diff --git a/.github/workflows/check-change-note.yml b/.github/workflows/check-change-note.yml
new file mode 100644
index 00000000000..e4e385a5319
--- /dev/null
+++ b/.github/workflows/check-change-note.yml
@@ -0,0 +1,21 @@
+on:
+  pull_request_target:
+    types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "*/ql/src/**/*.ql"
+      - "*/ql/src/**/*.qll"
+      - "!**/experimental/**"
+
+jobs:
+  check-change-note:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
+        if: |
+          github.event.pull_request.draft == false &&
+          !contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
+          jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 7f218e99da4..8ddae33fd7b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -5,10 +5,14 @@ on:
     branches:
       - main
       - 'rc/*'
+    paths:
+      - 'csharp/**'
   pull_request:
     branches:
       - main
       - 'rc/*'
+    paths:
+      - 'csharp/**'
   schedule:
     - cron: '0 9 * * 1'
 
diff --git a/.github/workflows/generate-query-help-docs.yml b/.github/workflows/generate-query-help-docs.yml
index 031bf97e728..e3af19c6dea 100644
--- a/.github/workflows/generate-query-help-docs.yml
+++ b/.github/workflows/generate-query-help-docs.yml
@@ -50,7 +50,7 @@ jobs:
       uses: ammaraskar/sphinx-action@8b4f60114d7fd1faeba1a712269168508d4750d2 # v0.4
       with:
         docs-folder: "query-help/"
-        pre-build-command: "python -m pip install --upgrade recommonmark"
+        pre-build-command: "python -m pip install --upgrade recommonmark && python -m pip install --upgrade sphinx-markdown-tables"
         build-command: "sphinx-build -b dirhtml . _build" 
     - name: Upload HTML artifacts
       uses: actions/upload-artifact@v2
diff --git a/CODEOWNERS b/CODEOWNERS
index 64bda94db77..95f707722ae 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -3,18 +3,3 @@
 /java/ @github/codeql-java
 /javascript/ @github/codeql-javascript
 /python/ @github/codeql-python
-
-# Assign query help for docs review
-/cpp/**/*.qhelp @hubwriter
-/csharp/**/*.qhelp @jf205
-/java/**/*.qhelp @felicitymay
-/javascript/**/*.qhelp @mchammer01
-/python/**/*.qhelp @felicitymay
-/docs/language/ @shati-patel @jf205
-
-# Exclude help for experimental queries from docs review
-/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
-/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
-/java/**/experimental/**/*.qhelp @github/codeql-java
-/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
-/python/**/experimental/**/*.qhelp @github/codeql-python
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 39552ad0bd9..f9f6fe310a4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -49,7 +49,11 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The query must have at least one true positive result on some revision of a real project.
 
-Experimental queries and libraries may not be actively maintained as the [supported](docs/supported-queries.md) libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
+6. **Query help files and unit tests**
+
+	- Query help (`.qhelp`) files and unit tests are optional (but strongly encouraged!) for queries in the `experimental` directories. For more information about contributing query help files and unit tests, see [Supported CodeQL queries and libraries](docs/supported-queries.md).
+
+Experimental queries and libraries may not be actively maintained as the supported libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
 
 After the experimental query is merged, we welcome pull requests to improve it. Before a query can be moved out of the `experimental` subdirectory, it must satisfy [the requirements for being a supported query](docs/supported-queries.md).
 
diff --git a/config/identical-files.json b/config/identical-files.json
index 5a8efc3405a..d68dabba861 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -356,6 +356,7 @@
   ],
   "Inline Test Expectations": [
     "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
     "python/ql/test/TestUtilities/InlineExpectationsTest.qll"
   ],
   "C++ ExternalAPIs": [
diff --git a/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll b/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll
index 788baeddbff..9ca598f86d6 100644
--- a/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll
+++ b/cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll
@@ -46,7 +46,7 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
   UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
 
   override predicate isSource(DataFlow::Node source) {
-    exists(RemoteFlowFunction remoteFlow |
+    exists(RemoteFlowSourceFunction remoteFlow |
       remoteFlow = source.asExpr().(Call).getTarget() and
       remoteFlow.hasRemoteFlowSource(_, _)
     )
diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
index 24484a9dcaf..d1e2fa12913 100644
--- a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
@@ -34,6 +34,10 @@ class Configuration extends TaintTrackingConfiguration {
   override predicate isSink(Element tainted) {
     exists(PrintStdoutCall call | call.getAnArgument() = tainted)
   }
+
+  override predicate isBarrier(Expr e) {
+    super.isBarrier(e) or e.getUnspecifiedType() instanceof IntegralType
+  }
 }
 
 from QueryString query, Element printedArg, PathNode sourceNode, PathNode sinkNode
diff --git a/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql b/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql
index fe9b56bd521..d883b2e7356 100644
--- a/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql
+++ b/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql
@@ -8,6 +8,7 @@
  * @tags reliability
  *       security
  *       external/cwe/cwe-242
+ *       external/cwe/cwe-676
  */
 
 import cpp
diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
index 35ae092780d..7ac79fd99c1 100644
--- a/cpp/ql/src/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -139,6 +139,19 @@ class Declaration extends Locatable, @declaration {
     this.hasQualifiedName("std", "", name)
   }
 
+  /**
+   * Holds if this declaration has the given name in the global namespace,
+   * the `std` namespace or the `bsl` namespace.
+   * We treat `std` and `bsl` as the same in some of our models.
+   */
+  predicate hasGlobalOrStdOrBslName(string name) {
+    this.hasGlobalName(name)
+    or
+    this.hasQualifiedName("std", "", name)
+    or
+    this.hasQualifiedName("bsl", "", name)
+  }
+
   /** Gets a specifier of this declaration. */
   Specifier getASpecifier() { none() } // overridden in subclasses
 
diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index 4ddf852f49f..a5ef1f8ca5e 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -467,7 +467,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
       // ... and likewise for destructors.
       this.(Destructor).getADestruction().mayBeGloballyImpure()
     else
-      // Unless it's a function that we know is side-effect-free, it may
+      // Unless it's a function that we know is side-effect free, it may
       // have side-effects.
       not this.hasGlobalOrStdName([
           "strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",
@@ -680,7 +680,7 @@ class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
 
 /**
  * A C/C++ non-member function (a function that is not a member of any
- * class). For example the in the following code, `MyFunction` is a
+ * class). For example, in the following code, `MyFunction` is a
  * `TopLevelFunction` but `MyMemberFunction` is not:
  * ```
  * void MyFunction() {
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll b/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll
index 4b75bbe27d2..461030f389d 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll
@@ -34,10 +34,10 @@ class Scanf extends ScanfFunction {
   Scanf() {
     this instanceof TopLevelFunction and
     (
-      hasName("scanf") or // scanf(format, args...)
-      hasName("wscanf") or // wscanf(format, args...)
-      hasName("_scanf_l") or // _scanf_l(format, locale, args...)
-      hasName("_wscanf_l") // _wscanf_l(format, locale, args...)
+      hasGlobalOrStdOrBslName("scanf") or // scanf(format, args...)
+      hasGlobalOrStdOrBslName("wscanf") or // wscanf(format, args...)
+      hasGlobalName("_scanf_l") or // _scanf_l(format, locale, args...)
+      hasGlobalName("_wscanf_l") // _wscanf_l(format, locale, args...)
     )
   }
 
@@ -53,10 +53,10 @@ class Fscanf extends ScanfFunction {
   Fscanf() {
     this instanceof TopLevelFunction and
     (
-      hasName("fscanf") or // fscanf(src_stream, format, args...)
-      hasName("fwscanf") or // fwscanf(src_stream, format, args...)
-      hasName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
-      hasName("_fwscanf_l") // _fwscanf_l(src_stream, format, locale, args...)
+      hasGlobalOrStdOrBslName("fscanf") or // fscanf(src_stream, format, args...)
+      hasGlobalOrStdOrBslName("fwscanf") or // fwscanf(src_stream, format, args...)
+      hasGlobalName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
+      hasGlobalName("_fwscanf_l") // _fwscanf_l(src_stream, format, locale, args...)
     )
   }
 
@@ -72,10 +72,10 @@ class Sscanf extends ScanfFunction {
   Sscanf() {
     this instanceof TopLevelFunction and
     (
-      hasName("sscanf") or // sscanf(src_stream, format, args...)
-      hasName("swscanf") or // swscanf(src, format, args...)
-      hasName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
-      hasName("_swscanf_l") // _swscanf_l(src, format, locale, args...)
+      hasGlobalOrStdOrBslName("sscanf") or // sscanf(src_stream, format, args...)
+      hasGlobalOrStdOrBslName("swscanf") or // swscanf(src, format, args...)
+      hasGlobalName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
+      hasGlobalName("_swscanf_l") // _swscanf_l(src, format, locale, args...)
     )
   }
 
@@ -91,10 +91,10 @@ class Snscanf extends ScanfFunction {
   Snscanf() {
     this instanceof TopLevelFunction and
     (
-      hasName("_snscanf") or // _snscanf(src, max_amount, format, args...)
-      hasName("_snwscanf") or // _snwscanf(src, max_amount, format, args...)
-      hasName("_snscanf_l") or // _snscanf_l(src, max_amount, format, locale, args...)
-      hasName("_snwscanf_l") // _snwscanf_l(src, max_amount, format, locale, args...)
+      hasGlobalName("_snscanf") or // _snscanf(src, max_amount, format, args...)
+      hasGlobalName("_snwscanf") or // _snwscanf(src, max_amount, format, args...)
+      hasGlobalName("_snscanf_l") or // _snscanf_l(src, max_amount, format, locale, args...)
+      hasGlobalName("_snwscanf_l") // _snwscanf_l(src, max_amount, format, locale, args...)
       // note that the max_amount is not a limit on the output length, it's an input length
       // limit used with non null-terminated strings.
     )
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 0ef286e8ab5..7024f9d8598 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -131,7 +131,22 @@ private predicate lvalueToUpdate(Expr lvalue, Expr outer, ControlFlowNode node)
     exists(Call call | node = call |
       outer = call.getQualifier().getFullyConverted() and
       outer.getUnspecifiedType() instanceof Class and
-      not call.getTarget().hasSpecifier("const")
+      not (
+        call.getTarget().hasSpecifier("const") and
+        // Given the following program:
+        // ```
+        // struct C {
+        //   void* data_;
+        //   void* data() const { return data; }
+        // };
+        // C c;
+        // memcpy(c.data(), source, 16)
+        // ```
+        // the data pointed to by `c.data_` is potentially modified by the call to `memcpy` even though
+        // `C::data` has a const specifier. So we further place the restriction that the type returned
+        // by `call` should not be of the form `const T*` (for some deeply const type `T`).
+        call.getType().isDeeplyConstBelow()
+      )
     )
     or
     assignmentTo(outer, node)
@@ -170,7 +185,11 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
       or
       outer = call.getQualifier().getFullyConverted() and
       outer.getUnspecifiedType() instanceof PointerType and
-      not call.getTarget().hasSpecifier("const")
+      not (
+        call.getTarget().hasSpecifier("const") and
+        // See the `lvalueToUpdate` case for an explanation of this conjunct.
+        call.getType().isDeeplyConstBelow()
+      )
     )
     or
     exists(PointerFieldAccess fa |
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/cpp/ql/src/semmle/code/cpp/models/Models.qll b/cpp/ql/src/semmle/code/cpp/models/Models.qll
index 7ec66b3a2e9..d5c7f50dde1 100644
--- a/cpp/ql/src/semmle/code/cpp/models/Models.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/Models.qll
@@ -28,3 +28,8 @@ private import implementations.Swap
 private import implementations.GetDelim
 private import implementations.SmartPointer
 private import implementations.Sscanf
+private import implementations.Send
+private import implementations.Recv
+private import implementations.Accept
+private import implementations.Poll
+private import implementations.Select
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll
new file mode 100644
index 00000000000..150f481de28
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll
@@ -0,0 +1,56 @@
+/**
+ * Provides implementation classes modeling `accept` and various similar
+ * functions. See `semmle.code.cpp.models.Models` for usage information.
+ */
+
+import semmle.code.cpp.Function
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.SideEffect
+
+/**
+ * The function `accept` and its assorted variants
+ */
+private class Accept extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
+  Accept() { this.hasGlobalName(["accept", "accept4", "WSAAccept"]) }
+
+  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+    bufParam = 1 and countParam = 2
+  }
+
+  override predicate hasArrayInput(int bufParam) { bufParam = 1 }
+
+  override predicate hasArrayOutput(int bufParam) { bufParam = 1 }
+
+  override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate parameterIsAlwaysReturned(int index) { none() }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    (input.isParameter(0) or input.isParameterDeref(1)) and
+    (output.isReturnValue() or output.isParameterDeref(1))
+  }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = 1 and buffer = true and mustWrite = false
+    or
+    i = 2 and buffer = false and mustWrite = false
+  }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    i = 0 and buffer = true
+    or
+    i = 1 and buffer = false
+  }
+
+  override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
+
+  // NOTE: We implement thse two predicates as none because we can't model the low-level changes made to
+  // the structure pointed to by the file-descriptor argument.
+  override predicate hasOnlySpecificReadSideEffects() { none() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { none() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll
index 91ec1525834..25dae1c2fd1 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll
@@ -15,7 +15,7 @@ private class MallocAllocationFunction extends AllocationFunction {
 
   MallocAllocationFunction() {
     // --- C library allocation
-    hasGlobalOrStdName("malloc") and // malloc(size)
+    hasGlobalOrStdOrBslName("malloc") and // malloc(size)
     sizeArg = 0
     or
     hasGlobalName([
@@ -104,7 +104,7 @@ private class CallocAllocationFunction extends AllocationFunction {
 
   CallocAllocationFunction() {
     // --- C library allocation
-    hasGlobalOrStdName("calloc") and // calloc(num, size)
+    hasGlobalOrStdOrBslName("calloc") and // calloc(num, size)
     sizeArg = 1 and
     multArg = 0
   }
@@ -124,7 +124,7 @@ private class ReallocAllocationFunction extends AllocationFunction {
 
   ReallocAllocationFunction() {
     // --- C library allocation
-    hasGlobalOrStdName("realloc") and // realloc(ptr, size)
+    hasGlobalOrStdOrBslName("realloc") and // realloc(ptr, size)
     sizeArg = 1 and
     reallocArg = 0
     or
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Deallocation.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Deallocation.qll
index b56c8c21949..6bd2916b733 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Deallocation.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Deallocation.qll
@@ -13,9 +13,13 @@ private class StandardDeallocationFunction extends DeallocationFunction {
   int freedArg;
 
   StandardDeallocationFunction() {
-    hasGlobalName([
+    hasGlobalOrStdOrBslName([
         // --- C library allocation
-        "free", "realloc",
+        "free", "realloc"
+      ]) and
+    freedArg = 0
+    or
+    hasGlobalName([
         // --- OpenSSL memory allocation
         "CRYPTO_free", "CRYPTO_secure_free"
       ]) and
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll
index 11568c8a974..df2d92fbc4f 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll
@@ -1,8 +1,8 @@
 import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.FlowSource
 
-private class Fread extends AliasFunction, RemoteFlowFunction {
-  Fread() { this.hasGlobalName("fread") }
+private class Fread extends AliasFunction, RemoteFlowSourceFunction {
+  Fread() { this.hasGlobalOrStdOrBslName("fread") }
 
   override predicate parameterNeverEscapes(int n) {
     n = 0 or
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll
index 3561caee7fb..e2015406346 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll
@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The standard functions `getdelim`, `getwdelim` and the glibc variant `__getdelim`.
  */
 private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectFunction,
-  RemoteFlowFunction {
+  RemoteFlowSourceFunction {
   GetDelimFunction() { hasGlobalName(["getdelim", "getwdelim", "__getdelim"]) }
 
   override predicate hasTaintFlow(FunctionInput i, FunctionOutput o) {
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll
index 9761a4293a8..87e191241d2 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll
@@ -8,8 +8,8 @@ import semmle.code.cpp.models.interfaces.FlowSource
 /**
  * The POSIX function `getenv`.
  */
-class Getenv extends LocalFlowFunction {
-  Getenv() { this.hasGlobalName("getenv") }
+class Getenv extends LocalFlowSourceFunction {
+  Getenv() { this.hasGlobalOrStdOrBslName("getenv") }
 
   override predicate hasLocalFlowSource(FunctionOutput output, string description) {
     (
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll
index 91653cd6b37..08222c2cd6a 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll
@@ -14,12 +14,12 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The standard functions `gets` and `fgets`.
  */
 private class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
-  SideEffectFunction, RemoteFlowFunction {
+  SideEffectFunction, RemoteFlowSourceFunction {
   GetsFunction() {
     // gets(str)
     // fgets(str, num, stream)
     // fgetws(wstr, num, stream)
-    hasGlobalOrStdName(["gets", "fgets", "fgetws"])
+    hasGlobalOrStdOrBslName(["gets", "fgets", "fgetws"])
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -54,13 +54,13 @@ private class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunctio
   }
 
   override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
-    not hasGlobalOrStdName("gets") and
+    not hasName("gets") and
     bufParam = 0 and
     countParam = 1
   }
 
   override predicate hasArrayWithUnknownSize(int bufParam) {
-    hasGlobalOrStdName("gets") and
+    hasName("gets") and
     bufParam = 0
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll
index bd188cffe49..60afd2b25ef 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll
@@ -6,12 +6,9 @@ import semmle.code.cpp.models.interfaces.SideEffect
 /**
  * The standard function templates `std::move` and `std::forward`.
  */
-private class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFunction {
-  IdentityFunction() {
-    this.getNamespace().getParentNamespace() instanceof GlobalNamespace and
-    this.getNamespace().getName() = "std" and
-    this.getName() = ["move", "forward"]
-  }
+private class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFunction,
+  FunctionTemplateInstantiation {
+  IdentityFunction() { this.hasQualifiedName("std", ["move", "forward"]) }
 
   override predicate hasOnlySpecificReadSideEffects() { any() }
 
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
index a5b1c0e83ec..24d5456293f 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
@@ -15,7 +15,7 @@ import semmle.code.cpp.models.interfaces.Iterator
  */
 private class IteratorTraits extends Class {
   IteratorTraits() {
-    this.hasQualifiedName("std", "iterator_traits") and
+    this.hasQualifiedName(["std", "bsl"], "iterator_traits") and
     not this instanceof TemplateClass and
     exists(TypedefType t |
       this.getAMember() = t and
@@ -26,6 +26,14 @@ private class IteratorTraits extends Class {
   Type getIteratorType() { result = this.getTemplateArgument(0) }
 }
 
+/**
+ * A type that is deduced to be an iterator because there is a corresponding
+ * `std::iterator_traits` instantiation for it.
+ */
+private class IteratorByTraits extends Iterator {
+  IteratorByTraits() { exists(IteratorTraits it | it.getIteratorType() = this) }
+}
+
 /**
  * A type which has the typedefs expected for an iterator.
  */
@@ -36,7 +44,7 @@ private class IteratorByTypedefs extends Iterator, Class {
     this.getAMember().(TypedefType).hasName("pointer") and
     this.getAMember().(TypedefType).hasName("reference") and
     this.getAMember().(TypedefType).hasName("iterator_category") and
-    not this.hasQualifiedName("std", "iterator_traits")
+    not this.hasQualifiedName(["std", "bsl"], "iterator_traits")
   }
 }
 
@@ -44,17 +52,13 @@ private class IteratorByTypedefs extends Iterator, Class {
  * The `std::iterator` class.
  */
 private class StdIterator extends Iterator, Class {
-  StdIterator() { this.hasQualifiedName("std", "iterator") }
+  StdIterator() { this.hasQualifiedName(["std", "bsl"], "iterator") }
 }
 
 /**
- * A type that is deduced to be an iterator because there is a corresponding
- * `std::iterator_traits` instantiation for it.
+ * Gets the `FunctionInput` corresponding to an iterator parameter to
+ * user-defined operator `op`, at `index`.
  */
-private class IteratorByTraits extends Iterator {
-  IteratorByTraits() { exists(IteratorTraits it | it.getIteratorType() = this) }
-}
-
 private FunctionInput getIteratorArgumentInput(Operator op, int index) {
   exists(Type t |
     t =
@@ -155,17 +159,21 @@ private class IteratorSubOperator extends Operator, TaintFunction {
 private class IteratorAssignArithmeticOperator extends Operator, DataFlowFunction, TaintFunction {
   IteratorAssignArithmeticOperator() {
     this.hasName(["operator+=", "operator-="]) and
-    this.getDeclaringType() instanceof Iterator
+    exists(getIteratorArgumentInput(this, 0))
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isParameter(0) and
     output.isReturnValue()
-    or
-    input.isParameterDeref(0) and output.isReturnValueDeref()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isParameterDeref(0) and output.isReturnValueDeref()
+    or
+    // reverse flow from returned reference to the object referenced by the first parameter
+    input.isReturnValueDeref() and
+    output.isParameterDeref(0)
+    or
     input.isParameterDeref(1) and
     output.isParameterDeref(0)
   }
@@ -177,8 +185,7 @@ private class IteratorAssignArithmeticOperator extends Operator, DataFlowFunctio
 class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunction,
   IteratorReferenceFunction {
   IteratorPointerDereferenceMemberOperator() {
-    this.hasName("operator*") and
-    this.getDeclaringType() instanceof Iterator
+    this.getClassAndName("operator*") instanceof Iterator
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -195,8 +202,7 @@ class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunc
  */
 private class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction, TaintFunction {
   IteratorCrementMemberOperator() {
-    this.hasName(["operator++", "operator--"]) and
-    this.getDeclaringType() instanceof Iterator
+    this.getClassAndName(["operator++", "operator--"]) instanceof Iterator
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -220,10 +226,7 @@ private class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunc
  * A member `operator->` function for an iterator type.
  */
 private class IteratorFieldMemberOperator extends Operator, TaintFunction {
-  IteratorFieldMemberOperator() {
-    this.hasName("operator->") and
-    this.getDeclaringType() instanceof Iterator
-  }
+  IteratorFieldMemberOperator() { this.getClassAndName("operator->") instanceof Iterator }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
@@ -236,8 +239,7 @@ private class IteratorFieldMemberOperator extends Operator, TaintFunction {
  */
 private class IteratorBinaryArithmeticMemberOperator extends MemberFunction, TaintFunction {
   IteratorBinaryArithmeticMemberOperator() {
-    this.hasName(["operator+", "operator-"]) and
-    this.getDeclaringType() instanceof Iterator
+    this.getClassAndName(["operator+", "operator-"]) instanceof Iterator
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -252,21 +254,24 @@ private class IteratorBinaryArithmeticMemberOperator extends MemberFunction, Tai
 private class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFunction,
   TaintFunction {
   IteratorAssignArithmeticMemberOperator() {
-    this.hasName(["operator+=", "operator-="]) and
-    this.getDeclaringType() instanceof Iterator
+    this.getClassAndName(["operator+=", "operator-="]) instanceof Iterator
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierAddress() and
     output.isReturnValue()
-    or
-    input.isReturnValueDeref() and
-    output.isQualifierObject()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
     output.isReturnValueDeref()
+    or
+    // reverse flow from returned reference to the qualifier
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
+    or
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
   }
 }
 
@@ -275,10 +280,7 @@ private class IteratorAssignArithmeticMemberOperator extends MemberFunction, Dat
  */
 private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
   IteratorReferenceFunction {
-  IteratorArrayMemberOperator() {
-    this.hasName("operator[]") and
-    this.getDeclaringType() instanceof Iterator
-  }
+  IteratorArrayMemberOperator() { this.getClassAndName("operator[]") instanceof Iterator }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
@@ -295,8 +297,7 @@ private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
  */
 private class IteratorAssignmentMemberOperator extends MemberFunction, TaintFunction {
   IteratorAssignmentMemberOperator() {
-    this.hasName("operator=") and
-    this.getDeclaringType() instanceof Iterator and
+    this.getClassAndName("operator=") instanceof Iterator and
     not this instanceof CopyAssignmentOperator and
     not this instanceof MoveAssignmentOperator
   }
@@ -337,7 +338,7 @@ private class BeginOrEndFunction extends MemberFunction, TaintFunction, GetItera
  */
 private class InserterIteratorFunction extends GetIteratorFunction {
   InserterIteratorFunction() {
-    this.hasQualifiedName("std", ["front_inserter", "inserter", "back_inserter"])
+    this.hasQualifiedName(["std", "bsl"], ["front_inserter", "inserter", "back_inserter"])
   }
 
   override predicate getsIterator(FunctionInput input, FunctionOutput output) {
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
index 02fa810142f..b7d8aed60fa 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
@@ -20,7 +20,7 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
     // memcpy(dest, src, num)
     // memmove(dest, src, num)
     // memmove(dest, src, num, remaining)
-    this.hasGlobalOrStdName(["memcpy", "memmove"])
+    this.hasGlobalOrStdOrBslName(["memcpy", "memmove"])
     or
     // bcopy(src, dest, num)
     // mempcpy(dest, src, num)
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memset.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memset.qll
index 6636b34fe9d..d646be0363d 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Memset.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memset.qll
@@ -15,7 +15,9 @@ import semmle.code.cpp.models.interfaces.SideEffect
 private class MemsetFunction extends ArrayFunction, DataFlowFunction, AliasFunction,
   SideEffectFunction {
   MemsetFunction() {
-    this.hasGlobalOrStdName(["memset", "wmemset"])
+    this.hasGlobalOrStdOrBslName("memset")
+    or
+    this.hasGlobalOrStdName("wmemset")
     or
     this.hasGlobalName([bzero(), "__builtin_memset", "__builtin_memset_chk"])
   }
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Poll.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Poll.qll
new file mode 100644
index 00000000000..020bd6aaa51
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Poll.qll
@@ -0,0 +1,44 @@
+/**
+ * Provides implementation classes modeling `poll` and various similar
+ * functions. See `semmle.code.cpp.models.Models` for usage information.
+ */
+
+import semmle.code.cpp.Function
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.SideEffect
+
+/**
+ * The function `poll` and its assorted variants
+ */
+private class Poll extends ArrayFunction, AliasFunction, SideEffectFunction {
+  Poll() { this.hasGlobalName(["poll", "ppoll", "WSAPoll"]) }
+
+  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+    bufParam = 0 and countParam = 1
+  }
+
+  override predicate hasArrayInput(int bufParam) { bufParam = 0 }
+
+  override predicate hasArrayOutput(int bufParam) { bufParam = 0 }
+
+  override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate parameterIsAlwaysReturned(int index) { none() }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = 0 and buffer = true and mustWrite = false
+  }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    i = 0 and buffer = true
+    or
+    this.hasGlobalName("ppoll") and i = [2, 3] and buffer = false
+  }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll
index 1767261efac..ed201a14587 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll
@@ -15,7 +15,7 @@ private class Printf extends FormattingFunction, AliasFunction {
   Printf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdName(["printf", "wprintf"]) or
+      hasGlobalOrStdOrBslName(["printf", "wprintf"]) or
       hasGlobalName(["printf_s", "wprintf_s", "g_printf"])
     ) and
     not exists(getDefinition().getFile().getRelativePath())
@@ -23,10 +23,7 @@ private class Printf extends FormattingFunction, AliasFunction {
 
   override int getFormatParameterIndex() { result = 0 }
 
-  deprecated override predicate isWideCharDefault() {
-    hasGlobalOrStdName("wprintf") or
-    hasGlobalName("wprintf_s")
-  }
+  deprecated override predicate isWideCharDefault() { hasName(["wprintf", "wprintf_s"]) }
 
   override predicate isOutputGlobal() { any() }
 
@@ -44,7 +41,7 @@ private class Fprintf extends FormattingFunction {
   Fprintf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdName(["fprintf", "fwprintf"]) or
+      hasGlobalOrStdOrBslName(["fprintf", "fwprintf"]) or
       hasGlobalName("g_fprintf")
     ) and
     not exists(getDefinition().getFile().getRelativePath())
@@ -52,7 +49,7 @@ private class Fprintf extends FormattingFunction {
 
   override int getFormatParameterIndex() { result = 1 }
 
-  deprecated override predicate isWideCharDefault() { hasGlobalOrStdName("fwprintf") }
+  deprecated override predicate isWideCharDefault() { hasName("fwprintf") }
 
   override int getOutputParameterIndex(boolean isStream) { result = 0 and isStream = true }
 }
@@ -64,7 +61,7 @@ private class Sprintf extends FormattingFunction {
   Sprintf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdName([
+      hasGlobalOrStdOrBslName([
           "sprintf", // sprintf(dst, format, args...)
           "wsprintf" // wsprintf(dst, format, args...)
         ])
@@ -90,22 +87,20 @@ private class Sprintf extends FormattingFunction {
   }
 
   override int getFormatParameterIndex() {
-    hasGlobalName("g_strdup_printf") and result = 0
+    hasName("g_strdup_printf") and result = 0
     or
-    hasGlobalName("__builtin___sprintf_chk") and result = 3
+    hasName("__builtin___sprintf_chk") and result = 3
     or
     not getName() = ["g_strdup_printf", "__builtin___sprintf_chk"] and
     result = 1
   }
 
   override int getOutputParameterIndex(boolean isStream) {
-    not hasGlobalName("g_strdup_printf") and result = 0 and isStream = false
+    not hasName("g_strdup_printf") and result = 0 and isStream = false
   }
 
   override int getFirstFormatArgumentIndex() {
-    if hasGlobalName("__builtin___sprintf_chk")
-    then result = 4
-    else result = getNumberOfParameters()
+    if hasName("__builtin___sprintf_chk") then result = 4 else result = getNumberOfParameters()
   }
 }
 
@@ -116,7 +111,7 @@ private class SnprintfImpl extends Snprintf {
   SnprintfImpl() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdName([
+      hasGlobalOrStdOrBslName([
           "snprintf", // C99 defines snprintf
           "swprintf" // The s version of wide-char printf is also always the n version
         ])
@@ -163,10 +158,7 @@ private class SnprintfImpl extends Snprintf {
   }
 
   override predicate returnsFullFormatLength() {
-    (
-      hasGlobalOrStdName("snprintf") or
-      hasGlobalName(["g_snprintf", "__builtin___snprintf_chk", "snprintf_s"])
-    ) and
+    hasName(["snprintf", "g_snprintf", "__builtin___snprintf_chk", "snprintf_s"]) and
     not exists(getDefinition().getFile().getRelativePath())
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
index 0dfa7fe6d76..d728a66463d 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
@@ -3,11 +3,14 @@ import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.SideEffect
 
-/** Pure string functions. */
+/**
+ * A function that operates on strings and is pure. That is, its evaluation is
+ * guaranteed to be side-effect free.
+ */
 private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction,
   SideEffectFunction {
   PureStrFunction() {
-    hasGlobalOrStdName([
+    hasGlobalOrStdOrBslName([
         atoi(), "strcasestr", "strchnul", "strchr", "strchrnul", "strstr", "strpbrk", "strrchr",
         "strspn", strtol(), strrev(), strcmp(), strlwr(), strupr()
       ])
@@ -89,10 +92,12 @@ private string strcmp() {
     ]
 }
 
-/** String standard `strlen` function, and related functions for computing string lengths. */
+/**
+ * A function such as `strlen` that returns the length of the given string.
+ */
 private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
   StrLenFunction() {
-    hasGlobalOrStdName(["strlen", "strnlen", "wcslen"])
+    hasGlobalOrStdOrBslName(["strlen", "strnlen", "wcslen"])
     or
     hasGlobalName(["_mbslen", "_mbslen_l", "_mbstrlen", "_mbstrlen_l"])
   }
@@ -123,9 +128,12 @@ private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFun
   }
 }
 
-/** Pure functions. */
+/**
+ * A function that is pure, that is, its evaluation is guaranteed to be
+ * side-effect free. Excludes functions modeled by `PureStrFunction` and `PureMemFunction`.
+ */
 private class PureFunction extends TaintFunction, SideEffectFunction {
-  PureFunction() { hasGlobalOrStdName(["abs", "labs"]) }
+  PureFunction() { hasGlobalOrStdOrBslName(["abs", "labs"]) }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     exists(ParameterIndex i |
@@ -140,11 +148,14 @@ private class PureFunction extends TaintFunction, SideEffectFunction {
   override predicate hasOnlySpecificWriteSideEffects() { any() }
 }
 
-/** Pure raw-memory functions. */
+/**
+ * A function that operates on memory buffers and is pure. That is, its
+ * evaluation is guaranteed to be side-effect free.
+ */
 private class PureMemFunction extends AliasFunction, ArrayFunction, TaintFunction,
   SideEffectFunction {
   PureMemFunction() {
-    hasGlobalOrStdName([
+    hasGlobalOrStdOrBslName([
         "memchr", "__builtin_memchr", "memrchr", "rawmemchr", "memcmp", "__builtin_memcmp", "memmem"
       ]) or
     this.hasGlobalName("memfrob")
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Recv.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Recv.qll
new file mode 100644
index 00000000000..691ba528f42
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Recv.qll
@@ -0,0 +1,88 @@
+/**
+ * Provides implementation classes modeling `recv` and various similar
+ * functions. See `semmle.code.cpp.models.Models` for usage information.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.models.interfaces.SideEffect
+
+/** The function `recv` and its assorted variants */
+private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction,
+  RemoteFlowSourceFunction {
+  Recv() {
+    this.hasGlobalName([
+        "recv", // recv(socket, dest, len, flags)
+        "recvfrom", // recvfrom(socket, dest, len, flags, from, fromlen)
+        "recvmsg", // recvmsg(socket, msg, flags)
+        "read", // read(socket, dest, len)
+        "pread", // pread(socket, dest, len, offset)
+        "readv", // readv(socket, dest, len)
+        "preadv", // readv(socket, dest, len, offset)
+        "preadv2" // readv2(socket, dest, len, offset, flags)
+      ])
+  }
+
+  override predicate parameterNeverEscapes(int index) {
+    this.getParameter(index).getUnspecifiedType() instanceof PointerType
+  }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate parameterIsAlwaysReturned(int index) { none() }
+
+  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+    not this.hasGlobalName("recvmsg") and
+    bufParam = 1 and
+    countParam = 2
+  }
+
+  override predicate hasArrayInput(int bufParam) { this.hasGlobalName("recvfrom") and bufParam = 4 }
+
+  override predicate hasArrayOutput(int bufParam) {
+    bufParam = 1
+    or
+    this.hasGlobalName("recvfrom") and bufParam = 4
+  }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    this.hasGlobalName("recvfrom") and
+    (
+      i = 4 and buffer = true
+      or
+      i = 5 and buffer = false
+    )
+    or
+    this.hasGlobalName("recvmsg") and
+    i = 1 and
+    buffer = true
+  }
+
+  override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = 1 and buffer = true and mustWrite = false
+    or
+    this.hasGlobalName("recvfrom") and
+    (
+      i = 4 and buffer = true and mustWrite = false
+      or
+      i = 5 and buffer = false and mustWrite = false
+    )
+  }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasRemoteFlowSource(FunctionOutput output, string description) {
+    (
+      output.isParameterDeref(1)
+      or
+      this.hasGlobalName("recvfrom") and output.isParameterDeref([4, 5])
+    ) and
+    description = "Buffer read by " + this.getName()
+  }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Select.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Select.qll
new file mode 100644
index 00000000000..b2120b241b9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Select.qll
@@ -0,0 +1,40 @@
+/**
+ * Provides implementation classes modeling `select` and various similar
+ * functions. See `semmle.code.cpp.models.Models` for usage information.
+ */
+
+import semmle.code.cpp.Function
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.SideEffect
+
+/**
+ * The function `select` and its assorted variants
+ */
+private class Select extends ArrayFunction, AliasFunction, SideEffectFunction {
+  Select() { this.hasGlobalName(["select", "pselect"]) }
+
+  override predicate hasArrayWithUnknownSize(int bufParam) { bufParam = [1 .. 3] }
+
+  override predicate hasArrayInput(int bufParam) { bufParam = [1 .. 3] }
+
+  override predicate hasArrayOutput(int bufParam) { bufParam = [1 .. 3] }
+
+  override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate parameterIsAlwaysReturned(int index) { none() }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = [1 .. 3] and buffer = true and mustWrite = false
+  }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    i = [1 .. 5] and buffer = true
+  }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Send.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Send.qll
new file mode 100644
index 00000000000..6086bc7748f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Send.qll
@@ -0,0 +1,63 @@
+/**
+ * Provides implementation classes modeling `send` and various similar
+ * functions. See `semmle.code.cpp.models.Models` for usage information.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.models.interfaces.SideEffect
+
+/** The function `send` and its assorted variants */
+private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, RemoteFlowSinkFunction {
+  Send() {
+    this.hasGlobalName([
+        "send", // send(socket, buf, len, flags)
+        "sendto", // sendto(socket, buf, len, flags, to, tolen)
+        "sendmsg", // sendmsg(socket, msg, flags)
+        "write", // write(socket, buf, len)
+        "writev", // writev(socket, buf, len)
+        "pwritev", // pwritev(socket, buf, len, offset)
+        "pwritev2" // pwritev2(socket, buf, len, offset, flags)
+      ])
+  }
+
+  override predicate parameterNeverEscapes(int index) {
+    this.getParameter(index).getUnspecifiedType() instanceof PointerType
+  }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
+
+  override predicate parameterIsAlwaysReturned(int index) { none() }
+
+  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+    not this.hasGlobalName("sendmsg") and
+    bufParam = 1 and
+    countParam = 2
+  }
+
+  override predicate hasArrayInput(int bufParam) { bufParam = 1 }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    none()
+  }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    i = 1 and buffer = true
+    or
+    this.hasGlobalName("sendto") and i = 4 and buffer = false
+    or
+    this.hasGlobalName("sendmsg") and i = 1 and buffer = true
+  }
+
+  override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
+
+  override predicate hasRemoteFlowSink(FunctionInput input, string description) {
+    input.isParameterDeref(1) and description = "Buffer sent by " + this.getName()
+  }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index b13b4a8801d..c6152624792 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -4,14 +4,14 @@ import semmle.code.cpp.models.interfaces.Taint
  * The `std::shared_ptr` and `std::unique_ptr` template classes.
  */
 private class UniqueOrSharedPtr extends Class {
-  UniqueOrSharedPtr() { this.hasQualifiedName("std", ["shared_ptr", "unique_ptr"]) }
+  UniqueOrSharedPtr() { this.hasQualifiedName(["std", "bsl"], ["shared_ptr", "unique_ptr"]) }
 }
 
 /**
  * The `std::make_shared` and `std::make_unique` template functions.
  */
 private class MakeUniqueOrShared extends TaintFunction {
-  MakeUniqueOrShared() { this.hasQualifiedName("std", ["make_shared", "make_unique"]) }
+  MakeUniqueOrShared() { this.hasQualifiedName(["bsl", "std"], ["make_shared", "make_unique"]) }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // Exclude the specializations of `std::make_shared` and `std::make_unique` that allocate arrays
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
index e7abde30e8c..367db1613fc 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
@@ -5,6 +5,41 @@
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.Iterator
 
+/**
+ * The `std::array` template class.
+ */
+private class Array extends Class {
+  Array() { this.hasQualifiedName(["std", "bsl"], "array") }
+}
+
+/**
+ * The `std::deque` template class.
+ */
+private class Deque extends Class {
+  Deque() { this.hasQualifiedName(["std", "bsl"], "deque") }
+}
+
+/**
+ * The `std::forward_list` template class.
+ */
+private class ForwardList extends Class {
+  ForwardList() { this.hasQualifiedName(["std", "bsl"], "forward_list") }
+}
+
+/**
+ * The `std::list` template class.
+ */
+private class List extends Class {
+  List() { this.hasQualifiedName(["std", "bsl"], "list") }
+}
+
+/**
+ * The `std::vector` template class.
+ */
+private class Vector extends Class {
+  Vector() { this.hasQualifiedName(["std", "bsl"], "vector") }
+}
+
 /**
  * Additional model for standard container constructors that reference the
  * value type of the container (that is, the `T` in `std::vector<T>`).  For
@@ -15,7 +50,10 @@ import semmle.code.cpp.models.interfaces.Iterator
  */
 private class StdSequenceContainerConstructor extends Constructor, TaintFunction {
   StdSequenceContainerConstructor() {
-    this.getDeclaringType().hasQualifiedName("std", ["vector", "deque", "list", "forward_list"])
+    this.getDeclaringType() instanceof Vector or
+    this.getDeclaringType() instanceof Deque or
+    this.getDeclaringType() instanceof List or
+    this.getDeclaringType() instanceof ForwardList
   }
 
   /**
@@ -50,7 +88,10 @@ private class StdSequenceContainerConstructor extends Constructor, TaintFunction
  * The standard container function `data`.
  */
 private class StdSequenceContainerData extends TaintFunction {
-  StdSequenceContainerData() { this.hasQualifiedName("std", ["array", "vector"], "data") }
+  StdSequenceContainerData() {
+    this.getClassAndName("data") instanceof Array or
+    this.getClassAndName("data") instanceof Vector
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from container itself (qualifier) to return value
@@ -69,8 +110,10 @@ private class StdSequenceContainerData extends TaintFunction {
  */
 private class StdSequenceContainerPush extends TaintFunction {
   StdSequenceContainerPush() {
-    this.hasQualifiedName("std", ["vector", "deque", "list"], "push_back") or
-    this.hasQualifiedName("std", ["deque", "list", "forward_list"], "push_front")
+    this.getClassAndName("push_back") instanceof Vector or
+    this.getClassAndName(["push_back", "push_front"]) instanceof Deque or
+    this.getClassAndName("push_front") instanceof ForwardList or
+    this.getClassAndName(["push_back", "push_front"]) instanceof List
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -85,8 +128,11 @@ private class StdSequenceContainerPush extends TaintFunction {
  */
 private class StdSequenceContainerFrontBack extends TaintFunction {
   StdSequenceContainerFrontBack() {
-    this.hasQualifiedName("std", ["array", "vector", "deque", "list", "forward_list"], "front") or
-    this.hasQualifiedName("std", ["array", "vector", "deque", "list"], "back")
+    this.getClassAndName(["front", "back"]) instanceof Array or
+    this.getClassAndName(["front", "back"]) instanceof Deque or
+    this.getClassAndName("front") instanceof ForwardList or
+    this.getClassAndName(["front", "back"]) instanceof List or
+    this.getClassAndName(["front", "back"]) instanceof Vector
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -101,8 +147,10 @@ private class StdSequenceContainerFrontBack extends TaintFunction {
  */
 private class StdSequenceContainerInsert extends TaintFunction {
   StdSequenceContainerInsert() {
-    this.hasQualifiedName("std", ["vector", "deque", "list"], "insert") or
-    this.hasQualifiedName("std", "forward_list", "insert_after")
+    this.getClassAndName("insert") instanceof Deque or
+    this.getClassAndName("insert") instanceof List or
+    this.getClassAndName("insert") instanceof Vector or
+    this.getClassAndName("insert_after") instanceof ForwardList
   }
 
   /**
@@ -138,7 +186,10 @@ private class StdSequenceContainerInsert extends TaintFunction {
  */
 private class StdSequenceContainerAssign extends TaintFunction {
   StdSequenceContainerAssign() {
-    this.hasQualifiedName("std", ["vector", "deque", "list", "forward_list"], "assign")
+    this.getClassAndName("assign") instanceof Deque or
+    this.getClassAndName("assign") instanceof ForwardList or
+    this.getClassAndName("assign") instanceof List or
+    this.getClassAndName("assign") instanceof Vector
   }
 
   /**
@@ -170,7 +221,9 @@ private class StdSequenceContainerAssign extends TaintFunction {
  */
 private class StdSequenceContainerAt extends TaintFunction {
   StdSequenceContainerAt() {
-    this.hasQualifiedName("std", ["vector", "array", "deque"], ["at", "operator[]"])
+    this.getClassAndName(["at", "operator[]"]) instanceof Array or
+    this.getClassAndName(["at", "operator[]"]) instanceof Deque or
+    this.getClassAndName(["at", "operator[]"]) instanceof Vector
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -188,7 +241,7 @@ private class StdSequenceContainerAt extends TaintFunction {
  * The standard vector `emplace` function.
  */
 class StdVectorEmplace extends TaintFunction {
-  StdVectorEmplace() { this.hasQualifiedName("std", "vector", "emplace") }
+  StdVectorEmplace() { this.getClassAndName("emplace") instanceof Vector }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from any parameter except the position iterator to qualifier and return value
@@ -205,7 +258,7 @@ class StdVectorEmplace extends TaintFunction {
  * The standard vector `emplace_back` function.
  */
 class StdVectorEmplaceBack extends TaintFunction {
-  StdVectorEmplaceBack() { this.hasQualifiedName("std", "vector", "emplace_back") }
+  StdVectorEmplaceBack() { this.getClassAndName("emplace_back") instanceof Vector }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from any parameter to qualifier
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
index f261038735d..aecd98981e8 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
@@ -5,14 +5,18 @@
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.Iterator
 
+/**
+ * The `std::map` and `std::unordered_map` template classes.
+ */
+private class MapOrUnorderedMap extends Class {
+  MapOrUnorderedMap() { this.hasQualifiedName(["std", "bsl"], ["map", "unordered_map"]) }
+}
+
 /**
  * Additional model for map constructors using iterator inputs.
  */
 private class StdMapConstructor extends Constructor, TaintFunction {
-  StdMapConstructor() {
-    this.hasQualifiedName("std", "map", "map") or
-    this.hasQualifiedName("std", "unordered_map", "unordered_map")
-  }
+  StdMapConstructor() { this.getDeclaringType() instanceof MapOrUnorderedMap }
 
   /**
    * Gets the index of a parameter to this function that is an iterator.
@@ -37,7 +41,7 @@ private class StdMapConstructor extends Constructor, TaintFunction {
  */
 private class StdMapInsert extends TaintFunction {
   StdMapInsert() {
-    this.hasQualifiedName("std", ["map", "unordered_map"], ["insert", "insert_or_assign"])
+    this.getClassAndName(["insert", "insert_or_assign"]) instanceof MapOrUnorderedMap
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -55,9 +59,7 @@ private class StdMapInsert extends TaintFunction {
  * The standard map `emplace` and `emplace_hint` functions.
  */
 private class StdMapEmplace extends TaintFunction {
-  StdMapEmplace() {
-    this.hasQualifiedName("std", ["map", "unordered_map"], ["emplace", "emplace_hint"])
-  }
+  StdMapEmplace() { this.getClassAndName(["emplace", "emplace_hint"]) instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from the last parameter (which may be the value part used to
@@ -79,7 +81,7 @@ private class StdMapEmplace extends TaintFunction {
  * The standard map `try_emplace` function.
  */
 private class StdMapTryEmplace extends TaintFunction {
-  StdMapTryEmplace() { this.hasQualifiedName("std", ["map", "unordered_map"], "try_emplace") }
+  StdMapTryEmplace() { this.getClassAndName("try_emplace") instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from any parameter apart from the key to qualifier and return value
@@ -106,7 +108,7 @@ private class StdMapTryEmplace extends TaintFunction {
  * The standard map `merge` function.
  */
 private class StdMapMerge extends TaintFunction {
-  StdMapMerge() { this.hasQualifiedName("std", ["map", "unordered_map"], "merge") }
+  StdMapMerge() { this.getClassAndName("merge") instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // container1.merge(container2)
@@ -119,7 +121,7 @@ private class StdMapMerge extends TaintFunction {
  * The standard map functions `at` and `operator[]`.
  */
 private class StdMapAt extends TaintFunction {
-  StdMapAt() { this.hasQualifiedName("std", ["map", "unordered_map"], ["at", "operator[]"]) }
+  StdMapAt() { this.getClassAndName(["at", "operator[]"]) instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
@@ -136,7 +138,7 @@ private class StdMapAt extends TaintFunction {
  * The standard map `find` function.
  */
 private class StdMapFind extends TaintFunction {
-  StdMapFind() { this.hasQualifiedName("std", ["map", "unordered_map"], "find") }
+  StdMapFind() { this.getClassAndName("find") instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
@@ -148,7 +150,7 @@ private class StdMapFind extends TaintFunction {
  * The standard map `erase` function.
  */
 private class StdMapErase extends TaintFunction {
-  StdMapErase() { this.hasQualifiedName("std", ["map", "unordered_map"], "erase") }
+  StdMapErase() { this.getClassAndName("erase") instanceof MapOrUnorderedMap }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to iterator return value
@@ -163,8 +165,7 @@ private class StdMapErase extends TaintFunction {
  */
 private class StdMapEqualRange extends TaintFunction {
   StdMapEqualRange() {
-    this.hasQualifiedName("std", ["map", "unordered_map"],
-      ["lower_bound", "upper_bound", "equal_range"])
+    this.getClassAndName(["lower_bound", "upper_bound", "equal_range"]) instanceof MapOrUnorderedMap
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
index 41867e71acc..755f6a48520 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
@@ -7,10 +7,16 @@ import semmle.code.cpp.models.interfaces.Taint
 /**
  * An instantiation of `std::pair<T1, T2>`.
  */
-class StdPairClass extends ClassTemplateInstantiation {
-  StdPairClass() { getTemplate().hasQualifiedName("std", "pair") }
+private class StdPair extends ClassTemplateInstantiation {
+  StdPair() { this.hasQualifiedName(["std", "bsl"], "pair") }
 }
 
+/**
+ * DEPRECATED: This is now called `StdPair` and is a private part of the
+ * library implementation.
+ */
+deprecated class StdPairClass = StdPair;
+
 /**
  * Any of the single-parameter constructors of `std::pair` that takes a reference to an
  * instantiation of `std::pair`. These constructors allow conversion between pair types when the
@@ -18,9 +24,9 @@ class StdPairClass extends ClassTemplateInstantiation {
  */
 class StdPairCopyishConstructor extends Constructor, TaintFunction {
   StdPairCopyishConstructor() {
-    this.getDeclaringType() instanceof StdPairClass and
+    this.getDeclaringType() instanceof StdPair and
     this.getNumberOfParameters() = 1 and
-    this.getParameter(0).getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdPairClass
+    this.getParameter(0).getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdPair
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -38,7 +44,7 @@ class StdPairCopyishConstructor extends Constructor, TaintFunction {
  * Additional model for `std::pair` constructors.
  */
 private class StdPairConstructor extends Constructor, TaintFunction {
-  StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
+  StdPairConstructor() { this.getDeclaringType() instanceof StdPair }
 
   /**
    * Gets the index of a parameter to this function that is a reference to
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll
index 9fac9ae75f8..d2e9892abcb 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll
@@ -5,14 +5,18 @@
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.Iterator
 
+/**
+ * An instantiation of `std::set` or `std::unordered_set`.
+ */
+private class StdSet extends ClassTemplateInstantiation {
+  StdSet() { this.hasQualifiedName(["std", "bsl"], ["set", "unordered_set"]) }
+}
+
 /**
  * Additional model for set constructors using iterator inputs.
  */
 private class StdSetConstructor extends Constructor, TaintFunction {
-  StdSetConstructor() {
-    this.hasQualifiedName("std", "set", "set") or
-    this.hasQualifiedName("std", "unordered_set", "unordered_set")
-  }
+  StdSetConstructor() { this.getDeclaringType() instanceof StdSet }
 
   /**
    * Gets the index of a parameter to this function that is an iterator.
@@ -36,7 +40,7 @@ private class StdSetConstructor extends Constructor, TaintFunction {
  * The standard set `insert` and `insert_or_assign` functions.
  */
 private class StdSetInsert extends TaintFunction {
-  StdSetInsert() { this.hasQualifiedName("std", ["set", "unordered_set"], "insert") }
+  StdSetInsert() { this.getClassAndName("insert") instanceof StdSet }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from last parameter to qualifier and return value
@@ -53,9 +57,7 @@ private class StdSetInsert extends TaintFunction {
  * The standard set `emplace` and `emplace_hint` functions.
  */
 private class StdSetEmplace extends TaintFunction {
-  StdSetEmplace() {
-    this.hasQualifiedName("std", ["set", "unordered_set"], ["emplace", "emplace_hint"])
-  }
+  StdSetEmplace() { this.getClassAndName(["emplace", "emplace_hint"]) instanceof StdSet }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from any parameter to qualifier and return value
@@ -76,7 +78,7 @@ private class StdSetEmplace extends TaintFunction {
  * The standard set `merge` function.
  */
 private class StdSetMerge extends TaintFunction {
-  StdSetMerge() { this.hasQualifiedName("std", ["set", "unordered_set"], "merge") }
+  StdSetMerge() { this.getClassAndName("merge") instanceof StdSet }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // container1.merge(container2)
@@ -89,7 +91,7 @@ private class StdSetMerge extends TaintFunction {
  * The standard set `find` function.
  */
 private class StdSetFind extends TaintFunction {
-  StdSetFind() { this.hasQualifiedName("std", ["set", "unordered_set"], "find") }
+  StdSetFind() { this.getClassAndName("find") instanceof StdSet }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
@@ -101,7 +103,7 @@ private class StdSetFind extends TaintFunction {
  * The standard set `erase` function.
  */
 private class StdSetErase extends TaintFunction {
-  StdSetErase() { this.hasQualifiedName("std", ["set", "unordered_set"], "erase") }
+  StdSetErase() { this.getClassAndName("erase") instanceof StdSet }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to iterator return value
@@ -116,8 +118,7 @@ private class StdSetErase extends TaintFunction {
  */
 private class StdSetEqualRange extends TaintFunction {
   StdSetEqualRange() {
-    this.hasQualifiedName("std", ["set", "unordered_set"],
-      ["lower_bound", "upper_bound", "equal_range"])
+    this.getClassAndName(["lower_bound", "upper_bound", "equal_range"]) instanceof StdSet
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 9f4c458815f..73a0f6edf26 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -12,7 +12,7 @@ import semmle.code.cpp.models.interfaces.DataFlow
  * The `std::basic_string` template class instantiations.
  */
 private class StdBasicString extends ClassTemplateInstantiation {
-  StdBasicString() { this.hasQualifiedName("std", "basic_string") }
+  StdBasicString() { this.hasQualifiedName(["std", "bsl"], "basic_string") }
 }
 
 /**
@@ -127,7 +127,7 @@ private class StdStringFrontBack extends TaintFunction {
  */
 private class StdStringPlus extends TaintFunction {
   StdStringPlus() {
-    this.hasQualifiedName("std", "operator+") and
+    this.hasQualifiedName(["std", "bsl"], "operator+") and
     this.getUnspecifiedType() instanceof StdBasicString
   }
 
@@ -252,13 +252,6 @@ private class StdStringSubstr extends TaintFunction {
   }
 }
 
-/**
- * The `std::basic_stringstream` template class instantiations.
- */
-private class StdBasicStringStream extends ClassTemplateInstantiation {
-  StdBasicStringStream() { this.hasQualifiedName("std", "basic_stringstream") }
-}
-
 /**
  * The `std::string` functions `at` and `operator[]`.
  */
@@ -280,7 +273,7 @@ private class StdStringAt extends TaintFunction {
  * The `std::basic_istream` template class instantiations.
  */
 private class StdBasicIStream extends ClassTemplateInstantiation {
-  StdBasicIStream() { this.hasQualifiedName("std", "basic_istream") }
+  StdBasicIStream() { this.hasQualifiedName(["std", "bsl"], "basic_istream") }
 }
 
 /**
@@ -314,7 +307,7 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
  */
 private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
   StdIStreamInNonMember() {
-    this.hasQualifiedName("std", "operator>>") and
+    this.hasQualifiedName(["std", "bsl"], "operator>>") and
     this.getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdBasicIStream
   }
 
@@ -462,7 +455,7 @@ private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
  * The (non-member) function `std::getline`.
  */
 private class StdGetLine extends DataFlowFunction, TaintFunction {
-  StdGetLine() { this.hasQualifiedName("std", "getline") }
+  StdGetLine() { this.hasQualifiedName(["std", "bsl"], "getline") }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // flow from first parameter to return value
@@ -488,7 +481,7 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
  * The `std::basic_ostream` template class instantiations.
  */
 private class StdBasicOStream extends ClassTemplateInstantiation {
-  StdBasicOStream() { this.hasQualifiedName("std", "basic_ostream") }
+  StdBasicOStream() { this.hasQualifiedName(["std", "bsl"], "basic_ostream") }
 }
 
 /**
@@ -535,7 +528,7 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
  */
 private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
   StdOStreamOutNonMember() {
-    this.hasQualifiedName("std", "operator<<") and
+    this.hasQualifiedName(["std", "bsl"], "operator<<") and
     this.getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdBasicOStream
   }
 
@@ -563,6 +556,13 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
   }
 }
 
+/**
+ * The `std::basic_stringstream` template class instantiations.
+ */
+private class StdBasicStringStream extends ClassTemplateInstantiation {
+  StdBasicStringStream() { this.hasQualifiedName(["std", "bsl"], "basic_stringstream") }
+}
+
 /**
  * Additional model for `std::stringstream` constructors that take a string
  * input parameter.
@@ -609,7 +609,7 @@ private class StdStringStreamStr extends TaintFunction {
  * The `std::basic_ios` template class instantiations.
  */
 private class StdBasicIOS extends ClassTemplateInstantiation {
-  StdBasicIOS() { this.hasQualifiedName("std", "basic_ios") }
+  StdBasicIOS() { this.hasQualifiedName(["std", "bsl"], "basic_ios") }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll
index f31d688d010..ee9af547582 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll
@@ -13,7 +13,7 @@ import semmle.code.cpp.models.interfaces.SideEffect
  */
 class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, SideEffectFunction {
   StrcatFunction() {
-    this.hasGlobalOrStdName([
+    this.hasGlobalOrStdOrBslName([
         "strcat", // strcat(dst, src)
         "strncat", // strncat(dst, src, max_amount)
         "wcscat", // wcscat(dst, src)
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
index e01d364c5a7..432fbf999ef 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
@@ -13,7 +13,7 @@ import semmle.code.cpp.models.interfaces.SideEffect
  */
 class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, SideEffectFunction {
   StrcpyFunction() {
-    this.hasGlobalOrStdName([
+    this.hasGlobalOrStdOrBslName([
         "strcpy", // strcpy(dst, src)
         "wcscpy", // wcscpy(dst, src)
         "strncpy", // strncpy(dst, src, max_amount)
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strtok.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strtok.qll
index 659494ef2dd..f2cb6498819 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Strtok.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strtok.qll
@@ -15,7 +15,7 @@ import semmle.code.cpp.models.interfaces.Taint
  */
 private class Strtok extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
   Strtok() {
-    this.hasGlobalOrStdName("strtok") or
+    this.hasGlobalOrStdOrBslName("strtok") or
     this.hasGlobalName(["strtok_r", "_strtok_l", "wcstok", "_wcstok_l", "_mbstok", "_mbstok_l"])
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll
index 285d20b8660..b79f7afe5d9 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll
@@ -9,7 +9,7 @@ import semmle.code.cpp.models.interfaces.Alias
  * ```
  */
 private class Swap extends DataFlowFunction {
-  Swap() { this.hasQualifiedName("std", "swap") }
+  Swap() { this.hasQualifiedName(["std", "bsl"], "swap") }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isParameterDeref(0) and
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll
index c0c95b38756..8c80377c8ec 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll
@@ -1,9 +1,9 @@
 /**
- * Provides a class for modeling functions that return data from potentially untrusted sources. To use
- * this QL library, create a QL class extending `DataFlowFunction` with a
+ * Provides classes for modeling functions that return data from (or send data to) potentially untrusted
+ * sources. To use this QL library, create a QL class extending `DataFlowFunction` with a
  * characteristic predicate that selects the function or set of functions you
  * are modeling. Within that class, override the predicates provided by
- * `RemoteFlowFunction` to match the flow within that function.
+ * `RemoteFlowSourceFunction` or `RemoteFlowSinkFunction` to match the flow within that function.
  */
 
