UseUseExplosion.cs:24:1963:24:1968 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:24:1425:24:1428 | access to property Prop |
-| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1408:24:1411 | this access | UseUseExplosion.cs:24:1425:24:1428 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | this access | UseUseExplosion.cs:24:1963:24:1968 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | [post] this access | UseUseExplosion.cs:24:1442:24:1445 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | [post] this access | UseUseExplosion.cs:24:1948:24:1953 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:24:1442:24:1445 | access to property Prop |
-| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1425:24:1428 | this access | UseUseExplosion.cs:24:1442:24:1445 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | this access | UseUseExplosion.cs:24:1948:24:1953 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | [post] this access | UseUseExplosion.cs:24:1459:24:1462 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | [post] this access | UseUseExplosion.cs:24:1933:24:1938 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:24:1459:24:1462 | access to property Prop |
-| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1442:24:1445 | this access | UseUseExplosion.cs:24:1459:24:1462 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | this access | UseUseExplosion.cs:24:1933:24:1938 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | [post] this access | UseUseExplosion.cs:24:1476:24:1479 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | [post] this access | UseUseExplosion.cs:24:1918:24:1923 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:24:1476:24:1479 | access to property Prop |
-| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1459:24:1462 | this access | UseUseExplosion.cs:24:1476:24:1479 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | this access | UseUseExplosion.cs:24:1918:24:1923 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | [post] this access | UseUseExplosion.cs:24:1493:24:1496 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | [post] this access | UseUseExplosion.cs:24:1903:24:1908 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:24:1493:24:1496 | access to property Prop |
-| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1476:24:1479 | this access | UseUseExplosion.cs:24:1493:24:1496 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | this access | UseUseExplosion.cs:24:1903:24:1908 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | [post] this access | UseUseExplosion.cs:24:1510:24:1513 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | [post] this access | UseUseExplosion.cs:24:1888:24:1893 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:24:1510:24:1513 | access to property Prop |
-| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1493:24:1496 | this access | UseUseExplosion.cs:24:1510:24:1513 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | this access | UseUseExplosion.cs:24:1888:24:1893 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | [post] this access | UseUseExplosion.cs:24:1527:24:1530 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | [post] this access | UseUseExplosion.cs:24:1873:24:1878 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:24:1527:24:1530 | access to property Prop |
-| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1510:24:1513 | this access | UseUseExplosion.cs:24:1527:24:1530 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | this access | UseUseExplosion.cs:24:1873:24:1878 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | [post] this access | UseUseExplosion.cs:24:1544:24:1547 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | [post] this access | UseUseExplosion.cs:24:1858:24:1863 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:24:1544:24:1547 | access to property Prop |
-| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1527:24:1530 | this access | UseUseExplosion.cs:24:1544:24:1547 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | this access | UseUseExplosion.cs:24:1858:24:1863 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | [post] this access | UseUseExplosion.cs:24:1561:24:1564 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | [post] this access | UseUseExplosion.cs:24:1843:24:1848 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:24:1561:24:1564 | access to property Prop |
-| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1544:24:1547 | this access | UseUseExplosion.cs:24:1561:24:1564 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | this access | UseUseExplosion.cs:24:1843:24:1848 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | [post] this access | UseUseExplosion.cs:24:1577:24:1580 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | [post] this access | UseUseExplosion.cs:24:1828:24:1833 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:24:1577:24:1580 | access to property Prop |
-| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1561:24:1564 | this access | UseUseExplosion.cs:24:1577:24:1580 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | this access | UseUseExplosion.cs:24:1828:24:1833 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | [post] this access | UseUseExplosion.cs:24:1593:24:1596 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | [post] this access | UseUseExplosion.cs:24:1813:24:1818 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:24:1593:24:1596 | access to property Prop |
-| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1577:24:1580 | this access | UseUseExplosion.cs:24:1593:24:1596 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | this access | UseUseExplosion.cs:24:1813:24:1818 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | [post] this access | UseUseExplosion.cs:24:1609:24:1612 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | [post] this access | UseUseExplosion.cs:24:1798:24:1803 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:24:1609:24:1612 | access to property Prop |
-| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1593:24:1596 | this access | UseUseExplosion.cs:24:1609:24:1612 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | this access | UseUseExplosion.cs:24:1798:24:1803 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | [post] this access | UseUseExplosion.cs:24:1625:24:1628 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | [post] this access | UseUseExplosion.cs:24:1783:24:1788 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:24:1625:24:1628 | access to property Prop |
-| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1609:24:1612 | this access | UseUseExplosion.cs:24:1625:24:1628 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | this access | UseUseExplosion.cs:24:1783:24:1788 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | [post] this access | UseUseExplosion.cs:24:1641:24:1644 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | [post] this access | UseUseExplosion.cs:24:1768:24:1773 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:24:1641:24:1644 | access to property Prop |
-| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1625:24:1628 | this access | UseUseExplosion.cs:24:1641:24:1644 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | this access | UseUseExplosion.cs:24:1768:24:1773 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | [post] this access | UseUseExplosion.cs:24:1657:24:1660 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | [post] this access | UseUseExplosion.cs:24:1753:24:1758 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:24:1657:24:1660 | access to property Prop |
-| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1641:24:1644 | this access | UseUseExplosion.cs:24:1657:24:1660 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | this access | UseUseExplosion.cs:24:1753:24:1758 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | [post] this access | UseUseExplosion.cs:24:1673:24:1676 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | [post] this access | UseUseExplosion.cs:24:1738:24:1743 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:24:1673:24:1676 | access to property Prop |
-| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1657:24:1660 | this access | UseUseExplosion.cs:24:1673:24:1676 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | this access | UseUseExplosion.cs:24:1738:24:1743 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | [post] this access | UseUseExplosion.cs:24:1689:24:1692 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | [post] this access | UseUseExplosion.cs:24:1723:24:1728 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:24:1689:24:1692 | access to property Prop |
-| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1673:24:1676 | this access | UseUseExplosion.cs:24:1689:24:1692 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | this access | UseUseExplosion.cs:24:1723:24:1728 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | [post] this access | UseUseExplosion.cs:24:1708:24:1713 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1689:24:1692 | this access | UseUseExplosion.cs:24:1708:24:1713 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
+| UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1708:24:1713 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1708:24:1713 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1712:24:1712 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1712:24:1712 | access to local variable x | UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1723:24:1728 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1723:24:1728 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1727:24:1727 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1727:24:1727 | access to local variable x | UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1738:24:1743 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1738:24:1743 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1742:24:1742 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1742:24:1742 | access to local variable x | UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1753:24:1758 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1753:24:1758 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1757:24:1757 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1757:24:1757 | access to local variable x | UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1768:24:1773 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1768:24:1773 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1772:24:1772 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1772:24:1772 | access to local variable x | UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1783:24:1788 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1783:24:1788 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1787:24:1787 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1787:24:1787 | access to local variable x | UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1798:24:1803 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1798:24:1803 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1802:24:1802 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1802:24:1802 | access to local variable x | UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1813:24:1818 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1813:24:1818 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1817:24:1817 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1817:24:1817 | access to local variable x | UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1828:24:1833 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1828:24:1833 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1832:24:1832 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1832:24:1832 | access to local variable x | UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1843:24:1848 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1843:24:1848 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1847:24:1847 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1847:24:1847 | access to local variable x | UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1858:24:1863 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1858:24:1863 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1862:24:1862 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1862:24:1862 | access to local variable x | UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1873:24:1878 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1873:24:1878 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1877:24:1877 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1877:24:1877 | access to local variable x | UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1888:24:1893 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1888:24:1893 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1892:24:1892 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1892:24:1892 | access to local variable x | UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1903:24:1908 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1903:24:1908 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1907:24:1907 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1907:24:1907 | access to local variable x | UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1918:24:1923 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1918:24:1923 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1922:24:1922 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1922:24:1922 | access to local variable x | UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1933:24:1938 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1933:24:1938 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1937:24:1937 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1937:24:1937 | access to local variable x | UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1948:24:1953 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1948:24:1953 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1952:24:1952 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1952:24:1952 | access to local variable x | UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1963:24:1968 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1963:24:1968 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1967:24:1967 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1967:24:1967 | access to local variable x | UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1978:24:1983 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1978:24:1983 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1982:24:1982 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1982:24:1982 | access to local variable x | UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1993:24:1998 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1993:24:1998 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1997:24:1997 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1997:24:1997 | access to local variable x | UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2008:24:2013 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2008:24:2013 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2012:24:2012 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2012:24:2012 | access to local variable x | UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2023:24:2028 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2023:24:2028 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2027:24:2027 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2027:24:2027 | access to local variable x | UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2038:24:2043 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2038:24:2043 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2042:24:2042 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2042:24:2042 | access to local variable x | UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2053:24:2058 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2053:24:2058 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2057:24:2057 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2057:24:2057 | access to local variable x | UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2068:24:2073 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2068:24:2073 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2072:24:2072 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2072:24:2072 | access to local variable x | UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2083:24:2088 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2083:24:2088 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2087:24:2087 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2087:24:2087 | access to local variable x | UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2098:24:2103 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2098:24:2103 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2102:24:2102 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2102:24:2102 | access to local variable x | UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2113:24:2118 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2113:24:2118 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2117:24:2117 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2117:24:2117 | access to local variable x | UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2128:24:2133 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2128:24:2133 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2132:24:2132 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2132:24:2132 | access to local variable x | UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2143:24:2148 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2143:24:2148 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2147:24:2147 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2147:24:2147 | access to local variable x | UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2158:24:2163 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2158:24:2163 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2162:24:2162 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2162:24:2162 | access to local variable x | UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2173:24:2178 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2173:24:2178 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2177:24:2177 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2177:24:2177 | access to local variable x | UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2188:24:2193 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2188:24:2193 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2192:24:2192 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2192:24:2192 | access to local variable x | UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2203:24:2208 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2203:24:2208 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2207:24:2207 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2207:24:2207 | access to local variable x | UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2218:24:2223 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2218:24:2223 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2222:24:2222 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2222:24:2222 | access to local variable x | UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2233:24:2238 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2233:24:2238 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2237:24:2237 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2237:24:2237 | access to local variable x | UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2248:24:2253 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2248:24:2253 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2252:24:2252 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2252:24:2252 | access to local variable x | UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2263:24:2268 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2263:24:2268 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2267:24:2267 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2267:24:2267 | access to local variable x | UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2278:24:2283 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2278:24:2283 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2282:24:2282 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2282:24:2282 | access to local variable x | UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2293:24:2298 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2293:24:2298 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2297:24:2297 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2297:24:2297 | access to local variable x | UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2308:24:2313 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2308:24:2313 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2312:24:2312 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2312:24:2312 | access to local variable x | UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2323:24:2328 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2323:24:2328 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2327:24:2327 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2327:24:2327 | access to local variable x | UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2338:24:2343 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2338:24:2343 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2342:24:2342 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2342:24:2342 | access to local variable x | UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2353:24:2358 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2353:24:2358 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2357:24:2357 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2357:24:2357 | access to local variable x | UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2368:24:2373 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2368:24:2373 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2372:24:2372 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2372:24:2372 | access to local variable x | UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2383:24:2388 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2383:24:2388 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2387:24:2387 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2387:24:2387 | access to local variable x | UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2398:24:2403 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2398:24:2403 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2402:24:2402 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2402:24:2402 | access to local variable x | UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2413:24:2418 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2413:24:2418 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2417:24:2417 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2417:24:2417 | access to local variable x | UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2428:24:2433 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2428:24:2433 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2432:24:2432 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2432:24:2432 | access to local variable x | UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2443:24:2448 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2443:24:2448 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2447:24:2447 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2447:24:2447 | access to local variable x | UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2458:24:2463 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2458:24:2463 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2462:24:2462 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2462:24:2462 | access to local variable x | UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2473:24:2478 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2473:24:2478 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2477:24:2477 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2477:24:2477 | access to local variable x | UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2488:24:2493 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2488:24:2493 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2492:24:2492 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2492:24:2492 | access to local variable x | UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2503:24:2508 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2503:24:2508 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2507:24:2507 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2507:24:2507 | access to local variable x | UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2518:24:2523 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2518:24:2523 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2522:24:2522 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2522:24:2522 | access to local variable x | UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2533:24:2538 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2533:24:2538 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2537:24:2537 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2537:24:2537 | access to local variable x | UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2548:24:2553 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2548:24:2553 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2552:24:2552 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2552:24:2552 | access to local variable x | UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2563:24:2568 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2563:24:2568 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2567:24:2567 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2567:24:2567 | access to local variable x | UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2578:24:2583 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2578:24:2583 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2582:24:2582 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2582:24:2582 | access to local variable x | UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2593:24:2598 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2593:24:2598 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2597:24:2597 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2597:24:2597 | access to local variable x | UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2608:24:2613 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2608:24:2613 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2612:24:2612 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2612:24:2612 | access to local variable x | UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2623:24:2628 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2623:24:2628 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2627:24:2627 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2627:24:2627 | access to local variable x | UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2638:24:2643 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2638:24:2643 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2642:24:2642 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2642:24:2642 | access to local variable x | UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2653:24:2658 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2653:24:2658 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2657:24:2657 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2657:24:2657 | access to local variable x | UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2668:24:2673 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2668:24:2673 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2672:24:2672 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2672:24:2672 | access to local variable x | UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2683:24:2688 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2683:24:2688 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2687:24:2687 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2687:24:2687 | access to local variable x | UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2698:24:2703 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2698:24:2703 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2702:24:2702 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2702:24:2702 | access to local variable x | UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2713:24:2718 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2713:24:2718 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2717:24:2717 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2717:24:2717 | access to local variable x | UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2728:24:2733 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2728:24:2733 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2732:24:2732 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2732:24:2732 | access to local variable x | UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2743:24:2748 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2743:24:2748 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2747:24:2747 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2747:24:2747 | access to local variable x | UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2758:24:2763 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2758:24:2763 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2762:24:2762 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2762:24:2762 | access to local variable x | UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2773:24:2778 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2773:24:2778 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2777:24:2777 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2777:24:2777 | access to local variable x | UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2788:24:2793 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2788:24:2793 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2792:24:2792 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2792:24:2792 | access to local variable x | UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2803:24:2808 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2803:24:2808 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2807:24:2807 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2807:24:2807 | access to local variable x | UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2818:24:2823 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2818:24:2823 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2822:24:2822 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2822:24:2822 | access to local variable x | UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2833:24:2838 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2833:24:2838 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2837:24:2837 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2837:24:2837 | access to local variable x | UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2848:24:2853 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2848:24:2853 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2852:24:2852 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2852:24:2852 | access to local variable x | UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2863:24:2868 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2863:24:2868 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2867:24:2867 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2867:24:2867 | access to local variable x | UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2878:24:2883 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2878:24:2883 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2882:24:2882 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2882:24:2882 | access to local variable x | UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2893:24:2898 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2893:24:2898 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2897:24:2897 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2897:24:2897 | access to local variable x | UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2908:24:2913 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2908:24:2913 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2912:24:2912 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2912:24:2912 | access to local variable x | UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2923:24:2928 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2923:24:2928 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2927:24:2927 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2927:24:2927 | access to local variable x | UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2938:24:2943 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2938:24:2943 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2942:24:2942 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2942:24:2942 | access to local variable x | UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2953:24:2958 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2953:24:2958 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2957:24:2957 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2957:24:2957 | access to local variable x | UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2968:24:2973 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2968:24:2973 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2972:24:2972 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2972:24:2972 | access to local variable x | UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2983:24:2988 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2983:24:2988 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2987:24:2987 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2987:24:2987 | access to local variable x | UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2998:24:3003 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2998:24:3003 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3002:24:3002 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3002:24:3002 | access to local variable x | UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3013:24:3018 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3013:24:3018 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3017:24:3017 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3017:24:3017 | access to local variable x | UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3028:24:3033 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3028:24:3033 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3032:24:3032 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3032:24:3032 | access to local variable x | UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3043:24:3048 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3043:24:3048 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3047:24:3047 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3047:24:3047 | access to local variable x | UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3058:24:3063 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3058:24:3063 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3062:24:3062 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3062:24:3062 | access to local variable x | UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3073:24:3078 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3073:24:3078 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3077:24:3077 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3077:24:3077 | access to local variable x | UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3088:24:3093 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3088:24:3093 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3092:24:3092 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3092:24:3092 | access to local variable x | UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3103:24:3108 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3103:24:3108 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3107:24:3107 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3107:24:3107 | access to local variable x | UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3118:24:3123 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3118:24:3123 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3122:24:3122 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3122:24:3122 | access to local variable x | UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3133:24:3138 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3133:24:3138 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3137:24:3137 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3137:24:3137 | access to local variable x | UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3148:24:3153 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3148:24:3153 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3152:24:3152 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3152:24:3152 | access to local variable x | UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3163:24:3168 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3163:24:3168 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3167:24:3167 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3167:24:3167 | access to local variable x | UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3178:24:3183 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3178:24:3183 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3182:24:3182 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3182:24:3182 | access to local variable x | UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3193:24:3198 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3193:24:3198 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3197:24:3197 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3197:24:3197 | access to local variable x | UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(x) |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) | UseUseExplosion.cs:25:13:25:16 | access to property Prop |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) | UseUseExplosion.cs:25:1712:25:1712 | access to local variable x |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) | UseUseExplosion.cs:25:1727:25:1727 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
index e1ea6fe13d9..ff7d8b0f6ba 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
@@ -10,7 +10,8 @@
| Capture.cs:51:9:51:15 | this access | Capture.cs:63:9:63:15 | this access |
| Capture.cs:58:21:58:21 | 1 | Capture.cs:58:17:58:17 | access to local variable i |
| Capture.cs:61:17:61:17 | 1 | Capture.cs:61:13:61:13 | access to local variable i |
-| LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:84:21:84:21 | access to parameter b |
+| LocalDataFlow.cs:48:24:48:24 | SSA param(b) | LocalDataFlow.cs:84:21:84:21 | access to parameter b |
+| LocalDataFlow.cs:48:24:48:24 | b | LocalDataFlow.cs:48:24:48:24 | SSA param(b) |
| LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 | LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) |
| LocalDataFlow.cs:51:13:51:34 | SSA def(sink0) | LocalDataFlow.cs:52:15:52:19 | access to local variable sink0 |
| LocalDataFlow.cs:51:21:51:34 | "taint source" | LocalDataFlow.cs:51:13:51:17 | access to local variable sink0 |
@@ -72,16 +73,18 @@
| LocalDataFlow.cs:84:21:84:35 | [b (line 48): true] ... ? ... : ... | LocalDataFlow.cs:84:13:84:17 | access to local variable sink7 |
| LocalDataFlow.cs:84:25:84:27 | [b (line 48): true] "a" | LocalDataFlow.cs:84:21:84:35 | [b (line 48): true] ... ? ... : ... |
| LocalDataFlow.cs:84:31:84:35 | [b (line 48): false] access to local variable sink6 | LocalDataFlow.cs:84:21:84:35 | [b (line 48): false] ... ? ... : ... |
-| LocalDataFlow.cs:85:15:85:19 | [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
-| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): false] access to local variable sink7 | LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) |
+| LocalDataFlow.cs:85:15:85:19 | [post] [b (line 48): true] access to local variable sink7 | LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) |
| LocalDataFlow.cs:88:9:88:16 | access to local variable nonSink0 | LocalDataFlow.cs:88:9:88:36 | SSA def(nonSink0) |
| LocalDataFlow.cs:88:9:88:36 | SSA def(nonSink0) | LocalDataFlow.cs:89:15:89:22 | access to local variable nonSink0 |
| LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... | LocalDataFlow.cs:88:9:88:16 | access to local variable nonSink0 |
| LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) | LocalDataFlow.cs:92:29:92:33 | access to local variable sink7 |
| LocalDataFlow.cs:88:24:88:28 | "abc" | LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... |
+| LocalDataFlow.cs:88:24:88:28 | [input] SSA phi(sink7) | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
| LocalDataFlow.cs:88:32:88:36 | "def" | LocalDataFlow.cs:88:20:88:36 | ... ? ... : ... |
+| LocalDataFlow.cs:88:32:88:36 | [input] SSA phi(sink7) | LocalDataFlow.cs:88:20:88:36 | SSA phi(sink7) |
| LocalDataFlow.cs:89:15:89:22 | [post] access to local variable nonSink0 | LocalDataFlow.cs:96:32:96:39 | access to local variable nonSink0 |
| LocalDataFlow.cs:89:15:89:22 | access to local variable nonSink0 | LocalDataFlow.cs:96:32:96:39 | access to local variable nonSink0 |
| LocalDataFlow.cs:92:13:92:17 | access to local variable sink8 | LocalDataFlow.cs:92:13:92:33 | SSA def(sink8) |
@@ -556,7 +559,7 @@
| LocalDataFlow.cs:281:13:281:34 | SSA def(sink70) | LocalDataFlow.cs:282:15:282:20 | access to local variable sink70 |
| LocalDataFlow.cs:281:22:281:26 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) |
| LocalDataFlow.cs:281:22:281:34 | ... = ... | LocalDataFlow.cs:281:13:281:18 | access to local variable sink70 |
-| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
+| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:22:313:29 | [input] SSA phi read(sink0) |
| LocalDataFlow.cs:281:22:281:34 | SSA def(sink0) | LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 |
| LocalDataFlow.cs:281:30:281:34 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:26 | access to local variable sink0 |
| LocalDataFlow.cs:281:30:281:34 | access to local variable sink0 | LocalDataFlow.cs:281:22:281:34 | ... = ... |
@@ -586,12 +589,14 @@
| LocalDataFlow.cs:307:18:307:33 | String nonSink17 | LocalDataFlow.cs:307:18:307:33 | SSA def(nonSink17) |
| LocalDataFlow.cs:313:13:313:18 | access to local variable sink73 | LocalDataFlow.cs:313:13:313:38 | SSA def(sink73) |
| LocalDataFlow.cs:313:13:313:38 | SSA def(sink73) | LocalDataFlow.cs:315:15:315:20 | access to local variable sink73 |
+| LocalDataFlow.cs:313:22:313:29 | [input] SSA phi read(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
| LocalDataFlow.cs:313:22:313:29 | access to local variable nonSink0 | LocalDataFlow.cs:313:22:313:38 | ... ?? ... |
| LocalDataFlow.cs:313:22:313:29 | access to local variable nonSink0 | LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 |
| LocalDataFlow.cs:313:22:313:38 | ... ?? ... | LocalDataFlow.cs:313:13:313:18 | access to local variable sink73 |
| LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) | LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 |
+| LocalDataFlow.cs:313:34:313:38 | [input] SSA phi read(sink0) | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:22:313:38 | ... ?? ... |
-| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:22:313:38 | SSA phi read(sink0) |
+| LocalDataFlow.cs:313:34:313:38 | access to local variable sink0 | LocalDataFlow.cs:313:34:313:38 | [input] SSA phi read(sink0) |
| LocalDataFlow.cs:314:13:314:18 | access to local variable sink74 | LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) |
| LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) | LocalDataFlow.cs:316:15:316:20 | access to local variable sink74 |
| LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
@@ -599,38 +604,52 @@
| LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
| LocalDataFlow.cs:334:28:334:30 | SSA entry def(this.anInt) | LocalDataFlow.cs:334:41:334:45 | access to field anInt |
| LocalDataFlow.cs:334:28:334:30 | this | LocalDataFlow.cs:334:41:334:45 | this access |
+| LocalDataFlow.cs:334:50:334:52 | SSA param(value) | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
| LocalDataFlow.cs:334:50:334:52 | this | LocalDataFlow.cs:334:56:334:60 | this access |
-| LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
+| LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:50:334:52 | SSA param(value) |
| LocalDataFlow.cs:334:64:334:68 | access to parameter value | LocalDataFlow.cs:334:56:334:60 | access to field anInt |
-| LocalDataFlow.cs:340:41:340:47 | tainted | LocalDataFlow.cs:342:15:342:21 | access to parameter tainted |
-| LocalDataFlow.cs:345:44:345:53 | nonTainted | LocalDataFlow.cs:347:15:347:24 | access to parameter nonTainted |
-| LocalDataFlow.cs:350:44:350:44 | x | LocalDataFlow.cs:353:21:353:21 | access to parameter x |
-| LocalDataFlow.cs:350:67:350:68 | os | LocalDataFlow.cs:356:33:356:34 | access to parameter os |
+| LocalDataFlow.cs:340:41:340:47 | SSA param(tainted) | LocalDataFlow.cs:342:15:342:21 | access to parameter tainted |
+| LocalDataFlow.cs:340:41:340:47 | tainted | LocalDataFlow.cs:340:41:340:47 | SSA param(tainted) |
+| LocalDataFlow.cs:345:44:345:53 | SSA param(nonTainted) | LocalDataFlow.cs:347:15:347:24 | access to parameter nonTainted |
+| LocalDataFlow.cs:345:44:345:53 | nonTainted | LocalDataFlow.cs:345:44:345:53 | SSA param(nonTainted) |
+| LocalDataFlow.cs:350:44:350:44 | SSA param(x) | LocalDataFlow.cs:353:21:353:21 | access to parameter x |
+| LocalDataFlow.cs:350:44:350:44 | x | LocalDataFlow.cs:350:44:350:44 | SSA param(x) |
+| LocalDataFlow.cs:350:67:350:68 | SSA param(os) | LocalDataFlow.cs:356:33:356:34 | access to parameter os |
+| LocalDataFlow.cs:350:67:350:68 | os | LocalDataFlow.cs:350:67:350:68 | SSA param(os) |
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:17 | access to local variable x1 |
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:21 | ... = ... |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:29 | access to local variable os2 |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:34 | ... = ... |
-| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
+| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
+| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:361:41:361:44 | SSA param(args) |
| LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion | LocalDataFlow.cs:363:22:363:25 | access to local variable span |
| LocalDataFlow.cs:364:27:364:30 | call to operator implicit conversion | LocalDataFlow.cs:364:23:364:23 | access to local variable x |
-| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
-| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:367:23:367:24 | SSA param(b1) | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
+| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:367:23:367:24 | SSA param(b1) |
+| LocalDataFlow.cs:367:32:367:33 | SSA param(b2) | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:367:32:367:33 | SSA param(b2) |
| LocalDataFlow.cs:369:17:369:18 | "" | LocalDataFlow.cs:369:13:369:13 | access to local variable x |
| LocalDataFlow.cs:373:13:373:13 | access to local variable x | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:374:17:374:18 | [input] SSA phi(x) |
| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
-| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:13 | access to local variable x |
+| LocalDataFlow.cs:374:17:374:18 | [input] SSA phi(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:381:13:381:13 | access to local variable x | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
-| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:381:13:381:29 | [input] SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | [input] SSA phi(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
| LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:13 | access to local variable x |
| LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
+| SSA.cs:5:17:5:17 | [input] SSA def(this.S) | SSA.cs:136:23:136:28 | SSA def(this.S) |
+| SSA.cs:5:17:5:17 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
-| SSA.cs:5:26:5:32 | tainted | SSA.cs:8:24:8:30 | access to parameter tainted |
-| SSA.cs:5:42:5:51 | nonTainted | SSA.cs:12:24:12:33 | access to parameter nonTainted |
+| SSA.cs:5:26:5:32 | SSA param(tainted) | SSA.cs:8:24:8:30 | access to parameter tainted |
+| SSA.cs:5:26:5:32 | tainted | SSA.cs:5:26:5:32 | SSA param(tainted) |
+| SSA.cs:5:42:5:51 | SSA param(nonTainted) | SSA.cs:12:24:12:33 | access to parameter nonTainted |
+| SSA.cs:5:42:5:51 | nonTainted | SSA.cs:5:42:5:51 | SSA param(nonTainted) |
| SSA.cs:8:13:8:20 | access to local variable ssaSink0 | SSA.cs:8:13:8:30 | SSA def(ssaSink0) |
| SSA.cs:8:13:8:30 | SSA def(ssaSink0) | SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
| SSA.cs:8:24:8:30 | access to parameter tainted | SSA.cs:8:13:8:20 | access to local variable ssaSink0 |
@@ -643,84 +662,116 @@
| SSA.cs:12:24:12:33 | access to parameter nonTainted | SSA.cs:23:13:23:22 | access to parameter nonTainted |