 import cpp
@@ -13,19 +13,42 @@ import semmle.code.cpp.models.Models
 /**
  * A library function that returns data that may be read from a network connection.
  */
-abstract class RemoteFlowFunction extends Function {
+abstract class RemoteFlowSourceFunction extends Function {
   /**
    * Holds if remote data described by `description` flows from `output` of a call to this function.
    */
   abstract predicate hasRemoteFlowSource(FunctionOutput output, string description);
 }
 
+/**
+ * DEPRECATED: Use `RemoteFlowSourceFunction` instead.
+ *
+ * A library function that returns data that may be read from a network connection.
+ */
+deprecated class RemoteFlowFunction = RemoteFlowSourceFunction;
+
 /**
  * A library function that returns data that is directly controlled by a user.
  */
-abstract class LocalFlowFunction extends Function {
+abstract class LocalFlowSourceFunction extends Function {
   /**
    * Holds if data described by `description` flows from `output` of a call to this function.
    */
   abstract predicate hasLocalFlowSource(FunctionOutput output, string description);
 }
+
+/**
+ * DEPRECATED: Use `LocalFlowSourceFunction` instead.
+ *
+ * A library function that returns data that is directly controlled by a user.
+ */
+deprecated class LocalFlowFunction = LocalFlowSourceFunction;
+
+/** A library function that sends data over a network connection. */
+abstract class RemoteFlowSinkFunction extends Function {
+  /**
+   * Holds if data described by `description` flows into `input` to a call to this function, and is then
+   * send over a network connection.
+   */
+  abstract predicate hasRemoteFlowSink(FunctionInput input, string description);
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/FlowSources.qll b/cpp/ql/src/semmle/code/cpp/security/FlowSources.qll
index c8bad67352b..b080651951f 100644
--- a/cpp/ql/src/semmle/code/cpp/security/FlowSources.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/FlowSources.qll
@@ -23,7 +23,7 @@ private class RemoteReturnSource extends RemoteFlowSource {
   string sourceType;
 
   RemoteReturnSource() {
-    exists(RemoteFlowFunction func, CallInstruction instr, FunctionOutput output |
+    exists(RemoteFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getStaticCallTarget() = func and
       func.hasRemoteFlowSource(output, sourceType) and
@@ -42,7 +42,7 @@ private class RemoteParameterSource extends RemoteFlowSource {
   string sourceType;
 
   RemoteParameterSource() {
-    exists(RemoteFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
+    exists(RemoteFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
       func.hasRemoteFlowSource(output, sourceType) and
@@ -57,7 +57,7 @@ private class LocalReturnSource extends LocalFlowSource {
   string sourceType;
 
   LocalReturnSource() {
-    exists(LocalFlowFunction func, CallInstruction instr, FunctionOutput output |
+    exists(LocalFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getStaticCallTarget() = func and
       func.hasLocalFlowSource(output, sourceType) and
@@ -76,7 +76,7 @@ private class LocalParameterSource extends LocalFlowSource {
   string sourceType;
 
   LocalParameterSource() {
-    exists(LocalFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
+    exists(LocalFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
       func.hasLocalFlowSource(output, sourceType) and
@@ -98,3 +98,31 @@ private class ArgvSource extends LocalFlowSource {
 
   override string getSourceType() { result = "a command-line argument" }
 }
+
+/** A remote data flow sink. */
+abstract class RemoteFlowSink extends DataFlow::Node {
+  /** Gets a string that describes the type of this flow sink. */
+  abstract string getSinkType();
+}
+
+private class RemoteParameterSink extends RemoteFlowSink {
+  string sourceType;
+
+  RemoteParameterSink() {
+    exists(RemoteFlowSinkFunction func, FunctionInput input, CallInstruction call, int index |
+      func.hasRemoteFlowSink(input, sourceType) and call.getStaticCallTarget() = func
+    |
+      exists(ReadSideEffectInstruction read |
+        call = read.getPrimaryInstruction() and
+        read.getIndex() = index and
+        this.asOperand() = read.getSideEffectOperand() and
+        input.isParameterDerefOrQualifierObject(index)
+      )
+      or
+      input.isParameterOrQualifierAddress(index) and
+      this.asOperand() = call.getArgumentOperand(index)
+    )
+  }
+
+  override string getSinkType() { result = sourceType }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/Security.qll b/cpp/ql/src/semmle/code/cpp/security/Security.qll
index 16dc89d9a6e..d39c13a25a0 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Security.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Security.qll
@@ -6,6 +6,7 @@
 import semmle.code.cpp.exprs.Expr
 import semmle.code.cpp.commons.Environment
 import semmle.code.cpp.security.SecurityOptions
+import semmle.code.cpp.models.interfaces.FlowSource
 
 /**
  * Extend this class to customize the security queries for
@@ -59,14 +60,14 @@ class SecurityOptions extends string {
       or
       functionCall.getTarget().hasGlobalName(fname) and
       exists(functionCall.getArgument(arg)) and
-      (
-        fname = ["read", "recv", "recvmsg"] and arg = 1
-        or
-        fname = "getaddrinfo" and arg = 3
-        or
-        fname = "recvfrom" and
-        (arg = 1 or arg = 4 or arg = 5)
-      )
+      fname = "getaddrinfo" and
+      arg = 3
+    )
+    or
+    exists(RemoteFlowSourceFunction remote, FunctionOutput output |
+      functionCall.getTarget() = remote and
+      output.isParameterDerefOrQualifierObject(arg) and
+      remote.hasRemoteFlowSource(output, _)
     )
   }
 
@@ -81,6 +82,12 @@ class SecurityOptions extends string {
         userInputReturn(fname)
       )
     )
+    or
+    exists(RemoteFlowSourceFunction remote, FunctionOutput output |
+      functionCall.getTarget() = remote and
+      (output.isReturnValue() or output.isReturnValueDeref()) and
+      remote.hasRemoteFlowSource(output, _)
+    )
   }
 
   /**
diff --git a/cpp/ql/test/README.md b/cpp/ql/test/README.md
index 417d7bbe19d..9de2b10e1b8 100644
--- a/cpp/ql/test/README.md
+++ b/cpp/ql/test/README.md
@@ -1,6 +1,6 @@
 # C/C++ CodeQL tests
 
-This document provides additional information about the C/C++ CodeQL Tests located in `cpp/ql/test`.  See [Contributing to CodeQL](/CONTRIBUTING.md) for general information about contributing to this repository.
+This document provides additional information about the C/C++ CodeQL tests located in `cpp/ql/test`.  The principles under "Copying code", below, also apply to any other C/C++ code in this repository, such as examples linked from query `.qhelp` files in `cpp/ql/src`.  For more general information about contributing to this repository, see [Contributing to CodeQL](/CONTRIBUTING.md).
 
 The tests can be run through Visual Studio Code.  Advanced users may also use the `codeql test run` command.
 