| SSA.cs:13:15:13:22 | [post] access to local variable nonSink0 | SSA.cs:19:13:19:20 | access to local variable nonSink0 |
| SSA.cs:13:15:13:22 | access to local variable nonSink0 | SSA.cs:19:13:19:20 | access to local variable nonSink0 |
+| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:24:24:24:31 | access to local variable ssaSink0 |
-| SSA.cs:16:13:16:20 | [post] access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:24:24:24:31 | access to local variable ssaSink0 |
-| SSA.cs:16:13:16:20 | access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:30:24:30:31 | access to local variable nonSink0 |
-| SSA.cs:19:13:19:20 | [post] access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:30:24:30:31 | access to local variable nonSink0 |
-| SSA.cs:19:13:19:20 | access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
| SSA.cs:22:16:22:23 | access to local variable ssaSink1 | SSA.cs:22:16:22:28 | SSA def(ssaSink1) |
-| SSA.cs:22:16:22:28 | SSA def(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
+| SSA.cs:22:16:22:28 | SSA def(ssaSink1) | SSA.cs:23:13:23:33 | [input] SSA phi(ssaSink1) |
| SSA.cs:22:27:22:28 | "" | SSA.cs:22:16:22:23 | access to local variable ssaSink1 |
| SSA.cs:23:13:23:22 | [post] access to parameter nonTainted | SSA.cs:29:13:29:22 | access to parameter nonTainted |
| SSA.cs:23:13:23:22 | access to parameter nonTainted | SSA.cs:29:13:29:22 | access to parameter nonTainted |
| SSA.cs:23:13:23:29 | access to property Length | SSA.cs:23:13:23:33 | ... > ... |
+| SSA.cs:23:13:23:33 | [input] SSA phi read(ssaSink0) | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:23:13:23:33 | [input] SSA phi(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
| SSA.cs:24:13:24:20 | access to local variable ssaSink1 | SSA.cs:24:13:24:31 | SSA def(ssaSink1) |
-| SSA.cs:24:13:24:31 | SSA def(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
+| SSA.cs:24:13:24:31 | SSA def(ssaSink1) | SSA.cs:24:13:24:31 | [input] SSA phi(ssaSink1) |
+| SSA.cs:24:13:24:31 | [input] SSA phi read(ssaSink0) | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:24:13:24:31 | [input] SSA phi(ssaSink1) | SSA.cs:25:9:25:24 | SSA phi(ssaSink1) |
| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:24:13:24:20 | access to local variable ssaSink1 |
-| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) |
+| SSA.cs:24:24:24:31 | access to local variable ssaSink0 | SSA.cs:24:13:24:31 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:35:13:35:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:37:24:37:31 | access to local variable ssaSink0 |
-| SSA.cs:25:9:25:24 | SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
| SSA.cs:25:9:25:24 | SSA phi(ssaSink1) | SSA.cs:25:15:25:22 | access to local variable ssaSink1 |
| SSA.cs:28:16:28:23 | access to local variable nonSink1 | SSA.cs:28:16:28:28 | SSA def(nonSink1) |
-| SSA.cs:28:16:28:28 | SSA def(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
+| SSA.cs:28:16:28:28 | SSA def(nonSink1) | SSA.cs:29:13:29:33 | [input] SSA phi(nonSink1) |
| SSA.cs:28:27:28:28 | "" | SSA.cs:28:16:28:23 | access to local variable nonSink1 |
| SSA.cs:29:13:29:22 | [post] access to parameter nonTainted | SSA.cs:35:13:35:22 | access to parameter nonTainted |
| SSA.cs:29:13:29:22 | access to parameter nonTainted | SSA.cs:35:13:35:22 | access to parameter nonTainted |
| SSA.cs:29:13:29:29 | access to property Length | SSA.cs:29:13:29:33 | ... > ... |
+| SSA.cs:29:13:29:33 | [input] SSA phi read(nonSink0) | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:29:13:29:33 | [input] SSA phi(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
| SSA.cs:30:13:30:20 | access to local variable nonSink1 | SSA.cs:30:13:30:31 | SSA def(nonSink1) |
-| SSA.cs:30:13:30:31 | SSA def(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
+| SSA.cs:30:13:30:31 | SSA def(nonSink1) | SSA.cs:30:13:30:31 | [input] SSA phi(nonSink1) |
+| SSA.cs:30:13:30:31 | [input] SSA phi read(nonSink0) | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:30:13:30:31 | [input] SSA phi(nonSink1) | SSA.cs:31:9:31:24 | SSA phi(nonSink1) |
| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:30:13:30:20 | access to local variable nonSink1 |
-| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:31:9:31:24 | SSA phi read(nonSink0) |
+| SSA.cs:30:24:30:31 | access to local variable nonSink0 | SSA.cs:30:13:30:31 | [input] SSA phi read(nonSink0) |
+| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:47:13:47:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:49:24:49:31 | access to local variable nonSink0 |
-| SSA.cs:31:9:31:24 | SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
| SSA.cs:31:9:31:24 | SSA phi(nonSink1) | SSA.cs:31:15:31:22 | access to local variable nonSink1 |
| SSA.cs:34:16:34:23 | access to local variable ssaSink2 | SSA.cs:34:16:34:28 | SSA def(ssaSink2) |
-| SSA.cs:34:16:34:28 | SSA def(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:34:16:34:28 | SSA def(ssaSink2) | SSA.cs:35:13:35:33 | [input] SSA phi(ssaSink2) |
| SSA.cs:34:27:34:28 | "" | SSA.cs:34:16:34:23 | access to local variable ssaSink2 |
+| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:38:17:38:26 | access to parameter nonTainted |
-| SSA.cs:35:13:35:22 | [post] access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:38:17:38:26 | access to parameter nonTainted |
-| SSA.cs:35:13:35:22 | access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
| SSA.cs:35:13:35:29 | access to property Length | SSA.cs:35:13:35:33 | ... > ... |
+| SSA.cs:35:13:35:33 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:35:13:35:33 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:35:13:35:33 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
| SSA.cs:37:13:37:20 | access to local variable ssaSink2 | SSA.cs:37:13:37:31 | SSA def(ssaSink2) |
| SSA.cs:37:13:37:31 | SSA def(ssaSink2) | SSA.cs:39:21:39:28 | access to local variable ssaSink2 |
| SSA.cs:37:13:37:31 | SSA def(ssaSink2) | SSA.cs:41:21:41:28 | access to local variable ssaSink2 |
| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:37:13:37:20 | access to local variable ssaSink2 |
-| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
-| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
-| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:39:17:39:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:37:24:37:31 | access to local variable ssaSink0 | SSA.cs:41:17:41:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | [post] access to parameter nonTainted | SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:38:17:38:26 | access to parameter nonTainted | SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) |
| SSA.cs:38:17:38:33 | access to property Length | SSA.cs:38:17:38:37 | ... > ... |
-| SSA.cs:39:21:39:28 | [post] access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:39:21:39:28 | access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:41:21:41:28 | [post] access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
-| SSA.cs:41:21:41:28 | access to local variable ssaSink2 | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:39:17:39:29 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:39:17:39:29 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:39:21:39:28 | [post] access to local variable ssaSink2 | SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:39:21:39:28 | access to local variable ssaSink2 | SSA.cs:39:17:39:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:41:17:41:29 | [input] SSA phi read(nonTainted) | SSA.cs:43:9:43:24 | SSA phi read(nonTainted) |
+| SSA.cs:41:17:41:29 | [input] SSA phi read(ssaSink0) | SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) |
+| SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) | SSA.cs:43:9:43:24 | SSA phi(ssaSink2) |
+| SSA.cs:41:21:41:28 | [post] access to local variable ssaSink2 | SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) |
+| SSA.cs:41:21:41:28 | access to local variable ssaSink2 | SSA.cs:41:17:41:29 | [input] SSA phi(ssaSink2) |
| SSA.cs:43:9:43:24 | SSA phi read(nonTainted) | SSA.cs:47:13:47:22 | access to parameter nonTainted |
+| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:89:13:89:33 | [input] SSA phi read(ssaSink0) |
| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:91:24:91:31 | access to local variable ssaSink0 |
-| SSA.cs:43:9:43:24 | SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
| SSA.cs:43:9:43:24 | SSA phi(ssaSink2) | SSA.cs:43:15:43:22 | access to local variable ssaSink2 |
| SSA.cs:46:16:46:23 | access to local variable nonSink2 | SSA.cs:46:16:46:28 | SSA def(nonSink2) |
-| SSA.cs:46:16:46:28 | SSA def(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:46:16:46:28 | SSA def(nonSink2) | SSA.cs:47:13:47:33 | [input] SSA phi(nonSink2) |
| SSA.cs:46:27:46:28 | "" | SSA.cs:46:16:46:23 | access to local variable nonSink2 |
+| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:50:17:50:26 | access to parameter nonTainted |
-| SSA.cs:47:13:47:22 | [post] access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:50:17:50:26 | access to parameter nonTainted |
-| SSA.cs:47:13:47:22 | access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
| SSA.cs:47:13:47:29 | access to property Length | SSA.cs:47:13:47:33 | ... > ... |
+| SSA.cs:47:13:47:33 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:47:13:47:33 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:47:13:47:33 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
| SSA.cs:49:13:49:20 | access to local variable nonSink2 | SSA.cs:49:13:49:31 | SSA def(nonSink2) |
| SSA.cs:49:13:49:31 | SSA def(nonSink2) | SSA.cs:51:21:51:28 | access to local variable nonSink2 |
| SSA.cs:49:13:49:31 | SSA def(nonSink2) | SSA.cs:53:21:53:28 | access to local variable nonSink2 |
| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:49:13:49:20 | access to local variable nonSink2 |
-| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
-| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
-| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:51:17:51:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:49:24:49:31 | access to local variable nonSink0 | SSA.cs:53:17:53:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | [post] access to parameter nonTainted | SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:50:17:50:26 | access to parameter nonTainted | SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) |
| SSA.cs:50:17:50:33 | access to property Length | SSA.cs:50:17:50:37 | ... > ... |
-| SSA.cs:51:21:51:28 | [post] access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:51:21:51:28 | access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:53:21:53:28 | [post] access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
-| SSA.cs:53:21:53:28 | access to local variable nonSink2 | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:51:17:51:29 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:51:17:51:29 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:51:21:51:28 | [post] access to local variable nonSink2 | SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:51:21:51:28 | access to local variable nonSink2 | SSA.cs:51:17:51:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:53:17:53:29 | [input] SSA phi read(nonSink0) | SSA.cs:55:9:55:24 | SSA phi read(nonSink0) |
+| SSA.cs:53:17:53:29 | [input] SSA phi read(nonTainted) | SSA.cs:55:9:55:24 | SSA phi read(nonTainted) |
+| SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) | SSA.cs:55:9:55:24 | SSA phi(nonSink2) |
+| SSA.cs:53:21:53:28 | [post] access to local variable nonSink2 | SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) |
+| SSA.cs:53:21:53:28 | access to local variable nonSink2 | SSA.cs:53:17:53:29 | [input] SSA phi(nonSink2) |
| SSA.cs:55:9:55:24 | SSA phi read(nonSink0) | SSA.cs:63:23:63:30 | access to local variable nonSink0 |
| SSA.cs:55:9:55:24 | SSA phi read(nonTainted) | SSA.cs:89:13:89:22 | access to parameter nonTainted |
| SSA.cs:55:9:55:24 | SSA phi(nonSink2) | SSA.cs:55:15:55:22 | access to local variable nonSink2 |
@@ -729,28 +780,28 @@
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:58:16:58:23 | access to local variable ssaSink3 |
| SSA.cs:58:27:58:33 | access to parameter tainted | SSA.cs:67:32:67:38 | access to parameter tainted |
| SSA.cs:59:23:59:30 | SSA def(ssaSink3) | SSA.cs:60:15:60:22 | access to local variable ssaSink3 |
-| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
-| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:59:23:59:30 | [post] access to local variable ssaSink3 | SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) |
| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:59:23:59:30 | access to local variable ssaSink3 | SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) |
| SSA.cs:63:23:63:30 | SSA def(nonSink0) | SSA.cs:64:15:64:22 | access to local variable nonSink0 |
-| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
-| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:63:23:63:30 | [post] access to local variable nonSink0 | SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) |
| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:63:23:63:30 | access to local variable nonSink0 | SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) |
| SSA.cs:67:9:67:12 | [post] this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:12 | this access | SSA.cs:68:23:68:26 | this access |
| SSA.cs:67:9:67:14 | [post] access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:14 | access to field S | SSA.cs:68:23:68:28 | access to field S |
| SSA.cs:67:9:67:28 | access to field SsaFieldSink0 | SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) |
-| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
+| SSA.cs:67:9:67:38 | SSA def(this.S.SsaFieldSink0) | SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:67:9:67:28 | access to field SsaFieldSink0 |
| SSA.cs:67:32:67:38 | access to parameter tainted | SSA.cs:77:20:77:26 | access to parameter tainted |
| SSA.cs:68:23:68:26 | [post] this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:26 | this access | SSA.cs:69:15:69:18 | this access |
| SSA.cs:68:23:68:28 | SSA def(this.S) | SSA.cs:69:15:69:20 | access to field S |
| SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:69:15:69:34 | access to field SsaFieldSink0 |
-| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
-| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:68:23:68:28 | [post] access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:68:23:68:28 | access to field S | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:68:23:68:28 | access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:69:15:69:18 | [post] this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:18 | this access | SSA.cs:72:9:72:12 | this access |
| SSA.cs:69:15:69:20 | [post] access to field S | SSA.cs:72:9:72:14 | access to field S |
@@ -760,15 +811,15 @@
| SSA.cs:72:9:72:14 | [post] access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:14 | access to field S | SSA.cs:73:23:73:28 | access to field S |
| SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 | SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) |
-| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:72:9:72:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:72:35:72:36 | "" | SSA.cs:72:9:72:31 | access to field SsaFieldNonSink0 |
| SSA.cs:73:23:73:26 | [post] this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:26 | this access | SSA.cs:74:15:74:18 | this access |
| SSA.cs:73:23:73:28 | SSA def(this.S) | SSA.cs:74:15:74:20 | access to field S |
| SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:74:15:74:37 | access to field SsaFieldNonSink0 |
-| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
-| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:73:23:73:28 | [post] access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:73:23:73:28 | access to field S | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:73:23:73:28 | access to field S | SSA.cs:89:13:89:33 | [input] SSA def(this.S) |
| SSA.cs:74:15:74:18 | [post] this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:18 | this access | SSA.cs:80:9:80:12 | this access |
| SSA.cs:74:15:74:20 | [post] access to field S | SSA.cs:80:9:80:14 | access to field S |
@@ -779,10 +830,10 @@
| SSA.cs:77:20:77:26 | access to parameter tainted | SSA.cs:80:35:80:41 | access to parameter tainted |
| SSA.cs:78:21:78:28 | SSA def(nonSink0) | SSA.cs:79:15:79:22 | access to local variable nonSink0 |
| SSA.cs:78:21:78:28 | access to local variable nonSink0 | SSA.cs:78:21:78:28 | SSA def(nonSink0) |
+| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
-| SSA.cs:79:15:79:22 | [post] access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) |
| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:104:24:104:31 | access to local variable nonSink0 |
-| SSA.cs:79:15:79:22 | access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
| SSA.cs:80:9:80:12 | [post] this access | SSA.cs:81:21:81:24 | this access |
| SSA.cs:80:9:80:12 | this access | SSA.cs:81:21:81:24 | this access |
| SSA.cs:80:9:80:14 | [post] access to field S | SSA.cs:81:21:81:26 | access to field S |
@@ -811,75 +862,110 @@
| SSA.cs:85:15:85:20 | [post] access to field S | SSA.cs:114:9:114:14 | access to field S |
| SSA.cs:85:15:85:20 | access to field S | SSA.cs:114:9:114:14 | access to field S |
| SSA.cs:88:16:88:23 | access to local variable ssaSink4 | SSA.cs:88:16:88:28 | SSA def(ssaSink4) |
-| SSA.cs:88:16:88:28 | SSA def(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:88:16:88:28 | SSA def(ssaSink4) | SSA.cs:89:13:89:33 | [input] SSA phi(ssaSink4) |
| SSA.cs:88:27:88:28 | "" | SSA.cs:88:16:88:23 | access to local variable ssaSink4 |
+| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:92:17:92:26 | access to parameter nonTainted |
-| SSA.cs:89:13:89:22 | [post] access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:92:17:92:26 | access to parameter nonTainted |
-| SSA.cs:89:13:89:22 | access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
| SSA.cs:89:13:89:29 | access to property Length | SSA.cs:89:13:89:33 | ... > ... |
+| SSA.cs:89:13:89:33 | [input] SSA def(nonSink0) | SSA.cs:63:23:63:30 | SSA def(nonSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA def(ssaSink3) | SSA.cs:59:23:59:30 | SSA def(ssaSink3) |
+| SSA.cs:89:13:89:33 | [input] SSA def(this.S) | SSA.cs:68:23:68:28 | SSA def(this.S) |
+| SSA.cs:89:13:89:33 | [input] SSA def(this.S) | SSA.cs:73:23:73:28 | SSA def(this.S) |
+| SSA.cs:89:13:89:33 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:89:13:89:33 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:73:23:73:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:89:13:89:33 | [input] SSA qualifier def(this.S.SsaFieldSink0) | SSA.cs:68:23:68:28 | SSA qualifier def(this.S.SsaFieldSink0) |
| SSA.cs:91:13:91:20 | access to local variable ssaSink4 | SSA.cs:91:13:91:31 | SSA def(ssaSink4) |
| SSA.cs:91:13:91:31 | SSA def(ssaSink4) | SSA.cs:93:21:93:28 | access to local variable ssaSink4 |
| SSA.cs:91:13:91:31 | SSA def(ssaSink4) | SSA.cs:95:21:95:28 | access to local variable ssaSink4 |
| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:91:13:91:20 | access to local variable ssaSink4 |
-| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
-| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
-| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:93:17:93:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:91:24:91:31 | access to local variable ssaSink0 | SSA.cs:95:17:95:29 | [input] SSA phi read(ssaSink0) |
+| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | [post] access to parameter nonTainted | SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:92:17:92:26 | access to parameter nonTainted | SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) |
| SSA.cs:92:17:92:33 | access to property Length | SSA.cs:92:17:92:37 | ... > ... |
-| SSA.cs:93:21:93:28 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
-| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:93:17:93:29 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:93:17:93:29 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:93:21:93:28 | [post] access to local variable ssaSink4 | SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:93:21:93:28 | access to local variable ssaSink4 | SSA.cs:93:17:93:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:95:17:95:29 | [input] SSA phi read(nonTainted) | SSA.cs:97:9:97:32 | SSA phi read(nonTainted) |
+| SSA.cs:95:17:95:29 | [input] SSA phi read(ssaSink0) | SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) |
+| SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) | SSA.cs:97:9:97:32 | SSA phi(ssaSink4) |
+| SSA.cs:95:21:95:28 | [post] access to local variable ssaSink4 | SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) |
+| SSA.cs:95:21:95:28 | access to local variable ssaSink4 | SSA.cs:95:17:95:29 | [input] SSA phi(ssaSink4) |
| SSA.cs:97:9:97:32 | SSA phi read(nonTainted) | SSA.cs:102:13:102:22 | access to parameter nonTainted |
| SSA.cs:97:9:97:32 | SSA phi read(ssaSink0) | SSA.cs:117:36:117:43 | access to local variable ssaSink0 |
| SSA.cs:97:9:97:32 | SSA phi(ssaSink4) | SSA.cs:97:23:97:30 | access to local variable ssaSink4 |
| SSA.cs:97:23:97:30 | SSA def(ssaSink4) | SSA.cs:98:15:98:22 | access to local variable ssaSink4 |
-| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
-| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:97:23:97:30 | [post] access to local variable ssaSink4 | SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) |
| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:97:23:97:30 | access to local variable ssaSink4 | SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) |
| SSA.cs:101:16:101:23 | access to local variable nonSink3 | SSA.cs:101:16:101:28 | SSA def(nonSink3) |
-| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:101:16:101:28 | SSA def(nonSink3) | SSA.cs:102:13:102:33 | [input] SSA phi(nonSink3) |
| SSA.cs:101:27:101:28 | "" | SSA.cs:101:16:101:23 | access to local variable nonSink3 |
+| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:105:17:105:26 | access to parameter nonTainted |
-| SSA.cs:102:13:102:22 | [post] access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:105:17:105:26 | access to parameter nonTainted |
-| SSA.cs:102:13:102:22 | access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
| SSA.cs:102:13:102:29 | access to property Length | SSA.cs:102:13:102:33 | ... > ... |
+| SSA.cs:102:13:102:33 | [input] SSA def(ssaSink4) | SSA.cs:97:23:97:30 | SSA def(ssaSink4) |
+| SSA.cs:102:13:102:33 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:102:13:102:33 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:102:13:102:33 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
| SSA.cs:104:13:104:20 | access to local variable nonSink3 | SSA.cs:104:13:104:31 | SSA def(nonSink3) |
| SSA.cs:104:13:104:31 | SSA def(nonSink3) | SSA.cs:106:21:106:28 | access to local variable nonSink3 |
| SSA.cs:104:13:104:31 | SSA def(nonSink3) | SSA.cs:108:21:108:28 | access to local variable nonSink3 |
| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:104:13:104:20 | access to local variable nonSink3 |
-| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
-| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
-| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:106:17:106:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:104:24:104:31 | access to local variable nonSink0 | SSA.cs:108:17:108:29 | [input] SSA phi read(nonSink0) |
+| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | [post] access to parameter nonTainted | SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) |
+| SSA.cs:105:17:105:26 | access to parameter nonTainted | SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) |
| SSA.cs:105:17:105:33 | access to property Length | SSA.cs:105:17:105:37 | ... > ... |
-| SSA.cs:106:21:106:28 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
-| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:106:17:106:29 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:106:17:106:29 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:106:21:106:28 | [post] access to local variable nonSink3 | SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:106:21:106:28 | access to local variable nonSink3 | SSA.cs:106:17:106:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:108:17:108:29 | [input] SSA phi read(nonSink0) | SSA.cs:110:9:110:32 | SSA phi read(nonSink0) |
+| SSA.cs:108:17:108:29 | [input] SSA phi read(nonTainted) | SSA.cs:110:9:110:32 | SSA phi read(nonTainted) |
+| SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) | SSA.cs:110:9:110:32 | SSA phi(nonSink3) |
+| SSA.cs:108:21:108:28 | [post] access to local variable nonSink3 | SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) |
+| SSA.cs:108:21:108:28 | access to local variable nonSink3 | SSA.cs:108:17:108:29 | [input] SSA phi(nonSink3) |
| SSA.cs:110:9:110:32 | SSA phi read(nonSink0) | SSA.cs:130:39:130:46 | access to local variable nonSink0 |
| SSA.cs:110:9:110:32 | SSA phi read(nonTainted) | SSA.cs:115:13:115:22 | access to parameter nonTainted |
| SSA.cs:110:9:110:32 | SSA phi(nonSink3) | SSA.cs:110:23:110:30 | access to local variable nonSink3 |
| SSA.cs:110:23:110:30 | SSA def(nonSink3) | SSA.cs:111:15:111:22 | access to local variable nonSink3 |
-| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
-| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:110:23:110:30 | [post] access to local variable nonSink3 | SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) |
| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:110:23:110:30 | access to local variable nonSink3 | SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:117:13:117:16 | this access |
| SSA.cs:114:9:114:12 | this access | SSA.cs:123:23:123:26 | this access |
+| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:117:13:117:18 | access to field S |
-| SSA.cs:114:9:114:14 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:114:9:114:14 | access to field S | SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) |
| SSA.cs:114:9:114:14 | access to field S | SSA.cs:117:13:117:18 | access to field S |
-| SSA.cs:114:9:114:14 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
| SSA.cs:114:9:114:28 | access to field SsaFieldSink1 | SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) |
-| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:114:9:114:33 | SSA def(this.S.SsaFieldSink1) | SSA.cs:115:13:115:33 | [input] SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:114:32:114:33 | "" | SSA.cs:114:9:114:28 | access to field SsaFieldSink1 |
+| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
-| SSA.cs:115:13:115:22 | [post] access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) |
| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:118:17:118:26 | access to parameter nonTainted |
-| SSA.cs:115:13:115:22 | access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
| SSA.cs:115:13:115:29 | access to property Length | SSA.cs:115:13:115:33 | ... > ... |
+| SSA.cs:115:13:115:33 | [input] SSA def(nonSink3) | SSA.cs:110:23:110:30 | SSA def(nonSink3) |
+| SSA.cs:115:13:115:33 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:115:13:115:33 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:115:13:115:33 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:117:13:117:16 | [post] this access | SSA.cs:119:21:119:24 | this access |
| SSA.cs:117:13:117:16 | [post] this access | SSA.cs:121:21:121:24 | this access |
| SSA.cs:117:13:117:16 | this access | SSA.cs:119:21:119:24 | this access |
@@ -892,31 +978,39 @@
| SSA.cs:117:13:117:43 | SSA def(this.S.SsaFieldSink1) | SSA.cs:119:21:119:40 | access to field SsaFieldSink1 |
| SSA.cs:117:13:117:43 | SSA def(this.S.SsaFieldSink1) | SSA.cs:121:21:121:40 | access to field SsaFieldSink1 |
| SSA.cs:117:36:117:43 | access to local variable ssaSink0 | SSA.cs:117:13:117:32 | access to field SsaFieldSink1 |
-| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
-| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | [post] access to parameter nonTainted | SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) |
+| SSA.cs:118:17:118:26 | access to parameter nonTainted | SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) |
| SSA.cs:118:17:118:33 | access to property Length | SSA.cs:118:17:118:37 | ... > ... |
+| SSA.cs:119:17:119:41 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:119:21:119:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:119:21:119:24 | this access | SSA.cs:123:23:123:26 | this access |
-| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:119:21:119:26 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
-| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:119:21:119:26 | [post] access to field S | SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) |
+| SSA.cs:119:21:119:26 | access to field S | SSA.cs:119:17:119:41 | [input] SSA phi read(this.S) |
+| SSA.cs:119:21:119:40 | [post] access to field SsaFieldSink1 | SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:119:21:119:40 | access to field SsaFieldSink1 | SSA.cs:119:17:119:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:17:121:41 | [input] SSA phi read(nonTainted) | SSA.cs:123:9:123:30 | SSA phi read(nonTainted) |
+| SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
+| SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:121:21:121:24 | [post] this access | SSA.cs:123:23:123:26 | this access |
| SSA.cs:121:21:121:24 | this access | SSA.cs:123:23:123:26 | this access |
-| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:121:21:121:26 | access to field S | SSA.cs:123:9:123:30 | SSA phi read(this.S) |
-| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
-| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:21:121:26 | [post] access to field S | SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) |
+| SSA.cs:121:21:121:26 | access to field S | SSA.cs:121:17:121:41 | [input] SSA phi read(this.S) |
+| SSA.cs:121:21:121:40 | [post] access to field SsaFieldSink1 | SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) |
+| SSA.cs:121:21:121:40 | access to field SsaFieldSink1 | SSA.cs:121:17:121:41 | [input] SSA phi(this.S.SsaFieldSink1) |
| SSA.cs:123:9:123:30 | SSA phi read(nonTainted) | SSA.cs:128:13:128:22 | access to parameter nonTainted |
| SSA.cs:123:9:123:30 | SSA phi read(this.S) | SSA.cs:123:23:123:28 | access to field S |
-| SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
+| SSA.cs:123:9:123:30 | SSA phi(this.S.SsaFieldSink1) | SSA.cs:128:13:128:33 | [input] SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:123:23:123:26 | [post] this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:26 | this access | SSA.cs:124:15:124:18 | this access |
| SSA.cs:123:23:123:28 | SSA def(this.S) | SSA.cs:124:15:124:20 | access to field S |
| SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:124:15:124:34 | access to field SsaFieldSink1 |
-| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
-| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:123:23:123:28 | [post] access to field S | SSA.cs:128:13:128:33 | [input] SSA def(this.S) |
| SSA.cs:123:23:123:28 | access to field S | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:123:23:123:28 | access to field S | SSA.cs:128:13:128:33 | [input] SSA def(this.S) |
| SSA.cs:124:15:124:18 | [post] this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:18 | this access | SSA.cs:127:9:127:12 | this access |
| SSA.cs:124:15:124:20 | [post] access to field S | SSA.cs:127:9:127:14 | access to field S |
@@ -925,16 +1019,20 @@
| SSA.cs:127:9:127:12 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:127:9:127:12 | this access | SSA.cs:130:13:130:16 | this access |
| SSA.cs:127:9:127:12 | this access | SSA.cs:136:23:136:26 | this access |
+| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:130:13:130:18 | access to field S |
-| SSA.cs:127:9:127:14 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:127:9:127:14 | access to field S | SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) |
| SSA.cs:127:9:127:14 | access to field S | SSA.cs:130:13:130:18 | access to field S |
-| SSA.cs:127:9:127:14 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
| SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 | SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) |
-| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:127:9:127:36 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:128:13:128:33 | [input] SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:127:35:127:36 | "" | SSA.cs:127:9:127:31 | access to field SsaFieldNonSink0 |
| SSA.cs:128:13:128:22 | [post] access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
| SSA.cs:128:13:128:22 | access to parameter nonTainted | SSA.cs:131:17:131:26 | access to parameter nonTainted |
| SSA.cs:128:13:128:29 | access to property Length | SSA.cs:128:13:128:33 | ... > ... |
+| SSA.cs:128:13:128:33 | [input] SSA def(this.S) | SSA.cs:123:23:123:28 | SSA def(this.S) |
+| SSA.cs:128:13:128:33 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:128:13:128:33 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:128:13:128:33 | [input] SSA qualifier def(this.S.SsaFieldSink1) | SSA.cs:123:23:123:28 | SSA qualifier def(this.S.SsaFieldSink1) |
| SSA.cs:130:13:130:16 | [post] this access | SSA.cs:132:21:132:24 | this access |
| SSA.cs:130:13:130:16 | [post] this access | SSA.cs:134:21:134:24 | this access |
| SSA.cs:130:13:130:16 | this access | SSA.cs:132:21:132:24 | this access |
@@ -948,70 +1046,90 @@
| SSA.cs:130:13:130:46 | SSA def(this.S.SsaFieldNonSink0) | SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 |
| SSA.cs:130:39:130:46 | access to local variable nonSink0 | SSA.cs:130:13:130:35 | access to field SsaFieldNonSink0 |
| SSA.cs:131:17:131:33 | access to property Length | SSA.cs:131:17:131:37 | ... > ... |
+| SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:132:21:132:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:132:21:132:24 | this access | SSA.cs:136:23:136:26 | this access |
-| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:132:21:132:26 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
-| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:132:21:132:26 | [post] access to field S | SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) |
+| SSA.cs:132:21:132:26 | access to field S | SSA.cs:132:17:132:44 | [input] SSA phi read(this.S) |
+| SSA.cs:132:21:132:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:132:21:132:43 | access to field SsaFieldNonSink0 | SSA.cs:132:17:132:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
+| SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:134:21:134:24 | [post] this access | SSA.cs:136:23:136:26 | this access |
| SSA.cs:134:21:134:24 | this access | SSA.cs:136:23:136:26 | this access |
-| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:134:21:134:26 | access to field S | SSA.cs:136:9:136:30 | SSA phi read(this.S) |
-| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
-| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:21:134:26 | [post] access to field S | SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) |
+| SSA.cs:134:21:134:26 | access to field S | SSA.cs:134:17:134:44 | [input] SSA phi read(this.S) |
+| SSA.cs:134:21:134:43 | [post] access to field SsaFieldNonSink0 | SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
+| SSA.cs:134:21:134:43 | access to field SsaFieldNonSink0 | SSA.cs:134:17:134:44 | [input] SSA phi(this.S.SsaFieldNonSink0) |
| SSA.cs:136:9:136:30 | SSA phi read(this.S) | SSA.cs:136:23:136:28 | access to field S |
-| SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) |
+| SSA.cs:136:9:136:30 | SSA phi(this.S.SsaFieldNonSink0) | SSA.cs:5:17:5:17 | [input] SSA qualifier def(this.S.SsaFieldNonSink0) |
| SSA.cs:136:23:136:26 | [post] this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:26 | this access | SSA.cs:137:15:137:18 | this access |
| SSA.cs:136:23:136:28 | SSA def(this.S) | SSA.cs:137:15:137:20 | access to field S |
| SSA.cs:136:23:136:28 | SSA qualifier def(this.S.SsaFieldNonSink0) | SSA.cs:137:15:137:37 | access to field SsaFieldNonSink0 |
-| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
+| SSA.cs:136:23:136:28 | [post] access to field S | SSA.cs:5:17:5:17 | [input] SSA def(this.S) |
+| SSA.cs:136:23:136:28 | access to field S | SSA.cs:5:17:5:17 | [input] SSA def(this.S) |
| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
-| SSA.cs:136:23:136:28 | access to field S | SSA.cs:136:23:136:28 | SSA def(this.S) |
-| SSA.cs:144:34:144:34 | t | SSA.cs:146:13:146:13 | access to parameter t |
+| SSA.cs:144:34:144:34 | SSA param(t) | SSA.cs:146:13:146:13 | access to parameter t |
+| SSA.cs:144:34:144:34 | t | SSA.cs:144:34:144:34 | SSA param(t) |
| SSA.cs:146:13:146:13 | (...) ... | SSA.cs:146:13:146:21 | ... == ... |
| SSA.cs:146:13:146:13 | access to parameter t | SSA.cs:146:13:146:13 | (...) ... |
| SSA.cs:146:13:146:13 | access to parameter t | SSA.cs:149:17:149:17 | access to parameter t |
| SSA.cs:147:13:147:13 | access to parameter t | SSA.cs:147:13:147:26 | SSA def(t) |
-| SSA.cs:147:13:147:26 | SSA def(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
+| SSA.cs:147:13:147:26 | SSA def(t) | SSA.cs:147:13:147:26 | [input] SSA phi(t) |
+| SSA.cs:147:13:147:26 | [input] SSA phi(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
| SSA.cs:147:17:147:26 | default(...) | SSA.cs:147:13:147:13 | access to parameter t |
| SSA.cs:149:13:149:13 | access to parameter t | SSA.cs:149:13:149:17 | SSA def(t) |
-| SSA.cs:149:13:149:17 | SSA def(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
+| SSA.cs:149:13:149:17 | SSA def(t) | SSA.cs:149:13:149:17 | [input] SSA phi(t) |
+| SSA.cs:149:13:149:17 | [input] SSA phi(t) | SSA.cs:144:17:144:26 | SSA phi(t) |
| SSA.cs:149:17:149:17 | access to parameter t | SSA.cs:149:13:149:13 | access to parameter t |
-| SSA.cs:152:36:152:36 | t | SSA.cs:154:13:154:13 | access to parameter t |
+| SSA.cs:152:36:152:36 | SSA param(t) | SSA.cs:154:13:154:13 | access to parameter t |
+| SSA.cs:152:36:152:36 | t | SSA.cs:152:36:152:36 | SSA param(t) |
| SSA.cs:154:13:154:13 | (...) ... | SSA.cs:154:13:154:21 | ... == ... |
-| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:152:17:152:28 | SSA phi(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:13 | (...) ... |
+| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:21 | [input] SSA phi(t) |
| SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
-| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:154:13:154:21 | [input] SSA phi(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:155:13:155:26 | [input] SSA phi(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
+| SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:155:13:155:26 | [input] SSA phi(t) |
| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:155:25:155:25 | SSA def(t) |
| SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
| SSA.cs:166:28:166:31 | null | SSA.cs:166:19:166:24 | access to field S |
-| SSA.cs:168:22:168:28 | tainted | SSA.cs:173:24:173:30 | access to parameter tainted |
-| SSA.cs:168:35:168:35 | i | SSA.cs:171:13:171:13 | access to parameter i |
+| SSA.cs:168:22:168:28 | SSA param(tainted) | SSA.cs:173:24:173:30 | access to parameter tainted |
+| SSA.cs:168:22:168:28 | tainted | SSA.cs:168:22:168:28 | SSA param(tainted) |
+| SSA.cs:168:35:168:35 | SSA param(i) | SSA.cs:171:13:171:13 | access to parameter i |
+| SSA.cs:168:35:168:35 | i | SSA.cs:168:35:168:35 | SSA param(i) |
| SSA.cs:170:16:170:23 | access to local variable ssaSink5 | SSA.cs:170:16:170:28 | SSA def(ssaSink5) |
-| SSA.cs:170:16:170:28 | SSA def(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
+| SSA.cs:170:16:170:28 | SSA def(ssaSink5) | SSA.cs:171:13:171:19 | [input] SSA phi(ssaSink5) |
| SSA.cs:170:27:170:28 | "" | SSA.cs:170:16:170:23 | access to local variable ssaSink5 |
| SSA.cs:171:13:171:13 | access to parameter i | SSA.cs:171:13:171:15 | SSA def(i) |
| SSA.cs:171:13:171:15 | ...-- | SSA.cs:171:13:171:19 | ... > ... |
-| SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:13:178:13 | [input] SSA phi(i) |
+| SSA.cs:171:13:171:19 | [input] SSA phi(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:173:13:173:20 | access to local variable ssaSink5 | SSA.cs:173:13:173:30 | SSA def(ssaSink5) |
-| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:174:13:178:13 | [input] SSA phi read(ssaSink5) |
| SSA.cs:173:24:173:30 | access to parameter tainted | SSA.cs:173:13:173:20 | access to local variable ssaSink5 |
+| SSA.cs:174:13:178:13 | [input] SSA phi read(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:174:13:178:13 | [input] SSA phi(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:174:20:174:26 | [input] SSA phi(ssaSink5) |
| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:176:21:176:28 | access to local variable ssaSink5 |
-| SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:174:20:174:20 | SSA phi(i) | SSA.cs:174:20:174:20 | access to parameter i |
| SSA.cs:174:20:174:20 | access to parameter i | SSA.cs:174:20:174:22 | SSA def(i) |
| SSA.cs:174:20:174:22 | ...-- | SSA.cs:174:20:174:26 | ... > ... |
-| SSA.cs:174:20:174:22 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:174:20:174:22 | SSA def(i) | SSA.cs:177:17:177:29 | [input] SSA phi(i) |
+| SSA.cs:174:20:174:26 | [input] SSA phi(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
| SSA.cs:176:21:176:28 | [post] access to local variable ssaSink5 | SSA.cs:177:21:177:28 | access to local variable ssaSink5 |
| SSA.cs:176:21:176:28 | access to local variable ssaSink5 | SSA.cs:177:21:177:28 | access to local variable ssaSink5 |
-| SSA.cs:177:21:177:28 | [post] access to local variable ssaSink5 | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
-| SSA.cs:177:21:177:28 | access to local variable ssaSink5 | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) | SSA.cs:174:20:174:20 | SSA phi read(ssaSink5) |
+| SSA.cs:177:17:177:29 | [input] SSA phi(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
+| SSA.cs:177:21:177:28 | [post] access to local variable ssaSink5 | SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) |
+| SSA.cs:177:21:177:28 | access to local variable ssaSink5 | SSA.cs:177:17:177:29 | [input] SSA phi read(ssaSink5) |
| SSA.cs:180:9:180:24 | SSA phi(ssaSink5) | SSA.cs:180:15:180:22 | access to local variable ssaSink5 |
-| Splitting.cs:3:18:3:18 | b | Splitting.cs:6:13:6:13 | access to parameter b |
-| Splitting.cs:3:28:3:34 | tainted | Splitting.cs:5:17:5:23 | access to parameter tainted |
+| Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:6:13:6:13 | access to parameter b |
+| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) |
+| Splitting.cs:3:28:3:34 | SSA param(tainted) | Splitting.cs:5:17:5:23 | access to parameter tainted |
+| Splitting.cs:3:28:3:34 | tainted | Splitting.cs:3:28:3:34 | SSA param(tainted) |
| Splitting.cs:5:13:5:13 | access to local variable x | Splitting.cs:5:13:5:23 | SSA def(x) |
| Splitting.cs:5:13:5:23 | SSA def(x) | Splitting.cs:8:19:8:19 | [b (line 3): true] access to local variable x |
| Splitting.cs:5:13:5:23 | SSA def(x) | Splitting.cs:12:15:12:15 | [b (line 3): false] access to local variable x |
@@ -1024,7 +1142,8 @@
| Splitting.cs:9:17:9:17 | [b (line 3): true] access to local variable x | Splitting.cs:12:15:12:15 | [b (line 3): true] access to local variable x |
| Splitting.cs:12:15:12:15 | [b (line 3): true] access to local variable x | Splitting.cs:14:19:14:19 | access to local variable x |
| Splitting.cs:12:15:12:15 | [post] [b (line 3): true] access to local variable x | Splitting.cs:14:19:14:19 | access to local variable x |
-| Splitting.cs:17:18:17:18 | b | Splitting.cs:20:13:20:13 | access to parameter b |
+| Splitting.cs:17:18:17:18 | SSA param(b) | Splitting.cs:20:13:20:13 | access to parameter b |
+| Splitting.cs:17:18:17:18 | b | Splitting.cs:17:18:17:18 | SSA param(b) |
| Splitting.cs:19:13:19:13 | access to local variable x | Splitting.cs:19:13:19:18 | SSA def(x) |
| Splitting.cs:19:13:19:18 | SSA def(x) | Splitting.cs:22:19:22:19 | [b (line 17): true] access to local variable x |
| Splitting.cs:19:13:19:18 | SSA def(x) | Splitting.cs:25:15:25:15 | [b (line 17): false] access to local variable x |
@@ -1038,7 +1157,8 @@
| Splitting.cs:25:15:25:15 | [b (line 17): true] access to local variable x | Splitting.cs:27:19:27:19 | access to local variable x |
| Splitting.cs:25:15:25:15 | [post] [b (line 17): false] access to local variable x | Splitting.cs:29:19:29:19 | access to local variable x |
| Splitting.cs:25:15:25:15 | [post] [b (line 17): true] access to local variable x | Splitting.cs:27:19:27:19 | access to local variable x |
-| Splitting.cs:32:18:32:18 | b | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:32:18:32:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
+| Splitting.cs:32:18:32:18 | b | Splitting.cs:32:18:32:18 | SSA param(b) |
| Splitting.cs:34:17:34:18 | "" | Splitting.cs:34:13:34:13 | access to local variable x |
| Splitting.cs:35:13:35:13 | access to parameter b | Splitting.cs:39:15:39:15 | [b (line 32): false] access to parameter b |
| Splitting.cs:35:13:35:13 | access to parameter b | Splitting.cs:39:15:39:15 | [b (line 32): true] access to parameter b |
@@ -1065,7 +1185,8 @@
| Splitting.cs:41:19:41:21 | [b (line 32): false] "d" | Splitting.cs:41:15:41:21 | [b (line 32): false] ... = ... |
| Splitting.cs:41:19:41:21 | [b (line 32): true] "d" | Splitting.cs:41:15:41:15 | access to local variable x |
| Splitting.cs:41:19:41:21 | [b (line 32): true] "d" | Splitting.cs:41:15:41:21 | [b (line 32): true] ... = ... |
-| Splitting.cs:46:18:46:18 | b | Splitting.cs:49:13:49:13 | access to parameter b |
+| Splitting.cs:46:18:46:18 | SSA param(b) | Splitting.cs:49:13:49:13 | access to parameter b |
+| Splitting.cs:46:18:46:18 | b | Splitting.cs:46:18:46:18 | SSA param(b) |
| Splitting.cs:48:13:48:13 | access to local variable x | Splitting.cs:48:13:48:18 | SSA def(x) |
| Splitting.cs:48:13:48:18 | SSA def(x) | Splitting.cs:53:13:53:13 | [b (line 46): false] access to local variable x |
| Splitting.cs:48:17:48:18 | "" | Splitting.cs:48:13:48:13 | access to local variable x |
@@ -1143,6 +1264,7 @@
| UseUseExplosion.cs:21:10:21:10 | SSA entry def(this.Prop) | UseUseExplosion.cs:24:13:24:16 | access to property Prop |
| UseUseExplosion.cs:21:10:21:10 | this | UseUseExplosion.cs:24:13:24:16 | this access |
| UseUseExplosion.cs:23:13:23:13 | access to local variable x | UseUseExplosion.cs:23:13:23:17 | SSA def(x) |
+| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(x) |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1712:24:1712 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1727:24:1727 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:1742:24:1742 | access to local variable x |
@@ -1243,1007 +1365,1209 @@
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3167:24:3167 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3182:24:3182 | access to local variable x |
| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:24:3197:24:3197 | access to local variable x |
-| UseUseExplosion.cs:23:13:23:17 | SSA def(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:23:17:23:17 | 0 | UseUseExplosion.cs:23:13:23:13 | access to local variable x |
| UseUseExplosion.cs:24:13:24:16 | [post] this access | UseUseExplosion.cs:24:31:24:34 | this access |
| UseUseExplosion.cs:24:13:24:16 | [post] this access | UseUseExplosion.cs:24:3193:24:3198 | this access |
| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:24:13:24:22 | ... > ... |
| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:24:31:24:34 | access to property Prop |
-| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:13:24:16 | access to property Prop | UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:13:24:16 | this access | UseUseExplosion.cs:24:31:24:34 | this access |
| UseUseExplosion.cs:24:13:24:16 | this access | UseUseExplosion.cs:24:3193:24:3198 | this access |
| UseUseExplosion.cs:24:31:24:34 | [post] this access | UseUseExplosion.cs:24:48:24:51 | this access |
| UseUseExplosion.cs:24:31:24:34 | [post] this access | UseUseExplosion.cs:24:3178:24:3183 | this access |
| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:24:31:24:39 | ... > ... |
| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:24:48:24:51 | access to property Prop |
-| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:31:24:34 | access to property Prop | UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:31:24:34 | this access | UseUseExplosion.cs:24:48:24:51 | this access |
| UseUseExplosion.cs:24:31:24:34 | this access | UseUseExplosion.cs:24:3178:24:3183 | this access |
| UseUseExplosion.cs:24:48:24:51 | [post] this access | UseUseExplosion.cs:24:65:24:68 | this access |
| UseUseExplosion.cs:24:48:24:51 | [post] this access | UseUseExplosion.cs:24:3163:24:3168 | this access |
| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:24:48:24:56 | ... > ... |
| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:24:65:24:68 | access to property Prop |
-| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:48:24:51 | access to property Prop | UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:48:24:51 | this access | UseUseExplosion.cs:24:65:24:68 | this access |
| UseUseExplosion.cs:24:48:24:51 | this access | UseUseExplosion.cs:24:3163:24:3168 | this access |
| UseUseExplosion.cs:24:65:24:68 | [post] this access | UseUseExplosion.cs:24:82:24:85 | this access |
| UseUseExplosion.cs:24:65:24:68 | [post] this access | UseUseExplosion.cs:24:3148:24:3153 | this access |
| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:24:65:24:73 | ... > ... |
| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:24:82:24:85 | access to property Prop |
-| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:65:24:68 | access to property Prop | UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:65:24:68 | this access | UseUseExplosion.cs:24:82:24:85 | this access |