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
index b24efc1dc8e..020a2f90b9e 100644
--- a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
@@ -216,3 +216,46 @@ void test_pointers2()
 	sink(ptr4); // clean
 	sink(*ptr4); // $ MISSING: ast,ir
 }
+
+// --- recv ---
+
+int recv(int s, char* buf, int len, int flags);
+
+void test_recv() {
+	char buffer[1024];
+	recv(0, buffer, sizeof(buffer), 0);
+	sink(buffer); // $ ast,ir
+	sink(*buffer); // $ ast,ir
+}
+
+// --- send and related functions ---
+
+int send(int, const void*, int, int);
+
+void test_send(char* buffer, int length) {
+  send(0, buffer, length, 0); // $ remote
+}
+
+struct iovec {
+  void  *iov_base;
+  unsigned iov_len;
+};
+
+int readv(int, const struct iovec*, int);
+int writev(int, const struct iovec*, int);
+
+void sink(const iovec* iovs);
+void sink(iovec);
+
+int test_readv_and_writev(iovec* iovs) {
+  readv(0, iovs, 16);
+  sink(iovs); // $ast,ir
+  sink(iovs[0]); // $ast MISSING: ir
+  sink(*iovs); // $ast MISSING: ir
+
+  char* p = (char*)iovs[1].iov_base;
+  sink(p); // $ MISSING: ast,ir
+  sink(*p); // $ MISSING: ast,ir
+
+  writev(0, iovs, 16); // $ remote
+}
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.expected b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.ql b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.ql
new file mode 100644
index 00000000000..4fbbe8fa3bf
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.ql
@@ -0,0 +1,20 @@
+/** This tests that we are able to detect remote flow sinks. */
+
+import cpp
+import TestUtilities.InlineExpectationsTest
+import semmle.code.cpp.security.FlowSources
+
+class RemoteFlowSinkTest extends InlineExpectationsTest {
+  RemoteFlowSinkTest() { this = "RemoteFlowSinkTest" }
+
+  override string getARelevantTag() { result = "remote" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "remote" and
+    value = "" and
+    exists(RemoteFlowSink node |
+      location = node.getLocation() and
+      element = node.toString()
+    )
+  }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
index c6528723d22..8cc13f226a9 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
@@ -36,9 +36,6 @@ argHasPostUpdate
 | arrays.cpp:10:8:10:15 | * ... | ArgumentNode is missing PostUpdateNode. |
 | arrays.cpp:16:8:16:13 | access to array | ArgumentNode is missing PostUpdateNode. |
 | arrays.cpp:17:8:17:13 | access to array | ArgumentNode is missing PostUpdateNode. |
-| by_reference.cpp:51:8:51:8 | s | ArgumentNode is missing PostUpdateNode. |
-| by_reference.cpp:57:8:57:8 | s | ArgumentNode is missing PostUpdateNode. |
-| by_reference.cpp:63:8:63:8 | s | ArgumentNode is missing PostUpdateNode. |
 postWithInFlow
 | A.cpp:25:13:25:13 | c [post update] | PostUpdateNode should not be the target of local flow. |
 | A.cpp:27:28:27:28 | c [post update] | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
index 996836a65b4..bd670c38ba5 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
@@ -227,14 +227,18 @@
 | by_reference.cpp:20:23:20:27 | value | AST only |
 | by_reference.cpp:24:19:24:22 | this | AST only |
 | by_reference.cpp:24:25:24:29 | value | AST only |
+| by_reference.cpp:40:12:40:15 | this | AST only |
 | by_reference.cpp:50:3:50:3 | s | AST only |
 | by_reference.cpp:50:17:50:26 | call to user_input | AST only |
+| by_reference.cpp:51:8:51:8 | s | AST only |
 | by_reference.cpp:51:10:51:20 | call to getDirectly | AST only |
 | by_reference.cpp:56:3:56:3 | s | AST only |
 | by_reference.cpp:56:19:56:28 | call to user_input | AST only |
+| by_reference.cpp:57:8:57:8 | s | AST only |
 | by_reference.cpp:57:10:57:22 | call to getIndirectly | AST only |
 | by_reference.cpp:62:3:62:3 | s | AST only |
 | by_reference.cpp:62:25:62:34 | call to user_input | AST only |
+| by_reference.cpp:63:8:63:8 | s | AST only |
 | by_reference.cpp:63:10:63:28 | call to getThroughNonMember | AST only |
 | by_reference.cpp:68:17:68:18 | & ... | AST only |
 | by_reference.cpp:68:21:68:30 | call to user_input | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
index 9b03e4f8039..0a3ea441f93 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
@@ -266,14 +266,18 @@
 | by_reference.cpp:20:23:20:27 | value |
 | by_reference.cpp:24:19:24:22 | this |
 | by_reference.cpp:24:25:24:29 | value |
+| by_reference.cpp:40:12:40:15 | this |
 | by_reference.cpp:50:3:50:3 | s |
 | by_reference.cpp:50:17:50:26 | call to user_input |
+| by_reference.cpp:51:8:51:8 | s |
 | by_reference.cpp:51:10:51:20 | call to getDirectly |
 | by_reference.cpp:56:3:56:3 | s |
 | by_reference.cpp:56:19:56:28 | call to user_input |
+| by_reference.cpp:57:8:57:8 | s |
 | by_reference.cpp:57:10:57:22 | call to getIndirectly |
 | by_reference.cpp:62:3:62:3 | s |
 | by_reference.cpp:62:25:62:34 | call to user_input |
+| by_reference.cpp:63:8:63:8 | s |
 | by_reference.cpp:63:10:63:28 | call to getThroughNonMember |
 | by_reference.cpp:68:17:68:18 | & ... |
 | by_reference.cpp:68:21:68:30 | call to user_input |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp
new file mode 100644
index 00000000000..4846420a5a5
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp
@@ -0,0 +1,24 @@
+void sink(...);
+int source();
+
+// --- accept ---
+
+struct sockaddr {
+	unsigned char length;
+	int sa_family;
+	char* sa_data;
+};
+
+int accept(int, const sockaddr*, int*);
+
+void sink(sockaddr);
+
+void test_accept() {
+  int s = source();
+  sockaddr addr;
+  int size = sizeof(sockaddr);
+  int a = accept(s, &addr, &size);
+
+  sink(a); // $ ast=17:11 SPURIOUS: ast=18:12 MISSING: ir
+  sink(addr); // $ ast MISSING: ir
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 9f038101d67..2b5ce44aca6 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -135,6 +135,17 @@
 | arrayassignment.cpp:145:12:145:12 | 5 | arrayassignment.cpp:145:7:145:13 | access to array | TAINT |
 | arrayassignment.cpp:146:7:146:10 | arr3 | arrayassignment.cpp:146:7:146:13 | access to array |  |
 | arrayassignment.cpp:146:12:146:12 | 5 | arrayassignment.cpp:146:7:146:13 | access to array | TAINT |
+| bsd.cpp:17:11:17:16 | call to source | bsd.cpp:20:18:20:18 | s |  |
+| bsd.cpp:18:12:18:15 | addr | bsd.cpp:20:22:20:25 | addr |  |
+| bsd.cpp:18:12:18:15 | addr | bsd.cpp:23:8:23:11 | addr |  |
+| bsd.cpp:19:14:19:29 | sizeof(sockaddr) | bsd.cpp:20:29:20:32 | size |  |
+| bsd.cpp:20:11:20:16 | call to accept | bsd.cpp:22:8:22:8 | a |  |
+| bsd.cpp:20:18:20:18 | s | bsd.cpp:20:11:20:16 | call to accept | TAINT |
+| bsd.cpp:20:21:20:25 | & ... | bsd.cpp:20:11:20:16 | call to accept | TAINT |
+| bsd.cpp:20:22:20:25 | addr | bsd.cpp:20:11:20:16 | call to accept | TAINT |
+| bsd.cpp:20:22:20:25 | addr | bsd.cpp:20:21:20:25 | & ... |  |
+| bsd.cpp:20:28:20:32 | ref arg & ... | bsd.cpp:20:29:20:32 | size [inner post update] |  |
+| bsd.cpp:20:29:20:32 | size | bsd.cpp:20:28:20:32 | & ... |  |
 | constructor_delegation.cpp:8:2:8:8 | this | constructor_delegation.cpp:8:20:8:24 | constructor init of field x [pre-this] |  |
 | constructor_delegation.cpp:8:14:8:15 | _x | constructor_delegation.cpp:8:22:8:23 | _x |  |
 | constructor_delegation.cpp:8:22:8:23 | _x | constructor_delegation.cpp:8:20:8:24 | constructor init of field x | TAINT |
@@ -796,8 +807,23 @@
 | map.cpp:146:40:146:41 | ref arg i1 | map.cpp:150:8:150:9 | i1 |  |
 | map.cpp:148:8:148:8 | call to operator* | map.cpp:148:8:148:10 | call to pair | TAINT |
 | map.cpp:148:9:148:10 | i1 | map.cpp:148:8:148:8 | call to operator* | TAINT |
+| map.cpp:148:9:148:10 | ref arg i1 | map.cpp:146:24:146:25 | i1 |  |
+| map.cpp:148:9:148:10 | ref arg i1 | map.cpp:146:40:146:41 | i1 |  |
+| map.cpp:148:9:148:10 | ref arg i1 | map.cpp:148:9:148:10 | i1 |  |
+| map.cpp:148:9:148:10 | ref arg i1 | map.cpp:149:8:149:9 | i1 |  |
+| map.cpp:148:9:148:10 | ref arg i1 | map.cpp:150:8:150:9 | i1 |  |
 | map.cpp:149:8:149:9 | i1 | map.cpp:149:10:149:10 | call to operator-> | TAINT |
+| map.cpp:149:8:149:9 | ref arg i1 | map.cpp:146:24:146:25 | i1 |  |
+| map.cpp:149:8:149:9 | ref arg i1 | map.cpp:146:40:146:41 | i1 |  |
+| map.cpp:149:8:149:9 | ref arg i1 | map.cpp:148:9:148:10 | i1 |  |
+| map.cpp:149:8:149:9 | ref arg i1 | map.cpp:149:8:149:9 | i1 |  |
+| map.cpp:149:8:149:9 | ref arg i1 | map.cpp:150:8:150:9 | i1 |  |
 | map.cpp:150:8:150:9 | i1 | map.cpp:150:10:150:10 | call to operator-> | TAINT |
+| map.cpp:150:8:150:9 | ref arg i1 | map.cpp:146:24:146:25 | i1 |  |
+| map.cpp:150:8:150:9 | ref arg i1 | map.cpp:146:40:146:41 | i1 |  |
+| map.cpp:150:8:150:9 | ref arg i1 | map.cpp:148:9:148:10 | i1 |  |
+| map.cpp:150:8:150:9 | ref arg i1 | map.cpp:149:8:149:9 | i1 |  |
+| map.cpp:150:8:150:9 | ref arg i1 | map.cpp:150:8:150:9 | i1 |  |
 | map.cpp:152:12:152:13 | m2 | map.cpp:152:15:152:19 | call to begin | TAINT |
 | map.cpp:152:12:152:13 | ref arg m2 | map.cpp:152:30:152:31 | m2 |  |
 | map.cpp:152:12:152:13 | ref arg m2 | map.cpp:182:7:182:8 | m2 |  |
@@ -830,8 +856,23 @@
 | map.cpp:152:40:152:41 | ref arg i2 | map.cpp:156:8:156:9 | i2 |  |
 | map.cpp:154:8:154:8 | call to operator* | map.cpp:154:8:154:10 | call to pair | TAINT |
 | map.cpp:154:9:154:10 | i2 | map.cpp:154:8:154:8 | call to operator* | TAINT |
+| map.cpp:154:9:154:10 | ref arg i2 | map.cpp:152:24:152:25 | i2 |  |
+| map.cpp:154:9:154:10 | ref arg i2 | map.cpp:152:40:152:41 | i2 |  |
+| map.cpp:154:9:154:10 | ref arg i2 | map.cpp:154:9:154:10 | i2 |  |
+| map.cpp:154:9:154:10 | ref arg i2 | map.cpp:155:8:155:9 | i2 |  |
+| map.cpp:154:9:154:10 | ref arg i2 | map.cpp:156:8:156:9 | i2 |  |
 | map.cpp:155:8:155:9 | i2 | map.cpp:155:10:155:10 | call to operator-> | TAINT |
+| map.cpp:155:8:155:9 | ref arg i2 | map.cpp:152:24:152:25 | i2 |  |
+| map.cpp:155:8:155:9 | ref arg i2 | map.cpp:152:40:152:41 | i2 |  |
+| map.cpp:155:8:155:9 | ref arg i2 | map.cpp:154:9:154:10 | i2 |  |
+| map.cpp:155:8:155:9 | ref arg i2 | map.cpp:155:8:155:9 | i2 |  |
+| map.cpp:155:8:155:9 | ref arg i2 | map.cpp:156:8:156:9 | i2 |  |
 | map.cpp:156:8:156:9 | i2 | map.cpp:156:10:156:10 | call to operator-> | TAINT |
+| map.cpp:156:8:156:9 | ref arg i2 | map.cpp:152:24:152:25 | i2 |  |
+| map.cpp:156:8:156:9 | ref arg i2 | map.cpp:152:40:152:41 | i2 |  |
+| map.cpp:156:8:156:9 | ref arg i2 | map.cpp:154:9:154:10 | i2 |  |
+| map.cpp:156:8:156:9 | ref arg i2 | map.cpp:155:8:155:9 | i2 |  |
+| map.cpp:156:8:156:9 | ref arg i2 | map.cpp:156:8:156:9 | i2 |  |
 | map.cpp:158:12:158:13 | m3 | map.cpp:158:15:158:19 | call to begin | TAINT |
 | map.cpp:158:12:158:13 | ref arg m3 | map.cpp:158:30:158:31 | m3 |  |
 | map.cpp:158:12:158:13 | ref arg m3 | map.cpp:252:1:252:1 | m3 |  |
@@ -852,8 +893,23 @@
 | map.cpp:158:40:158:41 | ref arg i3 | map.cpp:162:8:162:9 | i3 |  |
 | map.cpp:160:8:160:8 | call to operator* | map.cpp:160:8:160:10 | call to pair | TAINT |
 | map.cpp:160:9:160:10 | i3 | map.cpp:160:8:160:8 | call to operator* | TAINT |
+| map.cpp:160:9:160:10 | ref arg i3 | map.cpp:158:24:158:25 | i3 |  |
+| map.cpp:160:9:160:10 | ref arg i3 | map.cpp:158:40:158:41 | i3 |  |
+| map.cpp:160:9:160:10 | ref arg i3 | map.cpp:160:9:160:10 | i3 |  |
+| map.cpp:160:9:160:10 | ref arg i3 | map.cpp:161:8:161:9 | i3 |  |
+| map.cpp:160:9:160:10 | ref arg i3 | map.cpp:162:8:162:9 | i3 |  |
 | map.cpp:161:8:161:9 | i3 | map.cpp:161:10:161:10 | call to operator-> | TAINT |
+| map.cpp:161:8:161:9 | ref arg i3 | map.cpp:158:24:158:25 | i3 |  |
+| map.cpp:161:8:161:9 | ref arg i3 | map.cpp:158:40:158:41 | i3 |  |
+| map.cpp:161:8:161:9 | ref arg i3 | map.cpp:160:9:160:10 | i3 |  |
+| map.cpp:161:8:161:9 | ref arg i3 | map.cpp:161:8:161:9 | i3 |  |
+| map.cpp:161:8:161:9 | ref arg i3 | map.cpp:162:8:162:9 | i3 |  |
 | map.cpp:162:8:162:9 | i3 | map.cpp:162:10:162:10 | call to operator-> | TAINT |
+| map.cpp:162:8:162:9 | ref arg i3 | map.cpp:158:24:158:25 | i3 |  |
+| map.cpp:162:8:162:9 | ref arg i3 | map.cpp:158:40:158:41 | i3 |  |
+| map.cpp:162:8:162:9 | ref arg i3 | map.cpp:160:9:160:10 | i3 |  |
+| map.cpp:162:8:162:9 | ref arg i3 | map.cpp:161:8:161:9 | i3 |  |
+| map.cpp:162:8:162:9 | ref arg i3 | map.cpp:162:8:162:9 | i3 |  |
 | map.cpp:166:27:166:29 | call to map | map.cpp:167:7:167:9 | m10 |  |
 | map.cpp:166:27:166:29 | call to map | map.cpp:171:7:171:9 | m10 |  |
 | map.cpp:166:27:166:29 | call to map | map.cpp:252:1:252:1 | m10 |  |
@@ -1460,8 +1516,23 @@
 | map.cpp:298:40:298:41 | ref arg i1 | map.cpp:302:8:302:9 | i1 |  |
 | map.cpp:300:8:300:8 | call to operator* | map.cpp:300:8:300:10 | call to pair | TAINT |
 | map.cpp:300:9:300:10 | i1 | map.cpp:300:8:300:8 | call to operator* | TAINT |
+| map.cpp:300:9:300:10 | ref arg i1 | map.cpp:298:24:298:25 | i1 |  |
+| map.cpp:300:9:300:10 | ref arg i1 | map.cpp:298:40:298:41 | i1 |  |
+| map.cpp:300:9:300:10 | ref arg i1 | map.cpp:300:9:300:10 | i1 |  |
+| map.cpp:300:9:300:10 | ref arg i1 | map.cpp:301:8:301:9 | i1 |  |
+| map.cpp:300:9:300:10 | ref arg i1 | map.cpp:302:8:302:9 | i1 |  |
 | map.cpp:301:8:301:9 | i1 | map.cpp:301:10:301:10 | call to operator-> | TAINT |
+| map.cpp:301:8:301:9 | ref arg i1 | map.cpp:298:24:298:25 | i1 |  |
+| map.cpp:301:8:301:9 | ref arg i1 | map.cpp:298:40:298:41 | i1 |  |
+| map.cpp:301:8:301:9 | ref arg i1 | map.cpp:300:9:300:10 | i1 |  |
+| map.cpp:301:8:301:9 | ref arg i1 | map.cpp:301:8:301:9 | i1 |  |
+| map.cpp:301:8:301:9 | ref arg i1 | map.cpp:302:8:302:9 | i1 |  |
 | map.cpp:302:8:302:9 | i1 | map.cpp:302:10:302:10 | call to operator-> | TAINT |
+| map.cpp:302:8:302:9 | ref arg i1 | map.cpp:298:24:298:25 | i1 |  |
+| map.cpp:302:8:302:9 | ref arg i1 | map.cpp:298:40:298:41 | i1 |  |
+| map.cpp:302:8:302:9 | ref arg i1 | map.cpp:300:9:300:10 | i1 |  |
+| map.cpp:302:8:302:9 | ref arg i1 | map.cpp:301:8:301:9 | i1 |  |
+| map.cpp:302:8:302:9 | ref arg i1 | map.cpp:302:8:302:9 | i1 |  |
 | map.cpp:304:12:304:13 | m2 | map.cpp:304:15:304:19 | call to begin | TAINT |
 | map.cpp:304:12:304:13 | ref arg m2 | map.cpp:304:30:304:31 | m2 |  |
 | map.cpp:304:12:304:13 | ref arg m2 | map.cpp:334:7:334:8 | m2 |  |
@@ -1488,8 +1559,23 @@
 | map.cpp:304:40:304:41 | ref arg i2 | map.cpp:308:8:308:9 | i2 |  |
 | map.cpp:306:8:306:8 | call to operator* | map.cpp:306:8:306:10 | call to pair | TAINT |
 | map.cpp:306:9:306:10 | i2 | map.cpp:306:8:306:8 | call to operator* | TAINT |
+| map.cpp:306:9:306:10 | ref arg i2 | map.cpp:304:24:304:25 | i2 |  |
+| map.cpp:306:9:306:10 | ref arg i2 | map.cpp:304:40:304:41 | i2 |  |
+| map.cpp:306:9:306:10 | ref arg i2 | map.cpp:306:9:306:10 | i2 |  |
+| map.cpp:306:9:306:10 | ref arg i2 | map.cpp:307:8:307:9 | i2 |  |
+| map.cpp:306:9:306:10 | ref arg i2 | map.cpp:308:8:308:9 | i2 |  |
 | map.cpp:307:8:307:9 | i2 | map.cpp:307:10:307:10 | call to operator-> | TAINT |
+| map.cpp:307:8:307:9 | ref arg i2 | map.cpp:304:24:304:25 | i2 |  |
+| map.cpp:307:8:307:9 | ref arg i2 | map.cpp:304:40:304:41 | i2 |  |
+| map.cpp:307:8:307:9 | ref arg i2 | map.cpp:306:9:306:10 | i2 |  |
+| map.cpp:307:8:307:9 | ref arg i2 | map.cpp:307:8:307:9 | i2 |  |
+| map.cpp:307:8:307:9 | ref arg i2 | map.cpp:308:8:308:9 | i2 |  |
 | map.cpp:308:8:308:9 | i2 | map.cpp:308:10:308:10 | call to operator-> | TAINT |
+| map.cpp:308:8:308:9 | ref arg i2 | map.cpp:304:24:304:25 | i2 |  |
+| map.cpp:308:8:308:9 | ref arg i2 | map.cpp:304:40:304:41 | i2 |  |
+| map.cpp:308:8:308:9 | ref arg i2 | map.cpp:306:9:306:10 | i2 |  |
+| map.cpp:308:8:308:9 | ref arg i2 | map.cpp:307:8:307:9 | i2 |  |
+| map.cpp:308:8:308:9 | ref arg i2 | map.cpp:308:8:308:9 | i2 |  |
 | map.cpp:310:12:310:13 | m3 | map.cpp:310:15:310:19 | call to begin | TAINT |
 | map.cpp:310:12:310:13 | ref arg m3 | map.cpp:310:30:310:31 | m3 |  |
 | map.cpp:310:12:310:13 | ref arg m3 | map.cpp:438:1:438:1 | m3 |  |
@@ -1510,8 +1596,23 @@
 | map.cpp:310:40:310:41 | ref arg i3 | map.cpp:314:8:314:9 | i3 |  |
 | map.cpp:312:8:312:8 | call to operator* | map.cpp:312:8:312:10 | call to pair | TAINT |
 | map.cpp:312:9:312:10 | i3 | map.cpp:312:8:312:8 | call to operator* | TAINT |
+| map.cpp:312:9:312:10 | ref arg i3 | map.cpp:310:24:310:25 | i3 |  |
+| map.cpp:312:9:312:10 | ref arg i3 | map.cpp:310:40:310:41 | i3 |  |
+| map.cpp:312:9:312:10 | ref arg i3 | map.cpp:312:9:312:10 | i3 |  |
+| map.cpp:312:9:312:10 | ref arg i3 | map.cpp:313:8:313:9 | i3 |  |
+| map.cpp:312:9:312:10 | ref arg i3 | map.cpp:314:8:314:9 | i3 |  |
 | map.cpp:313:8:313:9 | i3 | map.cpp:313:10:313:10 | call to operator-> | TAINT |
+| map.cpp:313:8:313:9 | ref arg i3 | map.cpp:310:24:310:25 | i3 |  |
+| map.cpp:313:8:313:9 | ref arg i3 | map.cpp:310:40:310:41 | i3 |  |
+| map.cpp:313:8:313:9 | ref arg i3 | map.cpp:312:9:312:10 | i3 |  |
+| map.cpp:313:8:313:9 | ref arg i3 | map.cpp:313:8:313:9 | i3 |  |
+| map.cpp:313:8:313:9 | ref arg i3 | map.cpp:314:8:314:9 | i3 |  |
 | map.cpp:314:8:314:9 | i3 | map.cpp:314:10:314:10 | call to operator-> | TAINT |
+| map.cpp:314:8:314:9 | ref arg i3 | map.cpp:310:24:310:25 | i3 |  |
+| map.cpp:314:8:314:9 | ref arg i3 | map.cpp:310:40:310:41 | i3 |  |
+| map.cpp:314:8:314:9 | ref arg i3 | map.cpp:312:9:312:10 | i3 |  |
+| map.cpp:314:8:314:9 | ref arg i3 | map.cpp:313:8:313:9 | i3 |  |
+| map.cpp:314:8:314:9 | ref arg i3 | map.cpp:314:8:314:9 | i3 |  |
 | map.cpp:318:37:318:39 | call to unordered_map | map.cpp:319:7:319:9 | m10 |  |
 | map.cpp:318:37:318:39 | call to unordered_map | map.cpp:323:7:323:9 | m10 |  |
 | map.cpp:318:37:318:39 | call to unordered_map | map.cpp:438:1:438:1 | m10 |  |
@@ -2347,6 +2448,9 @@
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
 | set.cpp:55:40:55:41 | ref arg i1 | set.cpp:57:9:57:10 | i1 |  |
 | set.cpp:57:9:57:10 | i1 | set.cpp:57:8:57:8 | call to operator* | TAINT |
+| set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:24:55:25 | i1 |  |
+| set.cpp:57:9:57:10 | ref arg i1 | set.cpp:55:40:55:41 | i1 |  |
+| set.cpp:57:9:57:10 | ref arg i1 | set.cpp:57:9:57:10 | i1 |  |
 | set.cpp:59:12:59:13 | ref arg s2 | set.cpp:59:30:59:31 | s2 |  |
 | set.cpp:59:12:59:13 | ref arg s2 | set.cpp:126:1:126:1 | s2 |  |
 | set.cpp:59:12:59:13 | s2 | set.cpp:59:15:59:19 | call to begin | TAINT |
@@ -2362,6 +2466,9 @@
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
 | set.cpp:59:40:59:41 | ref arg i2 | set.cpp:61:9:61:10 | i2 |  |
 | set.cpp:61:9:61:10 | i2 | set.cpp:61:8:61:8 | call to operator* | TAINT |
+| set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:24:59:25 | i2 |  |
+| set.cpp:61:9:61:10 | ref arg i2 | set.cpp:59:40:59:41 | i2 |  |
+| set.cpp:61:9:61:10 | ref arg i2 | set.cpp:61:9:61:10 | i2 |  |
 | set.cpp:65:19:65:21 | call to set | set.cpp:66:2:66:4 | s11 |  |
 | set.cpp:65:19:65:21 | call to set | set.cpp:67:2:67:4 | s11 |  |
 | set.cpp:65:19:65:21 | call to set | set.cpp:68:2:68:4 | s11 |  |
@@ -2845,6 +2952,9 @@
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
 | set.cpp:169:40:169:41 | ref arg i1 | set.cpp:171:9:171:10 | i1 |  |
 | set.cpp:171:9:171:10 | i1 | set.cpp:171:8:171:8 | call to operator* | TAINT |
+| set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:24:169:25 | i1 |  |
+| set.cpp:171:9:171:10 | ref arg i1 | set.cpp:169:40:169:41 | i1 |  |
+| set.cpp:171:9:171:10 | ref arg i1 | set.cpp:171:9:171:10 | i1 |  |
 | set.cpp:173:12:173:13 | ref arg s2 | set.cpp:173:30:173:31 | s2 |  |
 | set.cpp:173:12:173:13 | ref arg s2 | set.cpp:238:1:238:1 | s2 |  |
 | set.cpp:173:12:173:13 | s2 | set.cpp:173:15:173:19 | call to begin | TAINT |
@@ -2860,6 +2970,9 @@
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
 | set.cpp:173:40:173:41 | ref arg i2 | set.cpp:175:9:175:10 | i2 |  |
 | set.cpp:175:9:175:10 | i2 | set.cpp:175:8:175:8 | call to operator* | TAINT |
+| set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:24:173:25 | i2 |  |
+| set.cpp:175:9:175:10 | ref arg i2 | set.cpp:173:40:173:41 | i2 |  |
+| set.cpp:175:9:175:10 | ref arg i2 | set.cpp:175:9:175:10 | i2 |  |
 | set.cpp:179:29:179:31 | call to unordered_set | set.cpp:180:2:180:4 | s11 |  |
 | set.cpp:179:29:179:31 | call to unordered_set | set.cpp:181:2:181:4 | s11 |  |
 | set.cpp:179:29:179:31 | call to unordered_set | set.cpp:182:2:182:4 | s11 |  |
@@ -3111,21 +3224,27 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
 | smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
+| smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:11:18:11 | p | smart_pointer.cpp:18:10:18:10 | call to operator* | TAINT |
+| smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
 | smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
+| smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:11:30:11 | p | smart_pointer.cpp:30:10:30:10 | call to operator* | TAINT |
+| smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:37:6:37:6 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
 | smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
+| smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
+| smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:10:37:15 | call to source | smart_pointer.cpp:37:5:37:17 | ... = ... |  |
 | smart_pointer.cpp:38:10:38:10 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* | TAINT |
@@ -3134,6 +3253,8 @@
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
 | smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
+| smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
+| smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:10:45:15 | call to source | smart_pointer.cpp:45:5:45:17 | ... = ... |  |
 | smart_pointer.cpp:46:10:46:10 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* | TAINT |
@@ -3147,6 +3268,7 @@
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:67:10:67:10 | p |  |
 | smart_pointer.cpp:65:48:65:53 | call to source | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
 | smart_pointer.cpp:65:58:65:58 | 0 | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
+| smart_pointer.cpp:66:10:66:10 | ref arg p | smart_pointer.cpp:67:10:67:10 | p |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:39:45:39:51 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:40:11:40:17 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:41:12:41:18 | source1 |  |
@@ -3197,6 +3319,56 @@
 | standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
 | standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 |  |
 | standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
+| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 |  |
+| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 |  |
+| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:106:6:106:7 | c1 |  |
+| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:101:6:101:7 | c1 | standalone_iterators.cpp:101:9:101:13 | call to begin | TAINT |
+| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:102:6:102:7 | c1 |  |
+| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:106:6:106:7 | c1 |  |
+| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:101:2:101:15 | ... = ... |  |
+| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:103:3:103:3 | a |  |
+| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:104:7:104:7 | a |  |
+| standalone_iterators.cpp:102:6:102:7 | c1 | standalone_iterators.cpp:102:9:102:13 | call to begin | TAINT |
+| standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:106:6:106:7 | c1 |  |
+| standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... |  |
+| standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b |  |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 |  |
+| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
+| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a |  |
+| standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
+| standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 |  |
+| standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:106:6:106:7 | c1 | standalone_iterators.cpp:106:9:106:13 | call to begin | TAINT |
+| standalone_iterators.cpp:106:6:106:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:106:9:106:13 | call to begin | standalone_iterators.cpp:106:2:106:15 | ... = ... |  |
+| standalone_iterators.cpp:106:9:106:13 | call to begin | standalone_iterators.cpp:108:7:108:7 | c |  |
+| standalone_iterators.cpp:107:7:107:7 | b [post update] | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:108:7:108:7 | c [post update] | standalone_iterators.cpp:109:7:109:8 | c1 |  |
+| standalone_iterators.cpp:113:15:113:16 | call to container | standalone_iterators.cpp:116:7:116:8 | c1 |  |
+| standalone_iterators.cpp:113:15:113:16 | call to container | standalone_iterators.cpp:122:7:122:8 | c1 |  |
+| standalone_iterators.cpp:116:7:116:8 | c1 | standalone_iterators.cpp:116:10:116:14 | call to begin | TAINT |
+| standalone_iterators.cpp:116:7:116:8 | ref arg c1 | standalone_iterators.cpp:122:7:122:8 | c1 |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:116:2:116:16 | ... = ... |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:117:7:117:8 | it |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:118:2:118:3 | it |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:119:7:119:8 | it |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:120:2:120:3 | it |  |
+| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:121:7:121:8 | it |  |
+| standalone_iterators.cpp:117:7:117:8 | it [post update] | standalone_iterators.cpp:122:7:122:8 | c1 |  |
+| standalone_iterators.cpp:118:2:118:3 | it | standalone_iterators.cpp:118:5:118:5 | call to operator+= |  |
+| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:119:7:119:8 | it |  |
+| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:120:2:120:3 | it |  |
+| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it |  |
+| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:122:7:122:8 | c1 |  |
+| standalone_iterators.cpp:118:8:118:8 | 1 | standalone_iterators.cpp:118:2:118:3 | ref arg it | TAINT |
+| standalone_iterators.cpp:120:2:120:3 | it | standalone_iterators.cpp:120:5:120:5 | call to operator+= |  |
+| standalone_iterators.cpp:120:2:120:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it |  |
+| standalone_iterators.cpp:120:8:120:13 | call to source | standalone_iterators.cpp:120:2:120:3 | ref arg it | TAINT |
 | stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
 | stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
 | stl.h:75:8:75:8 | this | stl.h:75:8:75:8 | constructor init of field container [pre-this] |  |
@@ -3408,6 +3580,9 @@
 | string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
 | string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
 | string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
+| string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
+| string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
+| string.cpp:121:15:121:15 | ref arg (__begin) | string.cpp:121:15:121:15 | (__begin) |  |
 | string.cpp:121:15:121:15 | ref arg (__range) | string.cpp:121:15:121:15 | (__range) |  |
 | string.cpp:121:15:121:15 | s | string.cpp:121:15:121:15 | (__range) |  |
 | string.cpp:121:15:121:15 | s | string.cpp:121:15:121:15 | (__range) |  |
@@ -3426,6 +3601,9 @@
 | string.cpp:125:61:125:62 | ref arg it | string.cpp:125:61:125:62 | it |  |
 | string.cpp:125:61:125:62 | ref arg it | string.cpp:126:9:126:10 | it |  |
 | string.cpp:126:9:126:10 | it | string.cpp:126:8:126:8 | call to operator* | TAINT |
+| string.cpp:126:9:126:10 | ref arg it | string.cpp:125:44:125:45 | it |  |
+| string.cpp:126:9:126:10 | ref arg it | string.cpp:125:61:125:62 | it |  |
+| string.cpp:126:9:126:10 | ref arg it | string.cpp:126:9:126:10 | it |  |
 | string.cpp:129:16:129:16 | (__begin) | string.cpp:129:16:129:16 | call to operator* | TAINT |
 | string.cpp:129:16:129:16 | (__begin) | string.cpp:129:16:129:16 | call to operator++ |  |
 | string.cpp:129:16:129:16 | (__end) | string.cpp:129:16:129:16 | call to iterator |  |
@@ -3439,6 +3617,9 @@
 | string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
 | string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
 | string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
+| string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
+| string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
+| string.cpp:129:16:129:16 | ref arg (__begin) | string.cpp:129:16:129:16 | (__begin) |  |
 | string.cpp:129:16:129:16 | ref arg (__range) | string.cpp:129:16:129:16 | (__range) |  |
 | string.cpp:129:16:129:16 | s | string.cpp:129:16:129:16 | (__range) |  |
 | string.cpp:129:16:129:16 | s | string.cpp:129:16:129:16 | (__range) |  |
@@ -3807,11 +3988,13 @@
 | string.cpp:376:31:376:35 | call to begin | string.cpp:378:9:378:13 | iter1 |  |
 | string.cpp:376:31:376:35 | call to begin | string.cpp:379:8:379:12 | iter1 |  |
 | string.cpp:378:9:378:13 | iter1 | string.cpp:378:8:378:8 | call to operator* | TAINT |
+| string.cpp:378:9:378:13 | ref arg iter1 | string.cpp:379:8:379:12 | iter1 |  |
 | string.cpp:379:8:379:12 | iter1 | string.cpp:379:13:379:13 | call to operator[] | TAINT |
 | string.cpp:380:28:380:29 | s2 | string.cpp:380:31:380:35 | call to begin | TAINT |
 | string.cpp:380:31:380:35 | call to begin | string.cpp:382:9:382:13 | iter2 |  |
 | string.cpp:380:31:380:35 | call to begin | string.cpp:383:8:383:12 | iter2 |  |
 | string.cpp:382:9:382:13 | iter2 | string.cpp:382:8:382:8 | call to operator* | TAINT |
+| string.cpp:382:9:382:13 | ref arg iter2 | string.cpp:383:8:383:12 | iter2 |  |
 | string.cpp:383:8:383:12 | iter2 | string.cpp:383:13:383:13 | call to operator[] | TAINT |
 | string.cpp:388:18:388:24 | hello | string.cpp:388:18:388:25 | call to basic_string | TAINT |
 | string.cpp:388:18:388:25 | call to basic_string | string.cpp:391:25:391:26 | s1 |  |
@@ -3855,10 +4038,12 @@
 | string.cpp:398:8:398:9 | i2 | string.cpp:398:3:398:9 | ... = ... |  |
 | string.cpp:398:8:398:9 | i2 | string.cpp:399:12:399:13 | i3 |  |
 | string.cpp:399:10:399:10 | call to operator++ | string.cpp:399:8:399:8 | call to operator* | TAINT |
+| string.cpp:399:10:399:10 | ref arg call to operator++ | string.cpp:399:12:399:13 | ref arg i3 |  |
 | string.cpp:399:12:399:13 | i3 | string.cpp:399:10:399:10 | call to operator++ |  |
 | string.cpp:400:8:400:9 | i2 | string.cpp:400:3:400:9 | ... = ... |  |
 | string.cpp:400:8:400:9 | i2 | string.cpp:401:12:401:13 | i4 |  |
 | string.cpp:401:10:401:10 | call to operator-- | string.cpp:401:8:401:8 | call to operator* | TAINT |
+| string.cpp:401:10:401:10 | ref arg call to operator-- | string.cpp:401:12:401:13 | ref arg i4 |  |
 | string.cpp:401:12:401:13 | i4 | string.cpp:401:10:401:10 | call to operator-- |  |
 | string.cpp:402:8:402:9 | i2 | string.cpp:402:3:402:9 | ... = ... |  |
 | string.cpp:402:8:402:9 | i2 | string.cpp:403:3:403:4 | i5 |  |
@@ -3876,12 +4061,14 @@
 | string.cpp:408:8:408:9 | i2 | string.cpp:409:10:409:11 | i7 |  |
 | string.cpp:409:10:409:11 | i7 | string.cpp:409:12:409:12 | call to operator+= |  |
 | string.cpp:409:12:409:12 | call to operator+= | string.cpp:409:8:409:8 | call to operator* | TAINT |
-| string.cpp:409:14:409:14 | 1 | string.cpp:409:12:409:12 | call to operator+= |  |
+| string.cpp:409:12:409:12 | ref arg call to operator+= | string.cpp:409:10:409:11 | ref arg i7 | TAINT |
+| string.cpp:409:14:409:14 | 1 | string.cpp:409:10:409:11 | ref arg i7 | TAINT |
 | string.cpp:410:8:410:9 | i2 | string.cpp:410:3:410:9 | ... = ... |  |
 | string.cpp:410:8:410:9 | i2 | string.cpp:411:10:411:11 | i8 |  |
 | string.cpp:411:10:411:11 | i8 | string.cpp:411:12:411:12 | call to operator-= |  |
 | string.cpp:411:12:411:12 | call to operator-= | string.cpp:411:8:411:8 | call to operator* | TAINT |
-| string.cpp:411:14:411:14 | 1 | string.cpp:411:12:411:12 | call to operator-= |  |
+| string.cpp:411:12:411:12 | ref arg call to operator-= | string.cpp:411:10:411:11 | ref arg i8 | TAINT |
+| string.cpp:411:14:411:14 | 1 | string.cpp:411:10:411:11 | ref arg i8 | TAINT |
 | string.cpp:413:8:413:9 | s2 | string.cpp:413:11:413:13 | call to end | TAINT |
 | string.cpp:413:11:413:13 | call to end | string.cpp:413:3:413:15 | ... = ... |  |
 | string.cpp:413:11:413:13 | call to end | string.cpp:414:5:414:6 | i9 |  |
@@ -6042,6 +6229,22 @@
 | taint.cpp:631:6:631:14 | call to _strnextc | taint.cpp:631:2:631:18 | ... = ... |  |
 | taint.cpp:631:6:631:14 | call to _strnextc | taint.cpp:632:7:632:7 | c |  |
 | taint.cpp:631:16:631:17 |  | taint.cpp:631:6:631:14 | call to _strnextc | TAINT |
+| taint.cpp:640:9:640:12 | this | taint.cpp:640:25:640:29 | this |  |
+| taint.cpp:643:33:643:38 | source | taint.cpp:645:20:645:25 | source |  |
+| taint.cpp:644:30:644:30 | c | taint.cpp:645:10:645:10 | c |  |
+| taint.cpp:644:30:644:30 | c | taint.cpp:646:8:646:8 | c |  |
+| taint.cpp:645:10:645:10 | ref arg c | taint.cpp:646:8:646:8 | c |  |
+| taint.cpp:645:12:645:15 | call to data | taint.cpp:645:3:645:8 | call to memcpy |  |
+| taint.cpp:645:20:645:25 | source | taint.cpp:645:3:645:8 | call to memcpy | TAINT |
+| taint.cpp:645:20:645:25 | source | taint.cpp:645:12:645:15 | ref arg call to data | TAINT |
+| taint.cpp:652:9:652:12 | this | taint.cpp:652:31:652:35 | this |  |
+| taint.cpp:655:35:655:40 | source | taint.cpp:657:20:657:25 | source |  |
+| taint.cpp:656:27:656:27 | c | taint.cpp:657:10:657:10 | c |  |
+| taint.cpp:656:27:656:27 | c | taint.cpp:658:8:658:8 | c |  |
+| taint.cpp:657:10:657:10 | ref arg c | taint.cpp:658:8:658:8 | c |  |
+| taint.cpp:657:12:657:15 | call to data | taint.cpp:657:3:657:8 | call to memcpy |  |
+| taint.cpp:657:20:657:25 | source | taint.cpp:657:3:657:8 | call to memcpy | TAINT |
+| taint.cpp:657:20:657:25 | source | taint.cpp:657:12:657:15 | ref arg call to data | TAINT |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 |  |
 | vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v |  |
@@ -6063,6 +6266,9 @@
 | vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
 | vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
 | vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
+| vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
+| vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
+| vector.cpp:19:14:19:14 | ref arg (__begin) | vector.cpp:19:14:19:14 | (__begin) |  |
 | vector.cpp:19:14:19:14 | ref arg (__range) | vector.cpp:19:14:19:14 | (__range) |  |
 | vector.cpp:19:14:19:14 | v | vector.cpp:19:14:19:14 | (__range) |  |
 | vector.cpp:19:14:19:14 | v | vector.cpp:19:14:19:14 | (__range) |  |
@@ -6083,6 +6289,9 @@
 | vector.cpp:23:66:23:67 | ref arg it | vector.cpp:23:66:23:67 | it |  |
 | vector.cpp:23:66:23:67 | ref arg it | vector.cpp:24:9:24:10 | it |  |
 | vector.cpp:24:9:24:10 | it | vector.cpp:24:8:24:8 | call to operator* | TAINT |
+| vector.cpp:24:9:24:10 | ref arg it | vector.cpp:23:49:23:50 | it |  |
+| vector.cpp:24:9:24:10 | ref arg it | vector.cpp:23:66:23:67 | it |  |
+| vector.cpp:24:9:24:10 | ref arg it | vector.cpp:24:9:24:10 | it |  |
 | vector.cpp:27:15:27:15 | (__begin) | vector.cpp:27:15:27:15 | call to operator* | TAINT |
 | vector.cpp:27:15:27:15 | (__begin) | vector.cpp:27:15:27:15 | call to operator++ |  |
 | vector.cpp:27:15:27:15 | (__end) | vector.cpp:27:15:27:15 | call to iterator |  |
@@ -6096,6 +6305,9 @@
 | vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
 | vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
 | vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
+| vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
+| vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
+| vector.cpp:27:15:27:15 | ref arg (__begin) | vector.cpp:27:15:27:15 | (__begin) |  |
 | vector.cpp:27:15:27:15 | ref arg (__range) | vector.cpp:27:15:27:15 | (__range) |  |
 | vector.cpp:27:15:27:15 | v | vector.cpp:27:15:27:15 | (__range) |  |
 | vector.cpp:27:15:27:15 | v | vector.cpp:27:15:27:15 | (__range) |  |
@@ -7019,16 +7231,20 @@
 | vector.cpp:329:62:329:65 | iter | vector.cpp:329:62:329:65 | iter |  |
 | vector.cpp:329:62:329:65 | iter | vector.cpp:330:3:330:6 | iter |  |
 | vector.cpp:330:2:330:2 | call to operator* [post update] | vector.cpp:329:62:329:65 | iter |  |
+| vector.cpp:330:2:330:2 | call to operator* [post update] | vector.cpp:330:3:330:6 | ref arg iter | TAINT |
 | vector.cpp:330:2:330:17 | ... = ... | vector.cpp:330:2:330:2 | call to operator* [post update] |  |
 | vector.cpp:330:3:330:6 | iter | vector.cpp:330:2:330:2 | call to operator* | TAINT |
+| vector.cpp:330:3:330:6 | ref arg iter | vector.cpp:329:62:329:65 | iter |  |
 | vector.cpp:330:10:330:15 | call to source | vector.cpp:330:2:330:2 | call to operator* [post update] | TAINT |
 | vector.cpp:330:10:330:15 | call to source | vector.cpp:330:2:330:17 | ... = ... |  |
 | vector.cpp:333:64:333:67 | iter | vector.cpp:333:64:333:67 | iter |  |
 | vector.cpp:333:64:333:67 | iter | vector.cpp:334:3:334:6 | iter |  |
 | vector.cpp:333:74:333:74 | i | vector.cpp:334:10:334:10 | i |  |
 | vector.cpp:334:2:334:2 | call to operator* [post update] | vector.cpp:333:64:333:67 | iter |  |
+| vector.cpp:334:2:334:2 | call to operator* [post update] | vector.cpp:334:3:334:6 | ref arg iter | TAINT |
 | vector.cpp:334:2:334:10 | ... = ... | vector.cpp:334:2:334:2 | call to operator* [post update] |  |
 | vector.cpp:334:3:334:6 | iter | vector.cpp:334:2:334:2 | call to operator* | TAINT |
+| vector.cpp:334:3:334:6 | ref arg iter | vector.cpp:333:64:333:67 | iter |  |
 | vector.cpp:334:10:334:10 | i | vector.cpp:334:2:334:2 | call to operator* [post update] | TAINT |
 | vector.cpp:334:10:334:10 | i | vector.cpp:334:2:334:10 | ... = ... |  |
 | vector.cpp:337:38:337:38 | b | vector.cpp:372:5:372:5 | b |  |
@@ -7086,6 +7302,7 @@
 | vector.cpp:340:34:340:35 | ref arg v1 | vector.cpp:415:1:415:1 | v1 |  |
 | vector.cpp:340:34:340:35 | v1 | vector.cpp:340:37:340:41 | call to begin | TAINT |
 | vector.cpp:340:37:340:41 | call to begin | vector.cpp:341:3:341:4 | i1 |  |
+| vector.cpp:341:2:341:2 | call to operator* [post update] | vector.cpp:341:3:341:4 | ref arg i1 | TAINT |
 | vector.cpp:341:2:341:2 | call to operator* [post update] | vector.cpp:342:7:342:8 | v1 |  |
 | vector.cpp:341:2:341:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v1 |  |
 | vector.cpp:341:2:341:15 | ... = ... | vector.cpp:341:2:341:2 | call to operator* [post update] |  |
@@ -7109,10 +7326,14 @@
 | vector.cpp:344:68:344:69 | ref arg it | vector.cpp:344:68:344:69 | it |  |
 | vector.cpp:344:68:344:69 | ref arg it | vector.cpp:345:4:345:5 | it |  |
 | vector.cpp:345:3:345:3 | call to operator* [post update] | vector.cpp:344:56:344:57 | v2 |  |
+| vector.cpp:345:3:345:3 | call to operator* [post update] | vector.cpp:345:4:345:5 | ref arg it | TAINT |
 | vector.cpp:345:3:345:3 | call to operator* [post update] | vector.cpp:347:7:347:8 | v2 |  |
 | vector.cpp:345:3:345:3 | call to operator* [post update] | vector.cpp:415:1:415:1 | v2 |  |
 | vector.cpp:345:3:345:16 | ... = ... | vector.cpp:345:3:345:3 | call to operator* [post update] |  |
 | vector.cpp:345:4:345:5 | it | vector.cpp:345:3:345:3 | call to operator* | TAINT |
+| vector.cpp:345:4:345:5 | ref arg it | vector.cpp:344:50:344:51 | it |  |
+| vector.cpp:345:4:345:5 | ref arg it | vector.cpp:344:68:344:69 | it |  |
+| vector.cpp:345:4:345:5 | ref arg it | vector.cpp:345:4:345:5 | it |  |
 | vector.cpp:345:9:345:14 | call to source | vector.cpp:345:3:345:3 | call to operator* [post update] | TAINT |
 | vector.cpp:345:9:345:14 | call to source | vector.cpp:345:3:345:16 | ... = ... |  |
 | vector.cpp:347:7:347:8 | ref arg v2 | vector.cpp:415:1:415:1 | v2 |  |
@@ -7128,6 +7349,9 @@
 | vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
 | vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
 | vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
+| vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
+| vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
+| vector.cpp:349:15:349:15 | ref arg (__begin) | vector.cpp:349:15:349:15 | (__begin) |  |
 | vector.cpp:349:15:349:15 | ref arg (__range) | vector.cpp:349:15:349:15 | (__range) |  |
 | vector.cpp:349:15:349:16 | v3 | vector.cpp:349:15:349:15 | (__range) |  |
 | vector.cpp:349:15:349:16 | v3 | vector.cpp:349:15:349:15 | (__range) |  |
@@ -7164,15 +7388,18 @@
 | vector.cpp:359:34:359:35 | v5 | vector.cpp:359:37:359:41 | call to begin | TAINT |
 | vector.cpp:359:37:359:41 | call to begin | vector.cpp:360:3:360:4 | i5 |  |
 | vector.cpp:359:37:359:41 | call to begin | vector.cpp:362:3:362:4 | i5 |  |
+| vector.cpp:360:2:360:2 | call to operator* [post update] | vector.cpp:360:3:360:4 | ref arg i5 | TAINT |
 | vector.cpp:360:2:360:2 | call to operator* [post update] | vector.cpp:361:7:361:8 | v5 |  |
 | vector.cpp:360:2:360:2 | call to operator* [post update] | vector.cpp:363:7:363:8 | v5 |  |
 | vector.cpp:360:2:360:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v5 |  |
 | vector.cpp:360:2:360:15 | ... = ... | vector.cpp:360:2:360:2 | call to operator* [post update] |  |
 | vector.cpp:360:3:360:4 | i5 | vector.cpp:360:2:360:2 | call to operator* | TAINT |
+| vector.cpp:360:3:360:4 | ref arg i5 | vector.cpp:362:3:362:4 | i5 |  |
 | vector.cpp:360:8:360:13 | call to source | vector.cpp:360:2:360:2 | call to operator* [post update] | TAINT |
 | vector.cpp:360:8:360:13 | call to source | vector.cpp:360:2:360:15 | ... = ... |  |
 | vector.cpp:361:7:361:8 | ref arg v5 | vector.cpp:363:7:363:8 | v5 |  |
 | vector.cpp:361:7:361:8 | ref arg v5 | vector.cpp:415:1:415:1 | v5 |  |
+| vector.cpp:362:2:362:2 | call to operator* [post update] | vector.cpp:362:3:362:4 | ref arg i5 | TAINT |
 | vector.cpp:362:2:362:2 | call to operator* [post update] | vector.cpp:363:7:363:8 | v5 |  |
 | vector.cpp:362:2:362:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v5 |  |
 | vector.cpp:362:2:362:8 | ... = ... | vector.cpp:362:2:362:2 | call to operator* [post update] |  |
@@ -7186,6 +7413,7 @@
 | vector.cpp:365:34:365:35 | ref arg v6 | vector.cpp:415:1:415:1 | v6 |  |
 | vector.cpp:365:34:365:35 | v6 | vector.cpp:365:37:365:41 | call to begin | TAINT |
 | vector.cpp:365:37:365:41 | call to begin | vector.cpp:366:3:366:4 | i6 |  |
+| vector.cpp:366:2:366:2 | call to operator* [post update] | vector.cpp:366:3:366:4 | ref arg i6 | TAINT |
 | vector.cpp:366:2:366:2 | call to operator* [post update] | vector.cpp:367:7:367:8 | v6 |  |
 | vector.cpp:366:2:366:2 | call to operator* [post update] | vector.cpp:368:2:368:3 | v6 |  |
 | vector.cpp:366:2:366:2 | call to operator* [post update] | vector.cpp:369:7:369:8 | v6 |  |
@@ -7209,6 +7437,7 @@
 | vector.cpp:371:34:371:35 | v7 | vector.cpp:371:37:371:41 | call to begin | TAINT |
 | vector.cpp:371:37:371:41 | call to begin | vector.cpp:373:4:373:5 | i7 |  |
 | vector.cpp:371:37:371:41 | call to begin | vector.cpp:376:4:376:5 | i7 |  |
+| vector.cpp:373:3:373:3 | call to operator* [post update] | vector.cpp:373:4:373:5 | ref arg i7 | TAINT |
 | vector.cpp:373:3:373:3 | call to operator* [post update] | vector.cpp:374:8:374:9 | v7 |  |
 | vector.cpp:373:3:373:3 | call to operator* [post update] | vector.cpp:379:7:379:8 | v7 |  |
 | vector.cpp:373:3:373:3 | call to operator* [post update] | vector.cpp:415:1:415:1 | v7 |  |
@@ -7218,6 +7447,7 @@
 | vector.cpp:373:9:373:14 | call to source | vector.cpp:373:3:373:16 | ... = ... |  |
 | vector.cpp:374:8:374:9 | ref arg v7 | vector.cpp:379:7:379:8 | v7 |  |
 | vector.cpp:374:8:374:9 | ref arg v7 | vector.cpp:415:1:415:1 | v7 |  |
+| vector.cpp:376:3:376:3 | call to operator* [post update] | vector.cpp:376:4:376:5 | ref arg i7 | TAINT |
 | vector.cpp:376:3:376:3 | call to operator* [post update] | vector.cpp:377:8:377:9 | v7 |  |
 | vector.cpp:376:3:376:3 | call to operator* [post update] | vector.cpp:379:7:379:8 | v7 |  |
 | vector.cpp:376:3:376:3 | call to operator* [post update] | vector.cpp:415:1:415:1 | v7 |  |
@@ -7234,15 +7464,18 @@
 | vector.cpp:381:34:381:35 | v8 | vector.cpp:381:37:381:41 | call to begin | TAINT |
 | vector.cpp:381:37:381:41 | call to begin | vector.cpp:382:3:382:4 | i8 |  |
 | vector.cpp:381:37:381:41 | call to begin | vector.cpp:384:3:384:4 | i8 |  |
+| vector.cpp:382:2:382:2 | call to operator* [post update] | vector.cpp:382:3:382:4 | ref arg i8 | TAINT |
 | vector.cpp:382:2:382:2 | call to operator* [post update] | vector.cpp:383:7:383:8 | v8 |  |
 | vector.cpp:382:2:382:2 | call to operator* [post update] | vector.cpp:385:7:385:8 | v8 |  |
 | vector.cpp:382:2:382:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v8 |  |
 | vector.cpp:382:2:382:15 | ... = ... | vector.cpp:382:2:382:2 | call to operator* [post update] |  |
 | vector.cpp:382:3:382:4 | i8 | vector.cpp:382:2:382:2 | call to operator* | TAINT |
+| vector.cpp:382:3:382:4 | ref arg i8 | vector.cpp:384:3:384:4 | i8 |  |
 | vector.cpp:382:8:382:13 | call to source | vector.cpp:382:2:382:2 | call to operator* [post update] | TAINT |
 | vector.cpp:382:8:382:13 | call to source | vector.cpp:382:2:382:15 | ... = ... |  |
 | vector.cpp:383:7:383:8 | ref arg v8 | vector.cpp:385:7:385:8 | v8 |  |
 | vector.cpp:383:7:383:8 | ref arg v8 | vector.cpp:415:1:415:1 | v8 |  |
+| vector.cpp:384:2:384:2 | call to operator* [post update] | vector.cpp:384:3:384:4 | ref arg i8 | TAINT |
 | vector.cpp:384:2:384:2 | call to operator* [post update] | vector.cpp:385:7:385:8 | v8 |  |
 | vector.cpp:384:2:384:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v8 |  |
 | vector.cpp:384:2:384:8 | ... = ... | vector.cpp:384:2:384:2 | call to operator* [post update] |  |
@@ -7255,10 +7488,12 @@
 | vector.cpp:387:34:387:35 | v9 | vector.cpp:387:37:387:41 | call to begin | TAINT |
 | vector.cpp:387:37:387:41 | call to begin | vector.cpp:389:3:389:4 | i9 |  |
 | vector.cpp:387:37:387:41 | call to begin | vector.cpp:390:31:390:32 | i9 |  |
+| vector.cpp:389:2:389:2 | call to operator* [post update] | vector.cpp:389:3:389:4 | ref arg i9 | TAINT |
 | vector.cpp:389:2:389:2 | call to operator* [post update] | vector.cpp:392:7:392:8 | v9 |  |
 | vector.cpp:389:2:389:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v9 |  |
 | vector.cpp:389:2:389:15 | ... = ... | vector.cpp:389:2:389:2 | call to operator* [post update] |  |
 | vector.cpp:389:3:389:4 | i9 | vector.cpp:389:2:389:2 | call to operator* | TAINT |
+| vector.cpp:389:3:389:4 | ref arg i9 | vector.cpp:390:31:390:32 | i9 |  |
 | vector.cpp:389:8:389:13 | call to source | vector.cpp:389:2:389:2 | call to operator* [post update] | TAINT |
 | vector.cpp:389:8:389:13 | call to source | vector.cpp:389:2:389:15 | ... = ... |  |
 | vector.cpp:390:31:390:32 | call to iterator [post update] | vector.cpp:392:7:392:8 | v9 |  |
@@ -7300,6 +7535,7 @@
 | vector.cpp:403:6:403:6 | call to operator++ | vector.cpp:403:2:403:2 | call to operator* | TAINT |
 | vector.cpp:403:11:403:11 | 0 | vector.cpp:403:2:403:2 | call to operator* [post update] | TAINT |
 | vector.cpp:403:11:403:11 | 0 | vector.cpp:403:2:403:11 | ... = ... |  |
+| vector.cpp:404:2:404:2 | call to operator* [post update] | vector.cpp:404:3:404:5 | ref arg i12 | TAINT |
 | vector.cpp:404:2:404:2 | call to operator* [post update] | vector.cpp:405:7:405:9 | v12 |  |
 | vector.cpp:404:2:404:2 | call to operator* [post update] | vector.cpp:415:1:415:1 | v12 |  |
 | vector.cpp:404:2:404:16 | ... = ... | vector.cpp:404:2:404:2 | call to operator* [post update] |  |
@@ -7481,3 +7717,70 @@
 | vector.cpp:496:25:496:30 | call to source | vector.cpp:496:2:496:3 | ref arg v2 | TAINT |
 | vector.cpp:496:25:496:30 | call to source | vector.cpp:496:5:496:11 | call to emplace | TAINT |
 | vector.cpp:497:7:497:8 | ref arg v2 | vector.cpp:498:1:498:1 | v2 |  |
+| vector.cpp:503:18:503:21 | {...} | vector.cpp:506:8:506:9 | as |  |
+| vector.cpp:503:18:503:21 | {...} | vector.cpp:507:8:507:9 | as |  |
+| vector.cpp:503:18:503:21 | {...} | vector.cpp:509:9:509:10 | as |  |
+| vector.cpp:503:18:503:21 | {...} | vector.cpp:515:8:515:9 | as |  |
+| vector.cpp:503:20:503:20 | 0 | vector.cpp:503:18:503:21 | {...} | TAINT |
+| vector.cpp:506:8:506:9 | as | vector.cpp:506:8:506:12 | access to array |  |
+| vector.cpp:506:11:506:11 | 1 | vector.cpp:506:8:506:12 | access to array | TAINT |
+| vector.cpp:507:8:507:9 | as | vector.cpp:507:8:507:19 | access to array |  |
+| vector.cpp:507:11:507:16 | call to source | vector.cpp:507:8:507:19 | access to array | TAINT |
+| vector.cpp:509:9:509:10 | as | vector.cpp:509:3:509:10 | ... = ... |  |
+| vector.cpp:509:9:509:10 | as | vector.cpp:510:9:510:11 | ptr |  |
+| vector.cpp:509:9:509:10 | as | vector.cpp:511:3:511:5 | ptr |  |
+| vector.cpp:510:9:510:11 | ptr | vector.cpp:510:8:510:11 | * ... | TAINT |
+| vector.cpp:511:3:511:5 | ptr | vector.cpp:511:3:511:10 | ... += ... | TAINT |
+| vector.cpp:511:3:511:10 | ... += ... | vector.cpp:512:9:512:11 | ptr |  |
+| vector.cpp:511:3:511:10 | ... += ... | vector.cpp:513:3:513:5 | ptr |  |
+| vector.cpp:511:10:511:10 | 1 | vector.cpp:511:3:511:10 | ... += ... | TAINT |
+| vector.cpp:512:9:512:11 | ptr | vector.cpp:512:8:512:11 | * ... | TAINT |
+| vector.cpp:513:3:513:5 | ptr | vector.cpp:513:3:513:17 | ... += ... | TAINT |
+| vector.cpp:513:3:513:17 | ... += ... | vector.cpp:514:9:514:11 | ptr |  |
+| vector.cpp:513:10:513:15 | call to source | vector.cpp:513:3:513:17 | ... += ... | TAINT |
+| vector.cpp:514:9:514:11 | ptr | vector.cpp:514:8:514:11 | * ... | TAINT |
+| vector.cpp:515:8:515:9 | as | vector.cpp:515:8:515:12 | access to array |  |
+| vector.cpp:515:11:515:11 | 1 | vector.cpp:515:8:515:12 | access to array | TAINT |
+| vector.cpp:520:25:520:31 | call to vector | vector.cpp:523:8:523:9 | vs |  |
+| vector.cpp:520:25:520:31 | call to vector | vector.cpp:524:8:524:9 | vs |  |
+| vector.cpp:520:25:520:31 | call to vector | vector.cpp:526:8:526:9 | vs |  |
+| vector.cpp:520:25:520:31 | call to vector | vector.cpp:532:8:532:9 | vs |  |
+| vector.cpp:520:25:520:31 | call to vector | vector.cpp:533:2:533:2 | vs |  |
+| vector.cpp:520:30:520:30 | 0 | vector.cpp:520:25:520:31 | call to vector | TAINT |
+| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:524:8:524:9 | vs |  |
+| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:526:8:526:9 | vs |  |
+| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:532:8:532:9 | vs |  |
+| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:533:2:533:2 | vs |  |
+| vector.cpp:523:8:523:9 | vs | vector.cpp:523:10:523:10 | call to operator[] | TAINT |
+| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:526:8:526:9 | vs |  |
+| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:532:8:532:9 | vs |  |
+| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:533:2:533:2 | vs |  |
+| vector.cpp:524:8:524:9 | vs | vector.cpp:524:10:524:10 | call to operator[] | TAINT |
+| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:532:8:532:9 | vs |  |
+| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:533:2:533:2 | vs |  |
+| vector.cpp:526:8:526:9 | vs | vector.cpp:526:11:526:15 | call to begin | TAINT |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:526:3:526:17 | ... = ... |  |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:527:9:527:10 | it |  |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:528:3:528:4 | it |  |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:529:9:529:10 | it |  |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:530:3:530:4 | it |  |
+| vector.cpp:526:11:526:15 | call to begin | vector.cpp:531:9:531:10 | it |  |
+| vector.cpp:527:9:527:10 | it | vector.cpp:527:8:527:8 | call to operator* | TAINT |
+| vector.cpp:527:9:527:10 | ref arg it | vector.cpp:528:3:528:4 | it |  |
+| vector.cpp:527:9:527:10 | ref arg it | vector.cpp:529:9:529:10 | it |  |
+| vector.cpp:527:9:527:10 | ref arg it | vector.cpp:530:3:530:4 | it |  |
+| vector.cpp:527:9:527:10 | ref arg it | vector.cpp:531:9:531:10 | it |  |
+| vector.cpp:528:3:528:4 | it | vector.cpp:528:6:528:6 | call to operator+= |  |
+| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:529:9:529:10 | it |  |
+| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:530:3:530:4 | it |  |
+| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:531:9:531:10 | it |  |
+| vector.cpp:528:9:528:9 | 1 | vector.cpp:528:3:528:4 | ref arg it | TAINT |
+| vector.cpp:529:9:529:10 | it | vector.cpp:529:8:529:8 | call to operator* | TAINT |
+| vector.cpp:529:9:529:10 | ref arg it | vector.cpp:530:3:530:4 | it |  |
+| vector.cpp:529:9:529:10 | ref arg it | vector.cpp:531:9:531:10 | it |  |
+| vector.cpp:530:3:530:4 | it | vector.cpp:530:6:530:6 | call to operator+= |  |
+| vector.cpp:530:3:530:4 | ref arg it | vector.cpp:531:9:531:10 | it |  |
+| vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT |
+| vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT |
+| vector.cpp:532:8:532:9 | ref arg vs | vector.cpp:533:2:533:2 | vs |  |
+| vector.cpp:532:8:532:9 | vs | vector.cpp:532:10:532:10 | call to operator[] | TAINT |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
index 3fb8c738305..362784eeb1a 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
@@ -90,3 +90,34 @@ void test_insert_iterator() {
     *i2-- = 0;
     sink(c2); // clean
 }
+
+void sink(insert_iterator_by_trait);
+insert_iterator_by_trait &operator+=(insert_iterator_by_trait &it, int amount);
+
+void test_assign_through_iterator() {
+    container c1;
+    insert_iterator_by_trait a, b, c;
+
+	a = c1.begin();
+	b = c1.begin();
+	*a = source();
+	sink(a); // $ ast MISSING: ir
+
+	c = c1.begin();
+	sink(b); // MISSING: ast,ir
+	sink(c); // $ ast MISSING: ir
+	sink(c1); // $ ast MISSING: ir
+}
+
+void test_nonmember_iterator() {
+    container c1;
+    insert_iterator_by_trait it;
+
+	it = c1.begin();
+	sink(it);
+	it += 1;
+	sink(it);
+	it += source();
+	sink(it); // $ ast,ir
+	sink(c1);
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
index 44d84c0c0b0..6db77f37ac1 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
@@ -630,4 +630,30 @@ void test__strnextc(const char* source) {
 	} while(c != '\0');
 	c = _strnextc("");
 	sink(c);
+}
+
+// --- taint through const specified function ---
+
+class C_no_const_member_function {
+  char* data_;
+public:
+  char* data() { return data_; }
+};
+
+void test_no_const_member(char* source) {
+  C_no_const_member_function c;
+  memcpy(c.data(), source, 16);
+  sink(c.data()); // $ ast MISSING: ir
+}
+
+class C_const_member_function {
+  char* data_;
+public:
+  char* data() const { return data_; }
+};
+
+void test_with_const_member(char* source) {
+  C_const_member_function c;
+  memcpy(c.data(), source, 16);
+  sink(c.data()); // $ ast MISSING: ir
 }
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
index ec354da548c..4f0c8fab414 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
@@ -496,3 +496,39 @@ void test_vector_emplace() {
 	v2.emplace(v2.begin(), source());
 	sink(v2); // $ ast,ir
 }
+
+void test_vector_iterator() {
+	{
+		// array behaviour, for comparison
+		short as[100] = {0};
+		short *ptr;
+
+		sink(as[1]);
+		sink(as[source()]); // $ ast,ir
+
+		ptr = as;
+		sink(*ptr);
+		ptr += 1;
+		sink(*ptr);
+		ptr += source();
+		sink(*ptr); // $ ast,ir
+		sink(as[1]);
+	}
+
+	{
+		// iterator behaviour
+		std::vector<short> vs(100, 0);
+		std::vector<short>::iterator it;
+
+		sink(vs[1]);
+		sink(vs[source()]); // $ MISSING: ast,ir
+
+		it = vs.begin();
+		sink(*it);
+		it += 1;
+		sink(*it);
+		it += source();
+		sink(*it); // $ ast,ir
+		sink(vs[1]);
+	}
+}
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
index 6f08104489e..de3326e74a5 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
@@ -8,14 +8,14 @@ edges
 | search.c:22:24:22:28 | *query | search.c:23:39:23:43 | query |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
-| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | *query |
-| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | *query |
-| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | query |
-| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | query |
-| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | *query |
-| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | *query |
-| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | query |
-| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | query |
+| search.c:51:21:51:26 | call to getenv | search.c:14:24:14:28 | *query |
+| search.c:51:21:51:26 | call to getenv | search.c:14:24:14:28 | *query |
+| search.c:51:21:51:26 | call to getenv | search.c:14:24:14:28 | query |
+| search.c:51:21:51:26 | call to getenv | search.c:14:24:14:28 | query |
+| search.c:51:21:51:26 | call to getenv | search.c:22:24:22:28 | *query |
+| search.c:51:21:51:26 | call to getenv | search.c:22:24:22:28 | *query |
+| search.c:51:21:51:26 | call to getenv | search.c:22:24:22:28 | query |
+| search.c:51:21:51:26 | call to getenv | search.c:22:24:22:28 | query |
 nodes
 | search.c:14:24:14:28 | *query | semmle.label | *query |
 | search.c:14:24:14:28 | query | semmle.label | query |
@@ -29,12 +29,12 @@ nodes
 | search.c:23:39:23:43 | query | semmle.label | query |
 | search.c:23:39:23:43 | query | semmle.label | query |
 | search.c:23:39:23:43 | query | semmle.label | query |
-| search.c:41:21:41:26 | call to getenv | semmle.label | call to getenv |
-| search.c:41:21:41:26 | call to getenv | semmle.label | call to getenv |
-| search.c:45:5:45:15 | Argument 0 | semmle.label | Argument 0 |
-| search.c:45:17:45:25 | Argument 0 indirection | semmle.label | Argument 0 indirection |
-| search.c:47:5:47:15 | Argument 0 | semmle.label | Argument 0 |
-| search.c:47:17:47:25 | Argument 0 indirection | semmle.label | Argument 0 indirection |
+| search.c:51:21:51:26 | call to getenv | semmle.label | call to getenv |
+| search.c:51:21:51:26 | call to getenv | semmle.label | call to getenv |
+| search.c:55:5:55:15 | Argument 0 | semmle.label | Argument 0 |
+| search.c:55:17:55:25 | Argument 0 indirection | semmle.label | Argument 0 indirection |
+| search.c:57:5:57:15 | Argument 0 | semmle.label | Argument 0 |
+| search.c:57:17:57:25 | Argument 0 indirection | semmle.label | Argument 0 indirection |
 #select
-| search.c:17:8:17:12 | query | search.c:41:21:41:26 | call to getenv | search.c:17:8:17:12 | query | Cross-site scripting vulnerability due to $@. | search.c:41:21:41:26 | call to getenv | this query data |
-| search.c:23:39:23:43 | query | search.c:41:21:41:26 | call to getenv | search.c:23:39:23:43 | query | Cross-site scripting vulnerability due to $@. | search.c:41:21:41:26 | call to getenv | this query data |
+| search.c:17:8:17:12 | query | search.c:51:21:51:26 | call to getenv | search.c:17:8:17:12 | query | Cross-site scripting vulnerability due to $@. | search.c:51:21:51:26 | call to getenv | this query data |
+| search.c:23:39:23:43 | query | search.c:51:21:51:26 | call to getenv | search.c:23:39:23:43 | query | Cross-site scripting vulnerability due to $@. | search.c:51:21:51:26 | call to getenv | this query data |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c
index df9a09ded59..77c830985d2 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c
@@ -26,7 +26,7 @@ void bad_server2(char* query) {
   puts(do_search(query));
 }
 