| UseUseExplosion.cs:24:65:24:68 | this access | UseUseExplosion.cs:24:3148:24:3153 | this access |
| UseUseExplosion.cs:24:82:24:85 | [post] this access | UseUseExplosion.cs:24:99:24:102 | this access |
| UseUseExplosion.cs:24:82:24:85 | [post] this access | UseUseExplosion.cs:24:3133:24:3138 | this access |
| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:24:82:24:90 | ... > ... |
| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:24:99:24:102 | access to property Prop |
-| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:82:24:85 | access to property Prop | UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:82:24:85 | this access | UseUseExplosion.cs:24:99:24:102 | this access |
| UseUseExplosion.cs:24:82:24:85 | this access | UseUseExplosion.cs:24:3133:24:3138 | this access |
| UseUseExplosion.cs:24:99:24:102 | [post] this access | UseUseExplosion.cs:24:116:24:119 | this access |
| UseUseExplosion.cs:24:99:24:102 | [post] this access | UseUseExplosion.cs:24:3118:24:3123 | this access |
| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:24:99:24:107 | ... > ... |
| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:24:116:24:119 | access to property Prop |
-| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:99:24:102 | access to property Prop | UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:99:24:102 | this access | UseUseExplosion.cs:24:116:24:119 | this access |
| UseUseExplosion.cs:24:99:24:102 | this access | UseUseExplosion.cs:24:3118:24:3123 | this access |
| UseUseExplosion.cs:24:116:24:119 | [post] this access | UseUseExplosion.cs:24:133:24:136 | this access |
| UseUseExplosion.cs:24:116:24:119 | [post] this access | UseUseExplosion.cs:24:3103:24:3108 | this access |
| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:24:116:24:124 | ... > ... |
| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:24:133:24:136 | access to property Prop |
-| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:116:24:119 | access to property Prop | UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:116:24:119 | this access | UseUseExplosion.cs:24:133:24:136 | this access |
| UseUseExplosion.cs:24:116:24:119 | this access | UseUseExplosion.cs:24:3103:24:3108 | this access |
| UseUseExplosion.cs:24:133:24:136 | [post] this access | UseUseExplosion.cs:24:150:24:153 | this access |
| UseUseExplosion.cs:24:133:24:136 | [post] this access | UseUseExplosion.cs:24:3088:24:3093 | this access |
| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:24:133:24:141 | ... > ... |
| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:24:150:24:153 | access to property Prop |
-| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:133:24:136 | access to property Prop | UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:133:24:136 | this access | UseUseExplosion.cs:24:150:24:153 | this access |
| UseUseExplosion.cs:24:133:24:136 | this access | UseUseExplosion.cs:24:3088:24:3093 | this access |
| UseUseExplosion.cs:24:150:24:153 | [post] this access | UseUseExplosion.cs:24:167:24:170 | this access |
| UseUseExplosion.cs:24:150:24:153 | [post] this access | UseUseExplosion.cs:24:3073:24:3078 | this access |
| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:24:150:24:158 | ... > ... |
| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:24:167:24:170 | access to property Prop |
-| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:150:24:153 | access to property Prop | UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:150:24:153 | this access | UseUseExplosion.cs:24:167:24:170 | this access |
| UseUseExplosion.cs:24:150:24:153 | this access | UseUseExplosion.cs:24:3073:24:3078 | this access |
| UseUseExplosion.cs:24:167:24:170 | [post] this access | UseUseExplosion.cs:24:184:24:187 | this access |
| UseUseExplosion.cs:24:167:24:170 | [post] this access | UseUseExplosion.cs:24:3058:24:3063 | this access |
| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:24:167:24:175 | ... > ... |
| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:24:184:24:187 | access to property Prop |
-| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:167:24:170 | access to property Prop | UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:167:24:170 | this access | UseUseExplosion.cs:24:184:24:187 | this access |
| UseUseExplosion.cs:24:167:24:170 | this access | UseUseExplosion.cs:24:3058:24:3063 | this access |
| UseUseExplosion.cs:24:184:24:187 | [post] this access | UseUseExplosion.cs:24:201:24:204 | this access |
| UseUseExplosion.cs:24:184:24:187 | [post] this access | UseUseExplosion.cs:24:3043:24:3048 | this access |
| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:24:184:24:192 | ... > ... |
| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:24:201:24:204 | access to property Prop |
-| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:184:24:187 | access to property Prop | UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:184:24:187 | this access | UseUseExplosion.cs:24:201:24:204 | this access |
| UseUseExplosion.cs:24:184:24:187 | this access | UseUseExplosion.cs:24:3043:24:3048 | this access |
| UseUseExplosion.cs:24:201:24:204 | [post] this access | UseUseExplosion.cs:24:218:24:221 | this access |
| UseUseExplosion.cs:24:201:24:204 | [post] this access | UseUseExplosion.cs:24:3028:24:3033 | this access |
| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:24:201:24:209 | ... > ... |
| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:24:218:24:221 | access to property Prop |
-| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:201:24:204 | access to property Prop | UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:201:24:204 | this access | UseUseExplosion.cs:24:218:24:221 | this access |
| UseUseExplosion.cs:24:201:24:204 | this access | UseUseExplosion.cs:24:3028:24:3033 | this access |
| UseUseExplosion.cs:24:218:24:221 | [post] this access | UseUseExplosion.cs:24:235:24:238 | this access |
| UseUseExplosion.cs:24:218:24:221 | [post] this access | UseUseExplosion.cs:24:3013:24:3018 | this access |
| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:24:218:24:226 | ... > ... |
| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:24:235:24:238 | access to property Prop |
-| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:218:24:221 | access to property Prop | UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:218:24:221 | this access | UseUseExplosion.cs:24:235:24:238 | this access |
| UseUseExplosion.cs:24:218:24:221 | this access | UseUseExplosion.cs:24:3013:24:3018 | this access |
| UseUseExplosion.cs:24:235:24:238 | [post] this access | UseUseExplosion.cs:24:252:24:255 | this access |
| UseUseExplosion.cs:24:235:24:238 | [post] this access | UseUseExplosion.cs:24:2998:24:3003 | this access |
| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:24:235:24:243 | ... > ... |
| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:24:252:24:255 | access to property Prop |
-| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:235:24:238 | access to property Prop | UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:235:24:238 | this access | UseUseExplosion.cs:24:252:24:255 | this access |
| UseUseExplosion.cs:24:235:24:238 | this access | UseUseExplosion.cs:24:2998:24:3003 | this access |
| UseUseExplosion.cs:24:252:24:255 | [post] this access | UseUseExplosion.cs:24:269:24:272 | this access |
| UseUseExplosion.cs:24:252:24:255 | [post] this access | UseUseExplosion.cs:24:2983:24:2988 | this access |
| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:24:252:24:260 | ... > ... |
| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:24:269:24:272 | access to property Prop |
-| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:252:24:255 | access to property Prop | UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:252:24:255 | this access | UseUseExplosion.cs:24:269:24:272 | this access |
| UseUseExplosion.cs:24:252:24:255 | this access | UseUseExplosion.cs:24:2983:24:2988 | this access |
| UseUseExplosion.cs:24:269:24:272 | [post] this access | UseUseExplosion.cs:24:286:24:289 | this access |
| UseUseExplosion.cs:24:269:24:272 | [post] this access | UseUseExplosion.cs:24:2968:24:2973 | this access |
| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:24:269:24:277 | ... > ... |
| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:24:286:24:289 | access to property Prop |
-| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:269:24:272 | access to property Prop | UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:269:24:272 | this access | UseUseExplosion.cs:24:286:24:289 | this access |
| UseUseExplosion.cs:24:269:24:272 | this access | UseUseExplosion.cs:24:2968:24:2973 | this access |
| UseUseExplosion.cs:24:286:24:289 | [post] this access | UseUseExplosion.cs:24:303:24:306 | this access |
| UseUseExplosion.cs:24:286:24:289 | [post] this access | UseUseExplosion.cs:24:2953:24:2958 | this access |
| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:24:286:24:294 | ... > ... |
| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:24:303:24:306 | access to property Prop |
-| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:286:24:289 | access to property Prop | UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:286:24:289 | this access | UseUseExplosion.cs:24:303:24:306 | this access |
| UseUseExplosion.cs:24:286:24:289 | this access | UseUseExplosion.cs:24:2953:24:2958 | this access |
| UseUseExplosion.cs:24:303:24:306 | [post] this access | UseUseExplosion.cs:24:320:24:323 | this access |
| UseUseExplosion.cs:24:303:24:306 | [post] this access | UseUseExplosion.cs:24:2938:24:2943 | this access |
| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:24:303:24:311 | ... > ... |
| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:24:320:24:323 | access to property Prop |
-| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:303:24:306 | access to property Prop | UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:303:24:306 | this access | UseUseExplosion.cs:24:320:24:323 | this access |
| UseUseExplosion.cs:24:303:24:306 | this access | UseUseExplosion.cs:24:2938:24:2943 | this access |
| UseUseExplosion.cs:24:320:24:323 | [post] this access | UseUseExplosion.cs:24:337:24:340 | this access |
| UseUseExplosion.cs:24:320:24:323 | [post] this access | UseUseExplosion.cs:24:2923:24:2928 | this access |
| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:24:320:24:328 | ... > ... |
| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:24:337:24:340 | access to property Prop |
-| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:320:24:323 | access to property Prop | UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:320:24:323 | this access | UseUseExplosion.cs:24:337:24:340 | this access |
| UseUseExplosion.cs:24:320:24:323 | this access | UseUseExplosion.cs:24:2923:24:2928 | this access |
| UseUseExplosion.cs:24:337:24:340 | [post] this access | UseUseExplosion.cs:24:354:24:357 | this access |
| UseUseExplosion.cs:24:337:24:340 | [post] this access | UseUseExplosion.cs:24:2908:24:2913 | this access |
| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:24:337:24:345 | ... > ... |
| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:24:354:24:357 | access to property Prop |
-| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:337:24:340 | access to property Prop | UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:337:24:340 | this access | UseUseExplosion.cs:24:354:24:357 | this access |
| UseUseExplosion.cs:24:337:24:340 | this access | UseUseExplosion.cs:24:2908:24:2913 | this access |
| UseUseExplosion.cs:24:354:24:357 | [post] this access | UseUseExplosion.cs:24:371:24:374 | this access |
| UseUseExplosion.cs:24:354:24:357 | [post] this access | UseUseExplosion.cs:24:2893:24:2898 | this access |
| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:24:354:24:362 | ... > ... |
| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:24:371:24:374 | access to property Prop |
-| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:354:24:357 | access to property Prop | UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:354:24:357 | this access | UseUseExplosion.cs:24:371:24:374 | this access |
| UseUseExplosion.cs:24:354:24:357 | this access | UseUseExplosion.cs:24:2893:24:2898 | this access |
| UseUseExplosion.cs:24:371:24:374 | [post] this access | UseUseExplosion.cs:24:388:24:391 | this access |
| UseUseExplosion.cs:24:371:24:374 | [post] this access | UseUseExplosion.cs:24:2878:24:2883 | this access |
| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:24:371:24:379 | ... > ... |
| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:24:388:24:391 | access to property Prop |
-| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:371:24:374 | access to property Prop | UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:371:24:374 | this access | UseUseExplosion.cs:24:388:24:391 | this access |
| UseUseExplosion.cs:24:371:24:374 | this access | UseUseExplosion.cs:24:2878:24:2883 | this access |
| UseUseExplosion.cs:24:388:24:391 | [post] this access | UseUseExplosion.cs:24:405:24:408 | this access |
| UseUseExplosion.cs:24:388:24:391 | [post] this access | UseUseExplosion.cs:24:2863:24:2868 | this access |
| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:24:388:24:396 | ... > ... |
| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:24:405:24:408 | access to property Prop |
-| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:388:24:391 | access to property Prop | UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:388:24:391 | this access | UseUseExplosion.cs:24:405:24:408 | this access |
| UseUseExplosion.cs:24:388:24:391 | this access | UseUseExplosion.cs:24:2863:24:2868 | this access |
| UseUseExplosion.cs:24:405:24:408 | [post] this access | UseUseExplosion.cs:24:422:24:425 | this access |
| UseUseExplosion.cs:24:405:24:408 | [post] this access | UseUseExplosion.cs:24:2848:24:2853 | this access |
| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:24:405:24:413 | ... > ... |
| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:24:422:24:425 | access to property Prop |
-| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:405:24:408 | access to property Prop | UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:405:24:408 | this access | UseUseExplosion.cs:24:422:24:425 | this access |
| UseUseExplosion.cs:24:405:24:408 | this access | UseUseExplosion.cs:24:2848:24:2853 | this access |
| UseUseExplosion.cs:24:422:24:425 | [post] this access | UseUseExplosion.cs:24:439:24:442 | this access |
| UseUseExplosion.cs:24:422:24:425 | [post] this access | UseUseExplosion.cs:24:2833:24:2838 | this access |
| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:24:422:24:430 | ... > ... |
| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:24:439:24:442 | access to property Prop |
-| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:422:24:425 | access to property Prop | UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:422:24:425 | this access | UseUseExplosion.cs:24:439:24:442 | this access |
| UseUseExplosion.cs:24:422:24:425 | this access | UseUseExplosion.cs:24:2833:24:2838 | this access |
| UseUseExplosion.cs:24:439:24:442 | [post] this access | UseUseExplosion.cs:24:456:24:459 | this access |
| UseUseExplosion.cs:24:439:24:442 | [post] this access | UseUseExplosion.cs:24:2818:24:2823 | this access |
| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:24:439:24:447 | ... > ... |
| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:24:456:24:459 | access to property Prop |
-| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:439:24:442 | access to property Prop | UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:439:24:442 | this access | UseUseExplosion.cs:24:456:24:459 | this access |
| UseUseExplosion.cs:24:439:24:442 | this access | UseUseExplosion.cs:24:2818:24:2823 | this access |
| UseUseExplosion.cs:24:456:24:459 | [post] this access | UseUseExplosion.cs:24:473:24:476 | this access |
| UseUseExplosion.cs:24:456:24:459 | [post] this access | UseUseExplosion.cs:24:2803:24:2808 | this access |
| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:24:456:24:464 | ... > ... |
| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:24:473:24:476 | access to property Prop |
-| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:456:24:459 | access to property Prop | UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:456:24:459 | this access | UseUseExplosion.cs:24:473:24:476 | this access |
| UseUseExplosion.cs:24:456:24:459 | this access | UseUseExplosion.cs:24:2803:24:2808 | this access |
| UseUseExplosion.cs:24:473:24:476 | [post] this access | UseUseExplosion.cs:24:490:24:493 | this access |
| UseUseExplosion.cs:24:473:24:476 | [post] this access | UseUseExplosion.cs:24:2788:24:2793 | this access |
| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:24:473:24:481 | ... > ... |
| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:24:490:24:493 | access to property Prop |
-| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:473:24:476 | access to property Prop | UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:473:24:476 | this access | UseUseExplosion.cs:24:490:24:493 | this access |
| UseUseExplosion.cs:24:473:24:476 | this access | UseUseExplosion.cs:24:2788:24:2793 | this access |
| UseUseExplosion.cs:24:490:24:493 | [post] this access | UseUseExplosion.cs:24:507:24:510 | this access |
| UseUseExplosion.cs:24:490:24:493 | [post] this access | UseUseExplosion.cs:24:2773:24:2778 | this access |
| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:24:490:24:498 | ... > ... |
| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:24:507:24:510 | access to property Prop |
-| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:490:24:493 | access to property Prop | UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:490:24:493 | this access | UseUseExplosion.cs:24:507:24:510 | this access |
| UseUseExplosion.cs:24:490:24:493 | this access | UseUseExplosion.cs:24:2773:24:2778 | this access |
| UseUseExplosion.cs:24:507:24:510 | [post] this access | UseUseExplosion.cs:24:524:24:527 | this access |
| UseUseExplosion.cs:24:507:24:510 | [post] this access | UseUseExplosion.cs:24:2758:24:2763 | this access |
| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:24:507:24:515 | ... > ... |
| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:24:524:24:527 | access to property Prop |
-| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:507:24:510 | access to property Prop | UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:507:24:510 | this access | UseUseExplosion.cs:24:524:24:527 | this access |
| UseUseExplosion.cs:24:507:24:510 | this access | UseUseExplosion.cs:24:2758:24:2763 | this access |
| UseUseExplosion.cs:24:524:24:527 | [post] this access | UseUseExplosion.cs:24:541:24:544 | this access |
| UseUseExplosion.cs:24:524:24:527 | [post] this access | UseUseExplosion.cs:24:2743:24:2748 | this access |
| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:24:524:24:532 | ... > ... |
| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:24:541:24:544 | access to property Prop |
-| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:524:24:527 | access to property Prop | UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:524:24:527 | this access | UseUseExplosion.cs:24:541:24:544 | this access |
| UseUseExplosion.cs:24:524:24:527 | this access | UseUseExplosion.cs:24:2743:24:2748 | this access |
| UseUseExplosion.cs:24:541:24:544 | [post] this access | UseUseExplosion.cs:24:558:24:561 | this access |
| UseUseExplosion.cs:24:541:24:544 | [post] this access | UseUseExplosion.cs:24:2728:24:2733 | this access |
| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:24:541:24:549 | ... > ... |
| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:24:558:24:561 | access to property Prop |
-| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:541:24:544 | access to property Prop | UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:541:24:544 | this access | UseUseExplosion.cs:24:558:24:561 | this access |
| UseUseExplosion.cs:24:541:24:544 | this access | UseUseExplosion.cs:24:2728:24:2733 | this access |
| UseUseExplosion.cs:24:558:24:561 | [post] this access | UseUseExplosion.cs:24:575:24:578 | this access |
| UseUseExplosion.cs:24:558:24:561 | [post] this access | UseUseExplosion.cs:24:2713:24:2718 | this access |
| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:24:558:24:566 | ... > ... |
| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:24:575:24:578 | access to property Prop |
-| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:558:24:561 | access to property Prop | UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:558:24:561 | this access | UseUseExplosion.cs:24:575:24:578 | this access |
| UseUseExplosion.cs:24:558:24:561 | this access | UseUseExplosion.cs:24:2713:24:2718 | this access |
| UseUseExplosion.cs:24:575:24:578 | [post] this access | UseUseExplosion.cs:24:592:24:595 | this access |
| UseUseExplosion.cs:24:575:24:578 | [post] this access | UseUseExplosion.cs:24:2698:24:2703 | this access |
| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:24:575:24:583 | ... > ... |
| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:24:592:24:595 | access to property Prop |
-| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:575:24:578 | access to property Prop | UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:575:24:578 | this access | UseUseExplosion.cs:24:592:24:595 | this access |
| UseUseExplosion.cs:24:575:24:578 | this access | UseUseExplosion.cs:24:2698:24:2703 | this access |
| UseUseExplosion.cs:24:592:24:595 | [post] this access | UseUseExplosion.cs:24:609:24:612 | this access |
| UseUseExplosion.cs:24:592:24:595 | [post] this access | UseUseExplosion.cs:24:2683:24:2688 | this access |
| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:24:592:24:600 | ... > ... |
| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:24:609:24:612 | access to property Prop |
-| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:592:24:595 | access to property Prop | UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:592:24:595 | this access | UseUseExplosion.cs:24:609:24:612 | this access |
| UseUseExplosion.cs:24:592:24:595 | this access | UseUseExplosion.cs:24:2683:24:2688 | this access |
| UseUseExplosion.cs:24:609:24:612 | [post] this access | UseUseExplosion.cs:24:626:24:629 | this access |
| UseUseExplosion.cs:24:609:24:612 | [post] this access | UseUseExplosion.cs:24:2668:24:2673 | this access |
| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:24:609:24:617 | ... > ... |
| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:24:626:24:629 | access to property Prop |
-| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:609:24:612 | access to property Prop | UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:609:24:612 | this access | UseUseExplosion.cs:24:626:24:629 | this access |
| UseUseExplosion.cs:24:609:24:612 | this access | UseUseExplosion.cs:24:2668:24:2673 | this access |
| UseUseExplosion.cs:24:626:24:629 | [post] this access | UseUseExplosion.cs:24:643:24:646 | this access |
| UseUseExplosion.cs:24:626:24:629 | [post] this access | UseUseExplosion.cs:24:2653:24:2658 | this access |
| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:24:626:24:634 | ... > ... |
| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:24:643:24:646 | access to property Prop |
-| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:626:24:629 | access to property Prop | UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:626:24:629 | this access | UseUseExplosion.cs:24:643:24:646 | this access |
| UseUseExplosion.cs:24:626:24:629 | this access | UseUseExplosion.cs:24:2653:24:2658 | this access |
| UseUseExplosion.cs:24:643:24:646 | [post] this access | UseUseExplosion.cs:24:660:24:663 | this access |
| UseUseExplosion.cs:24:643:24:646 | [post] this access | UseUseExplosion.cs:24:2638:24:2643 | this access |
| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:24:643:24:651 | ... > ... |
| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:24:660:24:663 | access to property Prop |
-| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:643:24:646 | access to property Prop | UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:643:24:646 | this access | UseUseExplosion.cs:24:660:24:663 | this access |
| UseUseExplosion.cs:24:643:24:646 | this access | UseUseExplosion.cs:24:2638:24:2643 | this access |
| UseUseExplosion.cs:24:660:24:663 | [post] this access | UseUseExplosion.cs:24:677:24:680 | this access |
| UseUseExplosion.cs:24:660:24:663 | [post] this access | UseUseExplosion.cs:24:2623:24:2628 | this access |
| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:24:660:24:668 | ... > ... |
| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:24:677:24:680 | access to property Prop |
-| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:660:24:663 | access to property Prop | UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:660:24:663 | this access | UseUseExplosion.cs:24:677:24:680 | this access |
| UseUseExplosion.cs:24:660:24:663 | this access | UseUseExplosion.cs:24:2623:24:2628 | this access |
| UseUseExplosion.cs:24:677:24:680 | [post] this access | UseUseExplosion.cs:24:694:24:697 | this access |
| UseUseExplosion.cs:24:677:24:680 | [post] this access | UseUseExplosion.cs:24:2608:24:2613 | this access |
| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:24:677:24:685 | ... > ... |
| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:24:694:24:697 | access to property Prop |
-| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:677:24:680 | access to property Prop | UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:677:24:680 | this access | UseUseExplosion.cs:24:694:24:697 | this access |
| UseUseExplosion.cs:24:677:24:680 | this access | UseUseExplosion.cs:24:2608:24:2613 | this access |
| UseUseExplosion.cs:24:694:24:697 | [post] this access | UseUseExplosion.cs:24:711:24:714 | this access |
| UseUseExplosion.cs:24:694:24:697 | [post] this access | UseUseExplosion.cs:24:2593:24:2598 | this access |
| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:24:694:24:702 | ... > ... |
| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:24:711:24:714 | access to property Prop |
-| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:694:24:697 | access to property Prop | UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:694:24:697 | this access | UseUseExplosion.cs:24:711:24:714 | this access |
| UseUseExplosion.cs:24:694:24:697 | this access | UseUseExplosion.cs:24:2593:24:2598 | this access |
| UseUseExplosion.cs:24:711:24:714 | [post] this access | UseUseExplosion.cs:24:728:24:731 | this access |
| UseUseExplosion.cs:24:711:24:714 | [post] this access | UseUseExplosion.cs:24:2578:24:2583 | this access |
| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:24:711:24:719 | ... > ... |
| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:24:728:24:731 | access to property Prop |
-| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:711:24:714 | access to property Prop | UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:711:24:714 | this access | UseUseExplosion.cs:24:728:24:731 | this access |
| UseUseExplosion.cs:24:711:24:714 | this access | UseUseExplosion.cs:24:2578:24:2583 | this access |
| UseUseExplosion.cs:24:728:24:731 | [post] this access | UseUseExplosion.cs:24:745:24:748 | this access |
| UseUseExplosion.cs:24:728:24:731 | [post] this access | UseUseExplosion.cs:24:2563:24:2568 | this access |
| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:24:728:24:736 | ... > ... |
| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:24:745:24:748 | access to property Prop |
-| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:728:24:731 | access to property Prop | UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:728:24:731 | this access | UseUseExplosion.cs:24:745:24:748 | this access |
| UseUseExplosion.cs:24:728:24:731 | this access | UseUseExplosion.cs:24:2563:24:2568 | this access |
| UseUseExplosion.cs:24:745:24:748 | [post] this access | UseUseExplosion.cs:24:762:24:765 | this access |
| UseUseExplosion.cs:24:745:24:748 | [post] this access | UseUseExplosion.cs:24:2548:24:2553 | this access |
| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:24:745:24:753 | ... > ... |
| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:24:762:24:765 | access to property Prop |
-| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:745:24:748 | access to property Prop | UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:745:24:748 | this access | UseUseExplosion.cs:24:762:24:765 | this access |
| UseUseExplosion.cs:24:745:24:748 | this access | UseUseExplosion.cs:24:2548:24:2553 | this access |
| UseUseExplosion.cs:24:762:24:765 | [post] this access | UseUseExplosion.cs:24:779:24:782 | this access |
| UseUseExplosion.cs:24:762:24:765 | [post] this access | UseUseExplosion.cs:24:2533:24:2538 | this access |
| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:24:762:24:770 | ... > ... |
| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:24:779:24:782 | access to property Prop |
-| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:762:24:765 | access to property Prop | UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:762:24:765 | this access | UseUseExplosion.cs:24:779:24:782 | this access |
| UseUseExplosion.cs:24:762:24:765 | this access | UseUseExplosion.cs:24:2533:24:2538 | this access |
| UseUseExplosion.cs:24:779:24:782 | [post] this access | UseUseExplosion.cs:24:796:24:799 | this access |
| UseUseExplosion.cs:24:779:24:782 | [post] this access | UseUseExplosion.cs:24:2518:24:2523 | this access |
| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:24:779:24:787 | ... > ... |
| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:24:796:24:799 | access to property Prop |
-| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:779:24:782 | access to property Prop | UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:779:24:782 | this access | UseUseExplosion.cs:24:796:24:799 | this access |
| UseUseExplosion.cs:24:779:24:782 | this access | UseUseExplosion.cs:24:2518:24:2523 | this access |
| UseUseExplosion.cs:24:796:24:799 | [post] this access | UseUseExplosion.cs:24:813:24:816 | this access |
| UseUseExplosion.cs:24:796:24:799 | [post] this access | UseUseExplosion.cs:24:2503:24:2508 | this access |
| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:24:796:24:804 | ... > ... |
| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:24:813:24:816 | access to property Prop |
-| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:796:24:799 | access to property Prop | UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:796:24:799 | this access | UseUseExplosion.cs:24:813:24:816 | this access |
| UseUseExplosion.cs:24:796:24:799 | this access | UseUseExplosion.cs:24:2503:24:2508 | this access |
| UseUseExplosion.cs:24:813:24:816 | [post] this access | UseUseExplosion.cs:24:830:24:833 | this access |
| UseUseExplosion.cs:24:813:24:816 | [post] this access | UseUseExplosion.cs:24:2488:24:2493 | this access |
| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:24:813:24:821 | ... > ... |
| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:24:830:24:833 | access to property Prop |
-| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:813:24:816 | access to property Prop | UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:813:24:816 | this access | UseUseExplosion.cs:24:830:24:833 | this access |
| UseUseExplosion.cs:24:813:24:816 | this access | UseUseExplosion.cs:24:2488:24:2493 | this access |
| UseUseExplosion.cs:24:830:24:833 | [post] this access | UseUseExplosion.cs:24:847:24:850 | this access |
| UseUseExplosion.cs:24:830:24:833 | [post] this access | UseUseExplosion.cs:24:2473:24:2478 | this access |
| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:24:830:24:838 | ... > ... |
| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:24:847:24:850 | access to property Prop |
-| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:830:24:833 | access to property Prop | UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:830:24:833 | this access | UseUseExplosion.cs:24:847:24:850 | this access |
| UseUseExplosion.cs:24:830:24:833 | this access | UseUseExplosion.cs:24:2473:24:2478 | this access |
| UseUseExplosion.cs:24:847:24:850 | [post] this access | UseUseExplosion.cs:24:864:24:867 | this access |
| UseUseExplosion.cs:24:847:24:850 | [post] this access | UseUseExplosion.cs:24:2458:24:2463 | this access |
| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:24:847:24:855 | ... > ... |
| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:24:864:24:867 | access to property Prop |
-| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:847:24:850 | access to property Prop | UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:847:24:850 | this access | UseUseExplosion.cs:24:864:24:867 | this access |
| UseUseExplosion.cs:24:847:24:850 | this access | UseUseExplosion.cs:24:2458:24:2463 | this access |
| UseUseExplosion.cs:24:864:24:867 | [post] this access | UseUseExplosion.cs:24:881:24:884 | this access |
| UseUseExplosion.cs:24:864:24:867 | [post] this access | UseUseExplosion.cs:24:2443:24:2448 | this access |
| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:24:864:24:872 | ... > ... |
| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:24:881:24:884 | access to property Prop |
-| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:864:24:867 | access to property Prop | UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:864:24:867 | this access | UseUseExplosion.cs:24:881:24:884 | this access |
| UseUseExplosion.cs:24:864:24:867 | this access | UseUseExplosion.cs:24:2443:24:2448 | this access |
| UseUseExplosion.cs:24:881:24:884 | [post] this access | UseUseExplosion.cs:24:898:24:901 | this access |
| UseUseExplosion.cs:24:881:24:884 | [post] this access | UseUseExplosion.cs:24:2428:24:2433 | this access |
| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:24:881:24:889 | ... > ... |
| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:24:898:24:901 | access to property Prop |
-| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:881:24:884 | access to property Prop | UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:881:24:884 | this access | UseUseExplosion.cs:24:898:24:901 | this access |
| UseUseExplosion.cs:24:881:24:884 | this access | UseUseExplosion.cs:24:2428:24:2433 | this access |
| UseUseExplosion.cs:24:898:24:901 | [post] this access | UseUseExplosion.cs:24:915:24:918 | this access |
| UseUseExplosion.cs:24:898:24:901 | [post] this access | UseUseExplosion.cs:24:2413:24:2418 | this access |
| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:24:898:24:906 | ... > ... |
| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:24:915:24:918 | access to property Prop |
-| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:898:24:901 | access to property Prop | UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:898:24:901 | this access | UseUseExplosion.cs:24:915:24:918 | this access |
| UseUseExplosion.cs:24:898:24:901 | this access | UseUseExplosion.cs:24:2413:24:2418 | this access |
| UseUseExplosion.cs:24:915:24:918 | [post] this access | UseUseExplosion.cs:24:932:24:935 | this access |
| UseUseExplosion.cs:24:915:24:918 | [post] this access | UseUseExplosion.cs:24:2398:24:2403 | this access |
| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:24:915:24:923 | ... > ... |
| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:24:932:24:935 | access to property Prop |
-| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:915:24:918 | access to property Prop | UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:915:24:918 | this access | UseUseExplosion.cs:24:932:24:935 | this access |
| UseUseExplosion.cs:24:915:24:918 | this access | UseUseExplosion.cs:24:2398:24:2403 | this access |
| UseUseExplosion.cs:24:932:24:935 | [post] this access | UseUseExplosion.cs:24:949:24:952 | this access |
| UseUseExplosion.cs:24:932:24:935 | [post] this access | UseUseExplosion.cs:24:2383:24:2388 | this access |
| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:24:932:24:940 | ... > ... |
| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:24:949:24:952 | access to property Prop |
-| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:932:24:935 | access to property Prop | UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:932:24:935 | this access | UseUseExplosion.cs:24:949:24:952 | this access |
| UseUseExplosion.cs:24:932:24:935 | this access | UseUseExplosion.cs:24:2383:24:2388 | this access |
| UseUseExplosion.cs:24:949:24:952 | [post] this access | UseUseExplosion.cs:24:966:24:969 | this access |
| UseUseExplosion.cs:24:949:24:952 | [post] this access | UseUseExplosion.cs:24:2368:24:2373 | this access |
| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:24:949:24:957 | ... > ... |
| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:24:966:24:969 | access to property Prop |
-| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:949:24:952 | access to property Prop | UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:949:24:952 | this access | UseUseExplosion.cs:24:966:24:969 | this access |
| UseUseExplosion.cs:24:949:24:952 | this access | UseUseExplosion.cs:24:2368:24:2373 | this access |
| UseUseExplosion.cs:24:966:24:969 | [post] this access | UseUseExplosion.cs:24:983:24:986 | this access |
| UseUseExplosion.cs:24:966:24:969 | [post] this access | UseUseExplosion.cs:24:2353:24:2358 | this access |
| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:24:966:24:974 | ... > ... |
| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:24:983:24:986 | access to property Prop |
-| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:966:24:969 | access to property Prop | UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:966:24:969 | this access | UseUseExplosion.cs:24:983:24:986 | this access |
| UseUseExplosion.cs:24:966:24:969 | this access | UseUseExplosion.cs:24:2353:24:2358 | this access |
| UseUseExplosion.cs:24:983:24:986 | [post] this access | UseUseExplosion.cs:24:1000:24:1003 | this access |
| UseUseExplosion.cs:24:983:24:986 | [post] this access | UseUseExplosion.cs:24:2338:24:2343 | this access |
| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:24:983:24:991 | ... > ... |
| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:24:1000:24:1003 | access to property Prop |
-| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:983:24:986 | access to property Prop | UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:983:24:986 | this access | UseUseExplosion.cs:24:1000:24:1003 | this access |
| UseUseExplosion.cs:24:983:24:986 | this access | UseUseExplosion.cs:24:2338:24:2343 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | [post] this access | UseUseExplosion.cs:24:1017:24:1020 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | [post] this access | UseUseExplosion.cs:24:2323:24:2328 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:24:1000:24:1008 | ... > ... |
| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:24:1017:24:1020 | access to property Prop |
-| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1000:24:1003 | access to property Prop | UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1000:24:1003 | this access | UseUseExplosion.cs:24:1017:24:1020 | this access |
| UseUseExplosion.cs:24:1000:24:1003 | this access | UseUseExplosion.cs:24:2323:24:2328 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | [post] this access | UseUseExplosion.cs:24:1034:24:1037 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | [post] this access | UseUseExplosion.cs:24:2308:24:2313 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:24:1017:24:1025 | ... > ... |
| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:24:1034:24:1037 | access to property Prop |
-| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1017:24:1020 | access to property Prop | UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1017:24:1020 | this access | UseUseExplosion.cs:24:1034:24:1037 | this access |
| UseUseExplosion.cs:24:1017:24:1020 | this access | UseUseExplosion.cs:24:2308:24:2313 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | [post] this access | UseUseExplosion.cs:24:1051:24:1054 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | [post] this access | UseUseExplosion.cs:24:2293:24:2298 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:24:1034:24:1042 | ... > ... |
| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:24:1051:24:1054 | access to property Prop |
-| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1034:24:1037 | access to property Prop | UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1034:24:1037 | this access | UseUseExplosion.cs:24:1051:24:1054 | this access |
| UseUseExplosion.cs:24:1034:24:1037 | this access | UseUseExplosion.cs:24:2293:24:2298 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | [post] this access | UseUseExplosion.cs:24:1068:24:1071 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | [post] this access | UseUseExplosion.cs:24:2278:24:2283 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:24:1051:24:1059 | ... > ... |
| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:24:1068:24:1071 | access to property Prop |
-| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1051:24:1054 | access to property Prop | UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1051:24:1054 | this access | UseUseExplosion.cs:24:1068:24:1071 | this access |
| UseUseExplosion.cs:24:1051:24:1054 | this access | UseUseExplosion.cs:24:2278:24:2283 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | [post] this access | UseUseExplosion.cs:24:1085:24:1088 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | [post] this access | UseUseExplosion.cs:24:2263:24:2268 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:24:1068:24:1076 | ... > ... |
| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:24:1085:24:1088 | access to property Prop |
-| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1068:24:1071 | access to property Prop | UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1068:24:1071 | this access | UseUseExplosion.cs:24:1085:24:1088 | this access |
| UseUseExplosion.cs:24:1068:24:1071 | this access | UseUseExplosion.cs:24:2263:24:2268 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | [post] this access | UseUseExplosion.cs:24:1102:24:1105 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | [post] this access | UseUseExplosion.cs:24:2248:24:2253 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:24:1085:24:1093 | ... > ... |
| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:24:1102:24:1105 | access to property Prop |
-| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1085:24:1088 | access to property Prop | UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1085:24:1088 | this access | UseUseExplosion.cs:24:1102:24:1105 | this access |
| UseUseExplosion.cs:24:1085:24:1088 | this access | UseUseExplosion.cs:24:2248:24:2253 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | [post] this access | UseUseExplosion.cs:24:1119:24:1122 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | [post] this access | UseUseExplosion.cs:24:2233:24:2238 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:24:1102:24:1110 | ... > ... |
| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:24:1119:24:1122 | access to property Prop |
-| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1102:24:1105 | access to property Prop | UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1102:24:1105 | this access | UseUseExplosion.cs:24:1119:24:1122 | this access |
| UseUseExplosion.cs:24:1102:24:1105 | this access | UseUseExplosion.cs:24:2233:24:2238 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | [post] this access | UseUseExplosion.cs:24:1136:24:1139 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | [post] this access | UseUseExplosion.cs:24:2218:24:2223 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:24:1119:24:1127 | ... > ... |
| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:24:1136:24:1139 | access to property Prop |
-| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1119:24:1122 | access to property Prop | UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1119:24:1122 | this access | UseUseExplosion.cs:24:1136:24:1139 | this access |
| UseUseExplosion.cs:24:1119:24:1122 | this access | UseUseExplosion.cs:24:2218:24:2223 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | [post] this access | UseUseExplosion.cs:24:1153:24:1156 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | [post] this access | UseUseExplosion.cs:24:2203:24:2208 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:24:1136:24:1144 | ... > ... |
| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:24:1153:24:1156 | access to property Prop |
-| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1136:24:1139 | access to property Prop | UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1136:24:1139 | this access | UseUseExplosion.cs:24:1153:24:1156 | this access |
| UseUseExplosion.cs:24:1136:24:1139 | this access | UseUseExplosion.cs:24:2203:24:2208 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | [post] this access | UseUseExplosion.cs:24:1170:24:1173 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | [post] this access | UseUseExplosion.cs:24:2188:24:2193 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:24:1153:24:1161 | ... > ... |
| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:24:1170:24:1173 | access to property Prop |
-| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1153:24:1156 | access to property Prop | UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1153:24:1156 | this access | UseUseExplosion.cs:24:1170:24:1173 | this access |
| UseUseExplosion.cs:24:1153:24:1156 | this access | UseUseExplosion.cs:24:2188:24:2193 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | [post] this access | UseUseExplosion.cs:24:1187:24:1190 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | [post] this access | UseUseExplosion.cs:24:2173:24:2178 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:24:1170:24:1178 | ... > ... |
| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:24:1187:24:1190 | access to property Prop |
-| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1170:24:1173 | access to property Prop | UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1170:24:1173 | this access | UseUseExplosion.cs:24:1187:24:1190 | this access |
| UseUseExplosion.cs:24:1170:24:1173 | this access | UseUseExplosion.cs:24:2173:24:2178 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | [post] this access | UseUseExplosion.cs:24:1204:24:1207 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | [post] this access | UseUseExplosion.cs:24:2158:24:2163 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:24:1187:24:1195 | ... > ... |
| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:24:1204:24:1207 | access to property Prop |
-| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1187:24:1190 | access to property Prop | UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1187:24:1190 | this access | UseUseExplosion.cs:24:1204:24:1207 | this access |
| UseUseExplosion.cs:24:1187:24:1190 | this access | UseUseExplosion.cs:24:2158:24:2163 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | [post] this access | UseUseExplosion.cs:24:1221:24:1224 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | [post] this access | UseUseExplosion.cs:24:2143:24:2148 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:24:1204:24:1212 | ... > ... |
| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:24:1221:24:1224 | access to property Prop |
-| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1204:24:1207 | access to property Prop | UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1204:24:1207 | this access | UseUseExplosion.cs:24:1221:24:1224 | this access |
| UseUseExplosion.cs:24:1204:24:1207 | this access | UseUseExplosion.cs:24:2143:24:2148 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | [post] this access | UseUseExplosion.cs:24:1238:24:1241 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | [post] this access | UseUseExplosion.cs:24:2128:24:2133 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:24:1221:24:1229 | ... > ... |
| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:24:1238:24:1241 | access to property Prop |
-| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1221:24:1224 | access to property Prop | UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1221:24:1224 | this access | UseUseExplosion.cs:24:1238:24:1241 | this access |
| UseUseExplosion.cs:24:1221:24:1224 | this access | UseUseExplosion.cs:24:2128:24:2133 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | [post] this access | UseUseExplosion.cs:24:1255:24:1258 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | [post] this access | UseUseExplosion.cs:24:2113:24:2118 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:24:1238:24:1246 | ... > ... |
| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:24:1255:24:1258 | access to property Prop |
-| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1238:24:1241 | access to property Prop | UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1238:24:1241 | this access | UseUseExplosion.cs:24:1255:24:1258 | this access |
| UseUseExplosion.cs:24:1238:24:1241 | this access | UseUseExplosion.cs:24:2113:24:2118 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | [post] this access | UseUseExplosion.cs:24:1272:24:1275 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | [post] this access | UseUseExplosion.cs:24:2098:24:2103 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:24:1255:24:1263 | ... > ... |
| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:24:1272:24:1275 | access to property Prop |
-| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1255:24:1258 | access to property Prop | UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1255:24:1258 | this access | UseUseExplosion.cs:24:1272:24:1275 | this access |
| UseUseExplosion.cs:24:1255:24:1258 | this access | UseUseExplosion.cs:24:2098:24:2103 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | [post] this access | UseUseExplosion.cs:24:1289:24:1292 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | [post] this access | UseUseExplosion.cs:24:2083:24:2088 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:24:1272:24:1280 | ... > ... |
| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:24:1289:24:1292 | access to property Prop |
-| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1272:24:1275 | access to property Prop | UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1272:24:1275 | this access | UseUseExplosion.cs:24:1289:24:1292 | this access |
| UseUseExplosion.cs:24:1272:24:1275 | this access | UseUseExplosion.cs:24:2083:24:2088 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | [post] this access | UseUseExplosion.cs:24:1306:24:1309 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | [post] this access | UseUseExplosion.cs:24:2068:24:2073 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:24:1289:24:1297 | ... > ... |
| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:24:1306:24:1309 | access to property Prop |
-| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1289:24:1292 | access to property Prop | UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1289:24:1292 | this access | UseUseExplosion.cs:24:1306:24:1309 | this access |
| UseUseExplosion.cs:24:1289:24:1292 | this access | UseUseExplosion.cs:24:2068:24:2073 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | [post] this access | UseUseExplosion.cs:24:1323:24:1326 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | [post] this access | UseUseExplosion.cs:24:2053:24:2058 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:24:1306:24:1314 | ... > ... |
| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:24:1323:24:1326 | access to property Prop |
-| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1306:24:1309 | access to property Prop | UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1306:24:1309 | this access | UseUseExplosion.cs:24:1323:24:1326 | this access |
| UseUseExplosion.cs:24:1306:24:1309 | this access | UseUseExplosion.cs:24:2053:24:2058 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | [post] this access | UseUseExplosion.cs:24:1340:24:1343 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | [post] this access | UseUseExplosion.cs:24:2038:24:2043 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:24:1323:24:1331 | ... > ... |
| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:24:1340:24:1343 | access to property Prop |
-| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1323:24:1326 | access to property Prop | UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1323:24:1326 | this access | UseUseExplosion.cs:24:1340:24:1343 | this access |
| UseUseExplosion.cs:24:1323:24:1326 | this access | UseUseExplosion.cs:24:2038:24:2043 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | [post] this access | UseUseExplosion.cs:24:1357:24:1360 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | [post] this access | UseUseExplosion.cs:24:2023:24:2028 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:24:1340:24:1348 | ... > ... |
| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:24:1357:24:1360 | access to property Prop |
-| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1340:24:1343 | access to property Prop | UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1340:24:1343 | this access | UseUseExplosion.cs:24:1357:24:1360 | this access |
| UseUseExplosion.cs:24:1340:24:1343 | this access | UseUseExplosion.cs:24:2023:24:2028 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | [post] this access | UseUseExplosion.cs:24:1374:24:1377 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | [post] this access | UseUseExplosion.cs:24:2008:24:2013 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:24:1357:24:1365 | ... > ... |
| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:24:1374:24:1377 | access to property Prop |
-| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1357:24:1360 | access to property Prop | UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1357:24:1360 | this access | UseUseExplosion.cs:24:1374:24:1377 | this access |
| UseUseExplosion.cs:24:1357:24:1360 | this access | UseUseExplosion.cs:24:2008:24:2013 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | [post] this access | UseUseExplosion.cs:24:1391:24:1394 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | [post] this access | UseUseExplosion.cs:24:1993:24:1998 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:24:1374:24:1382 | ... > ... |
| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:24:1391:24:1394 | access to property Prop |
-| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1374:24:1377 | access to property Prop | UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1374:24:1377 | this access | UseUseExplosion.cs:24:1391:24:1394 | this access |
| UseUseExplosion.cs:24:1374:24:1377 | this access | UseUseExplosion.cs:24:1993:24:1998 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | [post] this access | UseUseExplosion.cs:24:1408:24:1411 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | [post] this access | UseUseExplosion.cs:24:1978:24:1983 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:24:1391:24:1399 | ... > ... |
| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:24:1408:24:1411 | access to property Prop |
-| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1391:24:1394 | access to property Prop | UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1391:24:1394 | this access | UseUseExplosion.cs:24:1408:24:1411 | this access |
| UseUseExplosion.cs:24:1391:24:1394 | this access | UseUseExplosion.cs:24:1978:24:1983 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | [post] this access | UseUseExplosion.cs:24:1425:24:1428 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | [post] this access | UseUseExplosion.cs:24:1963:24:1968 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:24:1408:24:1416 | ... > ... |
| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:24:1425:24:1428 | access to property Prop |
-| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1408:24:1411 | access to property Prop | UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1408:24:1411 | this access | UseUseExplosion.cs:24:1425:24:1428 | this access |
| UseUseExplosion.cs:24:1408:24:1411 | this access | UseUseExplosion.cs:24:1963:24:1968 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | [post] this access | UseUseExplosion.cs:24:1442:24:1445 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | [post] this access | UseUseExplosion.cs:24:1948:24:1953 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:24:1425:24:1433 | ... > ... |
| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:24:1442:24:1445 | access to property Prop |
-| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1425:24:1428 | access to property Prop | UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1425:24:1428 | this access | UseUseExplosion.cs:24:1442:24:1445 | this access |
| UseUseExplosion.cs:24:1425:24:1428 | this access | UseUseExplosion.cs:24:1948:24:1953 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | [post] this access | UseUseExplosion.cs:24:1459:24:1462 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | [post] this access | UseUseExplosion.cs:24:1933:24:1938 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:24:1442:24:1450 | ... > ... |
| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:24:1459:24:1462 | access to property Prop |
-| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1442:24:1445 | access to property Prop | UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1442:24:1445 | this access | UseUseExplosion.cs:24:1459:24:1462 | this access |
| UseUseExplosion.cs:24:1442:24:1445 | this access | UseUseExplosion.cs:24:1933:24:1938 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | [post] this access | UseUseExplosion.cs:24:1476:24:1479 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | [post] this access | UseUseExplosion.cs:24:1918:24:1923 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:24:1459:24:1467 | ... > ... |
| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:24:1476:24:1479 | access to property Prop |
-| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1459:24:1462 | access to property Prop | UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1459:24:1462 | this access | UseUseExplosion.cs:24:1476:24:1479 | this access |
| UseUseExplosion.cs:24:1459:24:1462 | this access | UseUseExplosion.cs:24:1918:24:1923 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | [post] this access | UseUseExplosion.cs:24:1493:24:1496 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | [post] this access | UseUseExplosion.cs:24:1903:24:1908 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:24:1476:24:1484 | ... > ... |
| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:24:1493:24:1496 | access to property Prop |
-| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1476:24:1479 | access to property Prop | UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1476:24:1479 | this access | UseUseExplosion.cs:24:1493:24:1496 | this access |
| UseUseExplosion.cs:24:1476:24:1479 | this access | UseUseExplosion.cs:24:1903:24:1908 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | [post] this access | UseUseExplosion.cs:24:1510:24:1513 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | [post] this access | UseUseExplosion.cs:24:1888:24:1893 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:24:1493:24:1501 | ... > ... |
| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:24:1510:24:1513 | access to property Prop |
-| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1493:24:1496 | access to property Prop | UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1493:24:1496 | this access | UseUseExplosion.cs:24:1510:24:1513 | this access |
| UseUseExplosion.cs:24:1493:24:1496 | this access | UseUseExplosion.cs:24:1888:24:1893 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | [post] this access | UseUseExplosion.cs:24:1527:24:1530 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | [post] this access | UseUseExplosion.cs:24:1873:24:1878 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:24:1510:24:1518 | ... > ... |
| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:24:1527:24:1530 | access to property Prop |
-| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1510:24:1513 | access to property Prop | UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1510:24:1513 | this access | UseUseExplosion.cs:24:1527:24:1530 | this access |
| UseUseExplosion.cs:24:1510:24:1513 | this access | UseUseExplosion.cs:24:1873:24:1878 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | [post] this access | UseUseExplosion.cs:24:1544:24:1547 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | [post] this access | UseUseExplosion.cs:24:1858:24:1863 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:24:1527:24:1535 | ... > ... |
| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:24:1544:24:1547 | access to property Prop |
-| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1527:24:1530 | access to property Prop | UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1527:24:1530 | this access | UseUseExplosion.cs:24:1544:24:1547 | this access |
| UseUseExplosion.cs:24:1527:24:1530 | this access | UseUseExplosion.cs:24:1858:24:1863 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | [post] this access | UseUseExplosion.cs:24:1561:24:1564 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | [post] this access | UseUseExplosion.cs:24:1843:24:1848 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:24:1544:24:1552 | ... > ... |
| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:24:1561:24:1564 | access to property Prop |
-| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1544:24:1547 | access to property Prop | UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1544:24:1547 | this access | UseUseExplosion.cs:24:1561:24:1564 | this access |
| UseUseExplosion.cs:24:1544:24:1547 | this access | UseUseExplosion.cs:24:1843:24:1848 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | [post] this access | UseUseExplosion.cs:24:1577:24:1580 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | [post] this access | UseUseExplosion.cs:24:1828:24:1833 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:24:1561:24:1568 | ... > ... |
| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:24:1577:24:1580 | access to property Prop |
-| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1561:24:1564 | access to property Prop | UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1561:24:1564 | this access | UseUseExplosion.cs:24:1577:24:1580 | this access |
| UseUseExplosion.cs:24:1561:24:1564 | this access | UseUseExplosion.cs:24:1828:24:1833 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | [post] this access | UseUseExplosion.cs:24:1593:24:1596 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | [post] this access | UseUseExplosion.cs:24:1813:24:1818 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:24:1577:24:1584 | ... > ... |
| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:24:1593:24:1596 | access to property Prop |
-| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1577:24:1580 | access to property Prop | UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1577:24:1580 | this access | UseUseExplosion.cs:24:1593:24:1596 | this access |
| UseUseExplosion.cs:24:1577:24:1580 | this access | UseUseExplosion.cs:24:1813:24:1818 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | [post] this access | UseUseExplosion.cs:24:1609:24:1612 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | [post] this access | UseUseExplosion.cs:24:1798:24:1803 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:24:1593:24:1600 | ... > ... |
| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:24:1609:24:1612 | access to property Prop |
-| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1593:24:1596 | access to property Prop | UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1593:24:1596 | this access | UseUseExplosion.cs:24:1609:24:1612 | this access |
| UseUseExplosion.cs:24:1593:24:1596 | this access | UseUseExplosion.cs:24:1798:24:1803 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | [post] this access | UseUseExplosion.cs:24:1625:24:1628 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | [post] this access | UseUseExplosion.cs:24:1783:24:1788 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:24:1609:24:1616 | ... > ... |
| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:24:1625:24:1628 | access to property Prop |
-| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1609:24:1612 | access to property Prop | UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1609:24:1612 | this access | UseUseExplosion.cs:24:1625:24:1628 | this access |
| UseUseExplosion.cs:24:1609:24:1612 | this access | UseUseExplosion.cs:24:1783:24:1788 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | [post] this access | UseUseExplosion.cs:24:1641:24:1644 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | [post] this access | UseUseExplosion.cs:24:1768:24:1773 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:24:1625:24:1632 | ... > ... |
| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:24:1641:24:1644 | access to property Prop |
-| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1625:24:1628 | access to property Prop | UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1625:24:1628 | this access | UseUseExplosion.cs:24:1641:24:1644 | this access |
| UseUseExplosion.cs:24:1625:24:1628 | this access | UseUseExplosion.cs:24:1768:24:1773 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | [post] this access | UseUseExplosion.cs:24:1657:24:1660 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | [post] this access | UseUseExplosion.cs:24:1753:24:1758 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:24:1641:24:1648 | ... > ... |
| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:24:1657:24:1660 | access to property Prop |
-| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1641:24:1644 | access to property Prop | UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1641:24:1644 | this access | UseUseExplosion.cs:24:1657:24:1660 | this access |
| UseUseExplosion.cs:24:1641:24:1644 | this access | UseUseExplosion.cs:24:1753:24:1758 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | [post] this access | UseUseExplosion.cs:24:1673:24:1676 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | [post] this access | UseUseExplosion.cs:24:1738:24:1743 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:24:1657:24:1664 | ... > ... |
| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:24:1673:24:1676 | access to property Prop |
-| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1657:24:1660 | access to property Prop | UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1657:24:1660 | this access | UseUseExplosion.cs:24:1673:24:1676 | this access |
| UseUseExplosion.cs:24:1657:24:1660 | this access | UseUseExplosion.cs:24:1738:24:1743 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | [post] this access | UseUseExplosion.cs:24:1689:24:1692 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | [post] this access | UseUseExplosion.cs:24:1723:24:1728 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:24:1673:24:1680 | ... > ... |
| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:24:1689:24:1692 | access to property Prop |
-| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1673:24:1676 | access to property Prop | UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1673:24:1676 | this access | UseUseExplosion.cs:24:1689:24:1692 | this access |
| UseUseExplosion.cs:24:1673:24:1676 | this access | UseUseExplosion.cs:24:1723:24:1728 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | [post] this access | UseUseExplosion.cs:24:1708:24:1713 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:24:1689:24:1696 | ... > ... |
-| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1689:24:1692 | access to property Prop | UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(this.Prop) |
| UseUseExplosion.cs:24:1689:24:1692 | this access | UseUseExplosion.cs:24:1708:24:1713 | this access |
| UseUseExplosion.cs:24:1689:24:1692 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
+| UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1699:24:1701 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1708:24:1713 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1708:24:1713 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1712:24:1712 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1712:24:1712 | access to local variable x | UseUseExplosion.cs:24:1708:24:1713 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1723:24:1728 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1723:24:1728 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1727:24:1727 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1727:24:1727 | access to local variable x | UseUseExplosion.cs:24:1723:24:1728 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1738:24:1743 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1738:24:1743 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1742:24:1742 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1742:24:1742 | access to local variable x | UseUseExplosion.cs:24:1738:24:1743 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1753:24:1758 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1753:24:1758 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1757:24:1757 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1757:24:1757 | access to local variable x | UseUseExplosion.cs:24:1753:24:1758 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1768:24:1773 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1768:24:1773 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1772:24:1772 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1772:24:1772 | access to local variable x | UseUseExplosion.cs:24:1768:24:1773 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1783:24:1788 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1783:24:1788 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1787:24:1787 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1787:24:1787 | access to local variable x | UseUseExplosion.cs:24:1783:24:1788 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1798:24:1803 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1798:24:1803 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1802:24:1802 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1802:24:1802 | access to local variable x | UseUseExplosion.cs:24:1798:24:1803 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1813:24:1818 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1813:24:1818 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1817:24:1817 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1817:24:1817 | access to local variable x | UseUseExplosion.cs:24:1813:24:1818 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1828:24:1833 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1828:24:1833 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1832:24:1832 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1832:24:1832 | access to local variable x | UseUseExplosion.cs:24:1828:24:1833 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1843:24:1848 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1843:24:1848 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1847:24:1847 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1847:24:1847 | access to local variable x | UseUseExplosion.cs:24:1843:24:1848 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1858:24:1863 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1858:24:1863 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1862:24:1862 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1862:24:1862 | access to local variable x | UseUseExplosion.cs:24:1858:24:1863 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1873:24:1878 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1873:24:1878 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1877:24:1877 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1877:24:1877 | access to local variable x | UseUseExplosion.cs:24:1873:24:1878 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1888:24:1893 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1888:24:1893 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1892:24:1892 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1892:24:1892 | access to local variable x | UseUseExplosion.cs:24:1888:24:1893 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1903:24:1908 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1903:24:1908 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1907:24:1907 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1907:24:1907 | access to local variable x | UseUseExplosion.cs:24:1903:24:1908 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1918:24:1923 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1918:24:1923 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1922:24:1922 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1922:24:1922 | access to local variable x | UseUseExplosion.cs:24:1918:24:1923 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1933:24:1938 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1933:24:1938 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1937:24:1937 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1937:24:1937 | access to local variable x | UseUseExplosion.cs:24:1933:24:1938 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1948:24:1953 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1948:24:1953 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1952:24:1952 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1952:24:1952 | access to local variable x | UseUseExplosion.cs:24:1948:24:1953 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1963:24:1968 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1963:24:1968 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1967:24:1967 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1967:24:1967 | access to local variable x | UseUseExplosion.cs:24:1963:24:1968 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1978:24:1983 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1978:24:1983 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1982:24:1982 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1982:24:1982 | access to local variable x | UseUseExplosion.cs:24:1978:24:1983 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:1993:24:1998 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:1993:24:1998 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:1997:24:1997 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:1997:24:1997 | access to local variable x | UseUseExplosion.cs:24:1993:24:1998 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2008:24:2013 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2008:24:2013 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2012:24:2012 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2012:24:2012 | access to local variable x | UseUseExplosion.cs:24:2008:24:2013 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2023:24:2028 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2023:24:2028 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2027:24:2027 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2027:24:2027 | access to local variable x | UseUseExplosion.cs:24:2023:24:2028 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2038:24:2043 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2038:24:2043 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2042:24:2042 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2042:24:2042 | access to local variable x | UseUseExplosion.cs:24:2038:24:2043 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2053:24:2058 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2053:24:2058 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2057:24:2057 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2057:24:2057 | access to local variable x | UseUseExplosion.cs:24:2053:24:2058 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2068:24:2073 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2068:24:2073 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2072:24:2072 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2072:24:2072 | access to local variable x | UseUseExplosion.cs:24:2068:24:2073 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2083:24:2088 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2083:24:2088 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2087:24:2087 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2087:24:2087 | access to local variable x | UseUseExplosion.cs:24:2083:24:2088 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2098:24:2103 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2098:24:2103 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2102:24:2102 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2102:24:2102 | access to local variable x | UseUseExplosion.cs:24:2098:24:2103 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2113:24:2118 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2113:24:2118 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2117:24:2117 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2117:24:2117 | access to local variable x | UseUseExplosion.cs:24:2113:24:2118 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2128:24:2133 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2128:24:2133 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2132:24:2132 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2132:24:2132 | access to local variable x | UseUseExplosion.cs:24:2128:24:2133 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2143:24:2148 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2143:24:2148 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2147:24:2147 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2147:24:2147 | access to local variable x | UseUseExplosion.cs:24:2143:24:2148 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2158:24:2163 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2158:24:2163 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2162:24:2162 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2162:24:2162 | access to local variable x | UseUseExplosion.cs:24:2158:24:2163 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2173:24:2178 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2173:24:2178 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2177:24:2177 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2177:24:2177 | access to local variable x | UseUseExplosion.cs:24:2173:24:2178 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2188:24:2193 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2188:24:2193 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2192:24:2192 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2192:24:2192 | access to local variable x | UseUseExplosion.cs:24:2188:24:2193 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2203:24:2208 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2203:24:2208 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2207:24:2207 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2207:24:2207 | access to local variable x | UseUseExplosion.cs:24:2203:24:2208 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2218:24:2223 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2218:24:2223 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2222:24:2222 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2222:24:2222 | access to local variable x | UseUseExplosion.cs:24:2218:24:2223 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2233:24:2238 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2233:24:2238 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2237:24:2237 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2237:24:2237 | access to local variable x | UseUseExplosion.cs:24:2233:24:2238 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2248:24:2253 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2248:24:2253 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2252:24:2252 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2252:24:2252 | access to local variable x | UseUseExplosion.cs:24:2248:24:2253 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2263:24:2268 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2263:24:2268 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2267:24:2267 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2267:24:2267 | access to local variable x | UseUseExplosion.cs:24:2263:24:2268 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2278:24:2283 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2278:24:2283 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2282:24:2282 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2282:24:2282 | access to local variable x | UseUseExplosion.cs:24:2278:24:2283 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2293:24:2298 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2293:24:2298 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2297:24:2297 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2297:24:2297 | access to local variable x | UseUseExplosion.cs:24:2293:24:2298 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2308:24:2313 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2308:24:2313 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2312:24:2312 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2312:24:2312 | access to local variable x | UseUseExplosion.cs:24:2308:24:2313 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2323:24:2328 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2323:24:2328 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2327:24:2327 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2327:24:2327 | access to local variable x | UseUseExplosion.cs:24:2323:24:2328 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2338:24:2343 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2338:24:2343 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2342:24:2342 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2342:24:2342 | access to local variable x | UseUseExplosion.cs:24:2338:24:2343 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2353:24:2358 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2353:24:2358 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2357:24:2357 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2357:24:2357 | access to local variable x | UseUseExplosion.cs:24:2353:24:2358 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2368:24:2373 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2368:24:2373 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2372:24:2372 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2372:24:2372 | access to local variable x | UseUseExplosion.cs:24:2368:24:2373 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2383:24:2388 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2383:24:2388 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2387:24:2387 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2387:24:2387 | access to local variable x | UseUseExplosion.cs:24:2383:24:2388 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2398:24:2403 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2398:24:2403 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2402:24:2402 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2402:24:2402 | access to local variable x | UseUseExplosion.cs:24:2398:24:2403 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2413:24:2418 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2413:24:2418 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2417:24:2417 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2417:24:2417 | access to local variable x | UseUseExplosion.cs:24:2413:24:2418 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2428:24:2433 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2428:24:2433 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2432:24:2432 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2432:24:2432 | access to local variable x | UseUseExplosion.cs:24:2428:24:2433 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2443:24:2448 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2443:24:2448 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2447:24:2447 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2447:24:2447 | access to local variable x | UseUseExplosion.cs:24:2443:24:2448 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2458:24:2463 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2458:24:2463 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2462:24:2462 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2462:24:2462 | access to local variable x | UseUseExplosion.cs:24:2458:24:2463 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2473:24:2478 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2473:24:2478 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2477:24:2477 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2477:24:2477 | access to local variable x | UseUseExplosion.cs:24:2473:24:2478 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2488:24:2493 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2488:24:2493 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2492:24:2492 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2492:24:2492 | access to local variable x | UseUseExplosion.cs:24:2488:24:2493 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2503:24:2508 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2503:24:2508 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2507:24:2507 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2507:24:2507 | access to local variable x | UseUseExplosion.cs:24:2503:24:2508 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2518:24:2523 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2518:24:2523 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2522:24:2522 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2522:24:2522 | access to local variable x | UseUseExplosion.cs:24:2518:24:2523 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2533:24:2538 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2533:24:2538 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2537:24:2537 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2537:24:2537 | access to local variable x | UseUseExplosion.cs:24:2533:24:2538 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2548:24:2553 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2548:24:2553 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2552:24:2552 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2552:24:2552 | access to local variable x | UseUseExplosion.cs:24:2548:24:2553 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2563:24:2568 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2563:24:2568 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2567:24:2567 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2567:24:2567 | access to local variable x | UseUseExplosion.cs:24:2563:24:2568 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2578:24:2583 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2578:24:2583 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2582:24:2582 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2582:24:2582 | access to local variable x | UseUseExplosion.cs:24:2578:24:2583 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2593:24:2598 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2593:24:2598 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2597:24:2597 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2597:24:2597 | access to local variable x | UseUseExplosion.cs:24:2593:24:2598 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2608:24:2613 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2608:24:2613 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2612:24:2612 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2612:24:2612 | access to local variable x | UseUseExplosion.cs:24:2608:24:2613 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2623:24:2628 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2623:24:2628 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2627:24:2627 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2627:24:2627 | access to local variable x | UseUseExplosion.cs:24:2623:24:2628 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2638:24:2643 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2638:24:2643 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2642:24:2642 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2642:24:2642 | access to local variable x | UseUseExplosion.cs:24:2638:24:2643 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2653:24:2658 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2653:24:2658 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2657:24:2657 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2657:24:2657 | access to local variable x | UseUseExplosion.cs:24:2653:24:2658 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2668:24:2673 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2668:24:2673 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2672:24:2672 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2672:24:2672 | access to local variable x | UseUseExplosion.cs:24:2668:24:2673 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2683:24:2688 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2683:24:2688 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2687:24:2687 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2687:24:2687 | access to local variable x | UseUseExplosion.cs:24:2683:24:2688 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2698:24:2703 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2698:24:2703 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2702:24:2702 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2702:24:2702 | access to local variable x | UseUseExplosion.cs:24:2698:24:2703 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2713:24:2718 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2713:24:2718 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2717:24:2717 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2717:24:2717 | access to local variable x | UseUseExplosion.cs:24:2713:24:2718 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2728:24:2733 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2728:24:2733 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2732:24:2732 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2732:24:2732 | access to local variable x | UseUseExplosion.cs:24:2728:24:2733 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2743:24:2748 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2743:24:2748 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2747:24:2747 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2747:24:2747 | access to local variable x | UseUseExplosion.cs:24:2743:24:2748 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2758:24:2763 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2758:24:2763 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2762:24:2762 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2762:24:2762 | access to local variable x | UseUseExplosion.cs:24:2758:24:2763 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2773:24:2778 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2773:24:2778 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2777:24:2777 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2777:24:2777 | access to local variable x | UseUseExplosion.cs:24:2773:24:2778 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2788:24:2793 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2788:24:2793 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2792:24:2792 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2792:24:2792 | access to local variable x | UseUseExplosion.cs:24:2788:24:2793 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2803:24:2808 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2803:24:2808 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2807:24:2807 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2807:24:2807 | access to local variable x | UseUseExplosion.cs:24:2803:24:2808 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2818:24:2823 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2818:24:2823 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2822:24:2822 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2822:24:2822 | access to local variable x | UseUseExplosion.cs:24:2818:24:2823 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2833:24:2838 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2833:24:2838 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2837:24:2837 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2837:24:2837 | access to local variable x | UseUseExplosion.cs:24:2833:24:2838 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2848:24:2853 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2848:24:2853 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2852:24:2852 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2852:24:2852 | access to local variable x | UseUseExplosion.cs:24:2848:24:2853 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2863:24:2868 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2863:24:2868 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2867:24:2867 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2867:24:2867 | access to local variable x | UseUseExplosion.cs:24:2863:24:2868 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2878:24:2883 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2878:24:2883 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2882:24:2882 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2882:24:2882 | access to local variable x | UseUseExplosion.cs:24:2878:24:2883 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2893:24:2898 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2893:24:2898 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2897:24:2897 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2897:24:2897 | access to local variable x | UseUseExplosion.cs:24:2893:24:2898 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2908:24:2913 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2908:24:2913 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2912:24:2912 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2912:24:2912 | access to local variable x | UseUseExplosion.cs:24:2908:24:2913 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2923:24:2928 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2923:24:2928 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2927:24:2927 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2927:24:2927 | access to local variable x | UseUseExplosion.cs:24:2923:24:2928 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2938:24:2943 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2938:24:2943 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2942:24:2942 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2942:24:2942 | access to local variable x | UseUseExplosion.cs:24:2938:24:2943 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2953:24:2958 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2953:24:2958 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2957:24:2957 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2957:24:2957 | access to local variable x | UseUseExplosion.cs:24:2953:24:2958 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2968:24:2973 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2968:24:2973 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2972:24:2972 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2972:24:2972 | access to local variable x | UseUseExplosion.cs:24:2968:24:2973 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2983:24:2988 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2983:24:2988 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:2987:24:2987 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:2987:24:2987 | access to local variable x | UseUseExplosion.cs:24:2983:24:2988 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:2998:24:3003 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:2998:24:3003 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3002:24:3002 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3002:24:3002 | access to local variable x | UseUseExplosion.cs:24:2998:24:3003 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3013:24:3018 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3013:24:3018 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3017:24:3017 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3017:24:3017 | access to local variable x | UseUseExplosion.cs:24:3013:24:3018 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3028:24:3033 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3028:24:3033 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3032:24:3032 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3032:24:3032 | access to local variable x | UseUseExplosion.cs:24:3028:24:3033 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3043:24:3048 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3043:24:3048 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3047:24:3047 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3047:24:3047 | access to local variable x | UseUseExplosion.cs:24:3043:24:3048 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3058:24:3063 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3058:24:3063 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3062:24:3062 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3062:24:3062 | access to local variable x | UseUseExplosion.cs:24:3058:24:3063 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3073:24:3078 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3073:24:3078 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3077:24:3077 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3077:24:3077 | access to local variable x | UseUseExplosion.cs:24:3073:24:3078 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3088:24:3093 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3088:24:3093 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3092:24:3092 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3092:24:3092 | access to local variable x | UseUseExplosion.cs:24:3088:24:3093 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3103:24:3108 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3103:24:3108 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3107:24:3107 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3107:24:3107 | access to local variable x | UseUseExplosion.cs:24:3103:24:3108 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3118:24:3123 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3118:24:3123 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3122:24:3122 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3122:24:3122 | access to local variable x | UseUseExplosion.cs:24:3118:24:3123 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3133:24:3138 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3133:24:3138 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3137:24:3137 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3137:24:3137 | access to local variable x | UseUseExplosion.cs:24:3133:24:3138 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3148:24:3153 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3148:24:3153 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3152:24:3152 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3152:24:3152 | access to local variable x | UseUseExplosion.cs:24:3148:24:3153 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3163:24:3168 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3163:24:3168 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3167:24:3167 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3167:24:3167 | access to local variable x | UseUseExplosion.cs:24:3163:24:3168 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3178:24:3183 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3178:24:3183 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3182:24:3182 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3182:24:3182 | access to local variable x | UseUseExplosion.cs:24:3178:24:3183 | [input] SSA phi read(x) |
+| UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(this.Prop) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) |
+| UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(x) | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
| UseUseExplosion.cs:24:3193:24:3198 | [post] this access | UseUseExplosion.cs:25:13:25:16 | this access |
| UseUseExplosion.cs:24:3193:24:3198 | this access | UseUseExplosion.cs:25:13:25:16 | this access |
-| UseUseExplosion.cs:24:3197:24:3197 | access to local variable x | UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) |
+| UseUseExplosion.cs:24:3197:24:3197 | access to local variable x | UseUseExplosion.cs:24:3193:24:3198 | [input] SSA phi read(x) |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(this.Prop) | UseUseExplosion.cs:25:13:25:16 | access to property Prop |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) | UseUseExplosion.cs:25:1712:25:1712 | access to local variable x |
| UseUseExplosion.cs:25:9:25:3199 | SSA phi read(x) | UseUseExplosion.cs:25:1727:25:1727 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected
index 68a96fa6f5a..73b0a757b5a 100644
--- a/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected
@@ -92,7 +92,8 @@
| Tuples.cs:51:14:51:14 | [post] access to local variable y | Tuples.cs:52:14:52:14 | access to local variable y |
| Tuples.cs:51:14:51:14 | access to local variable y | Tuples.cs:52:14:52:14 | access to local variable y |
| Tuples.cs:52:14:52:20 | access to field Item2 | Tuples.cs:52:14:52:20 | (...) ... |
-| Tuples.cs:55:27:55:27 | s | Tuples.cs:75:18:75:18 | access to parameter s |
+| Tuples.cs:55:27:55:27 | SSA param(s) | Tuples.cs:75:18:75:18 | access to parameter s |
+| Tuples.cs:55:27:55:27 | s | Tuples.cs:55:27:55:27 | SSA param(s) |
| Tuples.cs:57:13:57:14 | access to local variable o1 | Tuples.cs:57:13:57:34 | SSA def(o1) |
| Tuples.cs:57:13:57:34 | SSA def(o1) | Tuples.cs:59:18:59:19 | access to local variable o1 |
| Tuples.cs:57:18:57:34 | call to method Source | Tuples.cs:57:13:57:14 | access to local variable o1 |
From 0e3c867cb9920197cbc48d1fc5e977d4cd318d39 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 16 Aug 2024 10:37:49 +0200
Subject: [PATCH 023/500] Toy rust program listing definitions of a cargo
project
---
rust/.gitignore | 2 +
rust/Cargo.lock | 1561 ++++++++++++++++++++++++++++++++++++++++++++++
rust/Cargo.toml | 9 +
rust/src/main.rs | 66 ++
4 files changed, 1638 insertions(+)
create mode 100644 rust/.gitignore
create mode 100644 rust/Cargo.lock
create mode 100644 rust/Cargo.toml
create mode 100644 rust/src/main.rs
diff --git a/rust/.gitignore b/rust/.gitignore
new file mode 100644
index 00000000000..d81f12ed1b1
--- /dev/null
+++ b/rust/.gitignore
@@ -0,0 +1,2 @@
+/target
+/.idea
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
new file mode 100644
index 00000000000..3c02ab3803a
--- /dev/null
+++ b/rust/Cargo.lock
@@ -0,0 +1,1561 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "always-assert"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1078fa1ce1e34b1872d8611ad921196d76bdd7027e949fbe31231abde201892"
+dependencies = [
+ "tracing",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "camino"
+version = "1.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0ec6b951b160caa93cc0c7b209e5a3bff7aae9062213451ac99493cd844c239"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo-platform"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chalk-derive"
+version = "0.98.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9426c8fd0fe61c3da880b801d3b510524df17843a8f9ec1f5b9cec24fb7412df"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "chalk-ir"
+version = "0.98.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f2eb1cd6054da221bd1ac0197fb2fe5e2caf3dcb93619398fc1433f8f09093"
+dependencies = [
+ "bitflags 2.6.0",
+ "chalk-derive",
+]
+
+[[package]]
+name = "chalk-recursive"
+version = "0.98.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "129dc03458f71cfb9c3cd621c9c68166a94e87b85b16ccd29af015d7ff9a1c61"
+dependencies = [
+ "chalk-derive",
+ "chalk-ir",
+ "chalk-solve",
+ "rustc-hash",
+ "tracing",
+]
+
+[[package]]
+name = "chalk-solve"
+version = "0.98.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7e8a8c1e928f98cdf227b868416ef21dcd8cc3c61b347576d783713444d41c8"
+dependencies = [
+ "chalk-derive",
+ "chalk-ir",
+ "ena",
+ "indexmap",
+ "itertools",
+ "petgraph",
+ "rustc-hash",
+ "tracing",
+]
+
+[[package]]
+name = "codeql-rust"
+version = "0.1.0"
+dependencies = [
+ "ra_ap_hir",
+ "ra_ap_load-cargo",
+ "ra_ap_project_model",
+]
+
+[[package]]
+name = "countme"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
+
+[[package]]
+name = "cov-mark"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0570650661aa447e7335f1d5e4f499d8e58796e617bedc9267d971e51c8b49d4"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "drop_bomb"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bda8e21c04aca2ae33ffc2fd8c23134f3cac46db123ba97bd9d3f3b8a4a85e1"
+
+[[package]]
+name = "either"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+
+[[package]]
+name = "ena"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "filetime"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf401df4a4e3872c4fe8151134cf483738e74b67fc934d6532c882b3d24a4550"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "fsevent-sys"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "fst"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93ead53efc7ea8ed3cfb0c79fc8023fbb782a5432b52830b6518941cebe6505c"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "jod-thread"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b23360e99b8717f20aaa4598f5a6541efbe30630039fbc7706cf954a87947ae"
+
+[[package]]
+name = "kqueue"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "la-arena"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
+
+[[package]]
+name = "libc"
+version = "0.2.155"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+
+[[package]]
+name = "libredox"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+dependencies = [
+ "bitflags 2.6.0",
+ "libc",
+ "redox_syscall",
+]
+
+[[package]]
+name = "line-index"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67d61795376ae2683928c218fda7d7d7db136fd38c06b7552904667f0d55580a"
+dependencies = [
+ "nohash-hasher",
+ "text-size",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "lz4_flex"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75761162ae2b0e580d7e7c390558127e5f01b4194debd6221fd8c207fc80e3f5"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "miow"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "359f76430b20a79f9e20e115b3428614e654f04fab314482fc0fda0ebd3c6044"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.6.0",
+ "crossbeam-channel",
+ "filetime",
+ "fsevent-sys",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "oorandom"
+version = "11.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b410bbe7e14ab526a0e86877eb47c6996a2bd7746f027ba551028c925390e4e9"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "perf-event"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5396562cd2eaa828445d6d34258ae21ee1eb9d40fe626ca7f51c8dccb4af9d66"
+dependencies = [
+ "libc",
+ "perf-event-open-sys",
+]
+
+[[package]]
+name = "perf-event-open-sys"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce9bedf5da2c234fdf2391ede2b90fabf585355f33100689bc364a3ea558561a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+dependencies = [
+ "fixedbitset",
+ "indexmap",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ra-ap-rustc_abi"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80b1d613eee933486c0613a7bc26e515e46f43adf479d1edd5e537f983e9ce46"
+dependencies = [
+ "bitflags 2.6.0",
+ "ra-ap-rustc_index",
+ "tracing",
+]
+
+[[package]]
+name = "ra-ap-rustc_index"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f072060ac77e9e1a02cc20028095993af7e72cc0804779c68bcbf47b16de49c9"
+dependencies = [
+ "arrayvec",
+ "ra-ap-rustc_index_macros",
+ "smallvec",
+]
+
+[[package]]
+name = "ra-ap-rustc_index_macros"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f3d6dcb30a66905388e14756b8f2216131d9f8004922c07f13335840e058d1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "ra-ap-rustc_lexer"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbd8a2b0bdcba9892cbce0b25f6c953d31b0febc1f3420fc692884fce5a23ad8"
+dependencies = [
+ "unicode-properties",
+ "unicode-xid",
+]
+
+[[package]]
+name = "ra-ap-rustc_parse_format"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70dad7a491c2554590222e0c9212dcb7c2e7aceb668875075012a35ea780d135"
+dependencies = [
+ "ra-ap-rustc_index",
+ "ra-ap-rustc_lexer",
+]
+
+[[package]]
+name = "ra-ap-rustc_pattern_analysis"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34768e1faf88c31f2e9ad57b48318a52b507dafac0cddbf01b5d63bfc0b0a365"
+dependencies = [
+ "ra-ap-rustc_index",
+ "rustc-hash",
+ "rustc_apfloat",
+ "smallvec",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_base_db"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2aae8f3b0315876c1aa11dc0aac7795b27cb9e21a2a870667842e97e6b7dc3b5"
+dependencies = [
+ "la-arena",
+ "lz4_flex",
+ "ra_ap_cfg",
+ "ra_ap_intern",
+ "ra_ap_salsa",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_vfs",
+ "rustc-hash",
+ "semver",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_cfg"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac59191045154789b3b3f9f8c67f35439c3cbd9e36107dd62d04d4a4b2c95322"
+dependencies = [
+ "ra_ap_intern",
+ "ra_ap_tt",
+ "rustc-hash",
+]
+
+[[package]]
+name = "ra_ap_hir"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b321e9c63fd434ac7b1617d6ddaed7329b8e21f6cae06ca05fec91c6361bb40d"
+dependencies = [
+ "arrayvec",
+ "either",
+ "itertools",
+ "once_cell",
+ "ra_ap_base_db",
+ "ra_ap_cfg",
+ "ra_ap_hir_def",
+ "ra_ap_hir_expand",
+ "ra_ap_hir_ty",
+ "ra_ap_intern",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_tt",
+ "rustc-hash",
+ "smallvec",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_hir_def"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc0e2dd39d1162650dd6668f1e179d24aec336e3ff12aae9f0e50c10928d1158"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.6.0",
+ "cov-mark",
+ "dashmap",
+ "drop_bomb",
+ "either",
+ "fst",
+ "hashbrown",
+ "indexmap",
+ "itertools",
+ "la-arena",
+ "once_cell",
+ "ra-ap-rustc_abi",
+ "ra-ap-rustc_parse_format",
+ "ra_ap_base_db",
+ "ra_ap_cfg",
+ "ra_ap_hir_expand",
+ "ra_ap_intern",
+ "ra_ap_limit",
+ "ra_ap_mbe",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_tt",
+ "rustc-hash",
+ "rustc_apfloat",
+ "smallvec",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_hir_expand"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7e3c27bb239be9c6f835790f32d1a6e82345713c2ea63605d3270f06daf5caf"
+dependencies = [
+ "cov-mark",
+ "either",
+ "hashbrown",
+ "itertools",
+ "la-arena",
+ "ra_ap_base_db",
+ "ra_ap_cfg",
+ "ra_ap_intern",
+ "ra_ap_limit",
+ "ra_ap_mbe",
+ "ra_ap_parser",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_syntax-bridge",
+ "ra_ap_tt",
+ "rustc-hash",
+ "smallvec",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_hir_ty"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c437b9971d421dea75d72f137ccd49612cff401b9118da0d5b31c033ea0bcf3d"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.6.0",
+ "chalk-derive",
+ "chalk-ir",
+ "chalk-recursive",
+ "chalk-solve",
+ "cov-mark",
+ "either",
+ "ena",
+ "indexmap",
+ "itertools",
+ "la-arena",
+ "nohash-hasher",
+ "once_cell",
+ "oorandom",
+ "ra-ap-rustc_abi",
+ "ra-ap-rustc_index",
+ "ra-ap-rustc_pattern_analysis",
+ "ra_ap_base_db",
+ "ra_ap_hir_def",
+ "ra_ap_hir_expand",
+ "ra_ap_intern",
+ "ra_ap_limit",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "rustc-hash",
+ "rustc_apfloat",
+ "scoped-tls",
+ "smallvec",
+ "tracing",
+ "triomphe",
+ "typed-arena",
+]
+
+[[package]]
+name = "ra_ap_ide_db"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa72d28b51a29efd6416979b43976663708894cee98fb44cabaa222cb049417"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.6.0",
+ "cov-mark",
+ "crossbeam-channel",
+ "either",
+ "fst",
+ "indexmap",
+ "itertools",
+ "line-index",
+ "memchr",
+ "nohash-hasher",
+ "once_cell",
+ "ra_ap_base_db",
+ "ra_ap_hir",
+ "ra_ap_limit",
+ "ra_ap_parser",
+ "ra_ap_profile",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_text_edit",
+ "rayon",
+ "rustc-hash",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_intern"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbeec56dfe875fd865cc9afb7d0a0a6af832bf323b6db461844ba1de2fa7006b"
+dependencies = [
+ "dashmap",
+ "hashbrown",
+ "rustc-hash",
+ "sptr",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_limit"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6d33f2d8eda04460315de38992e3681dd799c27e712788a7aeee9909bc1c0f5"
+
+[[package]]
+name = "ra_ap_load-cargo"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b7a4626cb8477733b02d836a7215db629249dd0076b2c9edcfe3f3a4e639f33"
+dependencies = [
+ "anyhow",
+ "crossbeam-channel",
+ "itertools",
+ "ra_ap_hir_expand",
+ "ra_ap_ide_db",
+ "ra_ap_intern",
+ "ra_ap_paths",
+ "ra_ap_proc_macro_api",
+ "ra_ap_project_model",
+ "ra_ap_span",
+ "ra_ap_tt",
+ "ra_ap_vfs",
+ "ra_ap_vfs-notify",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_mbe"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77e45337e002d5c0efcba96769da0bd2d94c4e66e2d315f627fea7c877380141"
+dependencies = [
+ "arrayvec",
+ "cov-mark",
+ "ra_ap_intern",
+ "ra_ap_parser",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_syntax-bridge",
+ "ra_ap_tt",
+ "rustc-hash",
+ "smallvec",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_parser"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "094cb41571e0c97501e1171f638bfdf4edb5f376d283b1ab04f3411aa3a44f51"
+dependencies = [
+ "drop_bomb",
+ "ra-ap-rustc_lexer",
+ "ra_ap_limit",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_paths"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6602581f62922de09c93fdf3d6ddffa3f4fdcafba6c9dd08827951fb5ad511cc"
+dependencies = [
+ "camino",
+ "serde",
+]
+
+[[package]]
+name = "ra_ap_proc_macro_api"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a2480058c6228d6ccdd6cfe1fa01c081f081ec6a6ea1a241b88618576ae6eff"
+dependencies = [
+ "indexmap",
+ "ra_ap_base_db",
+ "ra_ap_intern",
+ "ra_ap_paths",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_tt",
+ "rustc-hash",
+ "serde",
+ "serde_json",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_profile"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60263554aef637b9143a2d480a7fa93661297d795f7c46108386454a86885d49"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "perf-event",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ra_ap_project_model"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ff3383dcd32a63b914c59f42f38e81ebfa5d5d921067ca0d1b01585aed1a4bd"
+dependencies = [
+ "anyhow",
+ "cargo_metadata",
+ "itertools",
+ "la-arena",
+ "ra_ap_base_db",
+ "ra_ap_cfg",
+ "ra_ap_intern",
+ "ra_ap_paths",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_toolchain",
+ "rustc-hash",
+ "semver",
+ "serde",
+ "serde_json",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_salsa"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f6e29648a086801b2bd047a88e9b73782c354fca9117d1208bebbfd6a849a61"
+dependencies = [
+ "indexmap",
+ "itertools",
+ "lock_api",
+ "oorandom",
+ "parking_lot",
+ "ra_ap_salsa-macros",
+ "rustc-hash",
+ "smallvec",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_salsa-macros"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d104209e089a63a1aa8f9a5f06c6350b1508d856fca4c25002f1d8e7c04a685b"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "ra_ap_span"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d30beb9ac55357e4c56f8f8e5c84571ce204f10ba43b55640c51053e806e6b8"
+dependencies = [
+ "hashbrown",
+ "la-arena",
+ "ra_ap_salsa",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_vfs",
+ "rustc-hash",
+ "text-size",
+]
+
+[[package]]
+name = "ra_ap_stdx"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51c29e7dfc7282ed14e91419d09b59e8dca27e7cc10c3cfcbf1964d7db0bef34"
+dependencies = [
+ "always-assert",
+ "crossbeam-channel",
+ "itertools",
+ "jod-thread",
+ "libc",
+ "miow",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ra_ap_syntax"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "575c1e3deb1cb39e0939a95a4cb4339ee95b1283157cf03bc1bdaf76e6ebca8d"
+dependencies = [
+ "cov-mark",
+ "either",
+ "indexmap",
+ "itertools",
+ "once_cell",
+ "ra-ap-rustc_lexer",
+ "ra_ap_parser",
+ "ra_ap_stdx",
+ "ra_ap_text_edit",
+ "rowan",
+ "rustc-hash",
+ "smol_str",
+ "tracing",
+ "triomphe",
+]
+
+[[package]]
+name = "ra_ap_syntax-bridge"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f19c53a1f9f50d76f50b7c0c83cda0fa5de09a182d8f4ae3575ea986a24fa234"
+dependencies = [
+ "ra_ap_intern",
+ "ra_ap_parser",
+ "ra_ap_span",
+ "ra_ap_stdx",
+ "ra_ap_syntax",
+ "ra_ap_tt",
+ "rustc-hash",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_text_edit"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b38bb92b8924b2267d84524f09cc31851f7f93741811e5374701ceb2be47d0b"
+dependencies = [
+ "itertools",
+ "text-size",
+]
+
+[[package]]
+name = "ra_ap_toolchain"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18076d6d6b2ef93a9d0396b06d58369231e50916456d2fa4488bc78c97ea6714"
+dependencies = [
+ "camino",
+ "home",
+]
+
+[[package]]
+name = "ra_ap_tt"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "851bc23c870c67bd729e33056e001a2e07b16a31da13affe73d78e77049b12b8"
+dependencies = [
+ "arrayvec",
+ "ra-ap-rustc_lexer",
+ "ra_ap_intern",
+ "ra_ap_stdx",
+ "text-size",
+]
+
+[[package]]
+name = "ra_ap_vfs"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3b152d631514508b7322cda383a454e2a56b0b5ecd8562a8f1e40aabe9fb236"
+dependencies = [
+ "fst",
+ "indexmap",
+ "nohash-hasher",
+ "ra_ap_paths",
+ "ra_ap_stdx",
+ "rustc-hash",
+ "tracing",
+]
+
+[[package]]
+name = "ra_ap_vfs-notify"
+version = "0.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e516915fb4822a3d480404d35c20f240ae16a297ef52a68dc8cff748093f3abd"
+dependencies = [
+ "crossbeam-channel",
+ "notify",
+ "ra_ap_paths",
+ "ra_ap_stdx",
+ "ra_ap_vfs",
+ "rayon",
+ "rustc-hash",
+ "tracing",
+ "walkdir",
+]
+
+[[package]]
+name = "rayon"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
+dependencies = [
+ "bitflags 2.6.0",
+]
+
+[[package]]
+name = "rowan"
+version = "0.15.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a58fa8a7ccff2aec4f39cc45bf5f985cec7125ab271cf681c279fd00192b49"
+dependencies = [
+ "countme",
+ "hashbrown",
+ "memoffset",
+ "rustc-hash",
+ "text-size",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_apfloat"
+version = "0.2.1+llvm-462a31f5a5ab"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "886d94c63c812a8037c4faca2607453a0fa4cf82f734665266876b022244543f"
+dependencies = [
+ "bitflags 1.3.2",
+ "smallvec",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.207"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5665e14a49a4ea1b91029ba7d3bca9f299e1f7cfa194388ccc20f14743e784f2"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.207"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aea2634c86b0e8ef2cfdc0c340baede54ec27b1e46febd7f80dffb2aa44a00e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.125"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83c8e735a073ccf5be70aa8066aa984eaf2fa000db6c8d0100ae605b366d31ed"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "smol_str"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "sptr"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "syn"
+version = "2.0.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fceb41e3d546d0bd83421d3409b1460cc7444cd389341a4c880fe7a042cb3d7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "text-size"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
+
+[[package]]
+name = "thiserror"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "triomphe"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6631e42e10b40c0690bf92f404ebcfe6e1fdb480391d15f17cc8e96eeed5369"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4259d9d4425d9f0661581b804cb85fe66a4c631cadd8f490d1c13a35d5d9291"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
new file mode 100644
index 00000000000..e36cdfced04
--- /dev/null
+++ b/rust/Cargo.toml
@@ -0,0 +1,9 @@
+[package]
+name = "codeql-rust"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+ra_ap_hir = "0.0.229"
+ra_ap_load-cargo = "0.0.229"
+ra_ap_project_model = "0.0.229"
diff --git a/rust/src/main.rs b/rust/src/main.rs
new file mode 100644
index 00000000000..f5f966119d7
--- /dev/null
+++ b/rust/src/main.rs
@@ -0,0 +1,66 @@
+use ra_ap_hir::{Crate, ModuleDef, Name, HirDisplay, DefWithBody};
+use ra_ap_project_model::CargoConfig;
+use std::env;
+use std::path::Path;
+use ra_ap_load_cargo::{load_workspace_at, LoadCargoConfig, ProcMacroServerChoice};
+
+fn extract_name(n: Option) -> String {
+ match n {
+ Some(v) => v.as_str().to_owned(),
+ None => String::from(""),
+ }
+}
+
+fn main() {
+ let args: Vec = env::args().collect();
+ let config = CargoConfig { ..Default::default() };
+ let no_progress = &|_| ();
+ let load_config = LoadCargoConfig {
+ load_out_dirs_from_check: true,
+ with_proc_macro_server: ProcMacroServerChoice::Sysroot,
+ prefill_caches: false,
+ };
+ let (db, vfs, macro_server) = load_workspace_at(&Path::new(&args[1]), &config, &load_config, no_progress).unwrap();
+ let mut worklist: Vec<_> =
+ Crate::all(&db).into_iter().map(|krate| krate.root_module()).collect();
+
+ while let Some(module) = worklist.pop() {
+ println!("Module: {}", extract_name(module.name(&db)));
+ for d in module.declarations(&db) {
+ match d {
+ ModuleDef::Module(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Function(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Adt(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Variant(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Const(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Static(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::Trait(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::TraitAlias(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::TypeAlias(e) => {
+ println!(" {}", e.display(&db));
+ }
+ ModuleDef::BuiltinType(_e) => {}
+ ModuleDef::Macro(e) => {
+ println!(" {}", e.display(&db));
+ }
+ }
+ }
+ worklist.extend(module.children(&db));
+ }
+}
From 0126fbcb8f2cb9d7f38f8adce31716981f7a8422 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 10:56:46 +0100
Subject: [PATCH 024/500] Swift: Clear the language for Swift code snippets
that are rendering incorrectly.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index ef374fc9752..347a0ee0e29 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index b406faf8e17..c312fb1a6f5 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp b/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
index ddbb2835bc2..e641d9b4e61 100644
--- a/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
+++ b/swift/ql/src/queries/Security/CWE-1333/ReDoS.qhelp
@@ -3,7 +3,7 @@
Consider the following regular expression:
-
+
/^_(__|.)+_$/
Its sub-expression "(__|.)+" can match the string
@@ -19,7 +19,7 @@
the ambiguity between the two branches of the alternative inside the
repetition:
-
+
/^_(__|[^_])+_$/
From 2d19d6f61ecc12f8a888f5a5cdd76888e0c01763 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 11:40:57 +0100
Subject: [PATCH 025/500] Swift: Fix two of the qhelps by slightly modifying
the sample code instead.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
.../queries/Security/CWE-020/IncompleteHostnameRegexBad.swift | 4 ++--
.../Security/CWE-020/IncompleteHostnameRegexGood.swift | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift | 2 +-
5 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index 347a0ee0e29..ef374fc9752 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
index 3e28022ab98..6f553b2fbee 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) {
+func handleUrl(_ urlString: String) throws {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = #/^(www|beta).example.com//# // BAD
+ let regex = try Regex("^(www|beta).example.com/") // BAD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
index fad4135a263..1413a7ffa73 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) {
+func handleUrl(_ urlString: String) throws {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = #/^(www|beta)\.example\.com//# // GOOD
+ let regex = try Regex("^(www|beta)\\.example\\.com/") // GOOD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index c312fb1a6f5..b406faf8e17 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
index d399bf5a166..f2a8273d31a 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
@@ -1,4 +1,4 @@
-let script_tag_regex = /")
var old_html = ""
while (html != old_html) {
From 0088ece3ea7772811f7c2c75a2a75e16abb49d66 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 16 Aug 2024 13:24:03 +0100
Subject: [PATCH 026/500] Revert "Swift: Fix two of the qhelps by slightly
modifying the sample code instead."
This reverts commit 2d19d6f61ecc12f8a888f5a5cdd76888e0c01763.
---
.../queries/Security/CWE-020/IncompleteHostnameRegex.qhelp | 4 ++--
.../queries/Security/CWE-020/IncompleteHostnameRegexBad.swift | 4 ++--
.../Security/CWE-020/IncompleteHostnameRegexGood.swift | 4 ++--
swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp | 2 +-
swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift | 2 +-
5 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
index ef374fc9752..347a0ee0e29 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegex.qhelp
@@ -46,7 +46,7 @@
-
+
@@ -63,7 +63,7 @@
-
+
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
index 6f553b2fbee..3e28022ab98 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexBad.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) throws {
+func handleUrl(_ urlString: String) {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = try Regex("^(www|beta).example.com/") // BAD
+ let regex = #/^(www|beta).example.com//# // BAD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
index 1413a7ffa73..fad4135a263 100644
--- a/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
+++ b/swift/ql/src/queries/Security/CWE-020/IncompleteHostnameRegexGood.swift
@@ -1,11 +1,11 @@
-func handleUrl(_ urlString: String) throws {
+func handleUrl(_ urlString: String) {
// get the 'url=' parameter from the URL
let components = URLComponents(string: urlString)
let redirectParam = components?.queryItems?.first(where: { $0.name == "url" })
// check we trust the host
- let regex = try Regex("^(www|beta)\\.example\\.com/") // GOOD
+ let regex = #/^(www|beta)\.example\.com//# // GOOD
if let match = redirectParam?.value?.firstMatch(of: regex) {
// ... trust the URL ...
}
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
index b406faf8e17..c312fb1a6f5 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilter.qhelp
@@ -28,7 +28,7 @@ likely to handle corner cases correctly than a custom implementation.
The following example attempts to filters out all <script> tags.
-
+
The above sanitizer does not filter out all <script> tags.
diff --git a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
index f2a8273d31a..d399bf5a166 100644
--- a/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
+++ b/swift/ql/src/queries/Security/CWE-116/BadTagFilterBad.swift
@@ -1,4 +1,4 @@
-let script_tag_regex = try Regex("")
+let script_tag_regex = / GitHub, Inc.
Terms
- Privacy
From f44905324eb43bd1e632ad42ff4ed260e63ef7b0 Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Tue, 3 Sep 2024 12:55:56 +0100
Subject: [PATCH 155/500] Add article on running queries
---
docs/codeql/codeql-overview/codeql-tools.rst | 19 +++++------
docs/codeql/writing-codeql-queries/index.rst | 3 ++
.../running-codeql-queries.rst | 34 +++++++++++++++++++
3 files changed, 46 insertions(+), 10 deletions(-)
create mode 100644 docs/codeql/writing-codeql-queries/running-codeql-queries.rst
diff --git a/docs/codeql/codeql-overview/codeql-tools.rst b/docs/codeql/codeql-overview/codeql-tools.rst
index d58730e4702..f3d37880ab6 100644
--- a/docs/codeql/codeql-overview/codeql-tools.rst
+++ b/docs/codeql/codeql-overview/codeql-tools.rst
@@ -5,17 +5,16 @@
CodeQL tools
============
-GitHub provides the CodeQL command-line interface and CodeQL for Visual Studio
-Code for performing CodeQL analysis on open source codebases.
+GitHub provides the CodeQL command-line interface and CodeQL for Visual Studio Code for performing CodeQL analysis on open source codebases. For information on the use cases for each tool, see ":ref:`Running CodeQL queries `."
CodeQL command-line interface
-----------------------------
-The CodeQL command-line interface (CLI) is primarily used to create databases for
-security research. You can also query CodeQL databases directly from the command line
+The CodeQL command-line interface (CLI) is primarily used to create databases for
+security research. You can also query CodeQL databases directly from the command line
or using the Visual Studio Code extension.
-The CodeQL CLI can be downloaded from `GitHub releases `__.
-For more information, see "`CodeQL CLI `__" and the `CLI changelog `__.
+The CodeQL CLI can be downloaded from "`GitHub releases `__."
+For more information, see "`CodeQL CLI `__" and the ":ref:`Change log `."
CodeQL packs
-----------------------------
@@ -38,15 +37,15 @@ maintained by GitHub are:
- ``codeql/python-all`` (`changelog `__, `source `__)
- ``codeql/ruby-queries`` (`changelog `__, `source `__)
- ``codeql/ruby-all`` (`changelog `__, `source `__)
+- ``codeql/swift-queries`` (`changelog `__, `source `__)
+- ``codeql/swift-all`` (`changelog `__, `source `__)
For more information, see "`About CodeQL packs `__."
CodeQL bundle
-----------------------------
-The CodeQL bundle consists of the CodeQL CLI together with the standard CodeQL query and library packs
-maintained by GitHub. The bundle can be downloaded from `GitHub releases `__.
-Use this when running `code scanning with CodeQL `__ on GitHub Actions or in another CI system.
+The CodeQL bundle consists of the CodeQL CLI together with the standard CodeQL query and library packs maintained by GitHub. The bundle is used by the CodeQL action in GitHub to generate code scanning results. If you use an external CI system, you can download the bundle from `GitHub releases `__, generate code scanning results, and upload them to GitHub.
CodeQL for Visual Studio Code
-----------------------------
@@ -54,4 +53,4 @@ CodeQL for Visual Studio Code
You can analyze CodeQL databases in Visual Studio Code using the CodeQL
extension, which provides an enhanced environment for writing and running custom
queries and viewing the results. For more information, see "`CodeQL
-for Visual Studio Code `__."
\ No newline at end of file
+for Visual Studio Code `__."
diff --git a/docs/codeql/writing-codeql-queries/index.rst b/docs/codeql/writing-codeql-queries/index.rst
index 0459156a49b..1c492083034 100644
--- a/docs/codeql/writing-codeql-queries/index.rst
+++ b/docs/codeql/writing-codeql-queries/index.rst
@@ -9,8 +9,11 @@ Get to know more about queries and learn some key query-writing skills by solvin
- :ref:`QL tutorials `: Solve puzzles to learn the basics of QL before you analyze code with CodeQL. The tutorials teach you how to write queries and introduce you to key logic concepts along the way.
+- :ref:`Running CodeQL queries `: Guide to running queries as you try out the tutorials and start to develop your own queries.
+
.. toctree::
:hidden:
codeql-queries
ql-tutorials
+ running-codeql-queries
diff --git a/docs/codeql/writing-codeql-queries/running-codeql-queries.rst b/docs/codeql/writing-codeql-queries/running-codeql-queries.rst
new file mode 100644
index 00000000000..4d4a255a2cc
--- /dev/null
+++ b/docs/codeql/writing-codeql-queries/running-codeql-queries.rst
@@ -0,0 +1,34 @@
+:tocdepth: 1
+
+.. _running-codeql-queries:
+
+Running CodeQL queries
+======================
+
+There are several options available for running one or more CodeQL queries on a codebase. The best option depends on what your aims are.
+
+Work through a CodeQL tutorial
+------------------------------
+
+If you're working through a CodeQL tutorial, the CodeQL extension for Visual Studio Code makes it easy to run the queries in the tutorial. Unless you want to run the query on a specific code base, it's easiest to run queries on one of the many CodeQL databases that are available on GitHub. To get started, see "`Installing CodeQL for Visual Studio Code `__".
+
+Develop a new CodeQL query
+--------------------------
+
+If you're developing a new query, the CodeQL extension for Visual Studio Code makes it easy to run a query and compare the results with previous runs as you refine the query. The extension also provides autocomplete suggestions, syntax highlighting, and other features that make it easier to write and debug queries. To get started, see "`Installing CodeQL for Visual Studio Code `__".
+
+When you're ready to test the query on a wide range of codebases, you can choose from the pre-defined sets of CodeQL databases or define a custom group of codebases to run the query against. For more information, see "`Running CodeQL queries at scale with multi-repository variant analysis `__".
+
+Run your query against a specific codebase
+-------------------------------------------
+
+If the codebase that you want to run your query against doesn't have a CodeQL database, you can create one using the CodeQL CLI. For more information, see "`Setting up the CodeQL CLI `__" and "`Preparing your code for CodeQL analysis `__".
+
+Once you have created a CodeQL database, you can make the database available to the CodeQL extension in Visual Studio Code, or run the query using the CodeQL CLI. For more information, see "`Analyzing your code with CodeQL queries `__".
+
+Run the standard CodeQL queries
+-------------------------------
+
+The easiest way to run the standard CodeQL queries on a repository hosted on the GitHub platform is to enable code scanning with CodeQL (this requires GitHub Actions to be enabled). When you enable default setup, you can choose from a default set of security queries or an extended set of security queries. Any results are shown as code scanning alerts on the **Security** tab of the repository. For more information, see "`Configuring default setup for code scanning `__".
+
+If you want to run the standard CodeQL queries on a repository that is not hosted on the GitHub platform, or where GitHub Actions are disabled, you can use the CodeQL CLI. For more information, see "`About the CodeQL CLI `__".
From 44ca530087fcf83eff13cbc8c7afedce666584d6 Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Tue, 3 Sep 2024 12:59:29 +0100
Subject: [PATCH 156/500] Update template to match changes to landing page
---
docs/codeql/_templates/layout.html | 33 ++++++++++++++----------------
1 file changed, 15 insertions(+), 18 deletions(-)
diff --git a/docs/codeql/_templates/layout.html b/docs/codeql/_templates/layout.html
index df9c9a51f26..779c99cfe9f 100644
--- a/docs/codeql/_templates/layout.html
+++ b/docs/codeql/_templates/layout.html
@@ -1,7 +1,7 @@
{#
Override alabaster/layout.html template to customize the template
used to generate the CodeQL documentation.
-
+
The classes used in this template are provided by the GitHub Primer https://primer.style/css/.
The CSS for the primer can be found at https://unpkg.com/@primer/css/dist/primer.css
@@ -59,37 +59,34 @@
CodeQL resources
-
@@ -165,12 +162,12 @@
- - ©
+
- ©
GitHub, Inc.
- Terms
- - Privacy
From 037912fd2d59c0d39ba5e0a56dd0f8473d03e33c Mon Sep 17 00:00:00 2001
From: Simon Friis Vindum
Date: Tue, 3 Sep 2024 13:20:17 +0200
Subject: [PATCH 157/500] C++: Add data-flow test for realloc
---
.../dataflow-consistency.expected | 20 +++++++++----------
.../dataflow-tests/localFlow-ir.expected | 18 ++++++++---------
.../dataflow-tests/localFlow.expected | 14 ++++++-------
.../dataflow-tests/test-source-sink.expected | 5 +++--
.../dataflow/dataflow-tests/test.cpp | 8 ++++++++
.../dataflow-tests/type-bugs.expected | 2 +-
.../dataflow-tests/uninitialized.expected | 4 ++--
7 files changed, 40 insertions(+), 31 deletions(-)
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
index 109f5ffebd1..f1bf934b225 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
@@ -33,7 +33,7 @@ argHasPostUpdate
| test.cpp:67:29:67:35 | source1 | ArgumentNode is missing PostUpdateNode. |
| test.cpp:813:19:813:35 | * ... | ArgumentNode is missing PostUpdateNode. |
| test.cpp:848:23:848:25 | rpx | ArgumentNode is missing PostUpdateNode. |
-| test.cpp:1057:19:1057:21 | * ... | ArgumentNode is missing PostUpdateNode. |
+| test.cpp:1065:19:1065:21 | * ... | ArgumentNode is missing PostUpdateNode. |
postWithInFlow
| BarrierGuard.cpp:49:6:49:6 | x [post update] | PostUpdateNode should not be the target of local flow. |
| BarrierGuard.cpp:60:7:60:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
@@ -167,15 +167,15 @@ postWithInFlow
| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
| test.cpp:1045:9:1045:11 | ref arg buf | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1051:5:1051:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1052:9:1052:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1056:5:1056:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1056:6:1056:7 | pp [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1062:53:1062:53 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1072:3:1072:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1072:4:1072:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1073:3:1073:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:1073:4:1073:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1059:5:1059:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1060:9:1060:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1064:5:1064:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1064:6:1064:7 | pp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1070:53:1070:53 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1080:3:1080:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1080:4:1080:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1081:3:1081:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1081:4:1081:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
viableImplInCallContextTooLarge
uniqueParameterNodeAtPosition
uniqueParameterNodePosition
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
index f6c8375660c..db5bf5cda15 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
@@ -202,12 +202,12 @@
| test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
| test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
-| test.cpp:1050:12:1050:12 | definition of a | test.cpp:1051:3:1051:3 | *a |
-| test.cpp:1051:3:1051:3 | *a | test.cpp:1052:8:1052:9 | *& ... |
-| test.cpp:1051:3:1051:3 | *a [post update] | test.cpp:1052:8:1052:9 | *& ... |
-| test.cpp:1051:3:1051:3 | a | test.cpp:1052:8:1052:9 | & ... |
-| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:8:1052:9 | & ... |
-| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
-| test.cpp:1051:15:1051:21 | *0 | test.cpp:1051:3:1051:21 | *... = ... |
-| test.cpp:1052:9:1052:9 | *a | test.cpp:1052:8:1052:9 | *& ... |
-| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
+| test.cpp:1058:12:1058:12 | definition of a | test.cpp:1059:3:1059:3 | *a |
+| test.cpp:1059:3:1059:3 | *a | test.cpp:1060:8:1060:9 | *& ... |
+| test.cpp:1059:3:1059:3 | *a [post update] | test.cpp:1060:8:1060:9 | *& ... |
+| test.cpp:1059:3:1059:3 | a | test.cpp:1060:8:1060:9 | & ... |
+| test.cpp:1059:3:1059:3 | a [post update] | test.cpp:1060:8:1060:9 | & ... |
+| test.cpp:1059:15:1059:21 | 0 | test.cpp:1059:3:1059:21 | ... = ... |
+| test.cpp:1059:15:1059:21 | *0 | test.cpp:1059:3:1059:21 | *... = ... |
+| test.cpp:1060:9:1060:9 | *a | test.cpp:1060:8:1060:9 | *& ... |
+| test.cpp:1060:9:1060:9 | a | test.cpp:1060:8:1060:9 | & ... |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
index 2e0a1ce81ce..1296bab1637 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
@@ -81,10 +81,10 @@ WARNING: module 'DataFlow' has been deprecated and may be removed in future (loc
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
| test.cpp:488:24:488:30 | ref arg content | test.cpp:489:23:489:29 | content |
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
-| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
-| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
-| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:9:1052:9 | a |
-| test.cpp:1051:3:1051:21 | ... = ... | test.cpp:1051:5:1051:11 | content [post update] |
-| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
-| test.cpp:1052:8:1052:9 | ref arg & ... | test.cpp:1052:9:1052:9 | a [inner post update] |
-| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
+| test.cpp:1058:12:1058:12 | a | test.cpp:1059:3:1059:3 | a |
+| test.cpp:1058:12:1058:12 | a | test.cpp:1060:9:1060:9 | a |
+| test.cpp:1059:3:1059:3 | a [post update] | test.cpp:1060:9:1060:9 | a |
+| test.cpp:1059:3:1059:21 | ... = ... | test.cpp:1059:5:1059:11 | content [post update] |
+| test.cpp:1059:15:1059:21 | 0 | test.cpp:1059:3:1059:21 | ... = ... |
+| test.cpp:1060:8:1060:9 | ref arg & ... | test.cpp:1060:9:1060:9 | a [inner post update] |
+| test.cpp:1060:9:1060:9 | a | test.cpp:1060:8:1060:9 | & ... |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
index ac26a0c76ec..633445773f6 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
@@ -127,7 +127,7 @@ astFlow
| test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y |
| test.cpp:846:13:846:27 | call to indirect_source | test.cpp:848:23:848:25 | rpx |
| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic |
-| test.cpp:1050:12:1050:12 | a | test.cpp:1052:8:1052:9 | & ... |
+| test.cpp:1058:12:1058:12 | a | test.cpp:1060:8:1060:9 | & ... |
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
| true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x |
@@ -313,7 +313,8 @@ irFlow
| test.cpp:1021:18:1021:32 | *call to indirect_source | test.cpp:1027:19:1027:28 | *translated |
| test.cpp:1021:18:1021:32 | *call to indirect_source | test.cpp:1031:19:1031:28 | *translated |
| test.cpp:1045:14:1045:19 | call to source | test.cpp:1046:7:1046:10 | * ... |
-| test.cpp:1081:27:1081:34 | call to source | test.cpp:1081:27:1081:34 | call to source |
+| test.cpp:1052:13:1052:27 | *call to indirect_source | test.cpp:1054:7:1054:11 | * ... |
+| test.cpp:1089:27:1089:34 | call to source | test.cpp:1089:27:1089:34 | call to source |
| true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
index ae6b76b88ca..a7600c64aa2 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
@@ -1046,6 +1046,14 @@ void memset_test(char* buf) { // $ ast-def=buf ir-def=*buf
sink(*buf); // $ ir MISSING: ast
}
+void *realloc(void *, size_t);
+
+void test_realloc() {
+ int *src = indirect_source();
+ int *dest = (int*)realloc(src, sizeof(int));
+ sink(*dest); // $ ir, MISSING: ast
+}
+
void flow_out_of_address_with_local_flow() {
MyStruct a;
a.content = nullptr;
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected
index b79e7cd4271..f30404718c5 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected
@@ -51,5 +51,5 @@ incorrectBaseType
| test.cpp:848:23:848:25 | rpx | Expected 'Node.getType()' to be int, but it was int * |
| test.cpp:854:10:854:36 | * ... | Expected 'Node.getType()' to be const int, but it was int |
| test.cpp:867:10:867:30 | * ... | Expected 'Node.getType()' to be const int, but it was int |
-| test.cpp:1062:52:1062:53 | *& ... | Expected 'Node.getType()' to be char, but it was char * |
+| test.cpp:1070:52:1070:53 | *& ... | Expected 'Node.getType()' to be char, but it was char * |
failures
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
index fc230b0ed20..b374cf37ecd 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
@@ -54,5 +54,5 @@
| test.cpp:796:12:796:12 | a | test.cpp:797:20:797:20 | a |
| test.cpp:796:12:796:12 | a | test.cpp:797:31:797:31 | a |
| test.cpp:796:12:796:12 | a | test.cpp:798:17:798:17 | a |
-| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
-| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
+| test.cpp:1058:12:1058:12 | a | test.cpp:1059:3:1059:3 | a |
+| test.cpp:1058:12:1058:12 | a | test.cpp:1060:9:1060:9 | a |
From 68cbe35d960125ebabafa3b456969656a3d5a528 Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Tue, 3 Sep 2024 13:08:07 +0100
Subject: [PATCH 158/500] Fix a bad link
---
docs/codeql/writing-codeql-queries/running-codeql-queries.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/codeql/writing-codeql-queries/running-codeql-queries.rst b/docs/codeql/writing-codeql-queries/running-codeql-queries.rst
index 4d4a255a2cc..0fc967c184c 100644
--- a/docs/codeql/writing-codeql-queries/running-codeql-queries.rst
+++ b/docs/codeql/writing-codeql-queries/running-codeql-queries.rst
@@ -31,4 +31,4 @@ Run the standard CodeQL queries
The easiest way to run the standard CodeQL queries on a repository hosted on the GitHub platform is to enable code scanning with CodeQL (this requires GitHub Actions to be enabled). When you enable default setup, you can choose from a default set of security queries or an extended set of security queries. Any results are shown as code scanning alerts on the **Security** tab of the repository. For more information, see "`Configuring default setup for code scanning `__".
-If you want to run the standard CodeQL queries on a repository that is not hosted on the GitHub platform, or where GitHub Actions are disabled, you can use the CodeQL CLI. For more information, see "`About the CodeQL CLI `__".
+If you want to run the standard CodeQL queries on a repository where GitHub Actions are disabled, you can use the CodeQL CLI in your existing CI system. For more information, see "`Using code scanning with your existing CI system `__".
From 6c97096642db311ffd669c24be1c7b81cbed8fd7 Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 3 Sep 2024 14:16:25 +0200
Subject: [PATCH 159/500] remove unused imports, add tests for libarchive
---
.../Security/CWE/CWE-409/Brotli.qll | 1 -
.../Security/CWE/CWE-409/Bzip2.qll | 4 +-
.../Security/CWE/CWE-409/LibArchive.qll | 15 +-
.../Security/CWE/CWE-409/MiniZip.qll | 5 +-
.../query-tests/Security/CWE/CWE-409/XZ.qll | 1 -
.../query-tests/Security/CWE/CWE-409/ZSTD.qll | 2 -
.../Security/CWE/CWE-409/ZlibGzopen.qll | 1 -
.../Security/CWE/CWE-409/ZlibInflator.qll | 1 -
.../Security/CWE/CWE-409/ZlibUncompress.qll | 1 -
.../CWE/CWE-409/DecompressionBombs.expected | 104 +++++++++++++
.../Security/CWE/CWE-409/libarchiveTests.cpp | 147 ++++++++++++++++++
11 files changed, 268 insertions(+), 14 deletions(-)
create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
index 5c19e53df07..705f7a1f3b9 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.commons.File
import DecompressionBomb
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
index 7f69aa494c6..5d198eff61a 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
@@ -4,12 +4,10 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
import DecompressionBomb
/**
- * The `BZ2_bzDecompress` function as a Flow source
+ * The `BZ2_bzDecompress` function is used in flow sink
*/
class BZ2BzDecompressFunction extends DecompressionFunction {
BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
index e5124006504..f5e39ca2675 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
@@ -18,3 +17,17 @@ class Archive_read_data_block extends DecompressionFunction {
override int getArchiveParameterIndex() { result = 0 }
}
+
+/**
+ * The `archive_read_open_filename` function as a flow step.
+ */
+class ReadOpenFunction extends DecompressionFlowStep {
+ ReadOpenFunction() { this.hasGlobalName("archive_read_open_filename") }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asIndirectExpr() = fc.getArgument(1) and
+ node2.asIndirectExpr() = fc.getArgument(0)
+ )
+ }
+}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
index 1ebb7b277dc..a0365778c21 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
@@ -18,7 +17,7 @@ class Mz_zip_entry extends DecompressionFunction {
}
/**
- * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow source.
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow sink.
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
*/
class Mz_zip_reader_entry extends DecompressionFunction {
@@ -42,7 +41,7 @@ class UnzOpenFunction extends DecompressionFunction {
}
/**
- * The `mz_zip_reader_open_file` and `mz_zip_reader_open_file_in_memory` functions as a flow source.
+ * The `mz_zip_reader_open_file` and `mz_zip_reader_open_file_in_memory` functions as a flow step.