-void good_server(char* query) {
+void good_server1(char* query) {
   puts("<p>Query results for ");
   // GOOD: Escape HTML characters before adding to a page
   char* query_escaped = escape_html(query);
@@ -37,14 +37,25 @@ void good_server(char* query) {
   puts(do_search(query));
 }
 
-int main(int argc, char** argv) {
-  char* raw_query = getenv("QUERY_STRING");
-  if (strcmp("good", argv[0]) == 0) {
-    good_server(raw_query);
-  } else if (strcmp("bad1", argv[0]) == 0) {
-    bad_server1(raw_query);
-  } else {
-    bad_server2(raw_query);
-  }
+int sscanf(const char *s, const char *format, ...);
+
+void good_server2(char* query) {
+  puts("<p>Query results for ");
+  // GOOD: Only an integer is added to the page.
+  int i = 0;
+  sscanf(query, "value=%i", &i);
+  printf("\n<p>%i</p>\n", i);
 }
 
+int main(int argc, char** argv) {
+  char* raw_query = getenv("QUERY_STRING");
+  if (strcmp("good1", argv[0]) == 0) {
+    good_server1(raw_query);
+  } else if (strcmp("bad1", argv[0]) == 0) {
+    bad_server1(raw_query);
+  } else if (strcmp("bad2", argv[0]) == 0) {
+    bad_server2(raw_query);
+  } else if (strcmp("good2", argv[0]) == 0) {
+    good_server2(raw_query);
+  }
+}
diff --git a/csharp/autobuilder/Semmle.Autobuild.Shared/Solution.cs b/csharp/autobuilder/Semmle.Autobuild.Shared/Solution.cs
index 2f16872dd74..c5d65794fb5 100644
--- a/csharp/autobuilder/Semmle.Autobuild.Shared/Solution.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.Shared/Solution.cs
@@ -45,6 +45,7 @@ namespace Semmle.Autobuild.Shared
         private readonly SolutionFile? solution;
 
         private readonly IEnumerable<Project> includedProjects;
+
         public override IEnumerable<IProjectOrSolution> IncludedProjects => includedProjects;
 
         public IEnumerable<SolutionConfigurationInSolution> Configurations =>
@@ -84,8 +85,12 @@ namespace Semmle.Autobuild.Shared
                 .ToArray();
         }
 
-        private IEnumerable<Version> ToolsVersions => includedProjects.Where(p => p.ValidToolsVersion).Select(p => p.ToolsVersion);
+        private IEnumerable<Version> ToolsVersions => includedProjects
+            .Where(p => p.ValidToolsVersion)
+            .Select(p => p.ToolsVersion);
 
-        public Version ToolsVersion => ToolsVersions.Any() ? ToolsVersions.Max() : new Version();
+        public Version ToolsVersion => ToolsVersions.Any()
+            ? ToolsVersions.Max()
+            : new Version();
     }
 }
diff --git a/csharp/change-notes/2021-02-02-foreach-underlying-methods.md b/csharp/change-notes/2021-02-02-foreach-underlying-methods.md
new file mode 100644
index 00000000000..a9e934a0e5d
--- /dev/null
+++ b/csharp/change-notes/2021-02-02-foreach-underlying-methods.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The underlying methods of `foreach` statements are now explicitly extracted and
+they are made available on the `ForeachStmt` class.
diff --git a/csharp/change-notes/2021-02-12-with-expression.md b/csharp/change-notes/2021-02-12-with-expression.md
new file mode 100644
index 00000000000..b8f01cb2586
--- /dev/null
+++ b/csharp/change-notes/2021-02-12-with-expression.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* C# 9 `with` expressions are now extracted. Data flow support has been added to
+handle flow through `with` expressions and also from `record` constructor arguments
+to its properties.
diff --git a/csharp/extractor/Semmle.Extraction.CIL.Driver/ExtractorOptions.cs b/csharp/extractor/Semmle.Extraction.CIL.Driver/ExtractorOptions.cs
index 9964ff5bf0c..75405d562fe 100644
--- a/csharp/extractor/Semmle.Extraction.CIL.Driver/ExtractorOptions.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL.Driver/ExtractorOptions.cs
@@ -163,7 +163,7 @@ namespace Semmle.Extraction.CIL.Driver
         }
 
         private readonly HashSet<string> filesAnalyzed = new HashSet<string>();
-        public HashSet<AssemblyName> MissingReferences {get;} = new HashSet<AssemblyName>();
+        public HashSet<AssemblyName> MissingReferences { get; } = new HashSet<AssemblyName>();
     }
 
     /// <summary>
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Context.Factories.cs b/csharp/extractor/Semmle.Extraction.CIL/Context.Factories.cs
index dd09727f3c0..36e420e3628 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Context.Factories.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Context.Factories.cs
@@ -95,11 +95,11 @@ namespace Semmle.Extraction.CIL
         /// <param name="h">The handle of the entity.</param>
         /// <param name="genericContext">The generic context.</param>
         /// <returns></returns>
-        public IExtractedEntity CreateGeneric(GenericContext genericContext, Handle h) => genericHandleFactory[genericContext, h];
+        public IExtractedEntity CreateGeneric(IGenericContext genericContext, Handle h) => genericHandleFactory[genericContext, h];
 
-        private readonly GenericContext defaultGenericContext;
+        private readonly IGenericContext defaultGenericContext;
 
-        private IExtractedEntity CreateGenericHandle(GenericContext gc, Handle handle)
+        private IExtractedEntity CreateGenericHandle(IGenericContext gc, Handle handle)
         {
             IExtractedEntity entity;
             switch (handle.Kind)
@@ -136,7 +136,7 @@ namespace Semmle.Extraction.CIL
             return entity;
         }
 
-        private IExtractedEntity Create(GenericContext gc, MemberReferenceHandle handle)
+        private IExtractedEntity Create(IGenericContext gc, MemberReferenceHandle handle)
         {
             var mr = MdReader.GetMemberReference(handle);
             switch (mr.GetKind())
@@ -228,7 +228,7 @@ namespace Semmle.Extraction.CIL
 
         #endregion
 
-        private readonly CachedFunction<GenericContext, Handle, IExtractedEntity> genericHandleFactory;
+        private readonly CachedFunction<IGenericContext, Handle, IExtractedEntity> genericHandleFactory;
 
         /// <summary>
         /// Gets the short name of a member, without the preceding interface qualifier.
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Context.cs b/csharp/extractor/Semmle.Extraction.CIL/Context.cs
index ae662f2e87c..99113714b7c 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Context.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Context.cs
@@ -37,7 +37,7 @@ namespace Semmle.Extraction.CIL
 
             globalNamespace = new Lazy<Entities.Namespace>(() => Populate(new Entities.Namespace(this, "", null)));
             systemNamespace = new Lazy<Entities.Namespace>(() => Populate(new Entities.Namespace(this, "System")));
-            genericHandleFactory = new CachedFunction<GenericContext, Handle, IExtractedEntity>(CreateGenericHandle);
+            genericHandleFactory = new CachedFunction<IGenericContext, Handle, IExtractedEntity>(CreateGenericHandle);
             namespaceFactory = new CachedFunction<StringHandle, Entities.Namespace>(n => CreateNamespace(MdReader.GetString(n)));
             namespaceDefinitionFactory = new CachedFunction<NamespaceDefinitionHandle, Entities.Namespace>(CreateNamespace);
             sourceFiles = new CachedFunction<PDB.ISourceFile, Entities.PdbSourceFile>(path => new Entities.PdbSourceFile(this, path));
diff --git a/csharp/extractor/Semmle.Extraction.CIL/EmptyContext.cs b/csharp/extractor/Semmle.Extraction.CIL/EmptyContext.cs
index 70c73be1151..1105bc39cba 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/EmptyContext.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/EmptyContext.cs
@@ -5,14 +5,18 @@ namespace Semmle.Extraction.CIL
     /// <summary>
     /// A generic context which does not contain any type parameters.
     /// </summary>
-    public class EmptyContext : GenericContext
+    public class EmptyContext : IGenericContext
     {
-        public EmptyContext(Context cx) : base(cx)
+        public EmptyContext(Context cx)
         {
+            Cx = cx;
         }
 
-        public override IEnumerable<Entities.Type> TypeParameters { get { yield break; } }
+        public Context Cx { get; }
+
+        public IEnumerable<Entities.Type> TypeParameters { get { yield break; } }
+
+        public IEnumerable<Entities.Type> MethodParameters { get { yield break; } }
 
-        public override IEnumerable<Entities.Type> MethodParameters { get { yield break; } }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Assembly.cs
index 8a843f1672d..ba332b2db97 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Assembly.cs
@@ -40,6 +40,7 @@ namespace Semmle.Extraction.CIL.Entities
             trapFile.Write(FullName);
             trapFile.Write("#file:///");
             trapFile.Write(Cx.AssemblyPath.Replace("\\", "/"));
+            trapFile.Write(";assembly");
         }
 
         public override bool Equals(object? obj)
@@ -49,8 +50,6 @@ namespace Semmle.Extraction.CIL.Entities
 
         public override int GetHashCode() => 7 * file.GetHashCode();
 
-        public override string IdSuffix => ";assembly";
-
         private string FullName => assemblyName.GetPublicKey() is null ? assemblyName.FullName + ", PublicKeyToken=null" : assemblyName.FullName;
 
         public override IEnumerable<IExtractionProduct> Contents
@@ -136,7 +135,7 @@ namespace Semmle.Extraction.CIL.Entities
                 trapFile = trapWriter.TrapFile;
                 if (nocache || !System.IO.File.Exists(trapFile))
                 {
-                    var cx = extractor.CreateContext(null, trapWriter, null, false);
+                    var cx = new Extraction.Context(extractor, trapWriter);
                     ExtractCIL(cx, assemblyPath, extractPdbs);
                     extracted = true;
                 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Attribute.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Attribute.cs
index c862bc3fc4e..d79215f0adf 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Attribute.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Attribute.cs
@@ -12,9 +12,9 @@ namespace Semmle.Extraction.CIL.Entities
     {
         private readonly CustomAttributeHandle handle;
         private readonly CustomAttribute attrib;
-        private readonly IEntity @object;
+        private readonly IExtractedEntity @object;
 
-        public Attribute(Context cx, IEntity @object, CustomAttributeHandle handle) : base(cx)
+        public Attribute(Context cx, IExtractedEntity @object, CustomAttributeHandle handle) : base(cx)
         {
             attrib = cx.MdReader.GetCustomAttribute(handle);
             this.handle = handle;
@@ -80,7 +80,7 @@ namespace Semmle.Extraction.CIL.Entities
             return value?.ToString() ?? "null";
         }
 
-        public static IEnumerable<IExtractionProduct> Populate(Context cx, IEntity @object, CustomAttributeHandleCollection attributes)
+        public static IEnumerable<IExtractionProduct> Populate(Context cx, IExtractedEntity @object, CustomAttributeHandleCollection attributes)
         {
             foreach (var attrib in attributes)
             {
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractedEntity.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractedEntity.cs
new file mode 100644
index 00000000000..080227a63b9
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractedEntity.cs
@@ -0,0 +1,16 @@
+using System.Collections.Generic;
+
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// A CIL entity which has been extracted.
+    /// </summary>
+    public interface IExtractedEntity : IExtractionProduct, IEntity
+    {
+        /// <summary>
+        /// The contents of the entity.
+        /// </summary>
+
+        IEnumerable<IExtractionProduct> Contents { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractionProduct.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractionProduct.cs
new file mode 100644
index 00000000000..6383d7e1b4c
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IExtractionProduct.cs
@@ -0,0 +1,24 @@
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// Something that is extracted from an entity.
+    /// </summary>
+    ///
+    /// <remarks>
+    /// The extraction algorithm proceeds as follows:
+    /// - Construct entity
+    /// - Call Extract()
+    /// - IExtractedEntity check if already extracted
+    /// - Enumerate Contents to produce more extraction products
+    /// - Extract these until there is nothing left to extract
+    /// </remarks>
+    public interface IExtractionProduct
+    {
+        /// <summary>
+        /// Perform further extraction/population of this item as necessary.
+        /// </summary>
+        ///
+        /// <param name="cx">The extraction context.</param>
+        void Extract(Context cx);
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IGenericContext.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IGenericContext.cs
new file mode 100644
index 00000000000..21c69f7aeb4
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/IGenericContext.cs
@@ -0,0 +1,24 @@
+using System.Collections.Generic;
+
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// When we decode a type/method signature, we need access to
+    /// generic parameters.
+    /// </summary>
+    public interface IGenericContext
+    {
+        Context Cx { get; }
+
+        /// <summary>
+        /// The list of generic type parameters/arguments, including type parameters/arguments of
+        /// containing types.
+        /// </summary>
+        IEnumerable<Entities.Type> TypeParameters { get; }
+
+        /// <summary>
+        /// The list of generic method parameters/arguments.
+        /// </summary>
+        IEnumerable<Entities.Type> MethodParameters { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/LabelledEntity.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/LabelledEntity.cs
new file mode 100644
index 00000000000..a66ecbb1fab
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/LabelledEntity.cs
@@ -0,0 +1,39 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// An entity that needs to be populated during extraction.
+    /// This assigns a key and optionally extracts its contents.
+    /// </summary>
+    public abstract class LabelledEntity : Extraction.LabelledEntity, IExtractedEntity
+    {
+        // todo: with .NET 5 this can override the base context, and change the return type.
+        public Context Cx { get; }
+
+        protected LabelledEntity(Context cx) : base(cx.Cx)
+        {
+            this.Cx = cx;
+        }
+
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => throw new NotImplementedException();
+
+        public void Extract(Context cx2)
+        {
+            cx2.Populate(this);
+        }
+
+        public override string ToString()
+        {
+            using var writer = new StringWriter();
+            WriteQuotedId(writer);
+            return writer.ToString();
+        }
+
+        public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+
+        public abstract IEnumerable<IExtractionProduct> Contents { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/Tuple.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/Tuple.cs
new file mode 100644
index 00000000000..5657f072c9c
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/Tuple.cs
@@ -0,0 +1,22 @@
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// A tuple that is an extraction product.
+    /// </summary>
+    internal class Tuple : IExtractionProduct
+    {
+        private readonly Extraction.Tuple tuple;
+
+        public Tuple(string name, params object[] args)
+        {
+            tuple = new Extraction.Tuple(name, args);
+        }
+
+        public void Extract(Context cx)
+        {
+            cx.Cx.Emit(tuple);
+        }
+
+        public override string ToString() => tuple.ToString();
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/UnlabelledEntity.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/UnlabelledEntity.cs
new file mode 100644
index 00000000000..d8c18d291eb
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Base/UnlabelledEntity.cs
@@ -0,0 +1,31 @@
+using System;
+using System.Collections.Generic;
+
+namespace Semmle.Extraction.CIL
+{
+    /// <summary>
+    /// An entity that has contents to extract. There is no need to populate
+    /// a key as it's done in the contructor.
+    /// </summary>
+    public abstract class UnlabelledEntity : Extraction.UnlabelledEntity, IExtractedEntity
+    {
+        // todo: with .NET 5 this can override the base context, and change the return type.
+        public Context Cx { get; }
+
+        protected UnlabelledEntity(Context cx) : base(cx.Cx)
+        {
+            Cx = cx;
+        }
+
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => throw new NotImplementedException();
+
+        public void Extract(Context cx2)
+        {
+            cx2.Extract(this);
+        }
+
+        public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+
+        public abstract IEnumerable<IExtractionProduct> Contents { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
index 175da806597..8ff7fcf24bf 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CIL.Entities
 
         public override IList<LocalVariable>? LocalVariables => locals;
 
-        public DefinitionMethod(GenericContext gc, MethodDefinitionHandle handle) : base(gc)
+        public DefinitionMethod(IGenericContext gc, MethodDefinitionHandle handle) : base(gc)
         {
             md = Cx.MdReader.GetMethodDefinition(handle);
             this.gc = gc;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Event.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Event.cs
index e2e27484a4c..a6ca9364e0f 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Event.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Event.cs
@@ -25,10 +25,9 @@ namespace Semmle.Extraction.CIL.Entities
             parent.WriteId(trapFile);
             trapFile.Write('.');
             trapFile.Write(Cx.ShortName(ed.Name));
+            trapFile.Write(";cil-event");
         }
 
-        public override string IdSuffix => ";cil-event";
-
         public override bool Equals(object? obj)
         {
             return obj is Event e && handle.Equals(e.handle);
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/ExceptionRegion.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/ExceptionRegion.cs
index 75303e7903b..3026ff03030 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/ExceptionRegion.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/ExceptionRegion.cs
@@ -7,13 +7,13 @@ namespace Semmle.Extraction.CIL.Entities
     /// </summary>
     internal class ExceptionRegion : UnlabelledEntity
     {
-        private readonly GenericContext gc;
+        private readonly IGenericContext gc;
         private readonly MethodImplementation method;
         private readonly int index;
         private readonly System.Reflection.Metadata.ExceptionRegion r;
         private readonly Dictionary<int, Instruction> jump_table;
 
-        public ExceptionRegion(GenericContext gc, MethodImplementation method, int index, System.Reflection.Metadata.ExceptionRegion r, Dictionary<int, Instruction> jump_table) : base(gc.Cx)
+        public ExceptionRegion(IGenericContext gc, MethodImplementation method, int index, System.Reflection.Metadata.ExceptionRegion r, Dictionary<int, Instruction> jump_table) : base(gc.Cx)
         {
             this.gc = gc;
             this.method = method;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Field.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Field.cs
index 3f051796887..8decef24128 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Field.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Field.cs
@@ -8,40 +8,27 @@ namespace Semmle.Extraction.CIL.Entities
     /// <summary>
     /// An entity representing a field.
     /// </summary>
-    internal abstract class Field : GenericContext, IMember, ICustomModifierReceiver
+    internal abstract class Field : LabelledEntity, IGenericContext, IMember, ICustomModifierReceiver
     {
         protected Field(Context cx) : base(cx)
         {
         }
 
-        public Label Label { get; set; }
-
-        public void WriteId(TextWriter trapFile)
+        public override void WriteId(TextWriter trapFile)
         {
             trapFile.WriteSubId(DeclaringType);
             trapFile.Write('.');
             trapFile.Write(Name);
+            trapFile.Write(";cil-field");
         }
 
-        public void WriteQuotedId(TextWriter trapFile)
-        {
-            trapFile.Write("@\"");
-            WriteId(trapFile);
-            trapFile.Write(idSuffix);
-            trapFile.Write('\"');
-        }
-
-        private const string idSuffix = ";cil-field";
-
         public abstract string Name { get; }
 
         public abstract Type DeclaringType { get; }
 
-        public Location ReportingLocation => throw new NotImplementedException();
-
         public abstract Type Type { get; }
 
-        public virtual IEnumerable<IExtractionProduct> Contents
+        public override IEnumerable<IExtractionProduct> Contents
         {
             get
             {
@@ -55,11 +42,8 @@ namespace Semmle.Extraction.CIL.Entities
             }
         }
 
-        public void Extract(Context cx2)
-        {
-            cx2.Populate(this);
-        }
+        public abstract IEnumerable<Type> TypeParameters { get; }
 
-        TrapStackBehaviour IEntity.TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+        public abstract IEnumerable<Type> MethodParameters { get; }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/File.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/File.cs
index d5cb10a43db..4b612ae86af 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/File.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/File.cs
@@ -17,6 +17,7 @@ namespace Semmle.Extraction.CIL.Entities
         public override void WriteId(TextWriter trapFile)
         {
             trapFile.Write(TransformedPath.DatabaseId);
+            trapFile.Write(";sourcefile");
         }
 
         public override bool Equals(object? obj)
@@ -39,7 +40,5 @@ namespace Semmle.Extraction.CIL.Entities
                 yield return Tuples.files(this, TransformedPath.Value, TransformedPath.NameWithoutExtension, TransformedPath.Extension);
             }
         }
-
-        public override string IdSuffix => ";sourcefile";
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Folder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Folder.cs
index 6121792600a..2294a525e4b 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Folder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Folder.cs
@@ -15,10 +15,9 @@ namespace Semmle.Extraction.CIL.Entities
         public override void WriteId(TextWriter trapFile)
         {
             trapFile.Write(transformedPath.DatabaseId);
+            trapFile.Write(";folder");
         }
 
-        public override string IdSuffix => ";folder";
-
         public override IEnumerable<IExtractionProduct> Contents
         {
             get
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/ITypeSignature.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/ITypeSignature.cs
index 81dcf7b7804..beaecdfab6f 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/ITypeSignature.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/ITypeSignature.cs
@@ -4,6 +4,6 @@ namespace Semmle.Extraction.CIL.Entities
 {
     internal interface ITypeSignature
     {
-        void WriteId(TextWriter trapFile, GenericContext gc);
+        void WriteId(TextWriter trapFile, IGenericContext gc);
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Instruction.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Instruction.cs
index 75d0aab454a..033010e18a3 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Instruction.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Instruction.cs
@@ -8,7 +8,7 @@ namespace Semmle.Extraction.CIL.Entities
     /// <summary>
     /// A CIL instruction.
     /// </summary>
-    internal class Instruction : UnlabelledEntity, IEntity
+    internal class Instruction : UnlabelledEntity
     {
         /// <summary>
         /// The additional data following the opcode, if any.
@@ -289,11 +289,6 @@ namespace Semmle.Extraction.CIL.Entities
             }
         }
 
-        Label IEntity.Label
-        {
-            get; set;
-        }
-
         private readonly byte[] data;
 
         private int PayloadSize => payloadSizes[(int)PayloadType];
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/LocalVariable.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/LocalVariable.cs
index d96c430f3c9..5d7a00c64c9 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/LocalVariable.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/LocalVariable.cs
@@ -21,10 +21,9 @@ namespace Semmle.Extraction.CIL.Entities
             trapFile.WriteSubId(method);
             trapFile.Write('_');
             trapFile.Write(index);
+            trapFile.Write(";cil-local");
         }
 