*/
class ReaderOpenFunction extends DecompressionFlowStep {
ReaderOpenFunction() {
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
index a0b17388b93..7839f3b4e6a 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
index c34170df625..e5973d97b9a 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
@@ -4,8 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
import DecompressionBomb
/**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
index edb8ef7ff68..851500b2cee 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
index 464dce3ac45..6a5d4b8f1ec 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
index 60943495d45..656bd98655d 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
import DecompressionBomb
/**
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
index 1879cb98fc4..17b196d697a 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
@@ -1,13 +1,51 @@
edges
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
+| brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| libarchiveTests.cpp:10:46:10:46 | *a | libarchiveTests.cpp:10:46:10:46 | *a | provenance | |
+| libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:38:48:38:55 | *pArchive | provenance | |
+| libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:57:45:57:52 | *pArchive | provenance | |
+| libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:86:38:86:39 | *ar | provenance | |
+| libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:93:33:93:34 | *ar | provenance | |
+| libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:93:33:93:34 | *ar | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:57:45:57:52 | *pArchive | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | libarchiveTests.cpp:86:38:86:39 | *ar | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | libarchiveTests.cpp:86:38:86:39 | *ar [Return] | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | libarchiveTests.cpp:93:33:93:34 | *ar | provenance | |
+| libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | libarchiveTests.cpp:93:33:93:34 | *ar | provenance | |
+| libarchiveTests.cpp:105:33:105:40 | *filename | libarchiveTests.cpp:123:40:123:47 | *filename | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:38:48:38:55 | *pArchive | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:126:34:126:34 | *a | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:129:23:129:23 | *a | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument | libarchiveTests.cpp:126:34:126:34 | *a | provenance | |
+| libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument | libarchiveTests.cpp:129:23:129:23 | *a | provenance | |
+| libarchiveTests.cpp:123:40:123:47 | *filename | libarchiveTests.cpp:123:37:123:37 | *a | provenance | Config |
+| libarchiveTests.cpp:126:34:126:34 | *a | libarchiveTests.cpp:10:46:10:46 | *a | provenance | |
+| libarchiveTests.cpp:126:34:126:34 | *a | libarchiveTests.cpp:126:34:126:34 | archive_read_next_header output argument | provenance | |
+| libarchiveTests.cpp:126:34:126:34 | archive_read_next_header output argument | libarchiveTests.cpp:126:34:126:34 | *a | provenance | |
+| libarchiveTests.cpp:126:34:126:34 | archive_read_next_header output argument | libarchiveTests.cpp:129:23:129:23 | *a | provenance | |
+| libarchiveTests.cpp:129:23:129:23 | *a | libarchiveTests.cpp:86:38:86:39 | *ar | provenance | |
+| libarchiveTests.cpp:129:23:129:23 | *a | libarchiveTests.cpp:129:23:129:23 | copy_data output argument | provenance | |
+| libarchiveTests.cpp:129:23:129:23 | copy_data output argument | libarchiveTests.cpp:126:34:126:34 | *a | provenance | |
+| libarchiveTests.cpp:129:23:129:23 | copy_data output argument | libarchiveTests.cpp:129:23:129:23 | *a | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
+| libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| libarchiveTests.cpp:145:13:145:19 | *access to array | libarchiveTests.cpp:105:33:105:40 | *filename | provenance | |
| minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:28:46:28:48 | *buf | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
+| minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
@@ -81,6 +119,28 @@ nodes
| brotliTest.cpp:29:32:29:35 | **argv | semmle.label | **argv |
| brotliTest.cpp:31:42:31:60 | *access to array | semmle.label | *access to array |
| brotliTest.cpp:37:35:37:40 | *input2 | semmle.label | *input2 |
+| libarchiveTests.cpp:10:46:10:46 | *a | semmle.label | *a |
+| libarchiveTests.cpp:10:46:10:46 | *a | semmle.label | *a |
+| libarchiveTests.cpp:38:48:38:55 | *pArchive | semmle.label | *pArchive |
+| libarchiveTests.cpp:38:48:38:55 | *pArchive | semmle.label | *pArchive |
+| libarchiveTests.cpp:57:45:57:52 | *pArchive | semmle.label | *pArchive |
+| libarchiveTests.cpp:57:45:57:52 | *pArchive | semmle.label | *pArchive |
+| libarchiveTests.cpp:86:38:86:39 | *ar | semmle.label | *ar |
+| libarchiveTests.cpp:86:38:86:39 | *ar | semmle.label | *ar |
+| libarchiveTests.cpp:86:38:86:39 | *ar [Return] | semmle.label | *ar [Return] |
+| libarchiveTests.cpp:93:33:93:34 | *ar | semmle.label | *ar |
+| libarchiveTests.cpp:93:33:93:34 | *ar | semmle.label | *ar |
+| libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument | semmle.label | archive_read_data_block output argument |
+| libarchiveTests.cpp:105:33:105:40 | *filename | semmle.label | *filename |
+| libarchiveTests.cpp:123:37:123:37 | *a | semmle.label | *a |
+| libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument | semmle.label | archive_read_open_filename output argument |
+| libarchiveTests.cpp:123:40:123:47 | *filename | semmle.label | *filename |
+| libarchiveTests.cpp:126:34:126:34 | *a | semmle.label | *a |
+| libarchiveTests.cpp:126:34:126:34 | archive_read_next_header output argument | semmle.label | archive_read_next_header output argument |
+| libarchiveTests.cpp:129:23:129:23 | *a | semmle.label | *a |
+| libarchiveTests.cpp:129:23:129:23 | copy_data output argument | semmle.label | copy_data output argument |
+| libarchiveTests.cpp:144:32:144:35 | **argv | semmle.label | **argv |
+| libarchiveTests.cpp:145:13:145:19 | *access to array | semmle.label | *access to array |
| minizipTest.cpp:28:46:28:48 | *buf | semmle.label | *buf |
| minizipTest.cpp:28:46:28:48 | *buf | semmle.label | *buf |
| minizipTest.cpp:36:32:36:35 | **argv | semmle.label | **argv |
@@ -136,6 +196,11 @@ nodes
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | semmle.label | UnsafeGzread output argument |
| zlibTest.cpp:174:19:174:66 | *access to array | semmle.label | *access to array |
subpaths
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument |
+| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument |
+| libarchiveTests.cpp:126:34:126:34 | *a | libarchiveTests.cpp:10:46:10:46 | *a | libarchiveTests.cpp:10:46:10:46 | *a | libarchiveTests.cpp:126:34:126:34 | archive_read_next_header output argument |
+| libarchiveTests.cpp:129:23:129:23 | *a | libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:129:23:129:23 | copy_data output argument |
+| libarchiveTests.cpp:129:23:129:23 | *a | libarchiveTests.cpp:86:38:86:39 | *ar | libarchiveTests.cpp:86:38:86:39 | *ar [Return] | libarchiveTests.cpp:129:23:129:23 | copy_data output argument |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument |
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:109:39:109:44 | *handle | minizipTest.cpp:109:39:109:44 | *handle | minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument |
| minizipTest.cpp:55:36:55:45 | *zip_reader | minizipTest.cpp:101:46:101:50 | *pVoid | minizipTest.cpp:101:46:101:50 | *pVoid | minizipTest.cpp:55:36:55:45 | mz_zip_reader_goto_first_entry output argument |
@@ -145,28 +210,67 @@ subpaths
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument |
#select
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
| zlibTest.cpp:70:13:70:22 | & ... | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:70:13:70:22 | & ... | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
| zlibTest.cpp:101:32:101:38 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:101:32:101:38 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp
new file mode 100644
index 00000000000..d20486a007b
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp
@@ -0,0 +1,147 @@
+#define ARCHIVE_EXTRACT_TIME (0x0004)
+#define ARCHIVE_EXTRACT_PERM (0x0002)
+#define ARCHIVE_EXTRACT_ACL (0x0020)
+#define ARCHIVE_EXTRACT_FFLAGS (0x0040)
+#define ARCHIVE_EOF 1 /* Found end of archive. */
+#define ARCHIVE_OK 0 /* Operation was successful. */
+#define ARCHIVE_WARN (-20) /* Partial success. */
+
+
+int archive_read_next_header(struct archive *a, struct archive_entry **entry) {
+ return 1;
+}
+
+static struct archive *archive_read_new() {
+ return nullptr;
+}
+
+static archive *archive_write_disk_new() {
+ return nullptr;
+}
+
+static void archive_read_support_format_all(archive *pArchive) {
+
+}
+
+static void archive_read_support_filter_all(archive *pArchive) {
+
+}
+
+static void archive_write_disk_set_options(archive *pArchive, int flags) {
+
+}
+
+static void archive_write_disk_set_standard_lookup(archive *pArchive) {
+
+}
+
+static int archive_read_open_filename(archive *pArchive, const char *filename, int i) {}
+
+static void archive_error_string(archive *pArchive) {
+
+}
+
+struct archive_entry {
+};
+
+static int archive_write_header(archive *pArchive, archive_entry *entry) {
+ return 0;
+}
+
+static int archive_entry_size(archive_entry *pEntry) {
+}
+
+typedef int size_t;
+typedef int la_int64_t;
+
+static int archive_read_data_block(archive *pArchive, const void **pVoid, size_t *pInt, la_int64_t *pInt1) {
+ return 0;
+}
+
+static int archive_write_data_block(archive *pArchive, const void *pVoid, size_t size, la_int64_t offset) {
+ return 0;
+}
+
+static int archive_write_finish_entry(archive *pArchive) {
+ return 0;
+}
+
+static void archive_read_close(archive *pArchive) {
+
+}
+
+static void archive_read_free(archive *pArchive) {
+
+}
+
+static void archive_write_close(archive *pArchive) {
+
+}
+
+static void archive_write_free(archive *pArchive) {
+
+}
+
+
+static int copy_data(struct archive *ar, struct archive *aw) {
+ int r;
+ const void *buff;
+ size_t size;
+ la_int64_t offset;
+
+ for (;;) {
+ archive_read_data_block(ar, &buff, &size, &offset);
+ if (r == ARCHIVE_EOF)
+ return (ARCHIVE_OK);
+ if (r < ARCHIVE_OK)
+ return (r);
+ archive_write_data_block(aw, buff, size, offset);
+ if (r < ARCHIVE_OK) {
+ return (r);
+ }
+ }
+}
+
+static void extract(const char *filename) {
+ struct archive *a;
+ struct archive *ext;
+ struct archive_entry *entry;
+ int flags;
+ int r;
+ /* Select which attributes we want to restore. */
+ flags = ARCHIVE_EXTRACT_TIME;
+ flags |= ARCHIVE_EXTRACT_PERM;
+ flags |= ARCHIVE_EXTRACT_ACL;
+ flags |= ARCHIVE_EXTRACT_FFLAGS;
+
+ a = archive_read_new();
+ archive_read_support_format_all(a);
+ archive_read_support_filter_all(a);
+ ext = archive_write_disk_new();
+ archive_write_disk_set_options(ext, flags);
+ archive_write_disk_set_standard_lookup(ext);
+ if ((archive_read_open_filename(a, filename, 10240)))
+ return;
+ for (;;) {
+ archive_read_next_header(a, &entry);
+ archive_write_header(ext, entry);
+ if (archive_entry_size(entry) > 0) {
+ copy_data(a, ext);
+ if (r < ARCHIVE_WARN)
+ break;
+ }
+ archive_write_finish_entry(ext);
+ if (r < ARCHIVE_WARN)
+ break;
+ }
+ archive_read_close(a);
+ archive_read_free(a);
+ archive_write_close(ext);
+ archive_write_free(ext);
+}
+
+
+int main(int argc, const char *argv[]) {
+ extract(argv[1]);
+ return 0;
+}
From a0f0854fdbe3191bdb22759adc1b804810bb687f Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen
Date: Tue, 3 Sep 2024 14:26:02 +0200
Subject: [PATCH 160/500] Dataflow: Fix minor typo.
---
shared/dataflow/codeql/dataflow/DataFlow.qll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
index 7841c72811b..6e4921521b1 100644
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -298,7 +298,7 @@ signature module InputSig {
/** Extra data-flow steps needed for lambda flow analysis. */
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue);
- predicate knownSourceModel(Node sink, string model);
+ predicate knownSourceModel(Node source, string model);
predicate knownSinkModel(Node sink, string model);
From 4fc971dbcbef86368edf4c9ed53ba8d356da3a3a Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 3 Sep 2024 14:48:36 +0200
Subject: [PATCH 161/500] remove xz(lzma)
---
.../CWE/CWE-409/DecompressionBomb.qll | 1 -
.../query-tests/Security/CWE/CWE-409/XZ.qll | 25 -------------------
2 files changed, 26 deletions(-)
delete mode 100644 cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
index ebc112f8f8b..6a46eb4a778 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
@@ -5,7 +5,6 @@ import ZlibGzopen
import ZlibInflator
import ZlibUncompress
import LibArchive
-import XZ
import ZSTD
import Bzip2
import Brotli
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
deleted file mode 100644
index 7839f3b4e6a..00000000000
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * https://github.com/tukaani-project/xz
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import DecompressionBomb
-
-/**
- * The `lzma_code` function is used in flow sink.
- */
-class LzmaCodeFunction extends DecompressionFunction {
- LzmaCodeFunction() { this.hasGlobalName(["lzma_code"]) }
-
- override int getArchiveParameterIndex() { result = 0 }
-}
-
-/**
- * The `lzma_stream_buffer_decode` function is used in flow sink.
- */
-class LzmaStreamBufferDecodeFunction extends DecompressionFunction {
- LzmaStreamBufferDecodeFunction() { this.hasGlobalName(["lzma_stream_buffer_decode"]) }
-
- override int getArchiveParameterIndex() { result = 1 }
-}
From 81283d59ab2faaefdeb43e18740977969a82fd2c Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 3 Sep 2024 15:24:36 +0200
Subject: [PATCH 162/500] remove more unused imports, add tests for zstd, add
flow steps for zstd
zstd is not finilized
---
.../Security/CWE/CWE-409/Brotli.qll | 1 -
.../CWE/CWE-409/DecompressionBombs.ql | 1 -
.../query-tests/Security/CWE/CWE-409/ZSTD.qll | 43 +++++--
.../CWE/CWE-409/DecompressionBombs.expected | 120 ++++++++++++++++++
.../Security/CWE/CWE-409/zstdTest.cpp | 118 +++++++++++++++++
5 files changed, 269 insertions(+), 14 deletions(-)
create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zstdTest.cpp
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
index 705f7a1f3b9..f6d06ef1335 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
@@ -4,7 +4,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.commons.File
import DecompressionBomb
/**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
index 659e92d8498..cdc86836025 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -14,7 +14,6 @@
import cpp
import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
import DecompressionBomb
module DecompressionTaintConfig implements DataFlow::ConfigSig {
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
index e5973d97b9a..2683f03f7c2 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
@@ -9,8 +9,8 @@ import DecompressionBomb
/**
* The `ZSTD_decompress` function is used in flow sink.
*/
-class ZSTDDecompressFunction extends DecompressionFunction {
- ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
+class ZstdDecompressFunction extends DecompressionFunction {
+ ZstdDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
override int getArchiveParameterIndex() { result = 2 }
}
@@ -18,8 +18,8 @@ class ZSTDDecompressFunction extends DecompressionFunction {
/**
* The `ZSTD_decompressDCtx` function is used in flow sink.
*/
-class ZSTDDecompressDCtxFunction extends DecompressionFunction {
- ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
+class ZstdDecompressDctxFunction extends DecompressionFunction {
+ ZstdDecompressDctxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
override int getArchiveParameterIndex() { result = 3 }
}
@@ -27,8 +27,8 @@ class ZSTDDecompressDCtxFunction extends DecompressionFunction {
/**
* The `ZSTD_decompressStream` function is used in flow sink.
*/
-class ZSTDDecompressStreamFunction extends DecompressionFunction {
- ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
+class ZstdDecompressStreamFunction extends DecompressionFunction {
+ ZstdDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
override int getArchiveParameterIndex() { result = 2 }
}
@@ -36,17 +36,36 @@ class ZSTDDecompressStreamFunction extends DecompressionFunction {
/**
* The `ZSTD_decompress_usingDDict` function is used in flow sink.
*/
-class ZSTDDecompressUsingDictFunction extends DecompressionFunction {
- ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+class ZstdDecompressUsingDdictFunction extends DecompressionFunction {
+ ZstdDecompressUsingDdictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
override int getArchiveParameterIndex() { result = 3 }
}
/**
- * The `ZSTD_decompress_usingDDict` function is used in flow sink.
+ * The `fopen_orDie` function as a flow step.
*/
-class ZSTDDecompressUsingDDictFunction extends DecompressionFunction {
- ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
+class FopenOrDieFunction extends DecompressionFlowStep {
+ FopenOrDieFunction() { this.hasGlobalName("fopen_orDie") }
- override int getArchiveParameterIndex() { result = 3 }
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asIndirectExpr() = fc.getArgument(0) and
+ node2.asExpr() = fc
+ )
+ }
+}
+
+/**
+ * The `fread_orDie` function as a flow step.
+ */
+class FreadOrDieFunction extends DecompressionFlowStep {
+ FreadOrDieFunction() { this.hasGlobalName("fread_orDie") }
+
+ override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(FunctionCall fc | fc.getTarget() = this |
+ node1.asIndirectExpr() = fc.getArgument(2) and
+ node2.asIndirectExpr() = fc.getArgument(0)
+ )
+ }
}
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
index 17b196d697a..5bd0f6bcde2 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
@@ -1,11 +1,14 @@
edges
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
+| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
| brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | provenance | |
| libarchiveTests.cpp:10:46:10:46 | *a | libarchiveTests.cpp:10:46:10:46 | *a | provenance | |
| libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:38:48:38:55 | *pArchive | provenance | |
| libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:57:45:57:52 | *pArchive | provenance | |
@@ -35,21 +38,27 @@ edges
| libarchiveTests.cpp:129:23:129:23 | copy_data output argument | libarchiveTests.cpp:126:34:126:34 | *a | provenance | |
| libarchiveTests.cpp:129:23:129:23 | copy_data output argument | libarchiveTests.cpp:129:23:129:23 | *a | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
| libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | provenance | |
| libarchiveTests.cpp:145:13:145:19 | *access to array | libarchiveTests.cpp:105:33:105:40 | *filename | provenance | |
| minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:28:46:28:48 | *buf | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
+| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
| minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | provenance | |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:28:46:28:48 | *buf | provenance | |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | provenance | |
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
@@ -115,9 +124,20 @@ edges
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | provenance | |
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
| zlibTest.cpp:174:19:174:66 | *access to array | zlibTest.cpp:156:41:156:45 | *input | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
+| zstdTest.cpp:114:33:114:36 | **argv | libarchiveTests.cpp:145:13:145:19 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
+| zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | access to array | provenance | |
nodes
| brotliTest.cpp:29:32:29:35 | **argv | semmle.label | **argv |
| brotliTest.cpp:31:42:31:60 | *access to array | semmle.label | *access to array |
+| brotliTest.cpp:31:42:31:60 | access to array | semmle.label | access to array |
| brotliTest.cpp:37:35:37:40 | *input2 | semmle.label | *input2 |
| libarchiveTests.cpp:10:46:10:46 | *a | semmle.label | *a |
| libarchiveTests.cpp:10:46:10:46 | *a | semmle.label | *a |
@@ -146,6 +166,7 @@ nodes
| minizipTest.cpp:36:32:36:35 | **argv | semmle.label | **argv |
| minizipTest.cpp:42:52:42:67 | *access to array | semmle.label | *access to array |
| minizipTest.cpp:42:52:42:67 | *access to array | semmle.label | *access to array |
+| minizipTest.cpp:42:52:42:67 | access to array | semmle.label | access to array |
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | semmle.label | mz_zip_entry_read output argument |
| minizipTest.cpp:54:29:54:38 | **zip_reader | semmle.label | **zip_reader |
| minizipTest.cpp:54:29:54:38 | *zip_reader | semmle.label | *zip_reader |
@@ -156,6 +177,7 @@ nodes
| minizipTest.cpp:60:30:60:39 | **zip_reader | semmle.label | **zip_reader |
| minizipTest.cpp:60:30:60:39 | *zip_reader | semmle.label | *zip_reader |
| minizipTest.cpp:69:13:69:19 | *access to array | semmle.label | *access to array |
+| minizipTest.cpp:69:13:69:19 | access to array | semmle.label | access to array |
| minizipTest.cpp:101:46:101:50 | *pVoid | semmle.label | *pVoid |
| minizipTest.cpp:101:46:101:50 | *pVoid | semmle.label | *pVoid |
| minizipTest.cpp:109:39:109:44 | *handle | semmle.label | *handle |
@@ -195,6 +217,7 @@ nodes
| zlibTest.cpp:172:18:172:24 | *access to array | semmle.label | *access to array |
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | semmle.label | UnsafeGzread output argument |
| zlibTest.cpp:174:19:174:66 | *access to array | semmle.label | *access to array |
+| zstdTest.cpp:114:33:114:36 | **argv | semmle.label | **argv |
subpaths
| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:57:45:57:52 | *pArchive | libarchiveTests.cpp:93:33:93:34 | archive_read_data_block output argument |
| libarchiveTests.cpp:123:37:123:37 | *a | libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:38:48:38:55 | *pArchive | libarchiveTests.cpp:123:37:123:37 | archive_read_open_filename output argument |
@@ -212,66 +235,163 @@ subpaths
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:31:42:31:60 | access to array | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:31:42:31:60 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | libarchiveTests.cpp:144:32:144:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| brotliTest.cpp:37:35:37:40 | *input2 | zstdTest.cpp:114:33:114:36 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | brotliTest.cpp:29:32:29:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | libarchiveTests.cpp:144:32:144:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | minizipTest.cpp:36:32:36:35 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | zstdTest.cpp:114:33:114:36 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | zstdTest.cpp:114:33:114:36 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | zstdTest.cpp:114:33:114:36 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| libarchiveTests.cpp:93:33:93:34 | *ar | zstdTest.cpp:114:33:114:36 | **argv | libarchiveTests.cpp:93:33:93:34 | *ar | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:42:52:42:67 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:42:52:42:67 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | **zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:60:30:60:39 | *zip_reader | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | *access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | libarchiveTests.cpp:144:32:144:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | libarchiveTests.cpp:144:32:144:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
+| minizipTest.cpp:69:13:69:19 | access to array | zstdTest.cpp:114:33:114:36 | **argv | minizipTest.cpp:69:13:69:19 | access to array | This Decompression output $@. | zstdTest.cpp:114:33:114:36 | **argv | is not limited |
| zlibTest.cpp:70:13:70:22 | & ... | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:70:13:70:22 | & ... | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
| zlibTest.cpp:101:32:101:38 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:101:32:101:38 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
| zlibTest.cpp:121:38:121:44 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:121:38:121:44 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zstdTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zstdTest.cpp
new file mode 100644
index 00000000000..e04b85adfb7
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zstdTest.cpp
@@ -0,0 +1,118 @@
+typedef struct _IO_FILE FILE;
+
+static FILE *fopen_orDie(const char *filename, const char *instruction) {
+ return nullptr;
+}
+
+typedef long unsigned int size_t;
+
+static const size_t ZSTD_DStreamInSize() {
+ return 0;
+}
+
+static void *const malloc_orDie(const size_t size) {
+ return nullptr;
+}
+
+static const size_t ZSTD_DStreamOutSize() {
+ return 0;
+}
+
+struct ZSTD_DCtx {
+};
+
+typedef struct ZSTD_inBuffer_s {
+ const void *src;
+ size_t size;
+ size_t pos;
+} ZSTD_inBuffer;
+typedef struct ZSTD_outBuffer_s {
+ void *dst;
+ size_t size;
+ size_t pos;
+} ZSTD_outBuffer;
+
+static ZSTD_DCtx *const ZSTD_createDCtx() {
+ return nullptr;
+}
+
+static void CHECK(bool b, const char *string) {
+
+}
+
+static size_t fread_orDie(void *const pVoid, const size_t read, FILE *const pFile) {
+}
+
+static void CHECK_ZSTD(const size_t ret) {
+
+}
+
+static void fwrite_orDie(void *const pVoid, size_t pos, FILE *const pFile) {
+
+}
+
+static void exit(int i) {
+
+}
+
+static void fclose_orDie(FILE *const pFile) {
+
+}
+
+static void free(void *const pVoid) {
+
+}
+
+static const size_t ZSTD_decompressStream(ZSTD_DCtx *const pCtx, ZSTD_outBuffer *pS, ZSTD_inBuffer *pS1) {
+
+}
+
+static void ZSTD_freeDCtx(ZSTD_DCtx *const pCtx) {
+
+}
+
+static void decompressFile_orDie(const char *fname) {
+ FILE *const fin = fopen_orDie(fname, "rb");
+ size_t const buffInSize = ZSTD_DStreamInSize();
+ void *const buffIn = malloc_orDie(buffInSize);
+ FILE *stdout;
+ FILE *const fout = stdout;
+ size_t const buffOutSize = ZSTD_DStreamOutSize(); /* Guarantee to successfully flush at least one complete compressed block in all circumstances. */
+ void *const buffOut = malloc_orDie(buffOutSize);
+
+ ZSTD_DCtx *const dctx = ZSTD_createDCtx();
+ CHECK(dctx != nullptr, "ZSTD_createDCtx() failed!");
+ size_t const toRead = buffInSize;
+ size_t read;
+ size_t lastRet = 0;
+ int isEmpty = 1;
+ while ((read = fread_orDie(buffIn, toRead, fin))) {
+ isEmpty = 0;
+ ZSTD_inBuffer input = {buffIn, read, 0};
+ while (input.pos < input.size) {
+ ZSTD_outBuffer output = {buffOut, buffOutSize, 0};
+ size_t const ret = ZSTD_decompressStream(dctx, &output, &input);
+ CHECK_ZSTD(ret);
+ fwrite_orDie(buffOut, output.pos, fout);
+ lastRet = ret;
+ }
+ }
+ if (isEmpty) {
+ exit(1);
+ }
+ if (lastRet != 0) {
+ exit(1);
+ }
+ ZSTD_freeDCtx(dctx);
+ fclose_orDie(fin);
+ fclose_orDie(fout);
+ free(buffIn);
+ free(buffOut);
+}
+
+
+int main(int argc, const char **argv) {
+ const char *const inFilename = argv[1];
+ decompressFile_orDie(inFilename);
+ return 0;
+}
\ No newline at end of file
From 386e45a11e14e9a9c8ff838abdd21bb03aa5979f Mon Sep 17 00:00:00 2001
From: am0o0 <77095239+am0o0@users.noreply.github.com>
Date: Tue, 3 Sep 2024 15:33:14 +0200
Subject: [PATCH 163/500] delete bzip2 as it is not updated for more than three
years so it is not in the priority
---
.../Security/CWE/CWE-409/Bzip2.qll | 43 -------------------
.../CWE/CWE-409/DecompressionBomb.qll | 1 -
2 files changed, 44 deletions(-)
delete mode 100644 cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
deleted file mode 100644
index 5d198eff61a..00000000000
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
+++ /dev/null
@@ -1,43 +0,0 @@
-/**
- * https://www.sourceware.org/bzip2/manual/manual.html
- */
-
-import cpp
-import semmle.code.cpp.ir.dataflow.TaintTracking
-import DecompressionBomb
-
-/**
- * The `BZ2_bzDecompress` function is used in flow sink
- */
-class BZ2BzDecompressFunction extends DecompressionFunction {
- BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
-
- override int getArchiveParameterIndex() { result = 0 }
-}
-
-/**
- * The `BZ2_bzReadOpen` function
- */
-class BZ2BzReadOpenFunction extends DecompressionFunction {
- BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
-
- override int getArchiveParameterIndex() { result = 0 }
-}
-
-/**
- * The `BZ2_bzRead` function is used in flow sink.
- */
-class BZ2BzReadFunction extends DecompressionFunction {
- BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
-
- override int getArchiveParameterIndex() { result = 1 }
-}
-
-/**
- * The `BZ2_bzBuffToBuffDecompress` function is used in flow sink.
- */
-class BZ2BzBuffToBuffDecompressFunction extends DecompressionFunction {
- BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
-
- override int getArchiveParameterIndex() { result = 2 }
-}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
index 6a46eb4a778..e330e244c38 100644
--- a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
+++ b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll
@@ -6,7 +6,6 @@ import ZlibInflator
import ZlibUncompress
import LibArchive
import ZSTD
-import Bzip2
import Brotli
/**
From d5948d2d95f9b0f25416cfcf8428487533622e93 Mon Sep 17 00:00:00 2001
From: Simon Friis Vindum
Date: Tue, 3 Sep 2024 16:15:05 +0200
Subject: [PATCH 164/500] C++: Add change-note note for realloc as data-flow
function
---
cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md
diff --git a/cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md b/cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md
new file mode 100644
index 00000000000..3da89a025a5
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added a data-flow model for `realloc` and related functions. Previously they was modeled as a taint functions. This improves the precision of queries using data-flow or taint-tracking when `realloc` is involved.
From 52819432c0deb30efb9e33f9027b207f2fea76bd Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Tue, 3 Sep 2024 17:18:18 +0200
Subject: [PATCH 165/500] C++: Address review comment
---
cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll b/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
index 78c64e22282..91b57049a54 100644
--- a/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
@@ -727,7 +727,9 @@ class C11GenericExpr extends Conversion, @c11_generic {
* ```
* this holds for 0.
*/
- predicate isSelectedAssociation(int n) { this.getAssociationExpr(n) instanceof ReuseExpr }
+ predicate isSelectedAssociation(int n) {
+ this.getAssociationExpr(n).(ReuseExpr).getReusedExpr() = this.getExpr()
+ }
}
/**
From f5c195d83089dbe174564798efdac5142702860c Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Tue, 3 Sep 2024 16:24:55 +0100
Subject: [PATCH 166/500] Remove change note from 1.15.md
We will include this change note when there is documentation about how to use the functionality.
---
...024-09-03-local-threat-models-file-environment.md | 12 ++++++++++++
go/ql/lib/change-notes/released/1.1.5.md | 12 ------------
2 files changed, 12 insertions(+), 12 deletions(-)
create mode 100644 go/ql/lib/change-notes/2024-09-03-local-threat-models-file-environment.md
diff --git a/go/ql/lib/change-notes/2024-09-03-local-threat-models-file-environment.md b/go/ql/lib/change-notes/2024-09-03-local-threat-models-file-environment.md
new file mode 100644
index 00000000000..5efdd8a369e
--- /dev/null
+++ b/go/ql/lib/change-notes/2024-09-03-local-threat-models-file-environment.md
@@ -0,0 +1,12 @@
+---
+category: minorAnalysis
+---
+* Local source models for reading and parsing environment variables have been added for the following libraries:
+ * os
+ * syscall
+ * github.com/caarlos0/env
+ * github.com/gobuffalo/envy
+ * github.com/hashicorp/go-envparse
+ * github.com/joho/godotenv
+ * github.com/kelseyhightower/envconfig
+* Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
diff --git a/go/ql/lib/change-notes/released/1.1.5.md b/go/ql/lib/change-notes/released/1.1.5.md
index 6f2221304e9..ccec4d55ebb 100644
--- a/go/ql/lib/change-notes/released/1.1.5.md
+++ b/go/ql/lib/change-notes/released/1.1.5.md
@@ -1,17 +1,5 @@
## 1.1.5
-### Minor Analysis Improvements
-
-* Local source models for reading and parsing environment variables have been added for the following libraries:
- - os
- - syscall
- - github.com/caarlos0/env
- - github.com/gobuffalo/envy
- - github.com/hashicorp/go-envparse
- - github.com/joho/godotenv
- - github.com/kelseyhightower/envconfig
-* Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
-
### Bug Fixes
* Fixed an issue where `io/ioutil.WriteFile`'s non-path arguments incorrectly generated `go/path-injection` alerts when untrusted data was written to a file, or controlled the file's mode.
From 36c71a959294be446431e4166355c57967a96d85 Mon Sep 17 00:00:00 2001
From: Dave Bartolomeo
Date: Tue, 3 Sep 2024 11:47:02 -0400
Subject: [PATCH 167/500] Include hidden files when uploading Ruby pack
---
.github/workflows/ruby-build.yml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/.github/workflows/ruby-build.yml b/.github/workflows/ruby-build.yml
index cc0944e5909..4a3242ce604 100644
--- a/.github/workflows/ruby-build.yml
+++ b/.github/workflows/ruby-build.yml
@@ -140,6 +140,7 @@ jobs:
path: |
${{ runner.temp }}/query-packs/*
retention-days: 1
+ include-hidden-files: true
package:
runs-on: ubuntu-latest
@@ -176,6 +177,7 @@ jobs:
name: codeql-ruby-pack
path: ruby/codeql-ruby.zip
retention-days: 1
+ include-hidden-files: true
- uses: actions/download-artifact@v3
with:
name: codeql-ruby-queries
@@ -193,6 +195,7 @@ jobs:
name: codeql-ruby-bundle
path: ruby/codeql-ruby-bundle.zip
retention-days: 1
+ include-hidden-files: true
test:
defaults:
From 8ca52f278a72c01d608fdfea1427fddd4d7aaa77 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Fri, 30 Aug 2024 17:30:16 +0200
Subject: [PATCH 168/500] C++: Fix coroutine IR inconsistencies
While here, remove some dead code related to fixed points from the database
scheme.