-        public override string IdSuffix => ";cil-local";
-
         public override IEnumerable<IExtractionProduct> Contents
         {
             get
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceField.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceField.cs
index f8017a729e8..136ece10a8c 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceField.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceField.cs
@@ -8,10 +8,10 @@ namespace Semmle.Extraction.CIL.Entities
     {
         private readonly MemberReferenceHandle handle;
         private readonly MemberReference mr;
-        private readonly GenericContext gc;
+        private readonly IGenericContext gc;
         private readonly Type declType;
 
-        public MemberReferenceField(GenericContext gc, MemberReferenceHandle handle) : base(gc.Cx)
+        public MemberReferenceField(IGenericContext gc, MemberReferenceHandle handle) : base(gc.Cx)
         {
             this.handle = handle;
             this.gc = gc;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceMethod.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceMethod.cs
index cacbc6ab874..703bb717cee 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/MemberReferenceMethod.cs
@@ -12,10 +12,10 @@ namespace Semmle.Extraction.CIL.Entities
         private readonly MemberReferenceHandle handle;
         private readonly MemberReference mr;
         private readonly Type declaringType;
-        private readonly GenericContext parent;
+        private readonly IGenericContext parent;
         private readonly Method? sourceDeclaration;
 
-        public MemberReferenceMethod(GenericContext gc, MemberReferenceHandle handle) : base(gc)
+        public MemberReferenceMethod(IGenericContext gc, MemberReferenceHandle handle) : base(gc)
         {
             this.handle = handle;
             this.gc = gc;
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CIL.Entities
 
             signature = mr.DecodeMethodSignature(new SignatureDecoder(), gc);
 
-            parent = (GenericContext)Cx.CreateGeneric(gc, mr.Parent);
+            parent = (IGenericContext)Cx.CreateGeneric(gc, mr.Parent);
 
             var declType = parent is Method parentMethod
                 ? parentMethod.DeclaringType
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
index 30e94c8e16a..d1302837c16 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
@@ -12,10 +12,10 @@ namespace Semmle.Extraction.CIL.Entities
     internal abstract class Method : TypeContainer, IMember, ICustomModifierReceiver, IParameterizable
     {
         protected MethodTypeParameter[]? genericParams;
-        protected GenericContext gc;
+        protected IGenericContext gc;
         protected MethodSignature<ITypeSignature> signature;
 
-        protected Method(GenericContext gc) : base(gc.Cx)
+        protected Method(IGenericContext gc) : base(gc.Cx)
         {
             this.gc = gc;
         }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodSpecificationMethod.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodSpecificationMethod.cs
index 26811ce6c80..a3f87b14a8e 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodSpecificationMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodSpecificationMethod.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction.CIL.Entities
         private readonly Method unboundMethod;
         private readonly ImmutableArray<Type> typeParams;
 
-        public MethodSpecificationMethod(GenericContext gc, MethodSpecificationHandle handle) : base(gc)
+        public MethodSpecificationMethod(IGenericContext gc, MethodSpecificationHandle handle) : base(gc)
         {
             this.handle = handle;
             ms = Cx.MdReader.GetMethodSpecification(handle);
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodTypeParameter.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodTypeParameter.cs
index db5e56acb17..1795eb29269 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodTypeParameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/MethodTypeParameter.cs
@@ -21,7 +21,7 @@ namespace Semmle.Extraction.CIL.Entities
 
         public override string Name => "!" + index;
 
-        public MethodTypeParameter(GenericContext gc, Method m, int index) : base(gc)
+        public MethodTypeParameter(IGenericContext gc, Method m, int index) : base(gc)
         {
             method = m;
             this.index = index;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Namespace.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Namespace.cs
index e916fd0020f..5d498c5ac54 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Namespace.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Namespace.cs
@@ -14,9 +14,6 @@ namespace Semmle.Extraction.CIL.Entities
 
         public bool IsGlobalNamespace => ParentNamespace is null;
 
-        public override string IdSuffix => ";namespace";
-
-
         public override void WriteId(TextWriter trapFile)
         {
             if (ParentNamespace != null && !ParentNamespace.IsGlobalNamespace)
@@ -27,6 +24,8 @@ namespace Semmle.Extraction.CIL.Entities
             trapFile.Write(Name);
         }
 
+        public override string IdSuffix => ";namespacee";
+
         public override bool Equals(object? obj)
         {
             if (obj is Namespace ns && Name == ns.Name)
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
index 90452fe9265..9cf96412309 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
@@ -8,41 +8,40 @@ namespace Semmle.Extraction.CIL.Entities
     /// </summary>
     internal sealed class Parameter : LabelledEntity
     {
-        private readonly IParameterizable method;
+        private readonly IParameterizable parameterizable;
         private readonly int index;
         private readonly Type type;
 
-        public Parameter(Context cx, IParameterizable m, int i, Type t) : base(cx)
+        public Parameter(Context cx, IParameterizable p, int i, Type t) : base(cx)
         {
-            method = m;
+            parameterizable = p;
             index = i;
             type = t;
         }
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(method);
+            trapFile.WriteSubId(parameterizable);
             trapFile.Write('_');
             trapFile.Write(index);
+            trapFile.Write(";cil-parameter");
         }
 
         public override bool Equals(object? obj)
         {
-            return obj is Parameter param && method.Equals(param.method) && index == param.index;
+            return obj is Parameter param && parameterizable.Equals(param.parameterizable) && index == param.index;
         }
 
         public override int GetHashCode()
         {
-            return 23 * method.GetHashCode() + index;
+            return 23 * parameterizable.GetHashCode() + index;
         }
 
-        public override string IdSuffix => ";cil-parameter";
-
         public override IEnumerable<IExtractionProduct> Contents
         {
             get
             {
-                yield return Tuples.cil_parameter(this, method, index, type);
+                yield return Tuples.cil_parameter(this, parameterizable, index, type);
             }
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
index 5fb22b40409..e605468827a 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
@@ -13,10 +13,9 @@ namespace Semmle.Extraction.CIL.Entities
         private readonly Handle handle;
         private readonly Type type;
         private readonly PropertyDefinition pd;
-        public override string IdSuffix => ";cil-property";
-        private readonly GenericContext gc;
+        private readonly IGenericContext gc;
 
-        public Property(GenericContext gc, Type type, PropertyDefinitionHandle handle) : base(gc.Cx)
+        public Property(IGenericContext gc, Type type, PropertyDefinitionHandle handle) : base(gc.Cx)
         {
             this.gc = gc;
             this.handle = handle;
@@ -38,6 +37,7 @@ namespace Semmle.Extraction.CIL.Entities
                 param.WriteId(trapFile, gc);
             }
             trapFile.Write(")");
+            trapFile.Write(";cil-property");
         }
 
         public override bool Equals(object? obj)
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
index a955ef685c0..308846ff30a 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.shape = shape;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 elementType.WriteId(trapFile, gc);
                 trapFile.Write('[');
@@ -38,7 +38,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.elementType = elementType;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 elementType.WriteId(trapFile, gc);
                 trapFile.Write('&');
@@ -54,7 +54,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.signature = signature;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 FunctionPointerType.WriteName(
                     trapFile.Write,
@@ -84,7 +84,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.typeArguments = typeArguments;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 genericType.WriteId(trapFile, gc);
                 trapFile.Write('<');
@@ -112,7 +112,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.index = index;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext outerGc)
+            public void WriteId(TextWriter trapFile, IGenericContext outerGc)
             {
                 if (!ReferenceEquals(innerGc, outerGc) && innerGc is Method method)
                 {
@@ -132,7 +132,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.index = index;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 trapFile.Write("T!");
                 trapFile.Write(index);
@@ -158,7 +158,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.isRequired = isRequired;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 unmodifiedType.WriteId(trapFile, gc);
                 trapFile.Write(isRequired ? " modreq(" : " modopt(");
@@ -186,7 +186,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.elementType = elementType;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 elementType.WriteId(trapFile, gc);
                 trapFile.Write('*');
@@ -207,7 +207,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.typeCode = typeCode;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 trapFile.Write(typeCode.Id());
             }
@@ -227,7 +227,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.elementType = elementType;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 elementType.WriteId(trapFile, gc);
                 trapFile.Write("[]");
@@ -248,7 +248,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.handle = handle;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 var type = (Type)gc.Cx.Create(handle);
                 type.WriteId(trapFile);
@@ -269,7 +269,7 @@ namespace Semmle.Extraction.CIL.Entities
                 this.handle = handle;
             }
 
-            public void WriteId(TextWriter trapFile, GenericContext gc)
+            public void WriteId(TextWriter trapFile, IGenericContext gc)
             {
                 var type = (Type)gc.Cx.Create(handle);
                 type.WriteId(trapFile);
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/SourceLocation.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/SourceLocation.cs
index f0f1667bca2..318cac14930 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/SourceLocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/SourceLocation.cs
@@ -26,6 +26,7 @@ namespace Semmle.Extraction.CIL.Entities
             trapFile.Write(location.EndLine);
             trapFile.Write(',');
             trapFile.Write(location.EndColumn);
+            trapFile.Write(";sourcelocation");
         }
 
         public override bool Equals(object? obj)
@@ -43,7 +44,5 @@ namespace Semmle.Extraction.CIL.Entities
                 yield return Tuples.locations_default(this, file, location.StartLine, location.StartColumn, location.EndLine, location.EndColumn);
             }
         }
-
-        public override string IdSuffix => ";sourcelocation";
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Type.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Type.cs
index edeb1a54136..ad5a6ababaa 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Type.cs
@@ -11,7 +11,6 @@ namespace Semmle.Extraction.CIL.Entities
     /// </summary>
     public abstract class Type : TypeContainer, IMember
     {
-        public override string IdSuffix => ";cil-type";
         internal const string AssemblyTypeNameSeparator = "::";
         internal const string PrimitiveTypePrefix = "builtin" + AssemblyTypeNameSeparator + "System.";
 
@@ -48,6 +47,8 @@ namespace Semmle.Extraction.CIL.Entities
 
         public sealed override void WriteId(TextWriter trapFile) => WriteId(trapFile, false);
 
+        public override string IdSuffix => ";cil-type";
+
         /// <summary>
         /// Returns the friendly qualified name of types, such as
         /// ``"System.Collection.Generic.List`1"`` or
@@ -198,7 +199,7 @@ namespace Semmle.Extraction.CIL.Entities
 
         public sealed override IEnumerable<Type> MethodParameters => Enumerable.Empty<Type>();
 
-        public static Type DecodeType(GenericContext gc, TypeSpecificationHandle handle) =>
+        public static Type DecodeType(IGenericContext gc, TypeSpecificationHandle handle) =>
             gc.Cx.MdReader.GetTypeSpecification(handle).DecodeSignature(gc.Cx.TypeSignatureDecoder, gc);
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeContainer.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeContainer.cs
index a7b7a006af6..106b6fe83be 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeContainer.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeContainer.cs
@@ -1,5 +1,3 @@
-using System;
-using Microsoft.CodeAnalysis;
 using System.Collections.Generic;
 using System.IO;
 
@@ -8,17 +6,15 @@ namespace Semmle.Extraction.CIL.Entities
     /// <summary>
     /// Base class for all type containers (namespaces, types, methods).
     /// </summary>
-    public abstract class TypeContainer : GenericContext, IExtractedEntity
+    public abstract class TypeContainer : LabelledEntity, IGenericContext
     {
         protected TypeContainer(Context cx) : base(cx)
         {
         }
 
-        public virtual Label Label { get; set; }
+        public abstract string IdSuffix { get; }
 
-        public abstract void WriteId(TextWriter trapFile);
-
-        public void WriteQuotedId(TextWriter trapFile)
+        public override void WriteQuotedId(TextWriter trapFile)
         {
             trapFile.Write("@\"");
             WriteId(trapFile);
@@ -26,21 +22,7 @@ namespace Semmle.Extraction.CIL.Entities
             trapFile.Write('\"');
         }
 
-        public abstract string IdSuffix { get; }
-
-        Location IEntity.ReportingLocation => throw new NotImplementedException();
-
-        public void Extract(Context cx2) { cx2.Populate(this); }
-
-        public abstract IEnumerable<IExtractionProduct> Contents { get; }
-
-        public override string ToString()
-        {
-            using var writer = new StringWriter();
-            WriteQuotedId(writer);
-            return writer.ToString();
-        }
-
-        TrapStackBehaviour IEntity.TrapStackBehaviour => TrapStackBehaviour.NoLabel;
+        public abstract IEnumerable<Type> MethodParameters { get; }
+        public abstract IEnumerable<Type> TypeParameters { get; }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeParameter.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeParameter.cs
index 7c8d2222fa5..fd18374ed2d 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeParameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeParameter.cs
@@ -9,9 +9,9 @@ namespace Semmle.Extraction.CIL.Entities
 {
     internal abstract class TypeParameter : Type
     {
-        protected readonly GenericContext gc;
+        protected readonly IGenericContext gc;
 
-        protected TypeParameter(GenericContext gc) : base(gc.Cx)
+        protected TypeParameter(IGenericContext gc) : base(gc.Cx)
         {
             this.gc = gc;
         }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
index dcb986f1526..4417becc58d 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
@@ -1,13 +1,14 @@
 using System;
 using System.Reflection.Metadata;
 using System.Collections.Immutable;
+using System.Linq;
 
 namespace Semmle.Extraction.CIL.Entities
 {
     /// <summary>
     /// Decodes a type signature and produces a Type, for use by DecodeSignature() and friends.
     /// </summary>
-    public class TypeSignatureDecoder : ISignatureTypeProvider<Type, GenericContext>
+    public class TypeSignatureDecoder : ISignatureTypeProvider<Type, IGenericContext>
     {
         private readonly Context cx;
 
@@ -22,22 +23,22 @@ namespace Semmle.Extraction.CIL.Entities
         Type IConstructedTypeProvider<Type>.GetByReferenceType(Type elementType) =>
             new ByRefType(cx, elementType);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetFunctionPointerType(MethodSignature<Type> signature) =>
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetFunctionPointerType(MethodSignature<Type> signature) =>
             cx.Populate(new FunctionPointerType(cx, signature));
 
         Type IConstructedTypeProvider<Type>.GetGenericInstantiation(Type genericType, ImmutableArray<Type> typeArguments) =>
             genericType.Construct(typeArguments);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetGenericMethodParameter(GenericContext genericContext, int index) =>
-            genericContext.GetGenericMethodParameter(index);
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetGenericMethodParameter(IGenericContext genericContext, int index) =>
+            genericContext.MethodParameters.ElementAt(index);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetGenericTypeParameter(GenericContext genericContext, int index) =>
-            genericContext.GetGenericTypeParameter(index);
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetGenericTypeParameter(IGenericContext genericContext, int index) =>
+            genericContext.TypeParameters.ElementAt(index);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetModifiedType(Type modifier, Type unmodifiedType, bool isRequired) =>
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetModifiedType(Type modifier, Type unmodifiedType, bool isRequired) =>
             new ModifiedType(cx, unmodifiedType, modifier, isRequired);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetPinnedType(Type elementType) => elementType;
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetPinnedType(Type elementType) => elementType;
 
         Type IConstructedTypeProvider<Type>.GetPointerType(Type elementType) =>
             cx.Populate(new PointerType(cx, elementType));
@@ -53,7 +54,7 @@ namespace Semmle.Extraction.CIL.Entities
         Type ISimpleTypeProvider<Type>.GetTypeFromReference(MetadataReader reader, TypeReferenceHandle handle, byte rawTypeKind) =>
             (Type)cx.Create(handle);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetTypeFromSpecification(MetadataReader reader, GenericContext genericContext, TypeSpecificationHandle handle, byte rawTypeKind) =>
+        Type ISignatureTypeProvider<Type, IGenericContext>.GetTypeFromSpecification(MetadataReader reader, IGenericContext genericContext, TypeSpecificationHandle handle, byte rawTypeKind) =>
             throw new NotImplementedException();
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/ExtractionProduct.cs b/csharp/extractor/Semmle.Extraction.CIL/ExtractionProduct.cs
deleted file mode 100644
index 52415af9349..00000000000
--- a/csharp/extractor/Semmle.Extraction.CIL/ExtractionProduct.cs
+++ /dev/null
@@ -1,140 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-
-namespace Semmle.Extraction.CIL
-{
-    /// <summary>
-    /// Something that is extracted from an entity.
-    /// </summary>
-    ///
-    /// <remarks>
-    /// The extraction algorithm proceeds as follows:
-    /// - Construct entity
-    /// - Call Extract()
-    /// - IExtractedEntity check if already extracted
-    /// - Enumerate Contents to produce more extraction products
-    /// - Extract these until there is nothing left to extract
-    /// </remarks>
-    public interface IExtractionProduct
-    {
-        /// <summary>
-        /// Perform further extraction/population of this item as necessary.
-        /// </summary>
-        ///
-        /// <param name="cx">The extraction context.</param>
-        void Extract(Context cx);
-    }
-
-    /// <summary>
-    /// An entity which has been extracted.
-    /// </summary>
-    public interface IExtractedEntity : IEntity, IExtractionProduct
-    {
-        /// <summary>
-        /// The contents of the entity.
-        /// </summary>
-        IEnumerable<IExtractionProduct> Contents { get; }
-    }
-
-    /// <summary>
-    /// An entity that has contents to extract. There is no need to populate
-    /// a key as it's done in the contructor.
-    /// </summary>
-    public abstract class UnlabelledEntity : IExtractedEntity
-    {
-        public abstract IEnumerable<IExtractionProduct> Contents { get; }
-        public Label Label { get; set; }
-
-        public void WriteId(System.IO.TextWriter trapFile)
-        {
-            trapFile.Write('*');
-        }
-
-        public void WriteQuotedId(TextWriter trapFile)
-        {
-            WriteId(trapFile);
-        }
-
-        public Microsoft.CodeAnalysis.Location ReportingLocation => throw new NotImplementedException();
-
-        public virtual void Extract(Context cx2)
-        {
-            cx2.Extract(this);
-        }
-
-        public Context Cx { get; }
-
-        protected UnlabelledEntity(Context cx)
-        {
-            this.Cx = cx;
-            cx.Cx.AddFreshLabel(this);
-        }
-
-        TrapStackBehaviour IEntity.TrapStackBehaviour => TrapStackBehaviour.NoLabel;
-    }
-
-    /// <summary>
-    /// An entity that needs to be populated during extraction.
-    /// This assigns a key and optionally extracts its contents.
-    /// </summary>
-    public abstract class LabelledEntity : IExtractedEntity
-    {
-        public abstract IEnumerable<IExtractionProduct> Contents { get; }
-        public Label Label { get; set; }
-        public Microsoft.CodeAnalysis.Location ReportingLocation => throw new NotImplementedException();
-
-        public abstract void WriteId(System.IO.TextWriter trapFile);
-
-        public abstract string IdSuffix { get; }
-
-        public void WriteQuotedId(TextWriter trapFile)
-        {
-            trapFile.Write("@\"");
-            WriteId(trapFile);
-            trapFile.Write(IdSuffix);
-            trapFile.Write('\"');
-        }
-
-        public void Extract(Context cx2)
-        {
-            cx2.Populate(this);
-        }
-
-        public Context Cx { get; }
-
-        protected LabelledEntity(Context cx)
-        {
-            this.Cx = cx;
-        }
-
-        public override string ToString()
-        {
-            using var writer = new StringWriter();
-            WriteQuotedId(writer);
-            return writer.ToString();
-        }
-
-        TrapStackBehaviour IEntity.TrapStackBehaviour => TrapStackBehaviour.NoLabel;
-    }
-
-    /// <summary>
-    /// A tuple that is an extraction product.
-    /// </summary>
-    internal class Tuple : IExtractionProduct
-    {
-        private readonly Extraction.Tuple tuple;
-
-        public Tuple(string name, params object[] args)
-        {
-            tuple = new Extraction.Tuple(name, args);
-        }
-
-        public void Extract(Context cx)
-        {
-            cx.Cx.Emit(tuple);
-        }
-
-        public override string ToString() => tuple.ToString();
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/GenericContext.cs b/csharp/extractor/Semmle.Extraction.CIL/GenericContext.cs
deleted file mode 100644
index 6db62bf5bbf..00000000000
--- a/csharp/extractor/Semmle.Extraction.CIL/GenericContext.cs
+++ /dev/null
@@ -1,56 +0,0 @@
-using System.Collections.Generic;
-using System.Linq;
-
-namespace Semmle.Extraction.CIL
-{
-    /// <summary>
-    /// When we decode a type/method signature, we need access to
-    /// generic parameters.
-    /// </summary>
-    public abstract class GenericContext
-    {
-        public Context Cx { get; }
-
-        protected GenericContext(Context cx)
-        {
-            this.Cx = cx;
-        }
-
-        /// <summary>
-        /// The list of generic type parameters/arguments, including type parameters/arguments of
-        /// containing types.
-        /// </summary>
-        public abstract IEnumerable<Entities.Type> TypeParameters { get; }
-
-        /// <summary>
-        /// The list of generic method parameters.
-        /// </summary>
-        public abstract IEnumerable<Entities.Type> MethodParameters { get; }
-
-        /// <summary>
-        /// Gets the `p`th type parameter.
-        /// </summary>
-        /// <param name="p">The index of the parameter.</param>
-        /// <returns>
-        /// For constructed types, the supplied type.
-        /// For unbound types, the type parameter.
-        /// </returns>
-        public Entities.Type GetGenericTypeParameter(int p)
-        {
-            return TypeParameters.ElementAt(p);
-        }
-
-        /// <summary>
-        /// Gets the `p`th method type parameter.
-        /// </summary>
-        /// <param name="p">The index of the parameter.</param>
-        /// <returns>
-        /// For constructed types, the supplied type.
-        /// For unbound types, the type parameter.
-        /// </returns>
-        public Entities.Type GetGenericMethodParameter(int p)
-        {
-            return MethodParameters.ElementAt(p);
-        }
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/PDB/MdProvider.cs b/csharp/extractor/Semmle.Extraction.CIL/PDB/MdProvider.cs
index c6c943032a6..fc22f1f6e94 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/PDB/MdProvider.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/PDB/MdProvider.cs
@@ -2,6 +2,8 @@ using System;
 using Microsoft.DiaSymReader;
 using System.Reflection;
 
+#pragma warning disable IDE0060, CA1822
+
 namespace Semmle.Extraction.PDB
 {
     /// <summary>
@@ -31,3 +33,5 @@ namespace Semmle.Extraction.PDB
             throw new NotImplementedException();
     }
 }
+
+#pragma warning restore
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
index 0ae92386c3e..c8ed3445c6f 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
@@ -14,10 +14,10 @@ namespace Semmle.Extraction.CIL
         internal static Tuple cil_adder(Event member, Method method) =>
             new Tuple("cil_adder", member, method);
 
-        internal static Tuple cil_access(Instruction i, IEntity m) =>
+        internal static Tuple cil_access(Instruction i, IExtractedEntity m) =>
             new Tuple("cil_access", i, m);
 
-        internal static Tuple cil_attribute(Attribute attribute, IEntity @object, Method constructor) =>
+        internal static Tuple cil_attribute(Attribute attribute, IExtractedEntity @object, Method constructor) =>
             new Tuple("cil_attribute", attribute, @object, constructor);
 
         internal static Tuple cil_attribute_named_argument(Attribute attribute, string name, string value) =>
@@ -197,7 +197,7 @@ namespace Semmle.Extraction.CIL
         internal static Tuple cil_custom_modifiers(ICustomModifierReceiver receiver, Type modifier, bool isRequired) =>
             new Tuple("cil_custom_modifiers", receiver, modifier, isRequired ? 1 : 0);
 
-        internal static Tuple cil_type_annotation(IEntity receiver, TypeAnnotation annotation) =>
+        internal static Tuple cil_type_annotation(IExtractedEntity receiver, TypeAnnotation annotation) =>
             new Tuple("cil_type_annotation", receiver, (int)annotation);
 
         internal static Tuple containerparent(Folder parent, IFileOrFolder child) =>
@@ -215,7 +215,7 @@ namespace Semmle.Extraction.CIL
         internal static Tuple locations_default(PdbSourceLocation label, File file, int startLine, int startCol, int endLine, int endCol) =>
             new Tuple("locations_default", label, file, startLine, startCol, endLine, endCol);
 
-        internal static Tuple metadata_handle(IEntity entity, Assembly assembly, int handleValue) =>
+        internal static Tuple metadata_handle(IExtractedEntity entity, Assembly assembly, int handleValue) =>
             new Tuple("metadata_handle", entity, assembly, handleValue);
 
         internal static Tuple namespaces(Namespace ns, string name) =>
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs b/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
index f9e0d7c3806..b04b429993d 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.CSharp
     /// </summary>
     public sealed class Analyser : IDisposable
     {
-        private IExtractor extractor;
+        private Extraction.Extractor extractor;
         private CSharpCompilation compilation;
         private Layout layout;
         private bool init;
@@ -230,7 +230,7 @@ namespace Semmle.Extraction.CSharp
                 var projectLayout = layout.LookupProjectOrDefault(transformedAssemblyPath);
                 var trapWriter = projectLayout.CreateTrapWriter(Logger, transformedAssemblyPath, options.TrapCompression, discardDuplicates: false);
                 compilationTrapFile = trapWriter;  // Dispose later
-                var cx = extractor.CreateContext(compilation.Clone(), trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
+                var cx = new Context(extractor, compilation.Clone(), trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
 
                 compilationEntity = Entities.Compilation.Create(cx);
             }
@@ -285,7 +285,7 @@ namespace Semmle.Extraction.CSharp
 
                     if (c.GetAssemblyOrModuleSymbol(r) is IAssemblySymbol assembly)
                     {
-                        var cx = extractor.CreateContext(c, trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
+                        var cx = new Context(extractor, c, trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
 
                         foreach (var module in assembly.Modules)
                         {
@@ -371,7 +371,7 @@ namespace Semmle.Extraction.CSharp
 
                     if (!upToDate)
                     {
-                        var cx = extractor.CreateContext(compilation.Clone(), trapWriter, new SourceScope(tree), AddAssemblyTrapPrefix);
+                        var cx = new Context(extractor, compilation.Clone(), trapWriter, new SourceScope(tree), AddAssemblyTrapPrefix);
                         // Ensure that the file itself is populated in case the source file is totally empty
                         var root = tree.GetRoot();
                         Extraction.Entities.File.Create(cx, root.SyntaxTree.FilePath);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
index 08782ec36a7..d5a20e8eef6 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs
@@ -29,9 +29,9 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <summary>
         /// Gets the property symbol associated with this accessor.
         /// </summary>
-        private IPropertySymbol PropertySymbol => GetPropertySymbol(symbol);
+        private IPropertySymbol PropertySymbol => GetPropertySymbol(Symbol);
 
-        public new Accessor OriginalDefinition => Create(Context, symbol.OriginalDefinition);
+        public new Accessor OriginalDefinition => Create(Context, Symbol.OriginalDefinition);
 
         public override void Populate(TextWriter trapFile)
         {
@@ -42,42 +42,42 @@ namespace Semmle.Extraction.CSharp.Entities
             var prop = PropertySymbol;
             if (prop == null)
             {
-                Context.ModelError(symbol, "Unhandled accessor associated symbol");
+                Context.ModelError(Symbol, "Unhandled accessor associated symbol");
                 return;
             }
 
             var parent = Property.Create(Context, prop);
             int kind;
             Accessor unboundAccessor;
-            if (SymbolEqualityComparer.Default.Equals(symbol, prop.GetMethod))
+            if (SymbolEqualityComparer.Default.Equals(Symbol, prop.GetMethod))
             {
                 kind = 1;
                 unboundAccessor = Create(Context, prop.OriginalDefinition.GetMethod);
             }
-            else if (SymbolEqualityComparer.Default.Equals(symbol, prop.SetMethod))
+            else if (SymbolEqualityComparer.Default.Equals(Symbol, prop.SetMethod))
             {
                 kind = 2;
                 unboundAccessor = Create(Context, prop.OriginalDefinition.SetMethod);
             }
             else
             {
-                Context.ModelError(symbol, "Unhandled accessor kind");
+                Context.ModelError(Symbol, "Unhandled accessor kind");
                 return;
             }
 
-            trapFile.accessors(this, kind, symbol.Name, parent, unboundAccessor);
+            trapFile.accessors(this, kind, Symbol.Name, parent, unboundAccessor);
 
             foreach (var l in Locations)
                 trapFile.accessor_location(this, l);
 
             Overrides(trapFile);
 
-            if (symbol.FromSource() && Block == null)
+            if (Symbol.FromSource() && Block == null)
             {
                 trapFile.compiler_generated(this);
             }
 
-            if (symbol.IsInitOnly)
+            if (Symbol.IsInitOnly)
             {
                 trapFile.init_only_accessors(this);
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs
index 9fef80b383a..ba1d2093765 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs
@@ -47,7 +47,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            var type = Type.Create(Context, symbol.AttributeClass);
+            var type = Type.Create(Context, Symbol.AttributeClass);
             trapFile.attributes(this, type.TypeRef, entity);
             trapFile.attribute_location(this, Location);
 
@@ -69,10 +69,10 @@ namespace Semmle.Extraction.CSharp.Entities
             var ctorArguments = attributeSyntax?.ArgumentList?.Arguments.Where(a => a.NameEquals == null).ToList();
 
             var childIndex = 0;
-            for (var i = 0; i < symbol.ConstructorArguments.Length; i++)
+            for (var i = 0; i < Symbol.ConstructorArguments.Length; i++)
             {
-                var constructorArgument = symbol.ConstructorArguments[i];
-                var paramName = symbol.AttributeConstructor?.Parameters[i].Name;
+                var constructorArgument = Symbol.ConstructorArguments[i];
+                var paramName = Symbol.AttributeConstructor?.Parameters[i].Name;
                 var argSyntax = ctorArguments?.SingleOrDefault(a => a.NameColon != null && a.NameColon.Name.Identifier.Text == paramName);
 
                 if (argSyntax == null &&                            // couldn't find named argument
@@ -89,7 +89,7 @@ namespace Semmle.Extraction.CSharp.Entities
                     childIndex++);
             }
 
-            foreach (var namedArgument in symbol.NamedArguments)
+            foreach (var namedArgument in Symbol.NamedArguments)
             {
                 var expr = CreateExpressionFromArgument(
                     namedArgument.Value,
@@ -118,7 +118,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         private Semmle.Extraction.Entities.Location location;
         private Semmle.Extraction.Entities.Location Location =>
-            location ?? (location = Semmle.Extraction.Entities.Location.Create(Context, attributeSyntax is null ? entity.ReportingLocation : attributeSyntax.Name.GetLocation()));
+            location ?? (location = Context.CreateLocation(attributeSyntax is null ? entity.ReportingLocation : attributeSyntax.Name.GetLocation()));
 
         public override bool NeedsPopulation => true;
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CallTypeExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CallTypeExtensions.cs
new file mode 100644
index 00000000000..6b9564e49dc
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CallTypeExtensions.cs
@@ -0,0 +1,27 @@
+using Semmle.Extraction.Kinds;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    internal static class CallTypeExtensions
+    {
+        /// <summary>
+        /// Adjust the expression kind <paramref name="k"/> to match this call type.
+        /// </summary>
+        public static ExprKind AdjustKind(this Expression.CallType ct, ExprKind k)
+        {
+            if (k == ExprKind.ADDRESS_OF)
+            {
+                return k;
+            }
+
+            switch (ct)
+            {
+                case Expression.CallType.Dynamic:
+                case Expression.CallType.UserOperator:
+                    return ExprKind.OPERATOR_INVOCATION;
+                default:
+                    return k;
+            }
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentBlock.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentBlock.cs
index ab6802cf457..e06b6aebe7f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentBlock.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentBlock.cs
@@ -13,8 +13,8 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.commentblock(this);
             var child = 0;
-            trapFile.commentblock_location(this, Context.Create(symbol.Location));
-            foreach (var l in symbol.CommentLines)
+            trapFile.commentblock_location(this, Context.CreateLocation(Symbol.Location));
+            foreach (var l in Symbol.CommentLines)
             {
                 trapFile.commentblock_child(this, (CommentLine)l, child++);
             }
@@ -24,11 +24,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(Context.Create(symbol.Location));
+            trapFile.WriteSubId(Context.CreateLocation(Symbol.Location));
             trapFile.Write(";commentblock");
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => symbol.Location;
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.Location;
 
         public void BindTo(Label entity, CommentBinding binding)
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentLine.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentLine.cs
index e390cb8c509..102ea262b39 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentLine.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentLine.cs
@@ -13,28 +13,28 @@ namespace Semmle.Extraction.CSharp.Entities
             RawText = raw;
         }
 
-        public Microsoft.CodeAnalysis.Location Location => symbol.Item1;
+        public Microsoft.CodeAnalysis.Location Location => Symbol.Item1;
         public CommentLineType Type { get; private set; }
 
-        public string Text { get { return symbol.Item2; } }
+        public string Text { get { return Symbol.Item2; } }
         public string RawText { get; private set; }
 
         private Location location;
 
         public override void Populate(TextWriter trapFile)
         {
-            location = Context.Create(Location);
+            location = Context.CreateLocation(Location);
             trapFile.commentline(this, Type == CommentLineType.MultilineContinuation ? CommentLineType.Multiline : Type, Text, RawText);
             trapFile.commentline_location(this, location);
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => location.symbol;
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => location.Symbol;
 
         public override bool NeedsPopulation => true;
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(Context.Create(Location));
+            trapFile.WriteSubId(Context.CreateLocation(Location));
             trapFile.Write(";commentline");
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilations/Diagnostic.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilations/Diagnostic.cs
index 2900e5b0ae0..def6edbf5ad 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilations/Diagnostic.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilations/Diagnostic.cs
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.CSharp.Entities
         protected override void Populate(TextWriter trapFile)
         {
             trapFile.diagnostics(this, (int)diagnostic.Severity, diagnostic.Id, diagnostic.Descriptor.Title.ToString(),
-                diagnostic.GetMessage(), Extraction.Entities.Location.Create(cx, diagnostic.Location));
+                diagnostic.GetMessage(), Context.CreateLocation(diagnostic.Location));
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
index 499e6ec418a..d04e80324ff 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
@@ -19,10 +19,10 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateModifiers(trapFile);
             ContainingType.PopulateGenerics();
 
-            trapFile.constructors(this, symbol.ContainingType.Name, ContainingType, (Constructor)OriginalDefinition);
+            trapFile.constructors(this, Symbol.ContainingType.Name, ContainingType, (Constructor)OriginalDefinition);
             trapFile.constructor_location(this, Location);
 
-            if (symbol.IsImplicitlyDeclared)
+            if (Symbol.IsImplicitlyDeclared)
             {
                 var lineCounts = new LineCounts() { Total = 2, Code = 1, Comment = 0 };
                 trapFile.numlines(this, lineCounts);
@@ -48,10 +48,10 @@ namespace Semmle.Extraction.CSharp.Entities
             switch (initializer.Kind())
             {
                 case SyntaxKind.BaseConstructorInitializer:
-                    initializerType = symbol.ContainingType.BaseType;
+                    initializerType = Symbol.ContainingType.BaseType;
                     break;
                 case SyntaxKind.ThisConstructorInitializer:
-                    initializerType = symbol.ContainingType;
+                    initializerType = Symbol.ContainingType;
                     break;
                 default:
                     Context.ModelError(initializer, "Unknown initializer");
@@ -60,7 +60,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             var initInfo = new ExpressionInfo(Context,
                 AnnotatedTypeSymbol.CreateNotAnnotated(initializerType),
-                Context.Create(initializer.ThisOrBaseKeyword.GetLocation()),
+                Context.CreateLocation(initializer.ThisOrBaseKeyword.GetLocation()),
                 Kinds.ExprKind.CONSTRUCTOR_INIT,
                 this,
                 -1,
@@ -73,7 +73,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             if (target == null)
             {
-                Context.ModelError(symbol, "Unable to resolve call");
+                Context.ModelError(Symbol, "Unable to resolve call");
                 return;
             }
 
@@ -90,7 +90,7 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                return symbol.DeclaringSyntaxReferences
+                return Symbol.DeclaringSyntaxReferences
                     .Select(r => r.GetSyntax())
                     .OfType<ConstructorDeclarationSyntax>()
                     .FirstOrDefault();
@@ -114,15 +114,15 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            if (symbol.IsStatic)
+            if (Symbol.IsStatic)
                 trapFile.Write("static");
             trapFile.WriteSubId(ContainingType);
-            AddParametersToId(Context, trapFile, symbol);
+            AddParametersToId(Context, trapFile, Symbol);
             trapFile.Write(";constructor");
         }
 
         private ConstructorDeclarationSyntax GetSyntax() =>
-            symbol.DeclaringSyntaxReferences.Select(r => r.GetSyntax()).OfType<ConstructorDeclarationSyntax>().FirstOrDefault();
+            Symbol.DeclaringSyntaxReferences.Select(r => r.GetSyntax()).OfType<ConstructorDeclarationSyntax>().FirstOrDefault();
 
         public override Microsoft.CodeAnalysis.Location FullLocation => ReportingLocation;
 
@@ -136,12 +136,12 @@ namespace Semmle.Extraction.CSharp.Entities
                     return syn.Identifier.GetLocation();
                 }
 
-                if (symbol.IsImplicitlyDeclared)
+                if (Symbol.IsImplicitlyDeclared)
                 {
                     return ContainingType.ReportingLocation;
                 }
 
-                return symbol.ContainingType.Locations.FirstOrDefault();
+                return Symbol.ContainingType.Locations.FirstOrDefault();
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Conversion.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Conversion.cs
index aa125cae0a1..05a752cb35c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Conversion.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Conversion.cs
@@ -17,11 +17,11 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                return symbol.DeclaringSyntaxReferences
+                return Symbol.DeclaringSyntaxReferences
                     .Select(r => r.GetSyntax())
                     .OfType<ConversionOperatorDeclarationSyntax>()
                     .Select(s => s.FixedLocation())
-                    .Concat(symbol.Locations)
+                    .Concat(Symbol.Locations)
                     .FirstOrDefault();
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs
index a5c4acc3c03..0862baa3600 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateModifiers(trapFile);
             ContainingType.PopulateGenerics();
 
-            trapFile.destructors(this, string.Format("~{0}", symbol.ContainingType.Name), ContainingType, OriginalDefinition(Context, this, symbol));
+            trapFile.destructors(this, string.Format("~{0}", Symbol.ContainingType.Name), ContainingType, OriginalDefinition(Context, this, Symbol));
             trapFile.destructor_location(this, Location);
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
index 5c24cf97655..fe095ed4462 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs
@@ -14,20 +14,20 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.WriteSubId(ContainingType);
             trapFile.Write('.');
-            Method.AddExplicitInterfaceQualifierToId(Context, trapFile, symbol.ExplicitInterfaceImplementations);
-            trapFile.Write(symbol.Name);
+            Method.AddExplicitInterfaceQualifierToId(Context, trapFile, Symbol.ExplicitInterfaceImplementations);
+            trapFile.Write(Symbol.Name);
             trapFile.Write(";event");
         }
 
         public override void Populate(TextWriter trapFile)
         {
-            PopulateNullability(trapFile, symbol.GetAnnotatedType());
+            PopulateNullability(trapFile, Symbol.GetAnnotatedType());
 
-            var type = Type.Create(Context, symbol.Type);
-            trapFile.events(this, symbol.GetName(), ContainingType, type.TypeRef, Create(Context, symbol.OriginalDefinition));
+            var type = Type.Create(Context, Symbol.Type);
+            trapFile.events(this, Symbol.GetName(), ContainingType, type.TypeRef, Create(Context, Symbol.OriginalDefinition));
 
-            var adder = symbol.AddMethod;
-            var remover = symbol.RemoveMethod;
+            var adder = Symbol.AddMethod;
+            var remover = Symbol.RemoveMethod;
 
             if (!(adder is null))
                 Method.Create(Context, adder);
@@ -39,10 +39,10 @@ namespace Semmle.Extraction.CSharp.Entities
             BindComments();
 
             var declSyntaxReferences = IsSourceDeclaration
-                ? symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).ToArray()
+                ? Symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).ToArray()
                 : Enumerable.Empty<SyntaxNode>();
 