---
.../coroutine.ql | 18 +
.../old.dbscheme | 2315 ++++++++++++++++
.../semmlecode.cpp.dbscheme | 2319 +++++++++++++++++
.../upgrade.properties | 4 +
cpp/ql/lib/semmle/code/cpp/Variable.qll | 7 +
cpp/ql/lib/semmlecode.cpp.dbscheme | 34 +-
cpp/ql/lib/semmlecode.cpp.dbscheme.stats | 739 +++---
.../old.dbscheme | 2319 +++++++++++++++++
.../semmlecode.cpp.dbscheme | 2315 ++++++++++++++++
.../upgrade.properties | 4 +
.../upgrades.ql | 19 +
.../library-tests/ir/ir/aliased_ir.expected | 1080 ++++----
.../ir/ir/aliased_ssa_consistency.expected | 22 -
.../aliased_ssa_consistency_unsound.expected | 22 -
.../ir/ir/raw_consistency.expected | 28 -
.../test/library-tests/ir/ir/raw_ir.expected | 660 ++---
.../ir/ir/unaliased_ssa_consistency.expected | 22 -
...unaliased_ssa_consistency_unsound.expected | 22 -
18 files changed, 10543 insertions(+), 1406 deletions(-)
create mode 100644 cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/coroutine.ql
create mode 100644 cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/old.dbscheme
create mode 100644 cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/semmlecode.cpp.dbscheme
create mode 100644 cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/upgrade.properties
create mode 100644 cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/old.dbscheme
create mode 100644 cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/semmlecode.cpp.dbscheme
create mode 100644 cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrade.properties
create mode 100644 cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrades.ql
diff --git a/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/coroutine.ql b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/coroutine.ql
new file mode 100644
index 00000000000..293d18945b8
--- /dev/null
+++ b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/coroutine.ql
@@ -0,0 +1,18 @@
+ class Function extends @function {
+ string toString() { none() }
+}
+
+class Type extends @type {
+ string toString() { none() }
+}
+
+class Variable extends @variable {
+ string toString() { none() }
+}
+
+from Function func, Type traits, Variable handle, Variable promise
+where
+ coroutine(func, traits) and
+ coroutine_placeholder_variable(handle, 1, func) and
+ coroutine_placeholder_variable(promise, 2, func)
+select func, traits, handle, promise
diff --git a/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/old.dbscheme b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/old.dbscheme
new file mode 100644
index 00000000000..7ff6a6e53db
--- /dev/null
+++ b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/old.dbscheme
@@ -0,0 +1,2315 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+ unique int id: @external_package,
+ string namespace : string ref,
+ string package_name : string ref,
+ string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+ int fileid : @file ref,
+ int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+ unique int id : @svnentry,
+ string revision : string ref,
+ string author : string ref,
+ date revisionDate : date ref,
+ int changeSize : int ref
+)
+
+svnaffectedfiles(
+ int id : @svnentry ref,
+ int file : @file ref,
+ string action : string ref
+)
+
+svnentrymsg(
+ unique int id : @svnentry ref,
+ string message : string ref
+)
+
+svnchurn(
+ int commit : @svnentry ref,
+ int file : @file ref,
+ int addedLines : int ref,
+ int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ /** The location of an element that is not an expression or a statement. */
+ unique int id: @location_default,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+ /** The location of a statement. */
+ unique int id: @location_stmt,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+ /** The location of an expression. */
+ unique int id: @location_expr,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+/*
+case @function.kind of
+ 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+| 6 = @builtin_function // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+*/
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @functionorblock ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+case @usertype.kind of
+ 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+| 5 = @typedef // classic C: typedef typedef type name
+| 6 = @template
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+| 14 = @using_alias // a using name = type style typedef
+;
+*/
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ /* TODO | @fixedpointtype */
+ | @routinetype
+ | @ptrtomember
+ | @decltype;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_expr ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_expr ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof;
+
+sizeof_bind(
+ unique int expr: @runtime_sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_stmt ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+ | @xmlelement
+ | @xmlcomment
+ | @xmlattribute
+ | @xmldtd
+ | @file
+ | @xmlnamespace;
diff --git a/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/semmlecode.cpp.dbscheme b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/semmlecode.cpp.dbscheme
new file mode 100644
index 00000000000..0fea0ee7026
--- /dev/null
+++ b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/semmlecode.cpp.dbscheme
@@ -0,0 +1,2319 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+ unique int id: @external_package,
+ string namespace : string ref,
+ string package_name : string ref,
+ string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+ int fileid : @file ref,
+ int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+ unique int id : @svnentry,
+ string revision : string ref,
+ string author : string ref,
+ date revisionDate : date ref,
+ int changeSize : int ref
+)
+
+svnaffectedfiles(
+ int id : @svnentry ref,
+ int file : @file ref,
+ string action : string ref
+)
+
+svnentrymsg(
+ unique int id : @svnentry ref,
+ string message : string ref
+)
+
+svnchurn(
+ int commit : @svnentry ref,
+ int file : @file ref,
+ int addedLines : int ref,
+ int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ /** The location of an element that is not an expression or a statement. */
+ unique int id: @location_default,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+ /** The location of a statement. */
+ unique int id: @location_stmt,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+ /** The location of an expression. */
+ unique int id: @location_expr,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+/*
+case @function.kind of
+ 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+| 6 = @builtin_function // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+*/
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref,
+ int handle: @variable ref,
+ int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @functionorblock ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+case @usertype.kind of
+ 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+| 5 = @typedef // classic C: typedef typedef type name
+| 6 = @template
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+| 14 = @using_alias // a using name = type style typedef
+;
+*/
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+/*
+ Fixed point types
+ precision(1) = short, precision(2) = default, precision(3) = long
+ is_unsigned(1) = unsigned is_unsigned(2) = signed
+ is_fract_type(1) = declared with _Fract
+ saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+ unique int id: @fixedpointtype,
+ int precision: int ref,
+ int is_unsigned: int ref,
+ int is_fract_type: int ref,
+ int saturating: int ref);
+*/
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ /* TODO | @fixedpointtype */
+ | @routinetype
+ | @ptrtomember
+ | @decltype;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_expr ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_expr ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof;
+
+sizeof_bind(
+ unique int expr: @runtime_sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_stmt ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+ | @xmlelement
+ | @xmlcomment
+ | @xmlattribute
+ | @xmldtd
+ | @file
+ | @xmlnamespace;
diff --git a/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/upgrade.properties b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/upgrade.properties
new file mode 100644
index 00000000000..cb2077596c3
--- /dev/null
+++ b/cpp/downgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/upgrade.properties
@@ -0,0 +1,4 @@
+description: Improve handling of coroutine placeholder variables
+compatibility: full
+coroutine.rel: run coroutine.qlo
+coroutine_placeholder_variable.rel: delete
diff --git a/cpp/ql/lib/semmle/code/cpp/Variable.qll b/cpp/ql/lib/semmle/code/cpp/Variable.qll
index 8d78dbd2c71..96bfabb4de0 100644
--- a/cpp/ql/lib/semmle/code/cpp/Variable.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Variable.qll
@@ -409,11 +409,18 @@ class LocalVariable extends LocalScopeVariable, @localvariable {
exists(ConditionDeclExpr e | e.getVariable() = this and e.getEnclosingFunction() = result)
or
orphaned_variables(underlyingElement(this), unresolveElement(result))
+ or
+ coroutine_placeholder_variable(underlyingElement(this), _, unresolveElement(result))
}
override predicate isStatic() {
super.isStatic() or orphaned_variables(underlyingElement(this), _)
}
+
+ override predicate isCompilerGenerated() {
+ super.isCompilerGenerated() or
+ coroutine_placeholder_variable(underlyingElement(this), _, _)
+ }
}
/**
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme b/cpp/ql/lib/semmlecode.cpp.dbscheme
index 0fea0ee7026..7ff6a6e53db 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -384,11 +384,23 @@ function_return_type(
*/
coroutine(
unique int function: @function ref,
- int traits: @type ref,
- int handle: @variable ref,
- int promise: @variable ref
+ int traits: @type ref
);
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
/** The `new` function used for allocating the coroutine state, if any. */
coroutine_new(
unique int function: @function ref,
@@ -829,22 +841,6 @@ variable_template_argument_value(
int arg_value: @expr ref
);
-/*
- Fixed point types
- precision(1) = short, precision(2) = default, precision(3) = long
- is_unsigned(1) = unsigned is_unsigned(2) = signed
- is_fract_type(1) = declared with _Fract
- saturating(1) = declared with _Sat
-*/
-/* TODO
-fixedpointtypes(
- unique int id: @fixedpointtype,
- int precision: int ref,
- int is_unsigned: int ref,
- int is_fract_type: int ref,
- int saturating: int ref);
-*/
-
routinetypes(
unique int id: @routinetype,
int return_type: @type ref
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
index 73e6d0bf972..07045b0bd67 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
@@ -98,7 +98,7 @@
@localvariable
- 576947
+ 576946
@enumconstant
@@ -370,7 +370,7 @@
@usertype
- 5234031
+ 5234965
@mangledname
@@ -468,10 +468,6 @@
@initialiser
1710781
-
- @lambdacapture
- 28011
-
@address_of
438815
@@ -482,11 +478,11 @@
@array_to_pointer
- 1430839
+ 1430838
@parexpr
- 3587480
+ 3587479
@arithnegexpr
@@ -522,7 +518,7 @@
@conditionalexpr
- 657238
+ 657237
@addexpr
@@ -1360,6 +1356,10 @@
@c11_generic
8
+
+ @lambdacapture
+ 28011
+
@stmt_expr
1486025
@@ -2148,7 +2148,7 @@
seconds
- 9868
+ 9149
@@ -2229,47 +2229,47 @@
3
4
- 679
+ 759
4
5
- 319
+ 239
- 6
- 7
+ 5
+ 8
159
- 7
+ 8
10
- 159
+ 119
10
11
- 79
+ 159
11
- 14
+ 15
159
- 16
- 18
+ 17
+ 19
159
- 19
- 27
+ 20
+ 44
159
- 41
- 88
- 119
+ 50
+ 92
+ 79
@@ -2337,42 +2337,42 @@
3
4
- 1518
+ 1478
4
5
- 319
+ 279
5
6
- 199
+ 239
6
7
- 399
+ 479
7
8
- 119
+ 39
8
- 10
+ 9
279
- 10
- 28
- 279
+ 9
+ 24
+ 239
- 28
- 86
- 199
+ 25
+ 88
+ 279
@@ -2420,16 +2420,21 @@
3
4
- 79
-
-
- 134
- 135
39
- 148
- 149
+ 4
+ 5
+ 39
+
+
+ 124
+ 125
+ 39
+
+
+ 129
+ 130
39
@@ -2446,27 +2451,27 @@
1
2
- 5033
+ 4394
2
3
- 2556
+ 1757
3
4
- 1438
+ 1518
4
- 16
- 759
+ 5
+ 998
- 27
+ 5
46
- 79
+ 479
@@ -2482,17 +2487,17 @@
1
2
- 4314
+ 4115
2
3
- 2237
+ 1478
3
4
- 1638
+ 1478
4
@@ -2501,13 +2506,13 @@
5
- 11
- 759
+ 6
+ 559
- 16
- 76
- 119
+ 6
+ 75
+ 719
@@ -2523,12 +2528,12 @@
1
2
- 8230
+ 7910
2
3
- 1638
+ 1238
@@ -2872,7 +2877,7 @@
cpu_seconds
- 7168
+ 7100
elapsed_seconds
@@ -2922,17 +2927,22 @@
1
2
- 5779
+ 5655
2
3
- 846
+ 857
3
- 18
- 541
+ 7
+ 553
+
+
+ 11
+ 13
+ 33
@@ -2948,7 +2958,7 @@
1
2
- 6468
+ 6400
2
@@ -2967,9 +2977,9 @@
12
- 1
- 2
- 22
+ 2
+ 3
+ 33
4
@@ -2977,18 +2987,13 @@
11
- 5
- 6
+ 8
+ 9
11
- 9
- 10
- 11
-
-
- 12
- 13
+ 13
+ 14
22
@@ -2997,18 +3002,23 @@
11
- 153
- 154
+ 159
+ 160
11
177
178
- 22
+ 11
- 261
- 262
+ 185
+ 186
+ 11
+
+
+ 247
+ 248
11
@@ -3023,9 +3033,9 @@
12
- 1
- 2
- 22
+ 2
+ 3
+ 33
4
@@ -3033,19 +3043,19 @@
11
- 5
- 6
- 11
-
-
- 9
- 10
+ 8
+ 9
11
12
13
- 22
+ 11
+
+
+ 13
+ 14
+ 11
49
@@ -3053,23 +3063,23 @@
11
- 106
- 107
+ 112
+ 113
11
- 127
- 128
+ 124
+ 125
11
- 135
- 136
+ 145
+ 146
11
- 236
- 237
+ 218
+ 219
11
@@ -12346,15 +12356,15 @@
inmacroexpansion
- 109779198
+ 109779137
id
- 18027369
+ 18027366
inv
- 2700171
+ 2700175
@@ -12368,32 +12378,32 @@
1
3
- 1581956
+ 1581965
3
5
- 1077799
+ 1077798
5
6
- 1184884
+ 1184883
6
7
- 4819927
+ 4819923
7
8
- 6385963
+ 6385959
8
9
- 2605255
+ 2605253
9
@@ -12414,12 +12424,12 @@
1
2
- 378424
+ 378428
2
3
- 544108
+ 544105
3
@@ -12429,7 +12439,7 @@
4
7
- 200659
+ 200660
7
@@ -12449,12 +12459,12 @@
10
11
- 325487
+ 325486
11
337
- 224847
+ 224849
339
@@ -12474,15 +12484,15 @@
affectedbymacroexpansion
- 35689096
+ 35689082
id
- 5156743
+ 5156745
inv
- 2784774
+ 2784776
@@ -12496,12 +12506,12 @@
1
2
- 2815934
+ 2815933
2
3
- 560129
+ 560132
3
@@ -12542,7 +12552,7 @@
1
4
- 229116
+ 229120
4
@@ -12557,7 +12567,7 @@
9
12
- 251088
+ 251087
12
@@ -13883,14 +13893,6 @@
traits
3
-
- handle
- 6
-
-
- promise
- 6
-
@@ -13910,8 +13912,8 @@
- function
- handle
+ traits
+ function
12
@@ -13919,6 +13921,116 @@
1
2
+ 1
+
+
+ 2
+ 3
+ 1
+
+
+ 3
+ 4
+ 1
+
+
+
+
+
+
+
+
+ coroutine_placeholder_variable
+ 18
+
+
+ placeholder_variable
+ 18
+
+
+ kind
+ 3
+
+
+ function
+ 6
+
+
+
+
+ placeholder_variable
+ kind
+
+
+ 12
+
+
+ 1
+ 2
+ 18
+
+
+
+
+
+
+ placeholder_variable
+ function
+
+
+ 12
+
+
+ 1
+ 2
+ 18
+
+
+
+
+
+
+ kind
+ placeholder_variable
+
+
+ 12
+
+
+ 6
+ 7
+ 3
+
+
+
+
+
+
+ kind
+ function
+
+
+ 12
+
+
+ 6
+ 7
+ 3
+
+
+
+
+
+
+ function
+ placeholder_variable
+
+
+ 12
+
+
+ 3
+ 4
6
@@ -13927,188 +14039,14 @@
function
- promise
+ kind
12
-
- 1
- 2
- 6
-
-
-
-
-
-
- traits
- function
-
-
- 12
-
-
- 1
- 2
- 1
-
-
- 2
- 3
- 1
-
3
4
- 1
-
-
-
-
-
-
- traits
- handle
-
-
- 12
-
-
- 1
- 2
- 1
-
-
- 2
- 3
- 1
-
-
- 3
- 4
- 1
-
-
-
-
-
-
- traits
- promise
-
-
- 12
-
-
- 1
- 2
- 1
-
-
- 2
- 3
- 1
-
-
- 3
- 4
- 1
-
-
-
-
-
-
- handle
- function
-
-
- 12
-
-
- 1
- 2
- 6
-
-
-
-
-
-
- handle
- traits
-
-
- 12
-
-
- 1
- 2
- 6
-
-
-
-
-
-
- handle
- promise
-
-
- 12
-
-
- 1
- 2
- 6
-
-
-
-
-
-
- promise
- function
-
-
- 12
-
-
- 1
- 2
- 6
-
-
-
-
-
-
- promise
- traits
-
-
- 12
-
-
- 1
- 2
- 6
-
-
-
-
-
-
- promise
- handle
-
-
- 12
-
-
- 1
- 2
6
@@ -18313,7 +18251,7 @@
new
- 122753
+ 122752
old
@@ -18739,11 +18677,11 @@
localvariables
- 576947
+ 576946
id
- 576947
+ 576946
type_id
@@ -18765,7 +18703,7 @@
1
2
- 576947
+ 576946
@@ -18781,7 +18719,7 @@
1
2
- 576947
+ 576946
@@ -21817,11 +21755,11 @@
usertypes
- 5234031
+ 5234965
id
- 5234031
+ 5234965
name
@@ -21843,7 +21781,7 @@
1
2
- 5234031
+ 5234965
@@ -21859,7 +21797,7 @@
1
2
- 5234031
+ 5234965
@@ -21916,12 +21854,12 @@
2
3
- 125586
+ 125120
3
7
- 14939
+ 15406
@@ -21955,8 +21893,8 @@
466
- 133
- 134
+ 135
+ 136
466
@@ -22021,8 +21959,8 @@
466
- 41
- 42
+ 43
+ 44
466
@@ -22063,11 +22001,11 @@
usertypesize
- 1706394
+ 1707327
id
- 1706394
+ 1707327
size
@@ -22089,7 +22027,7 @@
1
2
- 1706394
+ 1707327
@@ -22105,7 +22043,7 @@
1
2
- 1706394
+ 1707327
@@ -22160,7 +22098,7 @@
740
- 2470
+ 2472
933
@@ -22221,8 +22159,8 @@
466
- 3209
- 3210
+ 3211
+ 3212
466
@@ -22333,11 +22271,11 @@
mangled_name
- 9019378
+ 9020312
id
- 9019378
+ 9020312
mangled_name
@@ -22359,7 +22297,7 @@
1
2
- 9019378
+ 9020312
@@ -22375,7 +22313,7 @@
1
2
- 9019378
+ 9020312
@@ -22426,8 +22364,8 @@
12
- 19319
- 19320
+ 19321
+ 19322
466
@@ -22465,22 +22403,22 @@
is_standard_layout_class
- 1254001
+ 1254935
id
- 1254001
+ 1254935
is_complete
- 1645701
+ 1646635
id
- 1645701
+ 1646635
@@ -22998,15 +22936,15 @@
is_proxy_class_for
- 62093
+ 63026
id
- 62093
+ 63026
templ_param_id
- 62093
+ 63026
@@ -23020,7 +22958,7 @@
1
2
- 62093
+ 63026
@@ -23036,7 +22974,7 @@
1
2
- 62093
+ 63026
@@ -24962,11 +24900,11 @@
typespecifiers
- 1132149
+ 1133083
type_id
- 1113941
+ 1114875
spec_id
@@ -24984,7 +24922,7 @@
1
2
- 1095733
+ 1096667
2
@@ -25030,7 +24968,12 @@
219
220
- 933
+ 466
+
+
+ 221
+ 222
+ 466
1701
@@ -25045,7 +24988,7 @@
funspecifiers
- 10305126
+ 10304659
func_id
@@ -25072,12 +25015,12 @@
2
3
- 640539
+ 641006
3
4
- 985553
+ 985086
4
@@ -25186,8 +25129,8 @@
466
- 6435
- 6436
+ 6434
+ 6435
466
@@ -26862,15 +26805,15 @@
unspecifiedtype
- 9488111
+ 9489045
type_id
- 9488111
+ 9489045
unspecified_type_id
- 6490367
+ 6491300
@@ -26884,7 +26827,7 @@
1
2
- 9488111
+ 9489045
@@ -26900,7 +26843,7 @@
1
2
- 4558943
+ 4559877
2
@@ -28814,15 +28757,15 @@
exprconv
- 7033025
+ 7033022
converted
- 7033025
+ 7033022
conversion
- 7033025
+ 7033022
@@ -28836,7 +28779,7 @@
1
2
- 7033025
+ 7033022
@@ -28852,7 +28795,7 @@
1
2
- 7033025
+ 7033022
@@ -29857,7 +29800,7 @@
qualifyingelement
- 97538
+ 97519
location
@@ -29971,7 +29914,7 @@
1
2
- 58420
+ 58401
2
@@ -30007,7 +29950,7 @@
1
2
- 58420
+ 58401
2
@@ -30043,7 +29986,7 @@
1
2
- 63834
+ 63815
2
@@ -30156,12 +30099,12 @@
1
2
- 137055
+ 137074
2
3
- 55703
+ 55684
3
@@ -30282,7 +30225,7 @@
fun
- 511325
+ 511344
@@ -30317,12 +30260,12 @@
1
2
- 315052
+ 315090
2
3
- 77912
+ 77893
3
@@ -30625,15 +30568,15 @@
expr_cond_guard
- 657238
+ 657237
cond
- 657238
+ 657237
guard
- 657238
+ 657237
@@ -30647,7 +30590,7 @@
1
2
- 657238
+ 657237
@@ -30663,7 +30606,7 @@
1
2
- 657238
+ 657237
@@ -30721,15 +30664,15 @@
expr_cond_false
- 657238
+ 657237
cond
- 657238
+ 657237
false
- 657238
+ 657237
@@ -30743,7 +30686,7 @@
1
2
- 657238
+ 657237
@@ -30759,7 +30702,7 @@
1
2
- 657238
+ 657237
@@ -36328,11 +36271,11 @@
stmt_decl_bind
- 580844
+ 580843
stmt
- 541062
+ 541061
num
@@ -36340,7 +36283,7 @@
decl
- 580740
+ 580739
@@ -36354,7 +36297,7 @@
1
2
- 520373
+ 520372
2
@@ -36375,7 +36318,7 @@
1
2
- 520373
+ 520372
2
@@ -36578,7 +36521,7 @@
1
2
- 580703
+ 580702
2
@@ -36599,7 +36542,7 @@
1
2
- 580740
+ 580739
@@ -36609,11 +36552,11 @@
stmt_decl_entry_bind
- 580844
+ 580843
stmt
- 541062
+ 541061
num
@@ -36621,7 +36564,7 @@
decl_entry
- 580786
+ 580785
@@ -36635,7 +36578,7 @@
1
2
- 520373
+ 520372
2
@@ -36656,7 +36599,7 @@
1
2
- 520373
+ 520372
2
@@ -36859,7 +36802,7 @@
1
2
- 580765
+ 580764
3
@@ -36880,7 +36823,7 @@
1
2
- 580786
+ 580785
diff --git a/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/old.dbscheme b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/old.dbscheme
new file mode 100644
index 00000000000..0fea0ee7026
--- /dev/null
+++ b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/old.dbscheme
@@ -0,0 +1,2319 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+ unique int id: @external_package,
+ string namespace : string ref,
+ string package_name : string ref,
+ string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+ int fileid : @file ref,
+ int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+ unique int id : @svnentry,
+ string revision : string ref,
+ string author : string ref,
+ date revisionDate : date ref,
+ int changeSize : int ref
+)
+
+svnaffectedfiles(
+ int id : @svnentry ref,
+ int file : @file ref,
+ string action : string ref
+)
+
+svnentrymsg(
+ unique int id : @svnentry ref,
+ string message : string ref
+)
+
+svnchurn(
+ int commit : @svnentry ref,
+ int file : @file ref,
+ int addedLines : int ref,
+ int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ /** The location of an element that is not an expression or a statement. */
+ unique int id: @location_default,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+ /** The location of a statement. */
+ unique int id: @location_stmt,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+ /** The location of an expression. */
+ unique int id: @location_expr,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+/*
+case @function.kind of
+ 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+| 6 = @builtin_function // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+*/
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref,
+ int handle: @variable ref,
+ int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @functionorblock ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+case @usertype.kind of
+ 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+| 5 = @typedef // classic C: typedef typedef type name
+| 6 = @template
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+| 14 = @using_alias // a using name = type style typedef
+;
+*/
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+/*
+ Fixed point types
+ precision(1) = short, precision(2) = default, precision(3) = long
+ is_unsigned(1) = unsigned is_unsigned(2) = signed
+ is_fract_type(1) = declared with _Fract
+ saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+ unique int id: @fixedpointtype,
+ int precision: int ref,
+ int is_unsigned: int ref,
+ int is_fract_type: int ref,
+ int saturating: int ref);
+*/
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ /* TODO | @fixedpointtype */
+ | @routinetype
+ | @ptrtomember
+ | @decltype;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_expr ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_expr ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof;
+
+sizeof_bind(
+ unique int expr: @runtime_sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_stmt ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+ | @xmlelement
+ | @xmlcomment
+ | @xmlattribute
+ | @xmldtd
+ | @file
+ | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/semmlecode.cpp.dbscheme b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/semmlecode.cpp.dbscheme
new file mode 100644
index 00000000000..7ff6a6e53db
--- /dev/null
+++ b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/semmlecode.cpp.dbscheme
@@ -0,0 +1,2315 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+ unique int id: @external_package,
+ string namespace : string ref,
+ string package_name : string ref,
+ string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+ int fileid : @file ref,
+ int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+ unique int id : @svnentry,
+ string revision : string ref,
+ string author : string ref,
+ date revisionDate : date ref,
+ int changeSize : int ref
+)
+
+svnaffectedfiles(
+ int id : @svnentry ref,
+ int file : @file ref,
+ string action : string ref
+)
+
+svnentrymsg(
+ unique int id : @svnentry ref,
+ string message : string ref
+)
+
+svnchurn(
+ int commit : @svnentry ref,
+ int file : @file ref,
+ int addedLines : int ref,
+ int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+extractor_version(
+ string codeql_version: string ref,
+ string frontend_version: string ref
+)
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+ /** The location of an element that is not an expression or a statement. */
+ unique int id: @location_default,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+ /** The location of a statement. */
+ unique int id: @location_stmt,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+ /** The location of an expression. */
+ unique int id: @location_expr,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+files(
+ unique int id: @file,
+ string name: string ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+case @macroinvocation.kind of
+ 1 = @macro_expansion
+| 2 = @other_macro_reference
+;
+
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+/*
+case @function.kind of
+ 1 = @normal_function
+| 2 = @constructor
+| 3 = @destructor
+| 4 = @conversion_function
+| 5 = @operator
+| 6 = @builtin_function // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 7 = @user_defined_literal
+| 8 = @deduction_guide
+;
+*/
+
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+function_entry_point(
+ int id: @function ref,
+ unique int entry_point: @stmt ref
+);
+
+function_return_type(
+ int id: @function ref,
+ int return_type: @type ref
+);
+
+/**
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
+coroutine(
+ unique int function: @function ref,
+ int traits: @type ref
+);
+
+/*
+case @coroutine_placeholder_variable.kind of
+ 1 = @handle
+| 2 = @promise
+| 3 = @init_await_resume
+;
+*/
+
+coroutine_placeholder_variable(
+ unique int placeholder_variable: @variable ref,
+ int kind: int ref,
+ int function: @function ref
+)
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+ unique int function: @function ref,
+ int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+ unique int function: @function ref,
+ int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+function_prototyped(unique int id: @function ref)
+
+deduction_guide_for_class(
+ int id: @function ref,
+ int class_template: @usertype ref
+)
+
+member_function_this_type(
+ unique int id: @function ref,
+ int this_type: @type ref
+);
+
+#keyset[id, type_id]
+fun_decls(
+ int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+ int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+case @using.kind of
+ 1 = @using_declaration
+| 2 = @using_directive
+| 3 = @using_enum_declaration
+;
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref,
+ int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+ int id: @parameter,
+ int function: @functionorblock ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(
+ int new: @function ref,
+ int old: @function ref
+);
+
+#keyset[id, type_id]
+membervariables(
+ int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+ int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+orphaned_variables(
+ int var: @localvariable ref,
+ int function: @function ref
+)
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/**
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+ 1 = @errortype
+| 2 = @unknowntype
+| 3 = @void
+| 4 = @boolean
+| 5 = @char
+| 6 = @unsigned_char
+| 7 = @signed_char
+| 8 = @short
+| 9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float // C99-specific _Complex float
+| 28 = @complex_double // C99-specific _Complex double
+| 29 = @complex_long_double // C99-specific _Complex long double
+| 30 = @imaginary_float // C99-specific _Imaginary float
+| 31 = @imaginary_double // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t // Microsoft-specific
+| 34 = @decltype_nullptr // C++11
+| 35 = @int128 // __int128
+| 36 = @unsigned_int128 // unsigned __int128
+| 37 = @signed_int128 // signed __int128
+| 38 = @float128 // __float128
+| 39 = @complex_float128 // _Complex __float128
+| 40 = @decimal32 // _Decimal32
+| 41 = @decimal64 // _Decimal64
+| 42 = @decimal128 // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32 // _Float32
+| 46 = @float32x // _Float32x
+| 47 = @std_float64 // _Float64
+| 48 = @float64x // _Float64x
+| 49 = @std_float128 // _Float128
+// ... 50 _Float128x
+| 51 = @char8_t
+| 52 = @float16 // _Float16
+| 53 = @complex_float16 // _Complex _Float16
+| 54 = @fp16 // __fp16
+| 55 = @std_bfloat16 // __bf16
+| 56 = @std_float16 // std::float16_t
+| 57 = @complex_std_float32 // _Complex _Float32
+| 58 = @complex_float32x // _Complex _Float32x
+| 59 = @complex_std_float64 // _Complex _Float64
+| 60 = @complex_float64x // _Complex _Float64x
+| 61 = @complex_std_float128 // _Complex _Float128
+;
+
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/**
+ * Derived types are types that are directly derived from existing types and
+ * point to, refer to, transform type data to return a new type.
+ */
+case @derivedtype.kind of
+ 1 = @pointer
+| 2 = @reference
+| 3 = @type_with_specifiers
+| 4 = @array
+| 5 = @gnu_vector
+| 6 = @routineptr
+| 7 = @routinereference
+| 8 = @rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+| 10 = @block
+;
+
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator. For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+ int id: @decltype,
+ int expr: @expr ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+case @usertype.kind of
+ 1 = @struct
+| 2 = @class
+| 3 = @union
+| 4 = @enum
+| 5 = @typedef // classic C: typedef typedef type name
+| 6 = @template
+| 7 = @template_parameter
+| 8 = @template_template_parameter
+| 9 = @proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+| 13 = @scoped_enum
+| 14 = @using_alias // a using name = type style typedef
+;
+*/
+
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ string uuid: string ref
+);
+
+mangled_name(
+ unique int id: @declaration ref,
+ int mangled_name : @mangledname,
+ boolean is_complete: boolean ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+class_template_argument_value(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location ref,
+ // a_symbol_reference_kind from the frontend.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+function_template_argument_value(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+variable_template_argument_value(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_value: @expr ref
+);
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+explicit_specifier_exprs(
+ unique int func_id: @function ref,
+ int constant: @expr ref
+)
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+| 5 = @attribute_arg_expr
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_constant(
+ unique int arg: @attribute_arg ref,
+ int constant: @expr ref
+)
+attribute_arg_expr(
+ unique int arg: @attribute_arg ref,
+ int expr: @expr ref
+)
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ /* TODO | @fixedpointtype */
+ | @routinetype
+ | @ptrtomember
+ | @decltype;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention
+ | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+ int element: @element ref,
+ int i: int ref,
+ int destructor_call: @routineexpr ref
+);
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespace_inline(
+ unique int id: @namespace ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+@conversion = @cast
+ | @array_to_pointer
+ | @parexpr
+ | @reference_to
+ | @ref_indirect
+ | @temp_init
+ | @c11_generic
+ ;
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(
+ unique int caller: @funbindexpr ref,
+ int kind: int ref
+);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+ | @unaryplusexpr
+ | @conjugation
+ | @realpartexpr
+ | @imagpartexpr
+ | @crement_expr
+ ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+ | @indirect
+ | @un_arith_op_expr
+ | @un_bitwise_op_expr
+ | @builtinaddressof
+ | @vec_fill
+ | @un_log_op_expr
+ | @co_await
+ | @co_yield
+ ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+ | @ltexpr
+ | @geexpr
+ | @leexpr
+ | @spaceshipexpr
+ ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+ | @rshiftexpr
+ | @andexpr
+ | @orexpr
+ | @xorexpr
+ ;
+
+@p_arith_op_expr = @paddexpr
+ | @psubexpr
+ | @pdiffexpr
+ ;
+
+@bin_arith_op_expr = @addexpr
+ | @subexpr
+ | @mulexpr
+ | @divexpr
+ | @remexpr
+ | @jmulexpr
+ | @jdivexpr
+ | @fjaddexpr
+ | @jfaddexpr
+ | @fjsubexpr
+ | @jfsubexpr
+ | @minexpr
+ | @maxexpr
+ | @p_arith_op_expr
+ ;
+
+@bin_op_expr = @bin_arith_op_expr
+ | @bin_bitwise_op_expr
+ | @cmp_op_expr
+ | @bin_log_op_expr
+ ;
+
+@op_expr = @un_op_expr
+ | @bin_op_expr
+ | @assign_expr
+ | @conditionalexpr
+ ;
+
+@assign_arith_expr = @assignaddexpr
+ | @assignsubexpr
+ | @assignmulexpr
+ | @assigndivexpr
+ | @assignremexpr
+ ;
+
+@assign_bitwise_expr = @assignandexpr
+ | @assignorexpr
+ | @assignxorexpr
+ | @assignlshiftexpr
+ | @assignrshiftexpr
+ ;
+
+@assign_pointer_expr = @assignpaddexpr
+ | @assignpsubexpr
+ ;
+
+@assign_op_expr = @assign_arith_expr
+ | @assign_bitwise_expr
+ | @assign_pointer_expr
+ ;
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+ Binary encoding of the allocator form.
+
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ Binary encoding of the deallocator form.
+
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 4 = destroying_delete
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+ unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+ unique int cond: @conditionalexpr ref,
+ int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+ unique int cond: @conditionalexpr ref,
+ int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+ unique int cond: @conditionalexpr ref,
+ int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+ unique int id: @value,
+ string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+ unique int id: @value ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_expr ref
+);
+
+braced_initialisers(
+ int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_expr ref
+);
+
+expr_reuse(
+ int reuse: @expr ref,
+ int original: @expr ref,
+ int value_category: int ref
+)
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+| 363 = @reuseexpr
+| 364 = @istriviallycopyassignable
+| 365 = @isassignablenopreconditioncheck
+| 366 = @referencebindstotemporary
+| 367 = @issameas
+| 368 = @builtinhasattribute
+| 369 = @ispointerinterconvertiblewithclass
+| 370 = @builtinispointerinterconvertiblewithclass
+| 371 = @iscorrespondingmember
+| 372 = @builtiniscorrespondingmember
+| 373 = @isboundedarray
+| 374 = @isunboundedarray
+| 375 = @isreferenceable
+| 378 = @isnothrowconvertible
+| 379 = @referenceconstructsfromtemporary
+| 380 = @referenceconvertsfromtemporary
+| 381 = @isconvertible
+| 382 = @isvalidwinrttype
+| 383 = @iswinclass
+| 384 = @iswininterface
+| 385 = @istriviallyequalitycomparable
+| 386 = @isscopedenum
+| 387 = @istriviallyrelocatable
+| 388 = @datasizeof
+| 389 = @c11_generic
+;
+
+@var_args_expr = @vastartexpr
+ | @vaendexpr
+ | @vaargexpr
+ | @vacopyexpr
+ ;
+
+@builtin_op = @var_args_expr
+ | @noopexpr
+ | @offsetofexpr
+ | @intaddrexpr
+ | @hasassignexpr
+ | @hascopyexpr
+ | @hasnothrowassign
+ | @hasnothrowconstr
+ | @hasnothrowcopy
+ | @hastrivialassign
+ | @hastrivialconstr
+ | @hastrivialcopy
+ | @hastrivialdestructor
+ | @hasuserdestr
+ | @hasvirtualdestr
+ | @isabstractexpr
+ | @isbaseofexpr
+ | @isclassexpr
+ | @isconvtoexpr
+ | @isemptyexpr
+ | @isenumexpr
+ | @ispodexpr
+ | @ispolyexpr
+ | @isunionexpr
+ | @typescompexpr
+ | @builtinshufflevector
+ | @builtinconvertvector
+ | @builtinaddressof
+ | @istriviallyconstructibleexpr
+ | @isdestructibleexpr
+ | @isnothrowdestructibleexpr
+ | @istriviallydestructibleexpr
+ | @istriviallyassignableexpr
+ | @isnothrowassignableexpr
+ | @istrivialexpr
+ | @isstandardlayoutexpr
+ | @istriviallycopyableexpr
+ | @isliteraltypeexpr
+ | @hastrivialmoveconstructorexpr
+ | @hastrivialmoveassignexpr
+ | @hasnothrowmoveassignexpr
+ | @isconstructibleexpr
+ | @isnothrowconstructibleexpr
+ | @hasfinalizerexpr
+ | @isdelegateexpr
+ | @isinterfaceclassexpr
+ | @isrefarrayexpr
+ | @isrefclassexpr
+ | @issealedexpr
+ | @issimplevalueclassexpr
+ | @isvalueclassexpr
+ | @isfinalexpr
+ | @builtinchooseexpr
+ | @builtincomplex
+ | @isassignable
+ | @isaggregate
+ | @hasuniqueobjectrepresentations
+ | @builtinbitcast
+ | @builtinshuffle
+ | @issame
+ | @isfunction
+ | @islayoutcompatible
+ | @ispointerinterconvertiblebaseof
+ | @isarray
+ | @arrayrank
+ | @arrayextent
+ | @isarithmetic
+ | @iscompletetype
+ | @iscompound
+ | @isconst
+ | @isfloatingpoint
+ | @isfundamental
+ | @isintegral
+ | @islvaluereference
+ | @ismemberfunctionpointer
+ | @ismemberobjectpointer
+ | @ismemberpointer
+ | @isobject
+ | @ispointer
+ | @isreference
+ | @isrvaluereference
+ | @isscalar
+ | @issigned
+ | @isunsigned
+ | @isvoid
+ | @isvolatile
+ | @istriviallycopyassignable
+ | @isassignablenopreconditioncheck
+ | @referencebindstotemporary
+ | @issameas
+ | @builtinhasattribute
+ | @ispointerinterconvertiblewithclass
+ | @builtinispointerinterconvertiblewithclass
+ | @iscorrespondingmember
+ | @builtiniscorrespondingmember
+ | @isboundedarray
+ | @isunboundedarray
+ | @isreferenceable
+ | @isnothrowconvertible
+ | @referenceconstructsfromtemporary
+ | @referenceconvertsfromtemporary
+ | @isconvertible
+ | @isvalidwinrttype
+ | @iswinclass
+ | @iswininterface
+ | @istriviallyequalitycomparable
+ | @isscopedenum
+ | @istriviallyrelocatable
+ ;
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_field_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int field: @membervariable ref,
+ int position: int ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array. Position is used to sort repeated initializers.