-            foreach (var explicitInterface in symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
+            foreach (var explicitInterface in Symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
             {
                 trapFile.explicitly_implements(this, explicitInterface.TypeRef);
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/EventAccessor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/EventAccessor.cs
index c75b6766dc7..82be6a6e406 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/EventAccessor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/EventAccessor.cs
@@ -11,7 +11,7 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <summary>
         /// Gets the event symbol associated with this accessor.
         /// </summary>
-        private IEventSymbol EventSymbol => symbol.AssociatedSymbol as IEventSymbol;
+        private IEventSymbol EventSymbol => Symbol.AssociatedSymbol as IEventSymbol;
 
         public override void Populate(TextWriter trapFile)
         {
@@ -21,30 +21,30 @@ namespace Semmle.Extraction.CSharp.Entities
             var @event = EventSymbol;
             if (@event == null)
             {
-                Context.ModelError(symbol, "Unhandled event accessor associated symbol");
+                Context.ModelError(Symbol, "Unhandled event accessor associated symbol");
                 return;
             }
 
             var parent = Event.Create(Context, @event);
             int kind;
             EventAccessor unboundAccessor;
-            if (SymbolEqualityComparer.Default.Equals(symbol, @event.AddMethod))
+            if (SymbolEqualityComparer.Default.Equals(Symbol, @event.AddMethod))
             {
                 kind = 1;
                 unboundAccessor = Create(Context, @event.OriginalDefinition.AddMethod);
             }
-            else if (SymbolEqualityComparer.Default.Equals(symbol, @event.RemoveMethod))
+            else if (SymbolEqualityComparer.Default.Equals(Symbol, @event.RemoveMethod))
             {
                 kind = 2;
                 unboundAccessor = Create(Context, @event.OriginalDefinition.RemoveMethod);
             }
             else
             {
-                Context.ModelError(symbol, "Undhandled event accessor kind");
+                Context.ModelError(Symbol, "Undhandled event accessor kind");
                 return;
             }
 
-            trapFile.event_accessors(this, kind, symbol.Name, parent, unboundAccessor);
+            trapFile.event_accessors(this, kind, Symbol.Name, parent, unboundAccessor);
 
             foreach (var l in Locations)
                 trapFile.event_accessor_location(this, l);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index 6c738da3af1..fe62bf8323b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -2,8 +2,6 @@ using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Extraction.CSharp.Entities.Expressions;
-using Semmle.Extraction.CSharp.Populators;
-using Semmle.Extraction.Entities;
 using Semmle.Extraction.Kinds;
 using System;
 using System.IO;
@@ -11,14 +9,6 @@ using System.Linq;
 
 namespace Semmle.Extraction.CSharp.Entities
 {
-    public interface IExpressionParentEntity : IEntity
-    {
-        /// <summary>
-        /// Whether this entity is the parent of a top-level expression.
-        /// </summary>
-        bool IsTopLevelParent { get; }
-    }
-
     internal class Expression : FreshEntity, IExpressionParentEntity
     {
         private readonly IExpressionInfo info;
@@ -39,7 +29,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected sealed override void Populate(TextWriter trapFile)
         {
-            var type = Type.HasValue ? Entities.Type.Create(cx, Type.Value) : NullType.Create(cx);
+            var type = Type.HasValue ? Entities.Type.Create(Context, Type.Value) : NullType.Create(Context);
             trapFile.expressions(this, Kind, type.TypeRef);
             if (info.Parent.IsTopLevelParent)
                 trapFile.expr_parent_top_level(this, info.Child, info.Parent);
@@ -49,7 +39,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             if (Type.HasValue && !Type.Value.HasObliviousNullability())
             {
-                var n = NullabilityEntity.Create(cx, Nullability.Create(Type.Value));
+                var n = NullabilityEntity.Create(Context, Nullability.Create(Type.Value));
                 trapFile.type_nullability(this, n);
             }
 
@@ -67,7 +57,7 @@ namespace Semmle.Extraction.CSharp.Entities
             type.PopulateGenerics();
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => Location.symbol;
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Location.Symbol;
 
         bool IExpressionParentEntity.IsTopLevelParent => false;
 
@@ -180,10 +170,10 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <param name="node">The expression.</param>
         public void OperatorCall(TextWriter trapFile, ExpressionSyntax node)
         {
-            var @operator = cx.GetSymbolInfo(node);
+            var @operator = Context.GetSymbolInfo(node);
             if (@operator.Symbol is IMethodSymbol method)
             {
-                var callType = GetCallType(cx, node);
+                var callType = GetCallType(Context, node);
                 if (callType == CallType.Dynamic)
                 {
                     UserOperator.OperatorSymbol(method.Name, out var operatorName);
@@ -191,7 +181,7 @@ namespace Semmle.Extraction.CSharp.Entities
                     return;
                 }
 
-                trapFile.expr_call(this, Method.Create(cx, method));
+                trapFile.expr_call(this, Method.Create(Context, method));
             }
         }
 
@@ -277,7 +267,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         private void PopulateArgument(TextWriter trapFile, ArgumentSyntax arg, int child)
         {
-            var expr = Create(cx, arg.Expression, this, child);
+            var expr = Create(Context, arg.Expression, this, child);
             int mode;
             switch (arg.RefOrOutKeyword.Kind())
             {
@@ -308,314 +298,4 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.OptionalLabel;
     }
-
-    internal static class CallTypeExtensions
-    {
-        /// <summary>
-        /// Adjust the expression kind <paramref name="k"/> to match this call type.
-        /// </summary>
-        public static ExprKind AdjustKind(this Expression.CallType ct, ExprKind k)
-        {
-            if (k == ExprKind.ADDRESS_OF)
-            {
-                return k;
-            }
-
-            switch (ct)
-            {
-                case Expression.CallType.Dynamic:
-                case Expression.CallType.UserOperator:
-                    return ExprKind.OPERATOR_INVOCATION;
-                default:
-                    return k;
-            }
-        }
-    }
-
-    internal abstract class Expression<TExpressionSyntax> : Expression
-        where TExpressionSyntax : ExpressionSyntax
-    {
-        public TExpressionSyntax Syntax { get; }
-
-        protected Expression(ExpressionNodeInfo info)
-            : base(info)
-        {
-            Syntax = (TExpressionSyntax)info.Node;
-        }
-
-        /// <summary>
-        /// Populates expression-type specific relations in the trap file. The general relations
-        /// <code>expressions</code> and <code>expr_location</code> are populated by the constructor
-        /// (should not fail), so even if expression-type specific population fails (e.g., in
-        /// standalone extraction), the expression created via
-        /// <see cref="Expression.Create(Context, ExpressionSyntax, IEntity, int, ITypeSymbol)"/> will
-        /// still be valid.
-        /// </summary>
-        protected abstract void PopulateExpression(TextWriter trapFile);
-
-        protected new Expression TryPopulate()
-        {
-            cx.Try(Syntax, null, () => PopulateExpression(cx.TrapWriter.Writer));
-            return this;
-        }
-    }
-
-    /// <summary>
-    /// Holds all information required to create an Expression entity.
-    /// </summary>
-    internal interface IExpressionInfo
-    {
-        Context Context { get; }
-
-        /// <summary>
-        /// The type of the expression.
-        /// </summary>
-        AnnotatedTypeSymbol? Type { get; }
-
-        /// <summary>
-        /// The location of the expression.
-        /// </summary>
-        Extraction.Entities.Location Location { get; }
-
-        /// <summary>
-        /// The kind of the expression.
-        /// </summary>
-        ExprKind Kind { get; }
-
-        /// <summary>
-        /// The parent of the expression.
-        /// </summary>
-        IExpressionParentEntity Parent { get; }
-
-        /// <summary>
-        /// The child index of the expression.
-        /// </summary>
-        int Child { get; }
-
-        /// <summary>
-        /// Holds if this is an implicit expression.
-        /// </summary>
-        bool IsCompilerGenerated { get; }
-
-        /// <summary>
-        /// Gets a string representation of the value.
-        /// null is encoded as the string "null".
-        /// If the expression does not have a value, then this
-        /// is null.
-        /// </summary>
-        string ExprValue { get; }
-
-        NullableFlowState FlowState { get; }
-    }
-
-    /// <summary>
-    /// Explicitly constructed expression information.
-    /// </summary>
-    internal class ExpressionInfo : IExpressionInfo
-    {
-        public Context Context { get; }
-        public AnnotatedTypeSymbol? Type { get; }
-        public Extraction.Entities.Location Location { get; }
-        public ExprKind Kind { get; }
-        public IExpressionParentEntity Parent { get; }
-        public int Child { get; }
-        public bool IsCompilerGenerated { get; }
-        public string ExprValue { get; }
-
-        public ExpressionInfo(Context cx, AnnotatedTypeSymbol? type, Extraction.Entities.Location location, ExprKind kind,
-            IExpressionParentEntity parent, int child, bool isCompilerGenerated, string value)
-        {
-            Context = cx;
-            Type = type;
-            Location = location;
-            Kind = kind;
-            Parent = parent;
-            Child = child;
-            ExprValue = value;
-            IsCompilerGenerated = isCompilerGenerated;
-        }
-
-        // Synthetic expressions don't have a flow state.
-        public NullableFlowState FlowState => NullableFlowState.None;
-    }
-
-    /// <summary>
-    /// Expression information constructed from a syntax node.
-    /// </summary>
-    internal class ExpressionNodeInfo : IExpressionInfo
-    {
-        public ExpressionNodeInfo(Context cx, ExpressionSyntax node, IExpressionParentEntity parent, int child) :
-            this(cx, node, parent, child, cx.GetTypeInfo(node))
-        {
-        }
-
-        public ExpressionNodeInfo(Context cx, ExpressionSyntax node, IExpressionParentEntity parent, int child, TypeInfo typeInfo)
-        {
-            Context = cx;
-            Node = node;
-            Parent = parent;
-            Child = child;
-            TypeInfo = typeInfo;
-            Conversion = cx.GetModel(node).GetConversion(node);
-        }
-
-        public Context Context { get; }
-        public ExpressionSyntax Node { get; private set; }
-        public IExpressionParentEntity Parent { get; set; }
-        public int Child { get; set; }
-        public TypeInfo TypeInfo { get; }
-        public Microsoft.CodeAnalysis.CSharp.Conversion Conversion { get; }
-
-        public AnnotatedTypeSymbol ResolvedType => new AnnotatedTypeSymbol(TypeInfo.Type.DisambiguateType(), TypeInfo.Nullability.Annotation);
-        public AnnotatedTypeSymbol ConvertedType => new AnnotatedTypeSymbol(TypeInfo.ConvertedType.DisambiguateType(), TypeInfo.ConvertedNullability.Annotation);
-
-        private AnnotatedTypeSymbol? cachedType;
-        private bool cachedTypeSet;
-        public AnnotatedTypeSymbol? Type
-        {
-            get
-            {
-                if (cachedTypeSet)
-                    return cachedType;
-
-                var type = ResolvedType;
-
-                if (type.Symbol == null)
-                    type.Symbol = (TypeInfo.Type ?? TypeInfo.ConvertedType).DisambiguateType();
-
-                // Roslyn workaround: It can't work out the type of "new object[0]"
-                // Clearly a bug.
-                if (type.Symbol?.TypeKind == Microsoft.CodeAnalysis.TypeKind.Error)
-                {
-                    if (Node is ArrayCreationExpressionSyntax arrayCreation)
-                    {
-                        var elementType = Context.GetType(arrayCreation.Type.ElementType);
-
-                        if (elementType.Symbol != null)
-                            // There seems to be no way to create an array with a nullable element at present.
-                            return new AnnotatedTypeSymbol(Context.Compilation.CreateArrayTypeSymbol(elementType.Symbol, arrayCreation.Type.RankSpecifiers.Count), NullableAnnotation.NotAnnotated);
-                    }
-
-                    Context.ModelError(Node, "Failed to determine type");
-                }
-
-                cachedType = type;
-                cachedTypeSet = true;
-
-                return type;
-            }
-        }
-
-        private Microsoft.CodeAnalysis.Location location;
-
-        public Microsoft.CodeAnalysis.Location CodeAnalysisLocation
-        {
-            get
-            {
-                if (location == null)
-                    location = Node.FixedLocation();
-                return location;
-            }
-            set
-            {
-                location = value;
-            }
-        }
-
-        public SemanticModel Model => Context.GetModel(Node);
-
-        public string ExprValue
-        {
-            get
-            {
-                var c = Model.GetConstantValue(Node);
-                if (c.HasValue)
-                {
-                    return Expression.ValueAsString(c.Value);
-                }
-
-                if (TryGetBoolValueFromLiteral(out var val))
-                {
-                    return Expression.ValueAsString(val);
-                }
-
-                return null;
-            }
-        }
-
-        private Extraction.Entities.Location cachedLocation;
-
-        public Extraction.Entities.Location Location
-        {
-            get
-            {
-                if (cachedLocation == null)
-                    cachedLocation = Context.Create(CodeAnalysisLocation);
-                return cachedLocation;
-            }
-
-            set
-            {
-                cachedLocation = value;
-            }
-        }
-
-        public ExprKind Kind { get; set; } = ExprKind.UNKNOWN;
-
-        public bool IsCompilerGenerated { get; set; }
-
-        public ExpressionNodeInfo SetParent(IExpressionParentEntity parent, int child)
-        {
-            Parent = parent;
-            Child = child;
-            return this;
-        }
-
-        public ExpressionNodeInfo SetKind(ExprKind kind)
-        {
-            Kind = kind;
-            return this;
-        }
-
-        public ExpressionNodeInfo SetType(AnnotatedTypeSymbol? type)
-        {
-            cachedType = type;
-            cachedTypeSet = true;
-            return this;
-        }
-
-        public ExpressionNodeInfo SetNode(ExpressionSyntax node)
-        {
-            Node = node;
-            return this;
-        }
-
-        private SymbolInfo cachedSymbolInfo;
-
-        public SymbolInfo SymbolInfo
-        {
-            get
-            {
-                if (cachedSymbolInfo.Symbol == null && cachedSymbolInfo.CandidateReason == CandidateReason.None)
-                    cachedSymbolInfo = Model.GetSymbolInfo(Node);
-                return cachedSymbolInfo;
-            }
-        }
-
-        public NullableFlowState FlowState => TypeInfo.Nullability.FlowState;
-
-        private bool TryGetBoolValueFromLiteral(out bool val)
-        {
-            var isTrue = Node.IsKind(SyntaxKind.TrueLiteralExpression);
-            var isFalse = Node.IsKind(SyntaxKind.FalseLiteralExpression);
-
-            val = isTrue;
-            return isTrue || isFalse;
-        }
-
-        public bool IsBoolLiteral()
-        {
-            return TryGetBoolValueFromLiteral(out var _);
-        }
-    }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionInfo.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionInfo.cs
new file mode 100644
index 00000000000..feb1eaa2d93
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionInfo.cs
@@ -0,0 +1,36 @@
+using Microsoft.CodeAnalysis;
+using Semmle.Extraction.Kinds;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    /// <summary>
+    /// Explicitly constructed expression information.
+    /// </summary>
+    internal class ExpressionInfo : IExpressionInfo
+    {
+        public Context Context { get; }
+        public AnnotatedTypeSymbol? Type { get; }
+        public Extraction.Entities.Location Location { get; }
+        public ExprKind Kind { get; }
+        public IExpressionParentEntity Parent { get; }
+        public int Child { get; }
+        public bool IsCompilerGenerated { get; }
+        public string ExprValue { get; }
+
+        public ExpressionInfo(Context cx, AnnotatedTypeSymbol? type, Extraction.Entities.Location location, ExprKind kind,
+            IExpressionParentEntity parent, int child, bool isCompilerGenerated, string value)
+        {
+            Context = cx;
+            Type = type;
+            Location = location;
+            Kind = kind;
+            Parent = parent;
+            Child = child;
+            ExprValue = value;
+            IsCompilerGenerated = isCompilerGenerated;
+        }
+
+        // Synthetic expressions don't have a flow state.
+        public NullableFlowState FlowState => NullableFlowState.None;
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionNodeInfo.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionNodeInfo.cs
new file mode 100644
index 00000000000..6968ca65abb
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionNodeInfo.cs
@@ -0,0 +1,189 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Semmle.Extraction.CSharp.Populators;
+using Semmle.Extraction.Entities;
+using Semmle.Extraction.Kinds;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    /// <summary>
+    /// Expression information constructed from a syntax node.
+    /// </summary>
+    internal class ExpressionNodeInfo : IExpressionInfo
+    {
+        public ExpressionNodeInfo(Context cx, ExpressionSyntax node, IExpressionParentEntity parent, int child) :
+            this(cx, node, parent, child, cx.GetTypeInfo(node))
+        {
+        }
+
+        public ExpressionNodeInfo(Context cx, ExpressionSyntax node, IExpressionParentEntity parent, int child, TypeInfo typeInfo)
+        {
+            Context = cx;
+            Node = node;
+            Parent = parent;
+            Child = child;
+            TypeInfo = typeInfo;
+            Conversion = cx.GetModel(node).GetConversion(node);
+        }
+
+        public Context Context { get; }
+        public ExpressionSyntax Node { get; private set; }
+        public IExpressionParentEntity Parent { get; set; }
+        public int Child { get; set; }
+        public TypeInfo TypeInfo { get; }
+        public Microsoft.CodeAnalysis.CSharp.Conversion Conversion { get; }
+
+        public AnnotatedTypeSymbol ResolvedType => new AnnotatedTypeSymbol(TypeInfo.Type.DisambiguateType(), TypeInfo.Nullability.Annotation);
+        public AnnotatedTypeSymbol ConvertedType => new AnnotatedTypeSymbol(TypeInfo.ConvertedType.DisambiguateType(), TypeInfo.ConvertedNullability.Annotation);
+
+        private AnnotatedTypeSymbol? cachedType;
+        private bool cachedTypeSet;
+        public AnnotatedTypeSymbol? Type
+        {
+            get
+            {
+                if (cachedTypeSet)
+                    return cachedType;
+
+                var type = ResolvedType;
+
+                if (type.Symbol == null)
+                    type.Symbol = (TypeInfo.Type ?? TypeInfo.ConvertedType).DisambiguateType();
+
+                // Roslyn workaround: It can't work out the type of "new object[0]"
+                // Clearly a bug.
+                if (type.Symbol?.TypeKind == Microsoft.CodeAnalysis.TypeKind.Error)
+                {
+                    if (Node is ArrayCreationExpressionSyntax arrayCreation)
+                    {
+                        var elementType = Context.GetType(arrayCreation.Type.ElementType);
+
+                        if (elementType.Symbol != null)
+                            // There seems to be no way to create an array with a nullable element at present.
+                            return new AnnotatedTypeSymbol(Context.Compilation.CreateArrayTypeSymbol(elementType.Symbol, arrayCreation.Type.RankSpecifiers.Count), NullableAnnotation.NotAnnotated);
+                    }
+
+                    Context.ModelError(Node, "Failed to determine type");
+                }
+
+                cachedType = type;
+                cachedTypeSet = true;
+
+                return type;
+            }
+        }
+
+        private Microsoft.CodeAnalysis.Location location;
+
+        public Microsoft.CodeAnalysis.Location CodeAnalysisLocation
+        {
+            get
+            {
+                if (location == null)
+                    location = Node.FixedLocation();
+                return location;
+            }
+            set
+            {
+                location = value;
+            }
+        }
+
+        public SemanticModel Model => Context.GetModel(Node);
+
+        public string ExprValue
+        {
+            get
+            {
+                var c = Model.GetConstantValue(Node);
+                if (c.HasValue)
+                {
+                    return Expression.ValueAsString(c.Value);
+                }
+
+                if (TryGetBoolValueFromLiteral(out var val))
+                {
+                    return Expression.ValueAsString(val);
+                }
+
+                return null;
+            }
+        }
+
+        private Extraction.Entities.Location cachedLocation;
+
+        public Extraction.Entities.Location Location
+        {
+            get
+            {
+                if (cachedLocation == null)
+                    cachedLocation = Context.CreateLocation(CodeAnalysisLocation);
+                return cachedLocation;
+            }
+
+            set
+            {
+                cachedLocation = value;
+            }
+        }
+
+        public ExprKind Kind { get; set; } = ExprKind.UNKNOWN;
+
+        public bool IsCompilerGenerated { get; set; }
+
+        public ExpressionNodeInfo SetParent(IExpressionParentEntity parent, int child)
+        {
+            Parent = parent;
+            Child = child;
+            return this;
+        }
+
+        public ExpressionNodeInfo SetKind(ExprKind kind)
+        {
+            Kind = kind;
+            return this;
+        }
+
+        public ExpressionNodeInfo SetType(AnnotatedTypeSymbol? type)
+        {
+            cachedType = type;
+            cachedTypeSet = true;
+            return this;
+        }
+
+        public ExpressionNodeInfo SetNode(ExpressionSyntax node)
+        {
+            Node = node;
+            return this;
+        }
+
+        private SymbolInfo cachedSymbolInfo;
+
+        public SymbolInfo SymbolInfo
+        {
+            get
+            {
+                if (cachedSymbolInfo.Symbol == null && cachedSymbolInfo.CandidateReason == CandidateReason.None)
+                    cachedSymbolInfo = Model.GetSymbolInfo(Node);
+                return cachedSymbolInfo;
+            }
+        }
+
+        public NullableFlowState FlowState => TypeInfo.Nullability.FlowState;
+
+        private bool TryGetBoolValueFromLiteral(out bool val)
+        {
+            var isTrue = Node.IsKind(SyntaxKind.TrueLiteralExpression);
+            var isFalse = Node.IsKind(SyntaxKind.FalseLiteralExpression);
+
+            val = isTrue;
+            return isTrue || isFalse;
+        }
+
+        public bool IsBoolLiteral()
+        {
+            return TryGetBoolValueFromLiteral(out var _);
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression`1.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression`1.cs
new file mode 100644
index 00000000000..6c027076472
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression`1.cs
@@ -0,0 +1,34 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using System.IO;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    internal abstract class Expression<TExpressionSyntax> : Expression
+        where TExpressionSyntax : ExpressionSyntax
+    {
+        public TExpressionSyntax Syntax { get; }
+
+        protected Expression(ExpressionNodeInfo info)
+            : base(info)
+        {
+            Syntax = (TExpressionSyntax)info.Node;
+        }
+
+        /// <summary>
+        /// Populates expression-type specific relations in the trap file. The general relations
+        /// <code>expressions</code> and <code>expr_location</code> are populated by the constructor
+        /// (should not fail), so even if expression-type specific population fails (e.g., in
+        /// standalone extraction), the expression created via
+        /// <see cref="Expression.Create(Context, ExpressionSyntax, IEntity, int, ITypeSymbol)"/> will
+        /// still be valid.
+        /// </summary>
+        protected abstract void PopulateExpression(TextWriter trapFile);
+
+        protected new Expression TryPopulate()
+        {
+            Context.Try(Syntax, null, () => PopulateExpression(Context.TrapWriter.Writer));
+            return this;
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
index d4d4c86c507..8ef72f8085c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
@@ -47,12 +47,12 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             if (!(target is null))
             {
-                cx.TrapWriter.Writer.expr_access(this, target);
+                Context.TrapWriter.Writer.expr_access(this, target);
             }
 
             if (implicitThis && !symbol.IsStatic)
             {
-                This.CreateImplicit(cx, symbol.ContainingType, Location, this, -1);
+                This.CreateImplicit(Context, symbol.ContainingType, Location, this, -1);
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
index ea818862d80..3d6d3b95722 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
@@ -31,7 +31,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
             if (TypeSyntax is null)
             {
-                cx.ModelError(Syntax, "Array has unexpected type syntax");
+                Context.ModelError(Syntax, "Array has unexpected type syntax");
             }
 
             var firstLevelSizes = TypeSyntax.RankSpecifiers.First()?.Sizes ?? SyntaxFactory.SeparatedList<ExpressionSyntax>();
@@ -44,20 +44,20 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 for (var sizeIndex = 0; sizeIndex < firstLevelSizes.Count; sizeIndex++)
                 {
-                    Create(cx, firstLevelSizes[sizeIndex], this, sizeIndex);
+                    Create(Context, firstLevelSizes[sizeIndex], this, sizeIndex);
                 }
                 explicitlySized = true;
             }
 
             if (!(Initializer is null))
             {
-                ArrayInitializer.Create(new ExpressionNodeInfo(cx, Initializer, this, InitializerIndex));
+                ArrayInitializer.Create(new ExpressionNodeInfo(Context, Initializer, this, InitializerIndex));
             }
 
             if (explicitlySized)
                 trapFile.explicitly_sized_array_creation(this);
 
-            TypeMention.Create(cx, TypeSyntax, this, Type);
+            TypeMention.Create(Context, TypeSyntax, this, Type);
         }
 
         private void SetArraySizes(InitializerExpressionSyntax initializer, int rank)
@@ -69,7 +69,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     return;
                 }
 
-                Literal.CreateGenerated(cx, this, level, cx.Compilation.GetSpecialType(SpecialType.System_Int32), initializer.Expressions.Count, Location);
+                Literal.CreateGenerated(Context, this, level, Context.Compilation.GetSpecialType(SpecialType.System_Int32), initializer.Expressions.Count, Location);
 
                 initializer = initializer.Expressions.FirstOrDefault() as InitializerExpressionSyntax;
             }
@@ -143,7 +143,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            ArrayInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, InitializerIndex));
+            ArrayInitializer.Create(new ExpressionNodeInfo(Context, Syntax.Initializer, this, InitializerIndex));
             trapFile.implicitly_typed_array_creation(this);
             trapFile.stackalloc_array_creation(this);
         }
@@ -159,7 +159,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             if (Syntax.Initializer != null)
             {
-                ArrayInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, InitializerIndex));
+                ArrayInitializer.Create(new ExpressionNodeInfo(Context, Syntax.Initializer, this, InitializerIndex));
             }
 
             trapFile.implicitly_typed_array_creation(this);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
index f785ce65da3..3325c8075a3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
@@ -26,17 +26,17 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             if (operatorKind.HasValue)
             {
                 // Convert assignment such as `a += b` into `a = a + b`.
-                var simpleAssignExpr = new Expression(new ExpressionInfo(cx, Type, Location, ExprKind.SIMPLE_ASSIGN, this, 2, false, null));
-                Create(cx, Syntax.Left, simpleAssignExpr, 1);
-                var opexpr = new Expression(new ExpressionInfo(cx, Type, Location, operatorKind.Value, simpleAssignExpr, 0, false, null));
-                Create(cx, Syntax.Left, opexpr, 0);
-                Create(cx, Syntax.Right, opexpr, 1);
+                var simpleAssignExpr = new Expression(new ExpressionInfo(Context, Type, Location, ExprKind.SIMPLE_ASSIGN, this, 2, false, null));
+                Create(Context, Syntax.Left, simpleAssignExpr, 1);
+                var opexpr = new Expression(new ExpressionInfo(Context, Type, Location, operatorKind.Value, simpleAssignExpr, 0, false, null));
+                Create(Context, Syntax.Left, opexpr, 0);
+                Create(Context, Syntax.Right, opexpr, 1);
                 opexpr.OperatorCall(trapFile, Syntax);
             }
             else
             {
-                Create(cx, Syntax.Left, this, 1);
-                Create(cx, Syntax.Right, this, 0);
+                Create(Context, Syntax.Left, this, 1);
+                Create(Context, Syntax.Right, this, 0);
 
                 if (Kind == ExprKind.ADD_EVENT || Kind == ExprKind.REMOVE_EVENT)
                 {
@@ -148,12 +148,12 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     case ExprKind.ASSIGN_COALESCE:
                         return ExprKind.NULL_COALESCING;
                     default:
-                        cx.ModelError(Syntax, "Couldn't unfold assignment of type " + kind);
+                        Context.ModelError(Syntax, "Couldn't unfold assignment of type " + kind);
                         return ExprKind.UNKNOWN;
                 }
             }
         }
 
-        public new CallType CallType => GetCallType(cx, Syntax);
+        public new CallType CallType => GetCallType(Context, Syntax);
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Await.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Await.cs
index 2f8726c8070..34088d9564a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Await.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Await.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
index 32ee3be5f73..74dcc9ff85f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
@@ -17,8 +17,8 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         protected override void PopulateExpression(TextWriter trapFile)
         {
             OperatorCall(trapFile, Syntax);
-            CreateDeferred(cx, Syntax.Left, this, 0);
-            CreateDeferred(cx, Syntax.Right, this, 1);
+            CreateDeferred(Context, Syntax.Left, this, 0);
+            CreateDeferred(Context, Syntax.Right, this, 1);
         }
 
         private static ExprKind GetKind(Context cx, BinaryExpressionSyntax node)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
index 6f2551ec904..2afe7a9b37e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
@@ -16,17 +16,17 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, ExpressionIndex);
+            Create(Context, Syntax.Expression, this, ExpressionIndex);
 
             if (Kind == ExprKind.CAST)
             {  // Type cast
-                TypeAccess.Create(new ExpressionNodeInfo(cx, Syntax.Type, this, TypeAccessIndex));
+                TypeAccess.Create(new ExpressionNodeInfo(Context, Syntax.Type, this, TypeAccessIndex));
             }
             else
             {
                 // Type conversion
                 OperatorCall(trapFile, Syntax);
-                TypeMention.Create(cx, Syntax.Type, this, Type);
+                TypeMention.Create(Context, Syntax.Type, this, Type);
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Checked.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Checked.cs
index e6958c4511c..4be8b378937 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Checked.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Checked.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Conditional.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Conditional.cs
index bfa4a836feb..193c88b112a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Conditional.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Conditional.cs
@@ -12,9 +12,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Condition, this, 0);
-            Create(cx, Syntax.WhenTrue, this, 1);
-            Create(cx, Syntax.WhenFalse, this, 2);
+            Create(Context, Syntax.Condition, this, 0);
+            Create(Context, Syntax.WhenTrue, this, 1);
+            Create(Context, Syntax.WhenFalse, this, 2);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
index 326516bba1b..9e1b42834b1 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            TypeAccess.Create(cx, Syntax.Type, this, 0);
+            TypeAccess.Create(Context, Syntax.Type, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
index ef35f901b92..4f2eecca9da 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         }
 
         private Discard(Context cx, CSharpSyntaxNode syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, cx.GetType(syntax), cx.Create(syntax.GetLocation()), ExprKind.DISCARD, parent, child, false, null))
+            base(new ExpressionInfo(cx, cx.GetType(syntax), cx.CreateLocation(syntax.GetLocation()), ExprKind.DISCARD, parent, child, false, null))
         {
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ElementAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ElementAccess.cs
index 59e573984fe..e860731ece3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ElementAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ElementAccess.cs
@@ -22,22 +22,22 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             if (Kind == ExprKind.POINTER_INDIRECTION)
             {
-                var qualifierInfo = new ExpressionNodeInfo(cx, qualifier, this, 0);
-                var add = new Expression(new ExpressionInfo(cx, qualifierInfo.Type, Location, ExprKind.ADD, this, 0, false, null));
+                var qualifierInfo = new ExpressionNodeInfo(Context, qualifier, this, 0);
+                var add = new Expression(new ExpressionInfo(Context, qualifierInfo.Type, Location, ExprKind.ADD, this, 0, false, null));
                 qualifierInfo.SetParent(add, 0);
                 CreateFromNode(qualifierInfo);
                 PopulateArguments(trapFile, argumentList, 1);
             }
             else
             {
-                Create(cx, qualifier, this, -1);
+                Create(Context, qualifier, this, -1);
                 PopulateArguments(trapFile, argumentList, 0);
 
-                var symbolInfo = cx.GetSymbolInfo(base.Syntax);
+                var symbolInfo = Context.GetSymbolInfo(base.Syntax);
 
                 if (symbolInfo.Symbol is IPropertySymbol indexer)
                 {
-                    trapFile.expr_access(this, Indexer.Create(cx, indexer));
+                    trapFile.expr_access(this, Indexer.Create(Context, indexer));
                 }
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs
index a21379d897c..48cd73944f3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs
@@ -250,6 +250,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     case SyntaxKind.SuppressNullableWarningExpression:
                         return PostfixUnary.Create(info.SetKind(ExprKind.SUPPRESS_NULLABLE_WARNING), ((PostfixUnaryExpressionSyntax)info.Node).Operand);
 
+                    case SyntaxKind.WithExpression:
+                        return WithExpression.Create(info);
+
                     default:
                         info.Context.ModelError(info.Node, $"Unhandled expression '{info.Node}' of kind '{info.Node.Kind()}'");
                         return new Unknown(info);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
index eccead4a4de..96d8dec039a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         public ImplicitCast(ExpressionNodeInfo info)
             : base(new ExpressionInfo(info.Context, info.ConvertedType, info.Location, ExprKind.CAST, info.Parent, info.Child, true, info.ExprValue))
         {
-            Expr = Factory.Create(new ExpressionNodeInfo(cx, info.Node, this, 0));
+            Expr = Factory.Create(new ExpressionNodeInfo(Context, info.Node, this, 0));
         }
 
         public ImplicitCast(ExpressionNodeInfo info, IMethodSymbol method)
@@ -22,11 +22,11 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             Expr = Factory.Create(info.SetParent(this, 0));
 
-            var target = Method.Create(cx, method);
+            var target = Method.Create(Context, method);
             if (target != null)
-                cx.TrapWriter.Writer.expr_call(this, target);
+                Context.TrapWriter.Writer.expr_call(this, target);
             else
-                cx.ModelError(info.Node, "Failed to resolve target for operator invocation");
+                Context.ModelError(info.Node, "Failed to resolve target for operator invocation");
         }
 
         /// <summary>
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
index d96a44527d8..6f53f1f144e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         protected Initializer(ExpressionNodeInfo info) : base(info) { }
     }
 
-    internal class ArrayInitializer : Expression<InitializerExpressionSyntax>
+    internal class ArrayInitializer : Initializer
     {
         private ArrayInitializer(ExpressionNodeInfo info) : base(info.SetType(null).SetKind(ExprKind.ARRAY_INIT)) { }
 
@@ -26,12 +26,12 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 if (e.Kind() == SyntaxKind.ArrayInitializerExpression)
                 {
                     // Recursively create another array initializer
-                    Create(new ExpressionNodeInfo(cx, (InitializerExpressionSyntax)e, this, child++));
+                    Create(new ExpressionNodeInfo(Context, (InitializerExpressionSyntax)e, this, child++));
                 }
                 else
                 {
                     // Create the expression normally.
-                    Create(cx, e, this, child++);
+                    Create(Context, e, this, child++);
                 }
             }
         }
@@ -61,7 +61,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            ArrayInitializer.Create(new ExpressionNodeInfo(cx, Syntax, this, -1));
+            ArrayInitializer.Create(new ExpressionNodeInfo(Context, Syntax, this, -1));
             trapFile.implicitly_typed_array_creation(this);
         }
     }
@@ -81,9 +81,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 if (init is AssignmentExpressionSyntax assignment)
                 {
-                    var assignmentInfo = new ExpressionNodeInfo(cx, init, this, child++).SetKind(ExprKind.SIMPLE_ASSIGN);
+                    var assignmentInfo = new ExpressionNodeInfo(Context, init, this, child++).SetKind(ExprKind.SIMPLE_ASSIGN);
                     var assignmentEntity = new Expression(assignmentInfo);
-                    var typeInfoRight = cx.GetTypeInfo(assignment.Right);
+                    var typeInfoRight = Context.GetTypeInfo(assignment.Right);
                     if (typeInfoRight.Type is null)
                         // The type may be null for nested initializers such as
                         // ```csharp
@@ -92,15 +92,15 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         // In this case we take the type from the assignment
                         // `As = { [0] = a }` instead
                         typeInfoRight = assignmentInfo.TypeInfo;
-                    CreateFromNode(new ExpressionNodeInfo(cx, assignment.Right, assignmentEntity, 0, typeInfoRight));
+                    CreateFromNode(new ExpressionNodeInfo(Context, assignment.Right, assignmentEntity, 0, typeInfoRight));
 
-                    var target = cx.GetSymbolInfo(assignment.Left);
+                    var target = Context.GetSymbolInfo(assignment.Left);
 
                     // If the target is null, then assume that this is an array initializer (of the form `[...] = ...`)
 
                     var access = target.Symbol is null ?
-                        new Expression(new ExpressionNodeInfo(cx, assignment.Left, assignmentEntity, 1).SetKind(ExprKind.ARRAY_ACCESS)) :
-                        Access.Create(new ExpressionNodeInfo(cx, assignment.Left, assignmentEntity, 1), target.Symbol, false, cx.CreateEntity(target.Symbol));
+                        new Expression(new ExpressionNodeInfo(Context, assignment.Left, assignmentEntity, 1).SetKind(ExprKind.ARRAY_ACCESS)) :
+                        Access.Create(new ExpressionNodeInfo(Context, assignment.Left, assignmentEntity, 1), target.Symbol, false, Context.CreateEntity(target.Symbol));
 
                     if (assignment.Left is ImplicitElementAccessSyntax iea)
                     {
@@ -109,14 +109,14 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         var indexChild = 0;
                         foreach (var arg in iea.ArgumentList.Arguments)
                         {
-                            Expression.Create(cx, arg.Expression, access, indexChild++);
+                            Expression.Create(Context, arg.Expression, access, indexChild++);
                         }
                     }
                 }
                 else
                 {
-                    cx.ModelError(init, "Unexpected object initialization");
-                    Create(cx, init, this, child++);
+                    Context.ModelError(init, "Unexpected object initialization");
+                    Create(Context, init, this, child++);
                 }
             }
         }
@@ -133,16 +133,16 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             var child = 0;
             foreach (var i in Syntax.Expressions)
             {
-                var collectionInfo = cx.GetModel(Syntax).GetCollectionInitializerSymbolInfo(i);
-                var addMethod = Method.Create(cx, collectionInfo.Symbol as IMethodSymbol);
-                var voidType = AnnotatedTypeSymbol.CreateNotAnnotated(cx.Compilation.GetSpecialType(SpecialType.System_Void));
+                var collectionInfo = Context.GetModel(Syntax).GetCollectionInitializerSymbolInfo(i);
+                var addMethod = Method.Create(Context, collectionInfo.Symbol as IMethodSymbol);
+                var voidType = AnnotatedTypeSymbol.CreateNotAnnotated(Context.Compilation.GetSpecialType(SpecialType.System_Void));
 
-                var invocation = new Expression(new ExpressionInfo(cx, voidType, cx.Create(i.GetLocation()), ExprKind.METHOD_INVOCATION, this, child++, false, null));
+                var invocation = new Expression(new ExpressionInfo(Context, voidType, Context.CreateLocation(i.GetLocation()), ExprKind.METHOD_INVOCATION, this, child++, false, null));
 
                 if (addMethod != null)
                     trapFile.expr_call(invocation, addMethod);
                 else
-                    cx.ModelError(Syntax, "Unable to find an Add() method for collection initializer");
+                    Context.ModelError(Syntax, "Unable to find an Add() method for collection initializer");
 
                 if (i.Kind() == SyntaxKind.ComplexElementInitializerExpression)
                 {
@@ -154,12 +154,12 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     var addChild = 0;
                     foreach (var arg in init.Expressions)
                     {
-                        Create(cx, arg, invocation, addChild++);
+                        Create(Context, arg, invocation, addChild++);
                     }
                 }
                 else
                 {
-                    Create(cx, i, invocation, 0);
+                    Create(Context, i, invocation, 0);
                 }
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/InterpolatedString.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/InterpolatedString.cs
index 152ff145897..ee69580f83a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/InterpolatedString.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/InterpolatedString.cs
@@ -22,12 +22,12 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 {
                     case SyntaxKind.Interpolation:
                         var interpolation = (InterpolationSyntax)c;
-                        Create(cx, interpolation.Expression, this, child++);
+                        Create(Context, interpolation.Expression, this, child++);
                         break;
                     case SyntaxKind.InterpolatedStringText:
                         // Create a string literal
                         var interpolatedText = (InterpolatedStringTextSyntax)c;
-                        new Expression(new ExpressionInfo(cx, Type, cx.Create(c.GetLocation()), ExprKind.STRING_LITERAL, this, child++, false, interpolatedText.TextToken.Text));
+                        new Expression(new ExpressionInfo(Context, Type, Context.CreateLocation(c.GetLocation()), ExprKind.STRING_LITERAL, this, child++, false, interpolatedText.TextToken.Text));
                         break;
                     default:
                         throw new InternalError(c, $"Unhandled interpolation kind {c.Kind()}");
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
index 638822f3d27..408556dff63 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -37,15 +37,15 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     memberName = memberAccess.Name.Identifier.Text;
                     if (Syntax.Expression.Kind() == SyntaxKind.SimpleMemberAccessExpression)
                         // Qualified method call; `x.M()`
-                        Create(cx, memberAccess.Expression, this, child++);
+                        Create(Context, memberAccess.Expression, this, child++);
                     else
                         // Pointer member access; `x->M()`
-                        Create(cx, Syntax.Expression, this, child++);
+                        Create(Context, Syntax.Expression, this, child++);
                     break;
                 case MemberBindingExpressionSyntax memberBinding:
                     // Conditionally qualified method call; `x?.M()`
                     memberName = memberBinding.Name.Identifier.Text;
-                    Create(cx, FindConditionalQualifier(memberBinding), this, child++);
+                    Create(Context, FindConditionalQualifier(memberBinding), this, child++);
                     MakeConditional(trapFile);
                     break;
                 case SimpleNameSyntax simpleName when (Kind == ExprKind.METHOD_INVOCATION):
@@ -55,10 +55,10 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     {
                         // Implicit `this` qualifier; add explicitly
 
-                        if (cx.GetModel(Syntax).GetEnclosingSymbol(Location.symbol.SourceSpan.Start) is IMethodSymbol callingMethod)
-                            This.CreateImplicit(cx, callingMethod.ContainingType, Location, this, child++);
+                        if (Context.GetModel(Syntax).GetEnclosingSymbol(Location.Symbol.SourceSpan.Start) is IMethodSymbol callingMethod)
+                            This.CreateImplicit(Context, callingMethod.ContainingType, Location, this, child++);
                         else
-                            cx.ModelError(Syntax, "Couldn't determine implicit this type");
+                            Context.ModelError(Syntax, "Couldn't determine implicit this type");
                     }
                     else
                     {
@@ -68,7 +68,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     break;
                 default:
                     // Delegate or function pointer call; `d()`
-                    Create(cx, Syntax.Expression, this, child++);
+                    Create(Context, Syntax.Expression, this, child++);
                     break;
             }
 
@@ -78,7 +78,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 if (memberName != null)
                     trapFile.dynamic_member_name(this, memberName);
                 else
-                    cx.ModelError(Syntax, "Unable to get name for dynamic call.");
+                    Context.ModelError(Syntax, "Unable to get name for dynamic call.");
             }
 
             PopulateArguments(trapFile, Syntax.ArgumentList, child);
@@ -86,11 +86,11 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             if (target == null)
             {
                 if (!isDynamicCall && !IsDelegateLikeCall(info))
-                    cx.ModelError(Syntax, "Unable to resolve target for call. (Compilation error?)");
+                    Context.ModelError(Syntax, "Unable to resolve target for call. (Compilation error?)");
                 return;
             }
 
-            var targetKey = Method.Create(cx, target);
+            var targetKey = Method.Create(Context, target);
             trapFile.expr_call(this, targetKey);
         }
 
@@ -125,7 +125,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         .Where(method => method.Parameters.Length >= Syntax.ArgumentList.Arguments.Count)
                         .Where(method => method.Parameters.Count(p => !p.HasExplicitDefaultValue) <= Syntax.ArgumentList.Arguments.Count);
 
-                    return cx.Extractor.Standalone ?
+                    return Context.Extractor.Standalone ?
                         candidates.FirstOrDefault() :
                         candidates.SingleOrDefault();
                 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/IsPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/IsPattern.cs
index 741d108ba01..1c335474a68 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/IsPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/IsPattern.cs
@@ -12,8 +12,8 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
-            Expressions.Pattern.Create(cx, Syntax.Pattern, this, 1);
+            Create(Context, Syntax.Expression, this, 0);
+            Expressions.Pattern.Create(Context, Syntax.Pattern, this, 1);
         }
 
         public static Expression Create(ExpressionNodeInfo info) => new IsPattern(info).TryPopulate();
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Lambda.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Lambda.cs
index 40f200ef5ef..2cd23101b1c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Lambda.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Lambda.cs
@@ -17,34 +17,34 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         private void VisitParameter(ParameterSyntax p)
         {
-            var symbol = cx.GetModel(p).GetDeclaredSymbol(p);
-            Parameter.Create(cx, symbol, this);
+            var symbol = Context.GetModel(p).GetDeclaredSymbol(p);
+            Parameter.Create(Context, symbol, this);
         }
 
         private Lambda(ExpressionNodeInfo info, CSharpSyntaxNode body, IEnumerable<ParameterSyntax> @params)
             : base(info)
         {
-            if (cx.GetModel(info.Node).GetSymbolInfo(info.Node).Symbol is IMethodSymbol symbol)
+            if (Context.GetModel(info.Node).GetSymbolInfo(info.Node).Symbol is IMethodSymbol symbol)
             {
-                Modifier.ExtractModifiers(cx, info.Context.TrapWriter.Writer, this, symbol);
+                Modifier.ExtractModifiers(Context, info.Context.TrapWriter.Writer, this, symbol);
             }
             else
             {
-                cx.ModelError(info.Node, "Unknown declared symbol");
+                Context.ModelError(info.Node, "Unknown declared symbol");
             }
 
             // No need to use `Populate` as the population happens later
-            cx.PopulateLater(() =>
+            Context.PopulateLater(() =>
             {
                 foreach (var param in @params)
                     VisitParameter(param);
 
                 if (body is ExpressionSyntax exprBody)
-                    Create(cx, exprBody, this, 0);
+                    Create(Context, exprBody, this, 0);
                 else if (body is BlockSyntax blockBody)
-                    Statements.Block.Create(cx, blockBody, this, 0);
+                    Statements.Block.Create(Context, blockBody, this, 0);
                 else
-                    cx.ModelError(body, "Unhandled lambda body");
+                    Context.ModelError(body, "Unhandled lambda body");
             });
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MakeRef.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MakeRef.cs
index 751d6b6e92c..66f2fd8676a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MakeRef.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MakeRef.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
index 7d2777540f0..fa9d3c9a6dd 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
@@ -9,16 +9,16 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         private MemberAccess(ExpressionNodeInfo info, ExpressionSyntax qualifier, ISymbol target) : base(info)
         {
             var trapFile = info.Context.TrapWriter.Writer;
-            Qualifier = Create(cx, qualifier, this, -1);
+            Qualifier = Create(Context, qualifier, this, -1);
 
             if (target == null)
             {
                 if (info.Kind != ExprKind.DYNAMIC_MEMBER_ACCESS)
-                    cx.ModelError(info.Node, "Could not determine target for member access");
+                    Context.ModelError(info.Node, "Could not determine target for member access");
             }
             else
             {
-                var t = cx.CreateEntity(target);
+                var t = Context.CreateEntity(target);
                 trapFile.expr_access(this, t);
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
index 5703c3101a2..df291c4e9fd 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
@@ -17,32 +17,32 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            var target = cx.GetSymbolInfo(Syntax);
+            var target = Context.GetSymbolInfo(Syntax);
             var method = (IMethodSymbol)target.Symbol;
 
             if (method != null)
             {
-                trapFile.expr_call(this, Method.Create(cx, method));
+                trapFile.expr_call(this, Method.Create(Context, method));
             }
             var child = 0;
 
             var objectInitializer = Syntax.Initializers.Any() ?
-                new Expression(new ExpressionInfo(cx, Type, Location, ExprKind.OBJECT_INIT, this, -1, false, null)) :
+                new Expression(new ExpressionInfo(Context, Type, Location, ExprKind.OBJECT_INIT, this, -1, false, null)) :
                 null;
 
             foreach (var init in Syntax.Initializers)
             {
                 // Create an "assignment"
-                var property = cx.GetModel(init).GetDeclaredSymbol(init);
-                var propEntity = Property.Create(cx, property);
+                var property = Context.GetModel(init).GetDeclaredSymbol(init);
+                var propEntity = Property.Create(Context, property);
                 var type = property.GetAnnotatedType();
-                var loc = cx.Create(init.GetLocation());
+                var loc = Context.CreateLocation(init.GetLocation());
 
-                var assignment = new Expression(new ExpressionInfo(cx, type, loc, ExprKind.SIMPLE_ASSIGN, objectInitializer, child++, false, null));
-                Create(cx, init.Expression, assignment, 0);
-                Property.Create(cx, property);
+                var assignment = new Expression(new ExpressionInfo(Context, type, loc, ExprKind.SIMPLE_ASSIGN, objectInitializer, child++, false, null));
+                Create(Context, init.Expression, assignment, 0);
+                Property.Create(Context, property);
 
-                var access = new Expression(new ExpressionInfo(cx, type, loc, ExprKind.PROPERTY_ACCESS, assignment, 1, false, null));
+                var access = new Expression(new ExpressionInfo(Context, type, loc, ExprKind.PROPERTY_ACCESS, assignment, 1, false, null));
                 trapFile.expr_access(access, propEntity);
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
index 10f4df8bf7f..6f2c38b63db 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
@@ -22,22 +22,22 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 PopulateArguments(trapFile, Syntax.ArgumentList, 0);
             }
 
-            var target = cx.GetModel(Syntax).GetSymbolInfo(Syntax);
+            var target = Context.GetModel(Syntax).GetSymbolInfo(Syntax);
             if (target.Symbol is IMethodSymbol method)
             {
-                trapFile.expr_call(this, Method.Create(cx, method));
+                trapFile.expr_call(this, Method.Create(Context, method));
             }
 
-            if (IsDynamicObjectCreation(cx, Syntax))
+            if (IsDynamicObjectCreation(Context, Syntax))
             {
-                if (cx.GetModel(Syntax).GetTypeInfo(Syntax).Type is INamedTypeSymbol type &&
+                if (Context.GetModel(Syntax).GetTypeInfo(Syntax).Type is INamedTypeSymbol type &&
                     !string.IsNullOrEmpty(type.Name))
                 {
                     trapFile.dynamic_member_name(this, type.Name);
                 }
                 else
                 {
-                    cx.ModelError(Syntax, "Unable to get name for dynamic object creation.");
+                    Context.ModelError(Syntax, "Unable to get name for dynamic object creation.");
                 }
             }
 
@@ -46,13 +46,13 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 switch (Syntax.Initializer.Kind())
                 {
                     case SyntaxKind.CollectionInitializerExpression:
-                        CollectionInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1).SetType(Type));
+                        CollectionInitializer.Create(new ExpressionNodeInfo(Context, Syntax.Initializer, this, -1).SetType(Type));
                         break;
                     case SyntaxKind.ObjectInitializerExpression:
-                        ObjectInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1).SetType(Type));
+                        ObjectInitializer.Create(new ExpressionNodeInfo(Context, Syntax.Initializer, this, -1).SetType(Type));
                         break;
                     default:
-                        cx.ModelError("Unhandled initializer in object creation");
+                        Context.ModelError("Unhandled initializer in object creation");
                         break;
                 }
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/ExplicitObjectCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/ExplicitObjectCreation.cs
index 51b2db20a9e..f51ab0cb810 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/ExplicitObjectCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/ExplicitObjectCreation.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             base.PopulateExpression(trapFile);
 
-            TypeMention.Create(cx, Syntax.Type, this, Type);
+            TypeMention.Create(Context, Syntax.Type, this, Type);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/BinaryPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/BinaryPattern.cs
index 33ea47d057b..2d0292ae720 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/BinaryPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/BinaryPattern.cs
@@ -9,7 +9,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class BinaryPattern : Expression
     {
         public BinaryPattern(Context cx, BinaryPatternSyntax syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), GetKind(syntax.OperatorToken, syntax), parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.CreateLocation(syntax.GetLocation()), GetKind(syntax.OperatorToken, syntax), parent, child, false, null))
         {
             Pattern.Create(cx, syntax.Left, this, 0);
             Pattern.Create(cx, syntax.Right, this, 1);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
index 65912ba12f1..05f3aab2526 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
@@ -34,7 +34,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                             if (cx.GetModel(syntax).GetDeclaredSymbol(designation) is ILocalSymbol symbol)
                             {
                                 var type = symbol.GetAnnotatedType();
-                                return VariableDeclaration.Create(cx, symbol, type, declPattern.Type, cx.Create(syntax.GetLocation()), false, parent, child);
+                                return VariableDeclaration.Create(cx, symbol, type, declPattern.Type, cx.CreateLocation(syntax.GetLocation()), false, parent, child);
                             }
                             if (designation is DiscardDesignationSyntax)
                             {
@@ -61,7 +61,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                             {
                                 var type = symbol.GetAnnotatedType();
 
-                                return VariableDeclaration.Create(cx, symbol, type, null, cx.Create(syntax.GetLocation()), true, parent, child);
+                                return VariableDeclaration.Create(cx, symbol, type, null, cx.CreateLocation(syntax.GetLocation()), true, parent, child);
                             }
 
                             throw new InternalError(varPattern, "Unable to get the declared symbol of the var pattern designation.");
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
index 0f3c2bf8800..f0ae03ae9dc 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class PositionalPattern : Expression
     {
         internal PositionalPattern(Context cx, PositionalPatternClauseSyntax posPc, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, null, cx.Create(posPc.GetLocation()), ExprKind.POSITIONAL_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.CreateLocation(posPc.GetLocation()), ExprKind.POSITIONAL_PATTERN, parent, child, false, null))
         {
             child = 0;
             foreach (var sub in posPc.Subpatterns)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
index ed947990045..7bd13e7a8a3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class PropertyPattern : Expression
     {
         internal PropertyPattern(Context cx, PropertyPatternClauseSyntax pp, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, null, cx.Create(pp.GetLocation()), ExprKind.PROPERTY_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.CreateLocation(pp.GetLocation()), ExprKind.PROPERTY_PATTERN, parent, child, false, null))
         {
             child = 0;
             var trapFile = cx.TrapWriter.Writer;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
index 02246311648..d29292b3073 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
@@ -16,7 +16,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         /// <param name="parent">The parent pattern/expression.</param>
         /// <param name="child">The child index of this pattern.</param>
         public RecursivePattern(Context cx, RecursivePatternSyntax syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), ExprKind.RECURSIVE_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.CreateLocation(syntax.GetLocation()), ExprKind.RECURSIVE_PATTERN, parent, child, false, null))
         {
             // Extract the type access
             if (syntax.Type is TypeSyntax t)
@@ -27,7 +27,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 var type = symbol.GetAnnotatedType();
 
-                VariableDeclaration.Create(cx, symbol, type, null, cx.Create(syntax.GetLocation()), false, this, 0);
+                VariableDeclaration.Create(cx, symbol, type, null, cx.CreateLocation(syntax.GetLocation()), false, this, 0);
             }
 
             if (syntax.PositionalPatternClause is PositionalPatternClauseSyntax posPc)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
index 77efd5668c4..c1a140005dc 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
@@ -9,7 +9,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class RelationalPattern : Expression
     {
         public RelationalPattern(Context cx, RelationalPatternSyntax syntax, IExpressionParentEntity parent, int child) :
-             base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), GetKind(syntax.OperatorToken), parent, child, false, null))
+             base(new ExpressionInfo(cx, null, cx.CreateLocation(syntax.GetLocation()), GetKind(syntax.OperatorToken), parent, child, false, null))
         {
             Expression.Create(cx, syntax.Expression, this, 0);
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
index d80c390efff..ce2cf773a92 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class UnaryPattern : Expression
     {
         public UnaryPattern(Context cx, UnaryPatternSyntax syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), ExprKind.NOT_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.CreateLocation(syntax.GetLocation()), ExprKind.NOT_PATTERN, parent, child, false, null))
         {
             Pattern.Create(cx, syntax.Pattern, this, 0);
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PointerMemberAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PointerMemberAccess.cs
index 01df338d1b3..a8ea0a30780 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PointerMemberAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PointerMemberAccess.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
 
             // !! We do not currently look at the member (or store the member name).
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
index 30c6058d95f..24d07441964 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
@@ -20,7 +20,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, operand, this, 0);
+            Create(Context, operand, this, 0);
             OperatorCall(trapFile, Syntax);
 
             if ((operatorKind == ExprKind.POST_INCR || operatorKind == ExprKind.POST_DECR) &&
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
index 1db6c39fef2..f919aaca568 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             public QueryCall(Context cx, IMethodSymbol method, SyntaxNode clause, IExpressionParentEntity parent, int child)
                 : base(new ExpressionInfo(cx, method?.GetAnnotatedReturnType(),
-                        cx.Create(clause.GetLocation()),
+                        cx.CreateLocation(clause.GetLocation()),
                         ExprKind.METHOD_INVOCATION, parent, child, false, null))
             {
                 if (method != null)
@@ -89,7 +89,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     variableSymbol,
                     declType,
                     declTypeSyntax,
-                    cx.Create(node.GetLocation()),
+                    cx.CreateLocation(node.GetLocation()),
                     true,
                     parent,
                     child
@@ -97,7 +97,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
                 Expression.Create(cx, Expr, decl, 0);
 
-                var nameLoc = cx.Create(name.GetLocation());
+                var nameLoc = cx.CreateLocation(name.GetLocation());
                 var access = new Expression(new ExpressionInfo(cx, type, nameLoc, ExprKind.LOCAL_VARIABLE_ACCESS, decl, 1, false, null));
                 cx.TrapWriter.Writer.expr_access(access, LocalVariable.Create(cx, variableSymbol));
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RangeExpression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RangeExpression.cs
index db5cd138155..2011f4ae367 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RangeExpression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RangeExpression.cs
@@ -13,9 +13,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         protected override void PopulateExpression(TextWriter trapFile)
         {
             if (!(Syntax.LeftOperand is null))
-                Expression.Create(cx, Syntax.LeftOperand, this, 0);
+                Expression.Create(Context, Syntax.LeftOperand, this, 0);
             if (!(Syntax.RightOperand is null))
-                Expression.Create(cx, Syntax.RightOperand, this, 1);
+                Expression.Create(Context, Syntax.RightOperand, this, 1);
         }
 
         public static Expression Create(ExpressionNodeInfo info) => new RangeExpression(info).TryPopulate();
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Ref.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Ref.cs
index 5b38b9b8ee6..ef28f5d7e25 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Ref.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Ref.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefType.cs
index 37f7e2a3f76..815a5928f51 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefType.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefValue.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefValue.cs
index 2372cc4bb09..7d9187533ae 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefValue.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/RefValue.cs
@@ -12,8 +12,8 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
-            Create(cx, Syntax.Type, this, 1);   // A type-access
+            Create(Context, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Type, this, 1);   // A type-access
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Sizeof.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Sizeof.cs
index a4b89928e00..d55fe1781ce 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Sizeof.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Sizeof.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            TypeAccess.Create(cx, Syntax.Type, this, 0);
+            TypeAccess.Create(Context, Syntax.Type, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
index 5fdc08c66d3..3dbe496cd4c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
@@ -17,10 +17,10 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            SwitchedExpr = Expression.Create(cx, Syntax.GoverningExpression, this, -1);
+            SwitchedExpr = Expression.Create(Context, Syntax.GoverningExpression, this, -1);
             for (var i = 0; i < Syntax.Arms.Count; i++)
             {
-                new SwitchCase(cx, Syntax.Arms[i], this, i);
+                new SwitchCase(Context, Syntax.Arms[i], this, i);
             }
         }
     }
@@ -29,7 +29,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     {
         internal SwitchCase(Context cx, SwitchExpressionArmSyntax arm, Switch parent, int child) :
             base(new ExpressionInfo(
-                cx, cx.GetType(arm.Expression), cx.Create(arm.GetLocation()),
+                cx, cx.GetType(arm.Expression), cx.CreateLocation(arm.GetLocation()),
                 ExprKind.SWITCH_CASE, parent, child, false, null))
         {
             Expressions.Pattern.Create(cx, arm.Pattern, this, 0);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Throw.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Throw.cs
index 5ef8feaebb6..36d0b34bf95 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Throw.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Throw.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Tuple.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Tuple.cs
index f2911bdcf75..726f8f540d7 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Tuple.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Tuple.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             var child = 0;
             foreach (var argument in Syntax.Arguments.Select(a => a.Expression))
             {
-                Expression.Create(cx, argument, this, child++);
+                Expression.Create(Context, argument, this, child++);
             }
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
index e5c0fd3ac66..54b9730e3d7 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
@@ -18,17 +18,17 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     if (Type?.Symbol.ContainingType is null)
                     {
                         // namespace qualifier
-                        TypeMention.Create(cx, maes.Name, this, Type, Syntax.GetLocation());
+                        TypeMention.Create(Context, maes.Name, this, Type, Syntax.GetLocation());
                     }
                     else
                     {
                         // type qualifier
-                        TypeMention.Create(cx, maes.Name, this, Type);
-                        Create(cx, maes.Expression, this, -1);
+                        TypeMention.Create(Context, maes.Name, this, Type);
+                        Create(Context, maes.Expression, this, -1);
                     }
                     return;
                 default:
-                    TypeMention.Create(cx, (TypeSyntax)Syntax, this, Type);
+                    TypeMention.Create(Context, (TypeSyntax)Syntax, this, Type);
                     return;
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
index 686e4156528..6e5dc3e05f1 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            TypeAccess.Create(cx, Syntax.Type, this, TypeAccessIndex);
+            TypeAccess.Create(Context, Syntax.Type, this, TypeAccessIndex);
         }
 
         public static Expression CreateGenerated(Context cx, IExpressionParentEntity parent, int childIndex, Microsoft.CodeAnalysis.ITypeSymbol type, Extraction.Entities.Location location)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
index f3c2c73b074..8cad73d6565 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Operand, this, 0);
+            Create(Context, Syntax.Operand, this, 0);
             OperatorCall(trapFile, Syntax);
 
             if ((operatorKind == ExprKind.PRE_INCR || operatorKind == ExprKind.PRE_DECR) &&
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unchecked.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unchecked.cs
index 5ffcf414132..016c3fcefc8 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unchecked.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unchecked.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         protected override void PopulateExpression(TextWriter trapFile)
         {
-            Create(cx, Syntax.Expression, this, 0);
+            Create(Context, Syntax.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
index 349236e893a..674f45b3f21 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
@@ -50,7 +50,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         public static Expression CreateParenthesized(Context cx, DeclarationExpressionSyntax node, ParenthesizedVariableDesignationSyntax designation, IExpressionParentEntity parent, int child)
         {
             AnnotatedTypeSymbol? type = null; // Should ideally be a corresponding tuple type
-            var tuple = new Expression(new ExpressionInfo(cx, type, cx.Create(node.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
+            var tuple = new Expression(new ExpressionInfo(cx, type, cx.CreateLocation(node.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
 
             cx.Try(null, null, () =>
             {
@@ -65,7 +65,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         public static Expression CreateParenthesized(Context cx, VarPatternSyntax varPattern, ParenthesizedVariableDesignationSyntax designation, IExpressionParentEntity parent, int child)
         {
             AnnotatedTypeSymbol? type = null; // Should ideally be a corresponding tuple type
-            var tuple = new Expression(new ExpressionInfo(cx, type, cx.Create(varPattern.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
+            var tuple = new Expression(new ExpressionInfo(cx, type, cx.CreateLocation(varPattern.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
 
             cx.Try(null, null, () =>
             {
@@ -123,7 +123,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             Create(cx, node, node.Designation, parent, child);
 
         public static VariableDeclaration Create(Context cx, CSharpSyntaxNode c, AnnotatedTypeSymbol? type, IExpressionParentEntity parent, int child) =>
-            new VariableDeclaration(new ExpressionInfo(cx, type, cx.Create(c.FixedLocation()), ExprKind.LOCAL_VAR_DECL, parent, child, false, null));
+            new VariableDeclaration(new ExpressionInfo(cx, type, cx.CreateLocation(c.FixedLocation()), ExprKind.LOCAL_VAR_DECL, parent, child, false, null));
 
         public static VariableDeclaration Create(Context cx, CatchDeclarationSyntax d, bool isVar, IExpressionParentEntity parent, int child)
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/WithExpression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/WithExpression.cs
new file mode 100644
index 00000000000..dc4e6ad12a0
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/WithExpression.cs
@@ -0,0 +1,20 @@
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Semmle.Extraction.Kinds;
+using System.IO;
+
+namespace Semmle.Extraction.CSharp.Entities.Expressions
+{
+    internal class WithExpression : Expression<WithExpressionSyntax>
+    {
+        private WithExpression(ExpressionNodeInfo info) : base(info.SetKind(ExprKind.WITH)) { }
+
+        public static Expression Create(ExpressionNodeInfo info) => new WithExpression(info).TryPopulate();
+
+        protected override void PopulateExpression(TextWriter trapFile)
+        {
+            Create(Context, Syntax.Expression, this, 0);
+
+            ObjectInitializer.Create(new ExpressionNodeInfo(Context, Syntax.Initializer, this, 1).SetType(Type));
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
index aadd9d2fbab..1c435ebd7d1 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private Field(Context cx, IFieldSymbol init)
             : base(cx, init)
         {
-            type = new Lazy<Type>(() => Entities.Type.Create(cx, symbol.Type));
+            type = new Lazy<Type>(() => Entities.Type.Create(cx, Symbol.Type));
         }
 
         public static Field Create(Context cx, IFieldSymbol field) => FieldFactory.Instance.CreateEntityFromSymbol(cx, field);
@@ -22,78 +22,78 @@ namespace Semmle.Extraction.CSharp.Entities
         // Do not populate backing fields.
         // Populate Tuple fields.
         public override bool NeedsPopulation =>
-            (base.NeedsPopulation && !symbol.IsImplicitlyDeclared) || symbol.ContainingType.IsTupleType;
+            (base.NeedsPopulation && !Symbol.IsImplicitlyDeclared) || Symbol.ContainingType.IsTupleType;
 
         public override void Populate(TextWriter trapFile)
         {
             PopulateMetadataHandle(trapFile);
             PopulateAttributes();
             ContainingType.PopulateGenerics();
-            PopulateNullability(trapFile, symbol.GetAnnotatedType());
+            PopulateNullability(trapFile, Symbol.GetAnnotatedType());
 
-            var unboundFieldKey = Field.Create(Context, symbol.OriginalDefinition);
-            trapFile.fields(this, (symbol.IsConst ? 2 : 1), symbol.Name, ContainingType, Type.TypeRef, unboundFieldKey);
+            var unboundFieldKey = Field.Create(Context, Symbol.OriginalDefinition);
+            trapFile.fields(this, (Symbol.IsConst ? 2 : 1), Symbol.Name, ContainingType, Type.TypeRef, unboundFieldKey);
 
             PopulateModifiers(trapFile);
 
-            if (symbol.IsVolatile)
+            if (Symbol.IsVolatile)
                 Modifier.HasModifier(Context, trapFile, this, "volatile");
 
-            if (symbol.IsConst)
+            if (Symbol.IsConst)
             {
                 Modifier.HasModifier(Context, trapFile, this, "const");
 
-                if (symbol.HasConstantValue)
+                if (Symbol.HasConstantValue)
                 {
-                    trapFile.constant_value(this, Expression.ValueAsString(symbol.ConstantValue));
+                    trapFile.constant_value(this, Expression.ValueAsString(Symbol.ConstantValue));
                 }
             }
 
             foreach (var l in Locations)
                 trapFile.field_location(this, l);
 
-            if (!IsSourceDeclaration || !symbol.FromSource())
+            if (!IsSourceDeclaration || !Symbol.FromSource())
                 return;
 
-            Context.BindComments(this, Location.symbol);
+            Context.BindComments(this, Location.Symbol);
 
             var child = 0;
-            foreach (var initializer in symbol.DeclaringSyntaxReferences
+            foreach (var initializer in Symbol.DeclaringSyntaxReferences
                 .Select(n => n.GetSyntax())
                 .OfType<VariableDeclaratorSyntax>()
                 .Where(n => n.Initializer != null))
             {
                 Context.PopulateLater(() =>
                 {
-                    var loc = Context.Create(initializer.GetLocation());
+                    var loc = Context.CreateLocation(initializer.GetLocation());
 
                     var fieldAccess = AddInitializerAssignment(trapFile, initializer.Initializer.Value, loc, null, ref child);
 
-                    if (!symbol.IsStatic)
+                    if (!Symbol.IsStatic)
                     {
-                        This.CreateImplicit(Context, symbol.ContainingType, Location, fieldAccess, -1);
+                        This.CreateImplicit(Context, Symbol.ContainingType, Location, fieldAccess, -1);
                     }
                 });
             }
 
-            foreach (var initializer in symbol.DeclaringSyntaxReferences
+            foreach (var initializer in Symbol.DeclaringSyntaxReferences
                 .Select(n => n.GetSyntax())
                 .OfType<EnumMemberDeclarationSyntax>()
                 .Where(n => n.EqualsValue != null))
             {
                 // Mark fields that have explicit initializers.
-                var constValue = symbol.HasConstantValue
-                    ? Expression.ValueAsString(symbol.ConstantValue)
+                var constValue = Symbol.HasConstantValue
+                    ? Expression.ValueAsString(Symbol.ConstantValue)
                     : null;
 
-                var loc = Context.Create(initializer.GetLocation());
+                var loc = Context.CreateLocation(initializer.GetLocation());
 
                 AddInitializerAssignment(trapFile, initializer.EqualsValue.Value, loc, constValue, ref child);
             }
 
             if (IsSourceDeclaration)
             {
-                foreach (var syntax in symbol.DeclaringSyntaxReferences
+                foreach (var syntax in Symbol.DeclaringSyntaxReferences
                   .Select(d => d.GetSyntax())
                   .OfType<VariableDeclaratorSyntax>()
                   .Select(d => d.Parent)
@@ -107,7 +107,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private Expression AddInitializerAssignment(TextWriter trapFile, ExpressionSyntax initializer, Extraction.Entities.Location loc,
             string constValue, ref int child)
         {
-            var type = symbol.GetAnnotatedType();
+            var type = Symbol.GetAnnotatedType();
             var simpleAssignExpr = new Expression(new ExpressionInfo(Context, type, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, constValue));
             Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer, simpleAssignExpr, 0));
             var access = new Expression(new ExpressionInfo(Context, type, Location, ExprKind.FIELD_ACCESS, simpleAssignExpr, 1, false, constValue));
@@ -124,7 +124,7 @@ namespace Semmle.Extraction.CSharp.Entities
             trapFile.Write(" ");
             trapFile.WriteSubId(ContainingType);
             trapFile.Write('.');
-            trapFile.Write(symbol.Name);
+            trapFile.Write(Symbol.Name);
             trapFile.Write(";field");
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionInfo.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionInfo.cs
new file mode 100644
index 00000000000..1a43a6fbd02
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionInfo.cs
@@ -0,0 +1,53 @@
+using Microsoft.CodeAnalysis;
+using Semmle.Extraction.Kinds;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    /// <summary>
+    /// Holds all information required to create an Expression entity.
+    /// </summary>
+    internal interface IExpressionInfo
+    {
+        Context Context { get; }
+
+        /// <summary>
+        /// The type of the expression.
+        /// </summary>
+        AnnotatedTypeSymbol? Type { get; }
+
+        /// <summary>
+        /// The location of the expression.
+        /// </summary>
+        Extraction.Entities.Location Location { get; }
+
+        /// <summary>
+        /// The kind of the expression.
+        /// </summary>
+        ExprKind Kind { get; }
+
+        /// <summary>
+        /// The parent of the expression.
+        /// </summary>
+        IExpressionParentEntity Parent { get; }
+
+        /// <summary>
+        /// The child index of the expression.
+        /// </summary>
+        int Child { get; }
+
+        /// <summary>
+        /// Holds if this is an implicit expression.
+        /// </summary>
+        bool IsCompilerGenerated { get; }
+
+        /// <summary>
+        /// Gets a string representation of the value.
+        /// null is encoded as the string "null".
+        /// If the expression does not have a value, then this
+        /// is null.
+        /// </summary>
+        string ExprValue { get; }
+
+        NullableFlowState FlowState { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionParentEntity.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionParentEntity.cs
new file mode 100644
index 00000000000..a8e4df3d6ca
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IExpressionParentEntity.cs
@@ -0,0 +1,10 @@
+namespace Semmle.Extraction.CSharp.Entities
+{
+    public interface IExpressionParentEntity : IEntity
+    {
+        /// <summary>
+        /// Whether this entity is the parent of a top-level expression.
+        /// </summary>
+        bool IsTopLevelParent { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/IStatementParentEntity.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IStatementParentEntity.cs
new file mode 100644
index 00000000000..40bc0f218c0
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/IStatementParentEntity.cs
@@ -0,0 +1,10 @@
+namespace Semmle.Extraction.CSharp.Entities
+{
+    /// <summary>
+    /// Whether this entity is the parent of a top-level statement.
+    /// </summary>
+    public interface IStatementParentEntity : IEntity
+    {
+        bool IsTopLevelParent { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
index 70b15a6fe16..04bc319c93e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
@@ -10,22 +10,22 @@ namespace Semmle.Extraction.CSharp.Entities
         protected Indexer(Context cx, IPropertySymbol init)
             : base(cx, init) { }
 
-        private Indexer OriginalDefinition => IsSourceDeclaration ? this : Create(Context, symbol.OriginalDefinition);
+        private Indexer OriginalDefinition => IsSourceDeclaration ? this : Create(Context, Symbol.OriginalDefinition);
 
         public override void Populate(TextWriter trapFile)
         {
-            PopulateNullability(trapFile, symbol.GetAnnotatedType());
+            PopulateNullability(trapFile, Symbol.GetAnnotatedType());
 
-            var type = Type.Create(Context, symbol.Type);
-            trapFile.indexers(this, symbol.GetName(useMetadataName: true), ContainingType, type.TypeRef, OriginalDefinition);
+            var type = Type.Create(Context, Symbol.Type);
+            trapFile.indexers(this, Symbol.GetName(useMetadataName: true), ContainingType, type.TypeRef, OriginalDefinition);
             foreach (var l in Locations)
                 trapFile.indexer_location(this, l);
 
-            var getter = symbol.GetMethod;
-            var setter = symbol.SetMethod;
+            var getter = Symbol.GetMethod;
+            var setter = Symbol.SetMethod;
 
             if (getter is null && setter is null)
-                Context.ModelError(symbol, "No indexer accessor defined");
+                Context.ModelError(Symbol, "No indexer accessor defined");
 
             if (!(getter is null))
                 Method.Create(Context, getter);
@@ -33,10 +33,10 @@ namespace Semmle.Extraction.CSharp.Entities
             if (!(setter is null))
                 Method.Create(Context, setter);
 
-            for (var i = 0; i < symbol.Parameters.Length; ++i)
+            for (var i = 0; i < Symbol.Parameters.Length; ++i)
             {
-                var original = Parameter.Create(Context, symbol.OriginalDefinition.Parameters[i], OriginalDefinition);
-                Parameter.Create(Context, symbol.Parameters[i], this, original);
+                var original = Parameter.Create(Context, Symbol.OriginalDefinition.Parameters[i], OriginalDefinition);
+                Parameter.Create(Context, Symbol.Parameters[i], this, original);
             }
 
             if (IsSourceDeclaration)
@@ -46,7 +46,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 {
                     // The expression may need to reference parameters in the getter.
                     // So we need to arrange that the expression is populated after the getter.
-                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0).SetType(symbol.GetAnnotatedType())));
+                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0).SetType(Symbol.GetAnnotatedType())));
                 }
             }
 
@@ -54,11 +54,11 @@ namespace Semmle.Extraction.CSharp.Entities
             BindComments();
 
             var declSyntaxReferences = IsSourceDeclaration
-                ? symbol.DeclaringSyntaxReferences.
+                ? Symbol.DeclaringSyntaxReferences.
                 Select(d => d.GetSyntax()).OfType<IndexerDeclarationSyntax>().ToArray()
                 : Enumerable.Empty<IndexerDeclarationSyntax>();
 
-            foreach (var explicitInterface in symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
+            foreach (var explicitInterface in Symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
             {
                 trapFile.explicitly_implements(this, explicitInterface.TypeRef);
 
@@ -77,9 +77,9 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.WriteSubId(ContainingType);
             trapFile.Write('.');
-            trapFile.Write(symbol.MetadataName);
+            trapFile.Write(Symbol.MetadataName);
             trapFile.Write('(');
-            trapFile.BuildList(",", symbol.Parameters, (p, tb0) => tb0.WriteSubId(Type.Create(Context, p.Type)));
+            trapFile.BuildList(",", Symbol.Parameters, (p, tb0) => tb0.WriteSubId(Type.Create(Context, p.Type)));
             trapFile.Write(");indexer");
         }
 
@@ -87,11 +87,11 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                return symbol.DeclaringSyntaxReferences
+                return Symbol.DeclaringSyntaxReferences
                     .Select(r => r.GetSyntax())
                     .OfType<IndexerDeclarationSyntax>()
                     .Select(s => s.GetLocation())
-                    .Concat(symbol.Locations)
+                    .Concat(Symbol.Locations)
                     .First();
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
index b376566e841..efc50f7f85f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
@@ -34,10 +34,10 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateMethod(trapFile);
             PopulateModifiers(trapFile);
 
-            var originalDefinition = IsSourceDeclaration ? this : Create(Context, symbol.OriginalDefinition);
-            var returnType = Type.Create(Context, symbol.ReturnType);
-            trapFile.local_functions(this, symbol.Name, returnType, originalDefinition);
-            ExtractRefReturn(trapFile, symbol, this);
+            var originalDefinition = IsSourceDeclaration ? this : Create(Context, Symbol.OriginalDefinition);
+            var returnType = Type.Create(Context, Symbol.ReturnType);
+            trapFile.local_functions(this, Symbol.Name, returnType, originalDefinition);
+            ExtractRefReturn(trapFile, Symbol, this);
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NeedsLabel;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
index e988ec2c815..4f9a0c4f7f6 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
@@ -23,12 +23,12 @@ namespace Semmle.Extraction.CSharp.Entities
         public void PopulateManual(Expression parent, bool isVar)
         {
             var trapFile = Context.TrapWriter.Writer;
-            var (kind, type) = symbol is ILocalSymbol l
+            var (kind, type) = Symbol is ILocalSymbol l
                 ? (l.IsRef ? 3 : l.IsConst ? 2 : 1, l.GetAnnotatedType())
                 : (1, parent.Type);
-            trapFile.localvars(this, kind, symbol.Name, isVar ? 1 : 0, Type.Create(Context, type).TypeRef, parent);
+            trapFile.localvars(this, kind, Symbol.Name, isVar ? 1 : 0, Type.Create(Context, type).TypeRef, parent);
 
-            if (symbol is ILocalSymbol local)
+            if (Symbol is ILocalSymbol local)
             {
                 PopulateNullability(trapFile, local.GetAnnotatedType());
                 if (local.IsRef)
@@ -47,7 +47,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         private void DefineConstantValue(TextWriter trapFile)
         {
-            if (symbol is ILocalSymbol local && local.HasConstantValue)
+            if (Symbol is ILocalSymbol local && local.HasConstantValue)
             {
                 trapFile.constant_value(this, Expression.ValueAsString(local.ConstantValue));
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
index 6a52087e384..8a1572796bc 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
@@ -1,4 +1,5 @@
 using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Extraction.CSharp.Populators;
 using System.Collections.Generic;
@@ -15,8 +16,8 @@ namespace Semmle.Extraction.CSharp.Entities
         protected void PopulateParameters()
         {
             var originalMethod = OriginalDefinition;
-            IEnumerable<IParameterSymbol> parameters = symbol.Parameters;
-            IEnumerable<IParameterSymbol> originalParameters = originalMethod.symbol.Parameters;
+            IEnumerable<IParameterSymbol> parameters = Symbol.Parameters;
+            IEnumerable<IParameterSymbol> originalParameters = originalMethod.Symbol.Parameters;
 
             if (IsReducedExtension)
             {
@@ -24,14 +25,14 @@ namespace Semmle.Extraction.CSharp.Entities
                 {
                     // Non-generic reduced extensions must be extracted exactly like the
                     // non-reduced counterparts
-                    parameters = symbol.ReducedFrom.Parameters;
+                    parameters = Symbol.ReducedFrom.Parameters;
                 }
                 else
                 {
                     // Constructed reduced extensions are special because their non-reduced
                     // counterparts are not constructed. Therefore, we need to manually add
                     // the `this` parameter based on the type of the receiver
-                    var originalThisParamSymbol = originalMethod.symbol.Parameters.First();
+                    var originalThisParamSymbol = originalMethod.Symbol.Parameters.First();
                     var originalThisParam = Parameter.Create(Context, originalThisParamSymbol, originalMethod);
                     ConstructedExtensionParameter.Create(Context, this, originalThisParam);
                     originalParameters = originalParameters.Skip(1);
@@ -46,7 +47,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 Parameter.Create(Context, p.paramSymbol, this, original);
             }
 