+ */
+#keyset[aggregate, position]
+aggregate_array_init(
+ int aggregate: @aggregateliteral ref,
+ int initializer: @expr ref,
+ int element_index: int ref,
+ int position: int ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof | @datasizeof;
+
+sizeof_bind(
+ unique int expr: @runtime_sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ int field: @membervariable ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+ int expr: @foldexpr ref,
+ string operator: string ref,
+ boolean is_left_fold: boolean ref
+);
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_stmt ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+| 35 = @stmt_constexpr_if
+| 37 = @stmt_co_return
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+ unique int if_stmt: @stmt_if ref,
+ int init_id: @stmt ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int init_id: @stmt ref
+);
+
+constexpr_if_then(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int then_id: @stmt ref
+);
+
+constexpr_if_else(
+ unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_initialization(
+ unique int switch_stmt: @stmt_switch ref,
+ int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ unique int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+@stmt_for_or_range_based_for = @stmt_for
+ | @stmt_range_based_for;
+
+for_initialization(
+ unique int for_stmt: @stmt_for_or_range_based_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ unique int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ unique int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ unique int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+ unique int block: @stmt_block ref,
+ int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+ | @xmlelement
+ | @xmlcomment
+ | @xmlattribute
+ | @xmldtd
+ | @file
+ | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrade.properties b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrade.properties
new file mode 100644
index 00000000000..fcd771ec854
--- /dev/null
+++ b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrade.properties
@@ -0,0 +1,4 @@
+description: Improve handling of coroutine placeholder variables
+compatibility: partial
+coroutine.rel: run upgrades.qlo new_coroutine
+coroutine_placeholder_variable.rel: run upgrades.qlo new_coroutine_placeholder_variable
diff --git a/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrades.ql b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrades.ql
new file mode 100644
index 00000000000..d34a7c787ae
--- /dev/null
+++ b/cpp/ql/lib/upgrades/0fea0ee7026c7c3f7d6faef4df4bf67847b67d71/upgrades.ql
@@ -0,0 +1,19 @@
+class Function extends @function {
+ string toString() { none() }
+}
+
+class Type extends @type {
+ string toString() { none() }
+}
+
+class Variable extends @variable {
+ string toString() { none() }
+}
+
+query predicate new_coroutine(Function func, Type traits) { coroutine(func, traits, _, _) }
+
+query predicate new_coroutine_placeholder_variable(Variable var, int kind, Function func) {
+ coroutine(func, _, var, _) and kind = 1
+ or
+ coroutine(func, _, _, var) and kind = 2
+}
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
index 51d5c943c4c..dedc58394f9 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
@@ -785,66 +785,65 @@ coroutines.cpp:
#-----| Block 1
#-----| m0_4(unknown) = Phi : from 0:~m87_34, from 2:~m87_61
#-----| r0_5(bool) = Constant[1] :
-#-----| r0_6(glval) = VariableAddress :
-#-----| m0_7(bool) = Store[?] : &:r0_6, r0_5
-#-----| m0_8(unknown) = Chi : total:m0_4, partial:m0_7
+#-----| r0_6(glval) = VariableAddress[(unnamed local variable)] :
+#-----| m0_7(bool) = Store[(unnamed local variable)] : &:r0_6, r0_5
# 87| r87_36(suspend_always *) = CopyValue : r87_27
# 87| r87_37(glval) = CopyValue : r87_36
-#-----| r0_9(glval) = Convert : r87_37
+#-----| r0_8(glval) = Convert : r87_37
# 87| r87_38(glval) = FunctionAddress[await_resume] :
-# 87| v87_39(void) = Call[await_resume] : func:r87_38, this:r0_9
-# 87| m87_40(unknown) = ^CallSideEffect : ~m0_8
-# 87| m87_41(unknown) = Chi : total:m0_8, partial:m87_40
-#-----| v0_10(void) = ^IndirectReadSideEffect[-1] : &:r0_9, ~m87_41
-#-----| v0_11(void) = CopyValue : v87_39
-#-----| r0_12(glval) = VariableAddress[(unnamed local variable)] :
-#-----| r0_13(glval) = FunctionAddress[return_void] :
-#-----| v0_14(void) = Call[return_void] : func:r0_13, this:r0_12
-#-----| m0_15(unknown) = ^CallSideEffect : ~m87_41
-#-----| m0_16(unknown) = Chi : total:m87_41, partial:m0_15
-#-----| v0_17(void) = ^IndirectReadSideEffect[-1] : &:r0_12, ~m0_16
-#-----| m0_18(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_12
-#-----| m0_19(unknown) = Chi : total:m0_16, partial:m0_18
+# 87| v87_39(void) = Call[await_resume] : func:r87_38, this:r0_8
+# 87| m87_40(unknown) = ^CallSideEffect : ~m0_4
+# 87| m87_41(unknown) = Chi : total:m0_4, partial:m87_40
+#-----| v0_9(void) = ^IndirectReadSideEffect[-1] : &:r0_8, ~m87_41
+#-----| v0_10(void) = CopyValue : v87_39
+#-----| r0_11(glval) = VariableAddress[(unnamed local variable)] :
+#-----| r0_12(glval) = FunctionAddress[return_void] :
+#-----| v0_13(void) = Call[return_void] : func:r0_12, this:r0_11
+#-----| m0_14(unknown) = ^CallSideEffect : ~m87_41
+#-----| m0_15(unknown) = Chi : total:m87_41, partial:m0_14
+#-----| v0_16(void) = ^IndirectReadSideEffect[-1] : &:r0_11, ~m0_15
+#-----| m0_17(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_11
+#-----| m0_18(unknown) = Chi : total:m0_15, partial:m0_17
# 88| v88_1(void) = NoOp :
-#-----| v0_20(void) = NoOp :
+#-----| v0_19(void) = NoOp :
#-----| Goto (back edge) -> Block 3
# 87| Block 2
-# 87| r87_42(suspend_always *) = CopyValue : r87_27
-# 87| r87_43(glval) = CopyValue : r87_42
-#-----| r0_21(glval) = Convert : r87_43
-# 87| r87_44(glval) = FunctionAddress[await_suspend] :
-# 87| r87_45(glval>) = VariableAddress[#temp87:20] :
-# 87| m87_46(coroutine_handle) = Uninitialized[#temp87:20] : &:r87_45
-# 87| m87_47(unknown) = Chi : total:m87_34, partial:m87_46
-# 87| r87_48(glval) = FunctionAddress[coroutine_handle] :
-# 87| r87_49(glval>) = VariableAddress :
-# 87| r87_50(glval>) = Convert : r87_49
-# 87| r87_51(coroutine_handle &) = CopyValue : r87_50
-# 87| v87_52(void) = Call[coroutine_handle] : func:r87_48, this:r87_45, 0:r87_51
-# 87| m87_53(unknown) = ^CallSideEffect : ~m87_47
-# 87| m87_54(unknown) = Chi : total:m87_47, partial:m87_53
-# 87| v87_55(void) = ^BufferReadSideEffect[0] : &:r87_51, ~m87_54
-# 87| m87_56(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r87_45
-# 87| m87_57(unknown) = Chi : total:m87_54, partial:m87_56
-# 87| r87_58(coroutine_handle) = Load[#temp87:20] : &:r87_45, ~m87_57
-# 87| v87_59(void) = Call[await_suspend] : func:r87_44, this:r0_21, 0:r87_58
-# 87| m87_60(unknown) = ^CallSideEffect : ~m87_57
-# 87| m87_61(unknown) = Chi : total:m87_57, partial:m87_60
-#-----| v0_22(void) = ^IndirectReadSideEffect[-1] : &:r0_21, ~m87_61
+# 87| r87_42(suspend_always *) = CopyValue : r87_27
+# 87| r87_43(glval) = CopyValue : r87_42
+#-----| r0_20(glval) = Convert : r87_43
+# 87| r87_44(glval) = FunctionAddress[await_suspend] :
+# 87| r87_45(glval>) = VariableAddress[#temp87:20] :
+# 87| m87_46(coroutine_handle) = Uninitialized[#temp87:20] : &:r87_45
+# 87| m87_47(unknown) = Chi : total:m87_34, partial:m87_46
+# 87| r87_48(glval) = FunctionAddress[coroutine_handle] :
+# 87| r87_49(glval>) = VariableAddress[(unnamed local variable)] :
+# 87| r87_50(glval>) = Convert : r87_49
+# 87| r87_51(coroutine_handle &) = CopyValue : r87_50
+# 87| v87_52(void) = Call[coroutine_handle] : func:r87_48, this:r87_45, 0:r87_51
+# 87| m87_53(unknown) = ^CallSideEffect : ~m87_47
+# 87| m87_54(unknown) = Chi : total:m87_47, partial:m87_53
+# 87| v87_55(void) = ^BufferReadSideEffect[0] : &:r87_51, ~m87_54
+# 87| m87_56(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r87_45
+# 87| m87_57(unknown) = Chi : total:m87_54, partial:m87_56
+# 87| r87_58(coroutine_handle) = Load[#temp87:20] : &:r87_45, ~m87_57
+# 87| v87_59(void) = Call[await_suspend] : func:r87_44, this:r0_20, 0:r87_58
+# 87| m87_60(unknown) = ^CallSideEffect : ~m87_57
+# 87| m87_61(unknown) = Chi : total:m87_57, partial:m87_60
+#-----| v0_21(void) = ^IndirectReadSideEffect[-1] : &:r0_20, ~m87_61
#-----| Goto -> Block 1
#-----| Block 3
-#-----| v0_23(void) = NoOp :
+#-----| v0_22(void) = NoOp :
# 87| r87_62(glval) = VariableAddress[(unnamed local variable)] :
# 87| r87_63(glval) = FunctionAddress[final_suspend] :
# 87| r87_64(suspend_always) = Call[final_suspend] : func:r87_63, this:r87_62
-# 87| m87_65(unknown) = ^CallSideEffect : ~m0_19
-# 87| m87_66(unknown) = Chi : total:m0_19, partial:m87_65
+# 87| m87_65(unknown) = ^CallSideEffect : ~m0_18
+# 87| m87_66(unknown) = Chi : total:m0_18, partial:m87_65
# 87| v87_67(void) = ^IndirectReadSideEffect[-1] : &:r87_62, ~m87_66
# 87| m87_68(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r87_62
# 87| m87_69(unknown) = Chi : total:m87_66, partial:m87_68
-#-----| r0_24(glval) = VariableAddress[#temp0:0] :
+#-----| r0_23(glval) = VariableAddress[#temp0:0] :
# 87| r87_70(glval) = VariableAddress[#temp87:20] :
# 87| r87_71(glval) = VariableAddress[(unnamed local variable)] :
# 87| r87_72(glval) = FunctionAddress[final_suspend] :
@@ -857,16 +856,16 @@ coroutines.cpp:
# 87| m87_79(suspend_always) = Store[#temp87:20] : &:r87_70, r87_73
# 87| m87_80(unknown) = Chi : total:m87_78, partial:m87_79
# 87| r87_81(suspend_always *) = CopyValue : r87_70
-# 87| m87_82(suspend_always *) = Store[#temp0:0] : &:r0_24, r87_81
-#-----| r0_25(suspend_always *) = Load[#temp0:0] : &:r0_24, m87_82
-# 87| r87_83(glval) = CopyValue : r0_25
+# 87| m87_82(suspend_always *) = Store[#temp0:0] : &:r0_23, r87_81
+#-----| r0_24(suspend_always *) = Load[#temp0:0] : &:r0_23, m87_82
+# 87| r87_83(glval) = CopyValue : r0_24
# 87| r87_84(glval) = Convert : r87_83
# 87| r87_85(glval) = FunctionAddress[await_ready] :
# 87| r87_86(bool) = Call[await_ready] : func:r87_85, this:r87_84
# 87| m87_87(unknown) = ^CallSideEffect : ~m87_80
# 87| m87_88(unknown) = Chi : total:m87_80, partial:m87_87
# 87| v87_89(void) = ^IndirectReadSideEffect[-1] : &:r87_84, ~m87_88
-#-----| v0_26(void) = ConditionalBranch : r87_86
+#-----| v0_25(void) = ConditionalBranch : r87_86
#-----| False -> Block 5
#-----| True -> Block 4
@@ -874,40 +873,40 @@ coroutines.cpp:
# 87| m87_90(unknown) = Phi : from 3:~m87_88, from 5:~m87_120
# 87| r87_91(suspend_always *) = CopyValue : r87_81
# 87| r87_92(glval) = CopyValue : r87_91
-#-----| r0_27(glval) = Convert : r87_92
+#-----| r0_26(glval) = Convert : r87_92
# 87| r87_93(glval) = FunctionAddress[await_resume] :
-# 87| v87_94(void) = Call[await_resume] : func:r87_93, this:r0_27
+# 87| v87_94(void) = Call[await_resume] : func:r87_93, this:r0_26
# 87| m87_95(unknown) = ^CallSideEffect : ~m87_90
# 87| m87_96(unknown) = Chi : total:m87_90, partial:m87_95
-#-----| v0_28(void) = ^IndirectReadSideEffect[-1] : &:r0_27, ~m87_96
+#-----| v0_27(void) = ^IndirectReadSideEffect[-1] : &:r0_26, ~m87_96
# 87| r87_97(glval) = VariableAddress[#return] :
# 87| v87_98(void) = ReturnValue : &:r87_97, ~m87_96
# 87| v87_99(void) = AliasedUse : ~m87_96
# 87| v87_100(void) = ExitFunction :
# 87| Block 5
-# 87| r87_101(suspend_always *) = CopyValue : r87_81
-# 87| r87_102(glval) = CopyValue : r87_101
-#-----| r0_29(glval) = Convert : r87_102
-# 87| r87_103(glval) = FunctionAddress[await_suspend] :
-# 87| r87_104(glval>) = VariableAddress[#temp87:20] :
-# 87| m87_105(coroutine_handle) = Uninitialized[#temp87:20] : &:r87_104
-# 87| m87_106(unknown) = Chi : total:m87_88, partial:m87_105
-# 87| r87_107(glval) = FunctionAddress[coroutine_handle] :
-# 87| r87_108(glval>) = VariableAddress :
-# 87| r87_109(glval>) = Convert : r87_108
-# 87| r87_110(coroutine_handle &) = CopyValue : r87_109
-# 87| v87_111(void) = Call[coroutine_handle] : func:r87_107, this:r87_104, 0:r87_110
-# 87| m87_112(unknown) = ^CallSideEffect : ~m87_106
-# 87| m87_113(unknown) = Chi : total:m87_106, partial:m87_112
-# 87| v87_114(void) = ^BufferReadSideEffect[0] : &:r87_110, ~m87_113
-# 87| m87_115(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r87_104
-# 87| m87_116(unknown) = Chi : total:m87_113, partial:m87_115
-# 87| r87_117(coroutine_handle) = Load[#temp87:20] : &:r87_104, ~m87_116
-# 87| v87_118(void) = Call[await_suspend] : func:r87_103, this:r0_29, 0:r87_117
-# 87| m87_119(unknown) = ^CallSideEffect : ~m87_116
-# 87| m87_120(unknown) = Chi : total:m87_116, partial:m87_119
-#-----| v0_30(void) = ^IndirectReadSideEffect[-1] : &:r0_29, ~m87_120
+# 87| r87_101(suspend_always *) = CopyValue : r87_81
+# 87| r87_102(glval) = CopyValue : r87_101
+#-----| r0_28(glval) = Convert : r87_102
+# 87| r87_103(glval) = FunctionAddress[await_suspend] :
+# 87| r87_104(glval>) = VariableAddress[#temp87:20] :
+# 87| m87_105(coroutine_handle) = Uninitialized[#temp87:20] : &:r87_104
+# 87| m87_106(unknown) = Chi : total:m87_88, partial:m87_105
+# 87| r87_107(glval) = FunctionAddress[coroutine_handle] :
+# 87| r87_108(glval>) = VariableAddress[(unnamed local variable)] :
+# 87| r87_109(glval>) = Convert : r87_108
+# 87| r87_110(coroutine_handle &) = CopyValue : r87_109
+# 87| v87_111(void) = Call[coroutine_handle] : func:r87_107, this:r87_104, 0:r87_110
+# 87| m87_112(unknown) = ^CallSideEffect : ~m87_106
+# 87| m87_113(unknown) = Chi : total:m87_106, partial:m87_112
+# 87| v87_114(void) = ^BufferReadSideEffect[0] : &:r87_110, ~m87_113
+# 87| m87_115(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r87_104
+# 87| m87_116(unknown) = Chi : total:m87_113, partial:m87_115
+# 87| r87_117(coroutine_handle) = Load[#temp87:20] : &:r87_104, ~m87_116
+# 87| v87_118(void) = Call[await_suspend] : func:r87_103, this:r0_28, 0:r87_117
+# 87| m87_119(unknown) = ^CallSideEffect : ~m87_116
+# 87| m87_120(unknown) = Chi : total:m87_116, partial:m87_119
+#-----| v0_29(void) = ^IndirectReadSideEffect[-1] : &:r0_28, ~m87_120
#-----| Goto -> Block 4
# 91| co_returnable_value co_return_int(int)
@@ -962,68 +961,67 @@ coroutines.cpp:
#-----| Block 1
#-----| m0_8(unknown) = Phi : from 0:~m91_36, from 2:~m91_63
#-----| r0_9(bool) = Constant[1] :
-#-----| r0_10(glval) = VariableAddress :
-#-----| m0_11(bool) = Store[?] : &:r0_10, r0_9
-#-----| m0_12(unknown) = Chi : total:m0_8, partial:m0_11
+#-----| r0_10(glval) = VariableAddress[(unnamed local variable)] :
+#-----| m0_11(bool) = Store[(unnamed local variable)] : &:r0_10, r0_9
# 91| r91_38(suspend_always *) = CopyValue : r91_29
# 91| r91_39(glval) = CopyValue : r91_38
-#-----| r0_13(glval) = Convert : r91_39
+#-----| r0_12(glval) = Convert : r91_39
# 91| r91_40(glval) = FunctionAddress[await_resume] :
-# 91| v91_41(void) = Call[await_resume] : func:r91_40, this:r0_13
-# 91| m91_42(unknown) = ^CallSideEffect : ~m0_12
-# 91| m91_43(unknown) = Chi : total:m0_12, partial:m91_42
-#-----| v0_14(void) = ^IndirectReadSideEffect[-1] : &:r0_13, ~m91_43
-#-----| v0_15(void) = CopyValue : v91_41
-#-----| r0_16(glval) = VariableAddress[(unnamed local variable)] :
-#-----| r0_17(glval) = FunctionAddress[return_value] :
+# 91| v91_41(void) = Call[await_resume] : func:r91_40, this:r0_12
+# 91| m91_42(unknown) = ^CallSideEffect : ~m0_8
+# 91| m91_43(unknown) = Chi : total:m0_8, partial:m91_42
+#-----| v0_13(void) = ^IndirectReadSideEffect[-1] : &:r0_12, ~m91_43
+#-----| v0_14(void) = CopyValue : v91_41
+#-----| r0_15(glval) = VariableAddress[(unnamed local variable)] :
+#-----| r0_16(glval) = FunctionAddress[return_value] :
# 92| r92_1(glval) = VariableAddress[i] :
# 92| r92_2(int) = Load[i] : &:r92_1, m0_4
-#-----| v0_18(void) = Call[return_value] : func:r0_17, this:r0_16, 0:r92_2
-#-----| m0_19(unknown) = ^CallSideEffect : ~m91_43
-#-----| m0_20(unknown) = Chi : total:m91_43, partial:m0_19
-#-----| v0_21(void) = ^IndirectReadSideEffect[-1] : &:r0_16, ~m0_20
-#-----| m0_22(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_16
-#-----| m0_23(unknown) = Chi : total:m0_20, partial:m0_22
+#-----| v0_17(void) = Call[return_value] : func:r0_16, this:r0_15, 0:r92_2
+#-----| m0_18(unknown) = ^CallSideEffect : ~m91_43
+#-----| m0_19(unknown) = Chi : total:m91_43, partial:m0_18
+#-----| v0_20(void) = ^IndirectReadSideEffect[-1] : &:r0_15, ~m0_19
+#-----| m0_21(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_15
+#-----| m0_22(unknown) = Chi : total:m0_19, partial:m0_21
# 92| v92_3(void) = NoOp :
-#-----| v0_24(void) = NoOp :
+#-----| v0_23(void) = NoOp :
#-----| Goto (back edge) -> Block 3
# 91| Block 2
-# 91| r91_44(suspend_always *) = CopyValue : r91_29
-# 91| r91_45(glval) = CopyValue : r91_44
-#-----| r0_25(glval) = Convert : r91_45
-# 91| r91_46(glval) = FunctionAddress[await_suspend] :
-# 91| r91_47(glval>) = VariableAddress[#temp91:21] :
-# 91| m91_48(coroutine_handle) = Uninitialized[#temp91:21] : &:r91_47
-# 91| m91_49(unknown) = Chi : total:m91_36, partial:m91_48
-# 91| r91_50(glval) = FunctionAddress[coroutine_handle] :
-# 91| r91_51(glval>) = VariableAddress :
-# 91| r91_52(glval>) = Convert : r91_51
-# 91| r91_53(coroutine_handle &) = CopyValue : r91_52
-# 91| v91_54(void) = Call[coroutine_handle] : func:r91_50, this:r91_47, 0:r91_53
-# 91| m91_55(unknown) = ^CallSideEffect : ~m91_49
-# 91| m91_56(unknown) = Chi : total:m91_49, partial:m91_55
-# 91| v91_57(void) = ^BufferReadSideEffect[0] : &:r91_53, ~m91_56
-# 91| m91_58(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r91_47
-# 91| m91_59(unknown) = Chi : total:m91_56, partial:m91_58
-# 91| r91_60(coroutine_handle) = Load[#temp91:21] : &:r91_47, ~m91_59
-# 91| v91_61(void) = Call[await_suspend] : func:r91_46, this:r0_25, 0:r91_60
-# 91| m91_62(unknown) = ^CallSideEffect : ~m91_59
-# 91| m91_63(unknown) = Chi : total:m91_59, partial:m91_62
-#-----| v0_26(void) = ^IndirectReadSideEffect[-1] : &:r0_25, ~m91_63
+# 91| r91_44(suspend_always *) = CopyValue : r91_29
+# 91| r91_45(glval) = CopyValue : r91_44
+#-----| r0_24(glval) = Convert : r91_45
+# 91| r91_46(glval) = FunctionAddress[await_suspend] :
+# 91| r91_47(glval>) = VariableAddress[#temp91:21] :
+# 91| m91_48(coroutine_handle) = Uninitialized[#temp91:21] : &:r91_47
+# 91| m91_49(unknown) = Chi : total:m91_36, partial:m91_48
+# 91| r91_50(glval) = FunctionAddress[coroutine_handle] :
+# 91| r91_51(glval>) = VariableAddress[(unnamed local variable)] :
+# 91| r91_52(glval>) = Convert : r91_51
+# 91| r91_53(coroutine_handle &) = CopyValue : r91_52
+# 91| v91_54(void) = Call[coroutine_handle] : func:r91_50, this:r91_47, 0:r91_53
+# 91| m91_55(unknown) = ^CallSideEffect : ~m91_49
+# 91| m91_56(unknown) = Chi : total:m91_49, partial:m91_55
+# 91| v91_57(void) = ^BufferReadSideEffect[0] : &:r91_53, ~m91_56
+# 91| m91_58(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r91_47
+# 91| m91_59(unknown) = Chi : total:m91_56, partial:m91_58
+# 91| r91_60(coroutine_handle) = Load[#temp91:21] : &:r91_47, ~m91_59
+# 91| v91_61(void) = Call[await_suspend] : func:r91_46, this:r0_24, 0:r91_60
+# 91| m91_62(unknown) = ^CallSideEffect : ~m91_59
+# 91| m91_63(unknown) = Chi : total:m91_59, partial:m91_62
+#-----| v0_25(void) = ^IndirectReadSideEffect[-1] : &:r0_24, ~m91_63
#-----| Goto -> Block 1
#-----| Block 3
-#-----| v0_27(void) = NoOp :
+#-----| v0_26(void) = NoOp :
# 91| r91_64(glval) = VariableAddress[(unnamed local variable)] :
# 91| r91_65(glval) = FunctionAddress[final_suspend] :
# 91| r91_66(suspend_always) = Call[final_suspend] : func:r91_65, this:r91_64
-# 91| m91_67(unknown) = ^CallSideEffect : ~m0_23
-# 91| m91_68(unknown) = Chi : total:m0_23, partial:m91_67
+# 91| m91_67(unknown) = ^CallSideEffect : ~m0_22
+# 91| m91_68(unknown) = Chi : total:m0_22, partial:m91_67
# 91| v91_69(void) = ^IndirectReadSideEffect[-1] : &:r91_64, ~m91_68
# 91| m91_70(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r91_64
# 91| m91_71(unknown) = Chi : total:m91_68, partial:m91_70
-#-----| r0_28(glval) = VariableAddress[#temp0:0] :
+#-----| r0_27(glval) = VariableAddress[#temp0:0] :
# 91| r91_72(glval) = VariableAddress[#temp91:21] :
# 91| r91_73(glval) = VariableAddress[(unnamed local variable)] :
# 91| r91_74(glval) = FunctionAddress[final_suspend] :
@@ -1036,16 +1034,16 @@ coroutines.cpp:
# 91| m91_81(suspend_always) = Store[#temp91:21] : &:r91_72, r91_75
# 91| m91_82(unknown) = Chi : total:m91_80, partial:m91_81
# 91| r91_83(suspend_always *) = CopyValue : r91_72
-# 91| m91_84(suspend_always *) = Store[#temp0:0] : &:r0_28, r91_83
-#-----| r0_29(suspend_always *) = Load[#temp0:0] : &:r0_28, m91_84
-# 91| r91_85(glval) = CopyValue : r0_29
+# 91| m91_84(suspend_always *) = Store[#temp0:0] : &:r0_27, r91_83
+#-----| r0_28(suspend_always *) = Load[#temp0:0] : &:r0_27, m91_84
+# 91| r91_85(glval) = CopyValue : r0_28
# 91| r91_86(glval) = Convert : r91_85
# 91| r91_87(glval) = FunctionAddress[await_ready] :
# 91| r91_88(bool) = Call[await_ready] : func:r91_87, this:r91_86
# 91| m91_89(unknown) = ^CallSideEffect : ~m91_82
# 91| m91_90(unknown) = Chi : total:m91_82, partial:m91_89
# 91| v91_91(void) = ^IndirectReadSideEffect[-1] : &:r91_86, ~m91_90
-#-----| v0_30(void) = ConditionalBranch : r91_88
+#-----| v0_29(void) = ConditionalBranch : r91_88
#-----| False -> Block 5
#-----| True -> Block 4
@@ -1053,40 +1051,40 @@ coroutines.cpp:
# 91| m91_92(unknown) = Phi : from 3:~m91_90, from 5:~m91_122
# 91| r91_93(suspend_always *) = CopyValue : r91_83
# 91| r91_94(glval) = CopyValue : r91_93
-#-----| r0_31(glval) = Convert : r91_94
+#-----| r0_30(glval) = Convert : r91_94
# 91| r91_95(glval) = FunctionAddress[await_resume] :
-# 91| v91_96(void) = Call[await_resume] : func:r91_95, this:r0_31
+# 91| v91_96(void) = Call[await_resume] : func:r91_95, this:r0_30
# 91| m91_97(unknown) = ^CallSideEffect : ~m91_92
# 91| m91_98(unknown) = Chi : total:m91_92, partial:m91_97
-#-----| v0_32(void) = ^IndirectReadSideEffect[-1] : &:r0_31, ~m91_98
+#-----| v0_31(void) = ^IndirectReadSideEffect[-1] : &:r0_30, ~m91_98
# 91| r91_99(glval) = VariableAddress[#return] :
# 91| v91_100(void) = ReturnValue : &:r91_99, ~m91_98
# 91| v91_101(void) = AliasedUse : ~m91_98
# 91| v91_102(void) = ExitFunction :
# 91| Block 5
-# 91| r91_103(suspend_always *) = CopyValue : r91_83
-# 91| r91_104(glval) = CopyValue : r91_103
-#-----| r0_33(glval) = Convert : r91_104
-# 91| r91_105(glval) = FunctionAddress[await_suspend] :
-# 91| r91_106(glval>) = VariableAddress[#temp91:21] :
-# 91| m91_107(coroutine_handle) = Uninitialized[#temp91:21] : &:r91_106
-# 91| m91_108(unknown) = Chi : total:m91_90, partial:m91_107
-# 91| r91_109(glval) = FunctionAddress[coroutine_handle] :
-# 91| r91_110(glval>) = VariableAddress :
-# 91| r91_111(glval>) = Convert : r91_110
-# 91| r91_112(coroutine_handle &) = CopyValue : r91_111
-# 91| v91_113(void) = Call[coroutine_handle] : func:r91_109, this:r91_106, 0:r91_112
-# 91| m91_114(unknown) = ^CallSideEffect : ~m91_108
-# 91| m91_115(unknown) = Chi : total:m91_108, partial:m91_114
-# 91| v91_116(void) = ^BufferReadSideEffect[0] : &:r91_112, ~m91_115
-# 91| m91_117(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r91_106
-# 91| m91_118(unknown) = Chi : total:m91_115, partial:m91_117
-# 91| r91_119(coroutine_handle) = Load[#temp91:21] : &:r91_106, ~m91_118
-# 91| v91_120(void) = Call[await_suspend] : func:r91_105, this:r0_33, 0:r91_119
-# 91| m91_121(unknown) = ^CallSideEffect : ~m91_118
-# 91| m91_122(unknown) = Chi : total:m91_118, partial:m91_121
-#-----| v0_34(void) = ^IndirectReadSideEffect[-1] : &:r0_33, ~m91_122
+# 91| r91_103(suspend_always *) = CopyValue : r91_83
+# 91| r91_104(glval) = CopyValue : r91_103
+#-----| r0_32(glval) = Convert : r91_104
+# 91| r91_105(glval) = FunctionAddress[await_suspend] :
+# 91| r91_106(glval>) = VariableAddress[#temp91:21] :
+# 91| m91_107(coroutine_handle) = Uninitialized[#temp91:21] : &:r91_106
+# 91| m91_108(unknown) = Chi : total:m91_90, partial:m91_107
+# 91| r91_109(glval) = FunctionAddress[coroutine_handle] :
+# 91| r91_110(glval>) = VariableAddress[(unnamed local variable)] :
+# 91| r91_111(glval>) = Convert : r91_110
+# 91| r91_112(coroutine_handle &) = CopyValue : r91_111
+# 91| v91_113(void) = Call[coroutine_handle] : func:r91_109, this:r91_106, 0:r91_112
+# 91| m91_114(unknown) = ^CallSideEffect : ~m91_108
+# 91| m91_115(unknown) = Chi : total:m91_108, partial:m91_114
+# 91| v91_116(void) = ^BufferReadSideEffect[0] : &:r91_112, ~m91_115
+# 91| m91_117(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r91_106
+# 91| m91_118(unknown) = Chi : total:m91_115, partial:m91_117
+# 91| r91_119(coroutine_handle) = Load[#temp91:21] : &:r91_106, ~m91_118
+# 91| v91_120(void) = Call[await_suspend] : func:r91_105, this:r0_32, 0:r91_119
+# 91| m91_121(unknown) = ^CallSideEffect : ~m91_118
+# 91| m91_122(unknown) = Chi : total:m91_118, partial:m91_121
+#-----| v0_33(void) = ^IndirectReadSideEffect[-1] : &:r0_32, ~m91_122
#-----| Goto -> Block 4
# 95| co_returnable_void co_yield_value_void(int)
@@ -1141,18 +1139,17 @@ coroutines.cpp:
#-----| Block 1
#-----| m0_8(unknown) = Phi : from 0:~m95_36, from 2:~m95_63
#-----| r0_9(bool) = Constant[1] :
-#-----| r0_10(glval) = VariableAddress :
-#-----| m0_11(bool) = Store[?] : &:r0_10, r0_9
-#-----| m0_12(unknown) = Chi : total:m0_8, partial:m0_11
+#-----| r0_10(glval) = VariableAddress[(unnamed local variable)] :
+#-----| m0_11(bool) = Store[(unnamed local variable)] : &:r0_10, r0_9
# 95| r95_38(suspend_always *) = CopyValue : r95_29
# 95| r95_39(glval) = CopyValue : r95_38
-#-----| r0_13(glval) = Convert : r95_39
+#-----| r0_12(glval) = Convert : r95_39
# 95| r95_40(glval) = FunctionAddress[await_resume] :
-# 95| v95_41(void) = Call[await_resume] : func:r95_40, this:r0_13
-# 95| m95_42(unknown) = ^CallSideEffect : ~m0_12
-# 95| m95_43(unknown) = Chi : total:m0_12, partial:m95_42
-#-----| v0_14(void) = ^IndirectReadSideEffect[-1] : &:r0_13, ~m95_43
-#-----| v0_15(void) = CopyValue : v95_41
+# 95| v95_41(void) = Call[await_resume] : func:r95_40, this:r0_12
+# 95| m95_42(unknown) = ^CallSideEffect : ~m0_8
+# 95| m95_43(unknown) = Chi : total:m0_8, partial:m95_42
+#-----| v0_13(void) = ^IndirectReadSideEffect[-1] : &:r0_12, ~m95_43
+#-----| v0_14(void) = CopyValue : v95_41
# 96| r96_1(glval) = VariableAddress[(unnamed local variable)] :
# 96| r96_2(glval) = FunctionAddress[yield_value] :
# 96| r96_3(glval) = VariableAddress[i] :
@@ -1163,7 +1160,7 @@ coroutines.cpp:
# 96| v96_8(void) = ^IndirectReadSideEffect[-1] : &:r96_1, ~m96_7
# 96| m96_9(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r96_1
# 96| m96_10(unknown) = Chi : total:m96_7, partial:m96_9
-#-----| r0_16(glval) = VariableAddress[#temp0:0] :
+#-----| r0_15(glval) = VariableAddress[#temp0:0] :
# 96| r96_11(glval) = VariableAddress[#temp96:13] :
# 96| r96_12(glval) = VariableAddress[(unnamed local variable)] :
# 96| r96_13(glval) = FunctionAddress[yield_value] :
@@ -1178,9 +1175,9 @@ coroutines.cpp:
# 96| m96_22(suspend_always) = Store[#temp96:13] : &:r96_11, r96_16
# 96| m96_23(unknown) = Chi : total:m96_21, partial:m96_22
# 96| r96_24(suspend_always *) = CopyValue : r96_11
-# 96| m96_25(suspend_always *) = Store[#temp0:0] : &:r0_16, r96_24
-#-----| r0_17(suspend_always *) = Load[#temp0:0] : &:r0_16, m96_25
-# 96| r96_26(glval) = CopyValue : r0_17
+# 96| m96_25(suspend_always *) = Store[#temp0:0] : &:r0_15, r96_24
+#-----| r0_16(suspend_always *) = Load[#temp0:0] : &:r0_15, m96_25
+# 96| r96_26(glval) = CopyValue : r0_16
# 96| r96_27(glval) = Convert : r96_26
# 96| r96_28(glval) = FunctionAddress[await_ready] :
# 96| r96_29(bool) = Call[await_ready] : func:r96_28, this:r96_27
@@ -1192,88 +1189,88 @@ coroutines.cpp:
#-----| True -> Block 3
# 95| Block 2
-# 95| r95_44(suspend_always *) = CopyValue : r95_29
-# 95| r95_45(glval) = CopyValue : r95_44
-#-----| r0_18(glval) = Convert : r95_45
-# 95| r95_46(glval) = FunctionAddress[await_suspend] :
-# 95| r95_47(glval>) = VariableAddress[#temp95:20] :
-# 95| m95_48(coroutine_handle) = Uninitialized[#temp95:20] : &:r95_47
-# 95| m95_49(unknown) = Chi : total:m95_36, partial:m95_48
-# 95| r95_50(glval) = FunctionAddress[coroutine_handle] :
-# 95| r95_51(glval>) = VariableAddress :
-# 95| r95_52(glval>) = Convert : r95_51
-# 95| r95_53(coroutine_handle &) = CopyValue : r95_52
-# 95| v95_54(void) = Call[coroutine_handle] : func:r95_50, this:r95_47, 0:r95_53
-# 95| m95_55(unknown) = ^CallSideEffect : ~m95_49
-# 95| m95_56(unknown) = Chi : total:m95_49, partial:m95_55
-# 95| v95_57(void) = ^BufferReadSideEffect[0] : &:r95_53, ~m95_56
-# 95| m95_58(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r95_47
-# 95| m95_59(unknown) = Chi : total:m95_56, partial:m95_58
-# 95| r95_60(coroutine_handle) = Load[#temp95:20] : &:r95_47, ~m95_59
-# 95| v95_61(void) = Call[await_suspend] : func:r95_46, this:r0_18, 0:r95_60
-# 95| m95_62(unknown) = ^CallSideEffect : ~m95_59
-# 95| m95_63(unknown) = Chi : total:m95_59, partial:m95_62
-#-----| v0_19(void) = ^IndirectReadSideEffect[-1] : &:r0_18, ~m95_63
+# 95| r95_44(suspend_always *) = CopyValue : r95_29
+# 95| r95_45(glval) = CopyValue : r95_44
+#-----| r0_17(glval) = Convert : r95_45
+# 95| r95_46(glval) = FunctionAddress[await_suspend] :
+# 95| r95_47(glval>) = VariableAddress[#temp95:20] :
+# 95| m95_48(coroutine_handle) = Uninitialized[#temp95:20] : &:r95_47
+# 95| m95_49(unknown) = Chi : total:m95_36, partial:m95_48
+# 95| r95_50(glval) = FunctionAddress[coroutine_handle] :
+# 95| r95_51(glval>) = VariableAddress[(unnamed local variable)] :
+# 95| r95_52(glval>) = Convert : r95_51
+# 95| r95_53(coroutine_handle &) = CopyValue : r95_52
+# 95| v95_54(void) = Call[coroutine_handle] : func:r95_50, this:r95_47, 0:r95_53
+# 95| m95_55(unknown) = ^CallSideEffect : ~m95_49
+# 95| m95_56(unknown) = Chi : total:m95_49, partial:m95_55
+# 95| v95_57(void) = ^BufferReadSideEffect[0] : &:r95_53, ~m95_56
+# 95| m95_58(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r95_47
+# 95| m95_59(unknown) = Chi : total:m95_56, partial:m95_58
+# 95| r95_60(coroutine_handle) = Load[#temp95:20] : &:r95_47, ~m95_59
+# 95| v95_61(void) = Call[await_suspend] : func:r95_46, this:r0_17, 0:r95_60
+# 95| m95_62(unknown) = ^CallSideEffect : ~m95_59
+# 95| m95_63(unknown) = Chi : total:m95_59, partial:m95_62
+#-----| v0_18(void) = ^IndirectReadSideEffect[-1] : &:r0_17, ~m95_63
#-----| Goto -> Block 1
# 96| Block 3
# 96| m96_34(unknown) = Phi : from 1:~m96_31, from 4:~m96_60
# 96| r96_35(suspend_always *) = CopyValue : r96_24
# 96| r96_36(glval) = CopyValue : r96_35
-#-----| r0_20(glval) = Convert : r96_36
+#-----| r0_19(glval) = Convert : r96_36
# 96| r96_37(glval) = FunctionAddress[await_resume] :
-# 96| v96_38(void) = Call[await_resume] : func:r96_37, this:r0_20
+# 96| v96_38(void) = Call[await_resume] : func:r96_37, this:r0_19
# 96| m96_39(unknown) = ^CallSideEffect : ~m96_34
# 96| m96_40(unknown) = Chi : total:m96_34, partial:m96_39
-#-----| v0_21(void) = ^IndirectReadSideEffect[-1] : &:r0_20, ~m96_40
-#-----| r0_22(glval) = VariableAddress[(unnamed local variable)] :
-#-----| r0_23(glval) = FunctionAddress[return_void] :
-#-----| v0_24(void) = Call[return_void] : func:r0_23, this:r0_22
-#-----| m0_25(unknown) = ^CallSideEffect : ~m96_40
-#-----| m0_26(unknown) = Chi : total:m96_40, partial:m0_25
-#-----| v0_27(void) = ^IndirectReadSideEffect[-1] : &:r0_22, ~m0_26
-#-----| m0_28(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_22
-#-----| m0_29(unknown) = Chi : total:m0_26, partial:m0_28
+#-----| v0_20(void) = ^IndirectReadSideEffect[-1] : &:r0_19, ~m96_40
+#-----| r0_21(glval) = VariableAddress[(unnamed local variable)] :
+#-----| r0_22(glval) = FunctionAddress[return_void] :
+#-----| v0_23(void) = Call[return_void] : func:r0_22, this:r0_21
+#-----| m0_24(unknown) = ^CallSideEffect : ~m96_40
+#-----| m0_25(unknown) = Chi : total:m96_40, partial:m0_24
+#-----| v0_26(void) = ^IndirectReadSideEffect[-1] : &:r0_21, ~m0_25
+#-----| m0_27(promise_type) = ^IndirectMayWriteSideEffect[-1] : &:r0_21
+#-----| m0_28(unknown) = Chi : total:m0_25, partial:m0_27
# 97| v97_1(void) = NoOp :
-#-----| v0_30(void) = NoOp :
+#-----| v0_29(void) = NoOp :
#-----| Goto (back edge) -> Block 5
# 96| Block 4
-# 96| r96_41(suspend_always *) = CopyValue : r96_24
-# 96| r96_42(glval) = CopyValue : r96_41
-#-----| r0_31(glval) = Convert : r96_42
-# 96| r96_43(glval) = FunctionAddress[await_suspend] :
-# 96| r96_44(glval>) = VariableAddress[#temp96:3] :
-# 96| m96_45(coroutine_handle) = Uninitialized[#temp96:3] : &:r96_44
-# 96| m96_46(unknown) = Chi : total:m96_31, partial:m96_45
-# 96| r96_47(glval) = FunctionAddress[coroutine_handle] :
-# 96| r96_48(glval>) = VariableAddress :
-# 96| r96_49(glval>) = Convert : r96_48
-# 96| r96_50(coroutine_handle &) = CopyValue : r96_49
-# 96| v96_51(void) = Call[coroutine_handle] : func:r96_47, this:r96_44, 0:r96_50
-# 96| m96_52(unknown) = ^CallSideEffect : ~m96_46
-# 96| m96_53(unknown) = Chi : total:m96_46, partial:m96_52
-# 96| v96_54(void) = ^BufferReadSideEffect[0] : &:r96_50, ~m96_53
-# 96| m96_55(coroutine_handle) = ^IndirectMayWriteSideEffect[-1] : &:r96_44
-# 96| m96_56(unknown) = Chi : total:m96_53, partial:m96_55
-# 96| r96_57(coroutine_handle) = Load[#temp96:3] : &:r96_44, ~m96_56
-# 96| v96_58(void) = Call[await_suspend] : func:r96_43, this:r0_31, 0:r96_57
-# 96| m96_59(unknown) = ^CallSideEffect : ~m96_56
-# 96| m96_60(unknown) = Chi : total:m96_56, partial:m96_59
-#-----| v0_32(void) = ^IndirectReadSideEffect[-1] : &:r0_31, ~m96_60
+# 96| r96_41(suspend_always *) = CopyValue : r96_24
+# 96| r96_42(glval) = CopyValue : r96_41
+#-----| r0_30(glval) = Convert : r96_42
+# 96| r96_43(glval