-            if (symbol.IsVararg)
+            if (Symbol.IsVararg)
             {
                 // Mono decided that "__arglist" should be an explicit parameter,
                 // so now we need to populate it.
@@ -83,14 +84,24 @@ namespace Semmle.Extraction.CSharp.Entities
                        else
                            Expression.Create(Context, expr, this, 0);
 
-                       Context.NumberOfLines(trapFile, BodyDeclaringSymbol, this);
+                       NumberOfLines(trapFile, BodyDeclaringSymbol, this);
                    });
             }
         }
 
+        public static void NumberOfLines(TextWriter trapFile, ISymbol symbol, IEntity callable)
+        {
+            foreach (var decl in symbol.DeclaringSyntaxReferences)
+            {
+                var node = (CSharpSyntaxNode)decl.GetSyntax();
+                var lineCounts = node.Accept(new AstLineCounter());
+                trapFile.numlines(callable, lineCounts);
+            }
+        }
+
         public void Overrides(TextWriter trapFile)
         {
-            foreach (var explicitInterface in symbol.ExplicitInterfaceImplementations
+            foreach (var explicitInterface in Symbol.ExplicitInterfaceImplementations
                 .Where(sym => sym.MethodKind == MethodKind.Ordinary)
                 .Select(impl => Type.Create(Context, impl.ContainingType)))
             {
@@ -98,14 +109,14 @@ namespace Semmle.Extraction.CSharp.Entities
 
                 if (IsSourceDeclaration)
                 {
-                    foreach (var syntax in symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).OfType<MethodDeclarationSyntax>())
+                    foreach (var syntax in Symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).OfType<MethodDeclarationSyntax>())
                         TypeMention.Create(Context, syntax.ExplicitInterfaceSpecifier.Name, this, explicitInterface);
                 }
             }
 
-            if (symbol.OverriddenMethod != null)
+            if (Symbol.OverriddenMethod != null)
             {
-                trapFile.overrides(this, Method.Create(Context, symbol.OverriddenMethod));
+                trapFile.overrides(this, Method.Create(Context, Symbol.OverriddenMethod));
             }
         }
 
@@ -114,22 +125,22 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         private static void BuildMethodId(Method m, TextWriter trapFile)
         {
-            m.symbol.ReturnType.BuildOrWriteId(m.Context, trapFile, m.symbol);
+            m.Symbol.ReturnType.BuildOrWriteId(m.Context, trapFile, m.Symbol);
             trapFile.Write(" ");
 
             trapFile.WriteSubId(m.ContainingType);
 
-            AddExplicitInterfaceQualifierToId(m.Context, trapFile, m.symbol.ExplicitInterfaceImplementations);
+            AddExplicitInterfaceQualifierToId(m.Context, trapFile, m.Symbol.ExplicitInterfaceImplementations);
 
             trapFile.Write(".");
-            trapFile.Write(m.symbol.Name);
+            trapFile.Write(m.Symbol.Name);
 
-            if (m.symbol.IsGenericMethod)
+            if (m.Symbol.IsGenericMethod)
             {
-                if (SymbolEqualityComparer.Default.Equals(m.symbol, m.symbol.OriginalDefinition))
+                if (SymbolEqualityComparer.Default.Equals(m.Symbol, m.Symbol.OriginalDefinition))
                 {
                     trapFile.Write('`');
-                    trapFile.Write(m.symbol.TypeParameters.Length);
+                    trapFile.Write(m.Symbol.TypeParameters.Length);
                 }
                 else
                 {
@@ -138,13 +149,13 @@ namespace Semmle.Extraction.CSharp.Entities
                     // Type arguments with different nullability can result in
                     // a constructed method with different nullability of its parameters and return type,
                     // so we need to create a distinct database entity for it.
-                    trapFile.BuildList(",", m.symbol.GetAnnotatedTypeArguments(), (ta, tb0) => { ta.Symbol.BuildOrWriteId(m.Context, tb0, m.symbol); trapFile.Write((int)ta.Nullability); });
+                    trapFile.BuildList(",", m.Symbol.GetAnnotatedTypeArguments(), (ta, tb0) => { ta.Symbol.BuildOrWriteId(m.Context, tb0, m.Symbol); trapFile.Write((int)ta.Nullability); });
                     trapFile.Write('>');
                 }
             }
 
-            AddParametersToId(m.Context, trapFile, m.symbol);
-            switch (m.symbol.MethodKind)
+            AddParametersToId(m.Context, trapFile, m.Symbol);
+            switch (m.Symbol.MethodKind)
             {
                 case MethodKind.PropertyGet:
                     trapFile.Write(";getter");
@@ -213,7 +224,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 trapFile.AppendList(",", explicitInterfaceImplementations.Select(impl => cx.CreateEntity(impl.ContainingType)));
         }
 
-        public virtual string Name => symbol.Name;
+        public virtual string Name => Symbol.Name;
 
         /// <summary>
         /// Creates a method of the appropriate subtype.
@@ -267,28 +278,28 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public Method OriginalDefinition =>
             IsReducedExtension
-                ? Create(Context, symbol.ReducedFrom)
-                : Create(Context, symbol.OriginalDefinition);
+                ? Create(Context, Symbol.ReducedFrom)
+                : Create(Context, Symbol.OriginalDefinition);
 
         public override Microsoft.CodeAnalysis.Location FullLocation => ReportingLocation;
 
-        public override bool IsSourceDeclaration => symbol.IsSourceDeclaration();
+        public override bool IsSourceDeclaration => Symbol.IsSourceDeclaration();
 
         /// <summary>
         /// Whether this method has type parameters.
         /// </summary>
-        public bool IsGeneric => symbol.IsGenericMethod;
+        public bool IsGeneric => Symbol.IsGenericMethod;
 
         /// <summary>
         /// Whether this method has unbound type parameters.
         /// </summary>
-        public bool IsUnboundGeneric => IsGeneric && SymbolEqualityComparer.Default.Equals(symbol.ConstructedFrom, symbol);
+        public bool IsUnboundGeneric => IsGeneric && SymbolEqualityComparer.Default.Equals(Symbol.ConstructedFrom, Symbol);
 
         public bool IsBoundGeneric => IsGeneric && !IsUnboundGeneric;
 
-        private bool IsReducedExtension => symbol.MethodKind == MethodKind.ReducedExtension;
+        private bool IsReducedExtension => Symbol.MethodKind == MethodKind.ReducedExtension;
 
-        protected IMethodSymbol ConstructedFromSymbol => symbol.ConstructedFrom.ReducedFrom ?? symbol.ConstructedFrom;
+        protected IMethodSymbol ConstructedFromSymbol => Symbol.ConstructedFrom.ReducedFrom ?? Symbol.ConstructedFrom;
 
         bool IExpressionParentEntity.IsTopLevelParent => true;
 
@@ -305,19 +316,19 @@ namespace Semmle.Extraction.CSharp.Entities
                 if (isFullyConstructed)
                 {
                     trapFile.constructed_generic(this, Method.Create(Context, ConstructedFromSymbol));
-                    foreach (var tp in symbol.GetAnnotatedTypeArguments())
+                    foreach (var tp in Symbol.GetAnnotatedTypeArguments())
                     {
                         trapFile.type_arguments(Type.Create(Context, tp.Symbol), child, this);
                         child++;
                     }
 
-                    var nullability = new Nullability(symbol);
+                    var nullability = new Nullability(Symbol);
                     if (!nullability.IsOblivious)
                         trapFile.type_nullability(this, NullabilityEntity.Create(Context, nullability));
                 }
                 else
                 {
-                    foreach (var typeParam in symbol.TypeParameters.Select(tp => TypeParameter.Create(Context, tp)))
+                    foreach (var typeParam in Symbol.TypeParameters.Select(tp => TypeParameter.Create(Context, tp)))
                     {
                         trapFile.type_parameters(typeParam, child, this);
                         child++;
@@ -343,7 +354,7 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateMethodBody(trapFile);
             PopulateGenerics(trapFile);
             PopulateMetadataHandle(trapFile);
-            PopulateNullability(trapFile, symbol.GetAnnotatedReturnType());
+            PopulateNullability(trapFile, Symbol.GetAnnotatedReturnType());
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.PushesLabel;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Modifier.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Modifier.cs
index 4b2725b89f3..b644558f799 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Modifier.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Modifier.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.Write(symbol);
+            trapFile.Write(Symbol);
             trapFile.Write(";modifier");
         }
 
@@ -20,7 +20,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.modifiers(Label, symbol);
+            trapFile.modifiers(Label, Symbol);
         }
 
         public static string AccessbilityModifier(Accessibility access)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
index 6ae31c82b64..31e66656eb3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Namespace.cs
@@ -12,11 +12,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.namespaces(this, symbol.Name);
+            trapFile.namespaces(this, Symbol.Name);
 
-            if (symbol.ContainingNamespace != null)
+            if (Symbol.ContainingNamespace != null)
             {
-                var parent = Create(Context, symbol.ContainingNamespace);
+                var parent = Create(Context, Symbol.ContainingNamespace);
                 trapFile.parent_namespace(this, parent);
             }
         }
@@ -25,11 +25,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            if (!symbol.IsGlobalNamespace)
+            if (!Symbol.IsGlobalNamespace)
             {
-                trapFile.WriteSubId(Create(Context, symbol.ContainingNamespace));
+                trapFile.WriteSubId(Create(Context, Symbol.ContainingNamespace));
                 trapFile.Write('.');
-                trapFile.Write(symbol.Name);
+                trapFile.Write(Symbol.Name);
             }
             trapFile.Write(";namespace");
         }
@@ -47,7 +47,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override int GetHashCode() => QualifiedName.GetHashCode();
 
-        private string QualifiedName => symbol.ToDisplayString();
+        private string QualifiedName => Symbol.ToDisplayString();
 
         public override bool Equals(object obj)
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/NamespaceDeclaration.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/NamespaceDeclaration.cs
index 17f9a198a39..3a19417008a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/NamespaceDeclaration.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/NamespaceDeclaration.cs
@@ -22,7 +22,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(Context.Create(ReportingLocation));
+            trapFile.WriteSubId(Context.CreateLocation(ReportingLocation));
             trapFile.Write(";namespacedeclaration");
         }
 
@@ -31,7 +31,7 @@ namespace Semmle.Extraction.CSharp.Entities
             var @namespace = (INamespaceSymbol)Context.GetModel(node).GetSymbolInfo(node.Name).Symbol;
             var ns = Namespace.Create(Context, @namespace);
             trapFile.namespace_declarations(this, ns);
-            trapFile.namespace_declaration_location(this, Context.Create(node.Name.GetLocation()));
+            trapFile.namespace_declaration_location(this, Context.CreateLocation(node.Name.GetLocation()));
 
             var visitor = new Populators.TypeOrNamespaceVisitor(Context, trapFile, this);
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
index d81fc25f72b..90f17d70ea4 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
@@ -11,20 +11,20 @@ namespace Semmle.Extraction.CSharp.Entities
         private OrdinaryMethod(Context cx, IMethodSymbol init)
             : base(cx, init) { }
 
-        public override string Name => symbol.GetName();
+        public override string Name => Symbol.GetName();
 
-        protected override IMethodSymbol BodyDeclaringSymbol => symbol.PartialImplementationPart ?? symbol;
+        protected override IMethodSymbol BodyDeclaringSymbol => Symbol.PartialImplementationPart ?? Symbol;
 
         public IMethodSymbol SourceDeclaration
         {
             get
             {
-                var reducedFrom = symbol.ReducedFrom ?? symbol;
+                var reducedFrom = Symbol.ReducedFrom ?? Symbol;
                 return reducedFrom.OriginalDefinition;
             }
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => symbol.GetSymbolLocation();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
 
         public override void Populate(TextWriter trapFile)
         {
@@ -32,12 +32,12 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateModifiers(trapFile);
             ContainingType.PopulateGenerics();
 
-            var returnType = Type.Create(Context, symbol.ReturnType);
+            var returnType = Type.Create(Context, Symbol.ReturnType);
             trapFile.methods(this, Name, ContainingType, returnType.TypeRef, OriginalDefinition);
 
             if (IsSourceDeclaration)
             {
-                foreach (var declaration in symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax()).OfType<MethodDeclarationSyntax>())
+                foreach (var declaration in Symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax()).OfType<MethodDeclarationSyntax>())
                 {
                     Context.BindComments(this, declaration.Identifier.GetLocation());
                     TypeMention.Create(Context, declaration.ReturnType, this, returnType);
@@ -49,7 +49,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             PopulateGenerics(trapFile);
             Overrides(trapFile);
-            ExtractRefReturn(trapFile, symbol, this);
+            ExtractRefReturn(trapFile, Symbol, this);
             ExtractCompilerGenerated(trapFile);
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
index c42a3edd236..b1b7a5444fe 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
@@ -19,7 +19,7 @@ namespace Semmle.Extraction.CSharp.Entities
             Original = original ?? this;
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => symbol.GetSymbolLocation();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
 
         public enum Kind
         {
@@ -35,9 +35,9 @@ namespace Semmle.Extraction.CSharp.Entities
                 // actually numbered from 1.
                 // This is to be consistent from the original (unreduced) extension method.
                 var isReducedExtension =
-                    symbol.ContainingSymbol is IMethodSymbol method &&
+                    Symbol.ContainingSymbol is IMethodSymbol method &&
                     method.MethodKind == MethodKind.ReducedExtension;
-                return symbol.Ordinal + (isReducedExtension ? 1 : 0);
+                return Symbol.Ordinal + (isReducedExtension ? 1 : 0);
             }
         }
 
@@ -45,7 +45,7 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                switch (symbol.RefKind)
+                switch (Symbol.RefKind)
                 {
                     case RefKind.Out:
                         return Kind.Out;
@@ -54,12 +54,12 @@ namespace Semmle.Extraction.CSharp.Entities
                     case RefKind.In:
                         return Kind.In;
                     default:
-                        if (symbol.IsParams)
+                        if (Symbol.IsParams)
                             return Kind.Params;
 
                         if (Ordinal == 0)
                         {
-                            if (symbol.ContainingSymbol is IMethodSymbol method && method.IsExtensionMethod)
+                            if (Symbol.ContainingSymbol is IMethodSymbol method && method.IsExtensionMethod)
                                 return Kind.This;
                         }
                         return Kind.None;
@@ -76,7 +76,7 @@ namespace Semmle.Extraction.CSharp.Entities
         public override void WriteId(TextWriter trapFile)
         {
             if (Parent == null)
-                Parent = Method.Create(Context, symbol.ContainingSymbol as IMethodSymbol);
+                Parent = Method.Create(Context, Symbol.ContainingSymbol as IMethodSymbol);
             trapFile.WriteSubId(Parent);
             trapFile.Write('_');
             trapFile.Write(Ordinal);
@@ -92,34 +92,42 @@ namespace Semmle.Extraction.CSharp.Entities
                 // Very rarely, two parameters have the same name according to the data model.
                 // This breaks our database constraints.
                 // Generate an impossible name to ensure that it doesn't conflict.
-                var conflictingCount = symbol.ContainingSymbol.GetParameters().Count(p => p.Ordinal < symbol.Ordinal && p.Name == symbol.Name);
-                return conflictingCount > 0 ? symbol.Name + "`" + conflictingCount : symbol.Name;
+                var conflictingCount = Symbol.ContainingSymbol.GetParameters().Count(p => p.Ordinal < Symbol.Ordinal && p.Name == Symbol.Name);
+                return conflictingCount > 0 ? Symbol.Name + "`" + conflictingCount : Symbol.Name;
             }
         }
 
         public override void Populate(TextWriter trapFile)
         {
             PopulateAttributes();
-            PopulateNullability(trapFile, symbol.GetAnnotatedType());
-            PopulateRefKind(trapFile, symbol.RefKind);
+            PopulateNullability(trapFile, Symbol.GetAnnotatedType());
+            PopulateRefKind(trapFile, Symbol.RefKind);
 
-            if (symbol.Name != Original.symbol.Name)
-                Context.ModelError(symbol, "Inconsistent parameter declaration");
+            if (Symbol.Name != Original.Symbol.Name)
+                Context.ModelError(Symbol, "Inconsistent parameter declaration");
 
-            var type = Type.Create(Context, symbol.Type);
+            var type = Type.Create(Context, Symbol.Type);
             trapFile.@params(this, Name, type.TypeRef, Ordinal, ParamKind, Parent, Original);
 
-            foreach (var l in symbol.Locations)
-                trapFile.param_location(this, Context.Create(l));
+            foreach (var l in Symbol.Locations)
+                trapFile.param_location(this, Context.CreateLocation(l));
 
-            if (!IsSourceDeclaration || !symbol.FromSource())
+            if (!Symbol.Locations.Any() &&
+                Symbol.ContainingSymbol is IMethodSymbol ms &&
+                ms.Name == WellKnownMemberNames.TopLevelStatementsEntryPointMethodName &&
+                ms.ContainingType.Name == WellKnownMemberNames.TopLevelStatementsEntryPointTypeName)
+            {
+                trapFile.param_location(this, Context.CreateLocation());
+            }
+
+            if (!IsSourceDeclaration || !Symbol.FromSource())
                 return;
 
             BindComments();
 
             if (IsSourceDeclaration)
             {
-                foreach (var syntax in symbol.DeclaringSyntaxReferences
+                foreach (var syntax in Symbol.DeclaringSyntaxReferences
                     .Select(d => d.GetSyntax())
                     .OfType<ParameterSyntax>()
                     .Where(s => s.Type != null))
@@ -128,21 +136,21 @@ namespace Semmle.Extraction.CSharp.Entities
                 }
             }
 
-            if (symbol.HasExplicitDefaultValue && Context.Defines(symbol))
+            if (Symbol.HasExplicitDefaultValue && Context.Defines(Symbol))
             {
                 // This is a slight bug in the dbscheme
                 // We should really define param_default(param, string)
                 // And use parameter child #0 to encode the default expression.
-                var defaultValue = GetParameterDefaultValue(symbol);
+                var defaultValue = GetParameterDefaultValue(Symbol);
                 if (defaultValue == null)
                 {
                     // In case this parameter belongs to an accessor of an indexer, we need
                     // to get the default value from the corresponding parameter belonging
                     // to the indexer itself
-                    var method = (IMethodSymbol)symbol.ContainingSymbol;
+                    var method = (IMethodSymbol)Symbol.ContainingSymbol;
                     if (method != null)
                     {
-                        var i = method.Parameters.IndexOf(symbol);
+                        var i = method.Parameters.IndexOf(Symbol);
                         var indexer = (IPropertySymbol)method.AssociatedSymbol;
                         if (indexer != null)
                             defaultValue = GetParameterDefaultValue(indexer.Parameters[i]);
@@ -159,7 +167,7 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
-        public override bool IsSourceDeclaration => symbol.IsSourceDeclaration();
+        public override bool IsSourceDeclaration => Symbol.IsSourceDeclaration();
 
         bool IExpressionParentEntity.IsTopLevelParent => true;
 
@@ -231,7 +239,7 @@ namespace Semmle.Extraction.CSharp.Entities
             trapFile.param_location(this, GeneratedLocation.Create(Context));
         }
 
-        protected override int Ordinal => ((Method)Parent).OriginalDefinition.symbol.Parameters.Length;
+        protected override int Ordinal => ((Method)Parent).OriginalDefinition.Symbol.Parameters.Length;
 
         public override int GetHashCode()
         {
@@ -258,20 +266,20 @@ namespace Semmle.Extraction.CSharp.Entities
         private readonly ITypeSymbol constructedType;
 
         private ConstructedExtensionParameter(Context cx, Method method, Parameter original)
-            : base(cx, original.symbol, method, original)
+            : base(cx, original.Symbol, method, original)
         {
-            constructedType = method.symbol.ReceiverType;
+            constructedType = method.Symbol.ReceiverType;
         }
 
         public override void Populate(TextWriter trapFile)
         {
             var typeKey = Type.Create(Context, constructedType);
-            trapFile.@params(this, Original.symbol.Name, typeKey.TypeRef, 0, Kind.This, Parent, Original);
+            trapFile.@params(this, Original.Symbol.Name, typeKey.TypeRef, 0, Kind.This, Parent, Original);
             trapFile.param_location(this, Original.Location);
         }
 
         public static ConstructedExtensionParameter Create(Context cx, Method method, Parameter parameter) =>
-            ExtensionParamFactory.Instance.CreateEntity(cx, (new SymbolEqualityWrapper(parameter.symbol), new SymbolEqualityWrapper(method.symbol.ReceiverType)), (method, parameter));
+            ExtensionParamFactory.Instance.CreateEntity(cx, (new SymbolEqualityWrapper(parameter.Symbol), new SymbolEqualityWrapper(method.Symbol.ReceiverType)), (method, parameter));
 
         private class ExtensionParamFactory : ICachedEntityFactory<(Method, Parameter), ConstructedExtensionParameter>
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/ElifDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/ElifDirective.cs
index ace89464b96..ece87fd1f42 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/ElifDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/ElifDirective.cs
@@ -22,7 +22,7 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.directive_elifs(this, trivia.BranchTaken, trivia.ConditionValue, start, index);
 
-            Expression.Create(cx, trivia.Condition, this, 0);
+            Expression.Create(Context, trivia.Condition, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/IfDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/IfDirective.cs
index e1b81e60d8a..29c6f741620 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/IfDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/IfDirective.cs
@@ -16,7 +16,7 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.directive_ifs(this, trivia.BranchTaken, trivia.ConditionValue);
 
-            Expression.Create(cx, trivia.Condition, this, 0);
+            Expression.Create(Context, trivia.Condition, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/LineDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/LineDirective.cs
index 54681d317e9..470f54f379a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/LineDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/LineDirective.cs
@@ -31,7 +31,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
                 if (!string.IsNullOrWhiteSpace(trivia.File.ValueText))
                 {
-                    var file = Extraction.Entities.File.Create(cx, trivia.File.ValueText);
+                    var file = Extraction.Entities.File.Create(Context, trivia.File.ValueText);
                     trapFile.directive_line_file(this, file);
                 }
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PragmaChecksumDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PragmaChecksumDirective.cs
index dff901fa826..572b77e2c73 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PragmaChecksumDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PragmaChecksumDirective.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void PopulatePreprocessor(TextWriter trapFile)
         {
-            var file = Extraction.Entities.File.Create(cx, trivia.File.ValueText);
+            var file = Extraction.Entities.File.Create(Context, trivia.File.ValueText);
             trapFile.pragma_checksums(this, file, trivia.Guid.ToString(), trivia.Bytes.ToString());
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PreprocessorDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PreprocessorDirective.cs
index 6ea6172a2d3..13e702603ab 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PreprocessorDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PreprocessorDirective.cs
@@ -23,11 +23,11 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulatePreprocessor(trapFile);
 
             trapFile.preprocessor_directive_active(this, trivia.IsActive);
-            trapFile.preprocessor_directive_location(this, cx.Create(ReportingLocation));
+            trapFile.preprocessor_directive_location(this, Context.CreateLocation(ReportingLocation));
 
-            if (!cx.Extractor.Standalone)
+            if (!Context.Extractor.Standalone)
             {
-                var compilation = Compilation.Create(cx);
+                var compilation = Compilation.Create(Context);
                 trapFile.preprocessor_directive_compilation(this, compilation);
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
index 08d5ae47c5e..085047d0812 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities
         protected Property(Context cx, IPropertySymbol init)
             : base(cx, init)
         {
-            type = new Lazy<Type>(() => Type.Create(Context, symbol.Type));
+            type = new Lazy<Type>(() => Type.Create(base.Context, Symbol.Type));
         }
 
         private readonly Lazy<Type> type;
@@ -27,8 +27,8 @@ namespace Semmle.Extraction.CSharp.Entities
             trapFile.Write(" ");
             trapFile.WriteSubId(ContainingType);
             trapFile.Write('.');
-            Method.AddExplicitInterfaceQualifierToId(Context, trapFile, symbol.ExplicitInterfaceImplementations);
-            trapFile.Write(symbol.Name);
+            Method.AddExplicitInterfaceQualifierToId(Context, trapFile, Symbol.ExplicitInterfaceImplementations);
+            trapFile.Write(Symbol.Name);
             trapFile.Write(";property");
         }
 
@@ -38,14 +38,14 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateAttributes();
             PopulateModifiers(trapFile);
             BindComments();
-            PopulateNullability(trapFile, symbol.GetAnnotatedType());
-            PopulateRefKind(trapFile, symbol.RefKind);
+            PopulateNullability(trapFile, Symbol.GetAnnotatedType());
+            PopulateRefKind(trapFile, Symbol.RefKind);
 
             var type = Type;
-            trapFile.properties(this, symbol.GetName(), ContainingType, type.TypeRef, Create(Context, symbol.OriginalDefinition));
+            trapFile.properties(this, Symbol.GetName(), ContainingType, type.TypeRef, Create(Context, Symbol.OriginalDefinition));
 
-            var getter = symbol.GetMethod;
-            var setter = symbol.SetMethod;
+            var getter = Symbol.GetMethod;
+            var setter = Symbol.SetMethod;
 
             if (!(getter is null))
                 Method.Create(Context, getter);
@@ -54,11 +54,11 @@ namespace Semmle.Extraction.CSharp.Entities
                 Method.Create(Context, setter);
 
             var declSyntaxReferences = IsSourceDeclaration ?
-                symbol.DeclaringSyntaxReferences.
+                Symbol.DeclaringSyntaxReferences.
                 Select(d => d.GetSyntax()).OfType<PropertyDeclarationSyntax>().ToArray()
                 : Enumerable.Empty<PropertyDeclarationSyntax>();
 
-            foreach (var explicitInterface in symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
+            foreach (var explicitInterface in Symbol.ExplicitInterfaceImplementations.Select(impl => Type.Create(Context, impl.ContainingType)))
             {
                 trapFile.explicitly_implements(this, explicitInterface.TypeRef);
 
@@ -69,7 +69,7 @@ namespace Semmle.Extraction.CSharp.Entities
             foreach (var l in Locations)
                 trapFile.property_location(this, l);
 
-            if (IsSourceDeclaration && symbol.FromSource())
+            if (IsSourceDeclaration && Symbol.FromSource())
             {
                 var expressionBody = ExpressionBody;
                 if (expressionBody != null)
@@ -84,15 +84,15 @@ namespace Semmle.Extraction.CSharp.Entities
                 {
                     Context.PopulateLater(() =>
                     {
-                        var loc = Context.Create(initializer.GetLocation());
-                        var annotatedType = AnnotatedTypeSymbol.CreateNotAnnotated(symbol.Type);
+                        var loc = Context.CreateLocation(initializer.GetLocation());
+                        var annotatedType = AnnotatedTypeSymbol.CreateNotAnnotated(Symbol.Type);
                         var simpleAssignExpr = new Expression(new ExpressionInfo(Context, annotatedType, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, null));
                         Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer.Value, simpleAssignExpr, 0));
                         var access = new Expression(new ExpressionInfo(Context, annotatedType, Location, ExprKind.PROPERTY_ACCESS, simpleAssignExpr, 1, false, null));
                         trapFile.expr_access(access, this);
-                        if (!symbol.IsStatic)
+                        if (!Symbol.IsStatic)
                         {
-                            This.CreateImplicit(Context, symbol.ContainingType, Location, access, -1);
+                            This.CreateImplicit(Context, Symbol.ContainingType, Location, access, -1);
                         }
                     });
                 }
@@ -106,11 +106,11 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                return symbol.DeclaringSyntaxReferences
+                return Symbol.DeclaringSyntaxReferences
                     .Select(r => r.GetSyntax())
                     .OfType<PropertyDeclarationSyntax>()
                     .Select(s => s.GetLocation())
-                    .Concat(symbol.Locations)
+                    .Concat(Symbol.Locations)
                     .First();
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement.cs
index 44bd7f80583..94ab9a7ce61 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement.cs
@@ -1,24 +1,41 @@
 using Microsoft.CodeAnalysis.CSharp.Syntax;
-using Semmle.Extraction.CSharp.Populators;
 using Microsoft.CodeAnalysis.CSharp;
-using Semmle.Extraction.Entities;
 using System.IO;
 
 namespace Semmle.Extraction.CSharp.Entities
 {
-    /// <summary>
-    /// Whether this entity is the parent of a top-level statement.
-    /// </summary>
-    public interface IStatementParentEntity : IEntity
-    {
-        bool IsTopLevelParent { get; }
-    }
-
     internal abstract class Statement : FreshEntity, IExpressionParentEntity, IStatementParentEntity
     {
-        protected Statement(Context cx) : base(cx) { }
+        private readonly int child;
+        private readonly Kinds.StmtKind kind;
+        private readonly IStatementParentEntity parent;
 
-        public static Statement Create(Context cx, StatementSyntax node, Statement parent, int child) =>
+        protected Statement(Context cx, Kinds.StmtKind kind, IStatementParentEntity parent, int child)
+            : base(cx)
+        {
+            this.kind = kind;
+            this.parent = parent;
+            this.child = child;
+        }
+
+        protected override void Populate(TextWriter trapFile)
+        {
+            trapFile.statements(this, kind);
+            if (parent.IsTopLevelParent)
+            {
+                trapFile.stmt_parent_top_level(this, child, parent);
+            }
+            else
+            {
+                trapFile.stmt_parent(this, child, parent);
+            }
+
+            PopulateStatement(trapFile);
+        }
+
+        protected abstract void PopulateStatement(TextWriter trapFile);
+
+        public static Statement Create(Context cx, StatementSyntax node, IStatementParentEntity parent, int child) =>
             Statements.Factory.Create(cx, node, parent, child);
 
         /// <summary>
@@ -27,54 +44,10 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         public virtual int NumberOfStatements => 1;
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => GetStatementSyntax().GetLocation();
-
         bool IExpressionParentEntity.IsTopLevelParent => false;
 
         bool IStatementParentEntity.IsTopLevelParent => false;
 
-        protected abstract CSharpSyntaxNode GetStatementSyntax();
-
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NeedsLabel;
     }
-
-    internal abstract class Statement<TSyntax> : Statement where TSyntax : CSharpSyntaxNode
-    {
-        protected readonly TSyntax Stmt;
-        private readonly int child;
-        private readonly Kinds.StmtKind kind;
-        private readonly IStatementParentEntity parent;
-        private readonly Location location;
-
-        protected override CSharpSyntaxNode GetStatementSyntax() => Stmt;
-
-        protected Statement(Context cx, TSyntax stmt, Kinds.StmtKind kind, IStatementParentEntity parent, int child, Location location)
-            : base(cx)
-        {
-            Stmt = stmt;
-            this.parent = parent;
-            this.child = child;
-            this.location = location;
-            this.kind = kind;
-            cx.BindComments(this, location.symbol);
-        }
-
-        protected sealed override void Populate(TextWriter trapFile)
-        {
-            trapFile.statements(this, kind);
-            if (parent.IsTopLevelParent)
-                trapFile.stmt_parent_top_level(this, child, parent);
-            else
-                trapFile.stmt_parent(this, child, parent);
-            trapFile.stmt_location(this, location);
-            PopulateStatement(trapFile);
-        }
-
-        protected abstract void PopulateStatement(TextWriter trapFile);
-
-        protected Statement(Context cx, TSyntax stmt, Kinds.StmtKind kind, IStatementParentEntity parent, int child)
-            : this(cx, stmt, kind, parent, child, cx.Create(stmt.FixedLocation())) { }
-
-        public override string ToString() => Label.ToString();
-    }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement`1.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement`1.cs
new file mode 100644
index 00000000000..21dd32e17cf
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statement`1.cs
@@ -0,0 +1,35 @@
+using Semmle.Extraction.CSharp.Populators;
+using Microsoft.CodeAnalysis.CSharp;
+using Semmle.Extraction.Entities;
+using System.IO;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    internal abstract class Statement<TSyntax> : Statement where TSyntax : CSharpSyntaxNode
+    {
+        protected readonly TSyntax Stmt;
+        private readonly Location location;
+
+        protected Statement(Context cx, TSyntax stmt, Kinds.StmtKind kind, IStatementParentEntity parent, int child, Location location)
+            : base(cx, kind, parent, child)
+        {
+            Stmt = stmt;
+            this.location = location;
+            cx.BindComments(this, location.Symbol);
+        }
+
+        protected Statement(Context cx, TSyntax stmt, Kinds.StmtKind kind, IStatementParentEntity parent, int child)
+            : this(cx, stmt, kind, parent, child, cx.CreateLocation(stmt.FixedLocation())) { }
+
+        protected sealed override void Populate(TextWriter trapFile)
+        {
+            base.Populate(trapFile);
+
+            trapFile.stmt_location(this, location);
+        }
+
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Stmt.GetLocation();
+
+        public override string ToString() => Label.ToString();
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Block.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Block.cs
index c3e2e15baf3..c50cad9b6cd 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Block.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Block.cs
@@ -20,7 +20,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             var child = 0;
-            foreach (var childStmt in Stmt.Statements.Select(c => Statement.Create(cx, c, this, child)))
+            foreach (var childStmt in Stmt.Statements.Select(c => Statement.Create(Context, c, this, child)))
             {
                 child += childStmt.NumberOfStatements;
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Case.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Case.cs
index e2a712c006b..73a2582060b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Case.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Case.cs
@@ -10,7 +10,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
     internal abstract class Case<TSyntax> : Statement<TSyntax> where TSyntax : SwitchLabelSyntax
     {
         protected Case(Context cx, TSyntax node, Switch parent, int child)
-            : base(cx, node, StmtKind.CASE, parent, child, cx.Create(node.GetLocation())) { }
+            : base(cx, node, StmtKind.CASE, parent, child, cx.CreateLocation(node.GetLocation())) { }
 
         public static Statement Create(Context cx, SwitchLabelSyntax node, Switch parent, int child)
         {
@@ -36,8 +36,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             var value = Stmt.Value;
-            Expression.Create(cx, value, this, 0);
-            Switch.LabelForValue(cx.GetModel(Stmt).GetConstantValue(value).Value);
+            Expression.Create(Context, value, this, 0);
+            Switch.LabelForValue(Context.GetModel(Stmt).GetConstantValue(value).Value);
         }
 
         public static CaseLabel Create(Context cx, CaseSwitchLabelSyntax node, Switch parent, int child)
@@ -70,11 +70,11 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expressions.Pattern.Create(cx, Stmt.Pattern, this, 0);
+            Expressions.Pattern.Create(Context, Stmt.Pattern, this, 0);
 
             if (Stmt.WhenClause != null)
             {
-                Expression.Create(cx, Stmt.WhenClause.Condition, this, 1);
+                Expression.Create(Context, Stmt.WhenClause.Condition, this, 1);
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
index db1a0d413c1..f7484c72d56 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
@@ -10,7 +10,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         private static readonly string systemExceptionName = typeof(System.Exception).ToString();
 
         private Catch(Context cx, CatchClauseSyntax node, Try parent, int child)
-            : base(cx, node, StmtKind.CATCH, parent, child, cx.Create(node.GetLocation())) { }
+            : base(cx, node, StmtKind.CATCH, parent, child, cx.CreateLocation(node.GetLocation())) { }
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
@@ -19,26 +19,26 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
             if (hasVariableDeclaration) // A catch clause of the form 'catch(Ex ex) { ... }'
             {
-                var decl = Expressions.VariableDeclaration.Create(cx, Stmt.Declaration, false, this, 0);
-                trapFile.catch_type(this, Type.Create(cx, decl.Type).TypeRef, true);
+                var decl = Expressions.VariableDeclaration.Create(Context, Stmt.Declaration, false, this, 0);
+                trapFile.catch_type(this, Type.Create(Context, decl.Type).TypeRef, true);
             }
             else if (isSpecificCatchClause) // A catch clause of the form 'catch(Ex) { ... }'
             {
-                trapFile.catch_type(this, Type.Create(cx, cx.GetType(Stmt.Declaration.Type)).TypeRef, true);
+                trapFile.catch_type(this, Type.Create(Context, Context.GetType(Stmt.Declaration.Type)).TypeRef, true);
             }
             else // A catch clause of the form 'catch { ... }'
             {
-                var exception = Type.Create(cx, cx.Compilation.GetTypeByMetadataName(systemExceptionName));
+                var exception = Type.Create(Context, Context.Compilation.GetTypeByMetadataName(systemExceptionName));
                 trapFile.catch_type(this, exception, false);
             }
 
             if (Stmt.Filter != null)
             {
                 // For backward compatibility, the catch filter clause is child number 2.
-                Expression.Create(cx, Stmt.Filter.FilterExpression, this, 2);
+                Expression.Create(Context, Stmt.Filter.FilterExpression, this, 2);
             }
 
-            Create(cx, Stmt.Block, this, 1);
+            Create(Context, Stmt.Block, this, 1);
         }
 
         public static Catch Create(Context cx, CatchClauseSyntax node, Try parent, int child)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Checked.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Checked.cs
index 4ce000bed3f..0f5766fad23 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Checked.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Checked.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Statement.Create(cx, Stmt.Block, this, 0);
+            Statement.Create(Context, Stmt.Block, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Do.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Do.cs
index a0cd9da7372..e3518505270 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Do.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Do.cs
@@ -8,7 +8,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
     internal class Do : Statement<DoStatementSyntax>
     {
         private Do(Context cx, DoStatementSyntax node, IStatementParentEntity parent, int child)
-            : base(cx, node, StmtKind.DO, parent, child, cx.Create(node.GetLocation())) { }
+            : base(cx, node, StmtKind.DO, parent, child, cx.CreateLocation(node.GetLocation())) { }
 
         public static Do Create(Context cx, DoStatementSyntax node, IStatementParentEntity parent, int child)
         {
@@ -19,8 +19,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Create(cx, Stmt.Statement, this, 1);
-            Expression.Create(cx, Stmt.Condition, this, 0);
+            Create(Context, Stmt.Statement, this, 1);
+            Expression.Create(Context, Stmt.Condition, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ExpressionStatement.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ExpressionStatement.cs
index 252e867efa9..76d369bde23 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ExpressionStatement.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ExpressionStatement.cs
@@ -18,9 +18,9 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             if (Stmt.Expression != null)
-                Expression.Create(cx, Stmt.Expression, this, 0);
+                Expression.Create(Context, Stmt.Expression, this, 0);
             else
-                cx.ModelError(Stmt, "Invalid expression statement");
+                Context.ModelError(Stmt, "Invalid expression statement");
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Factory.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Factory.cs
index 69ebdca1c16..2960982061e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Factory.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Factory.cs
@@ -5,7 +5,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 {
     internal static class Factory
     {
-        internal static Statement Create(Context cx, StatementSyntax node, Statement parent, int child)
+        internal static Statement Create(Context cx, StatementSyntax node, IStatementParentEntity parent, int child)
         {
             switch (node.Kind())
             {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Fixed.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Fixed.cs
index 7cd8350c7d1..1d01b1708f2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Fixed.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Fixed.cs
@@ -19,8 +19,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            VariableDeclarations.Populate(cx, Stmt.Declaration, this, -1, childIncrement: -1);
-            Create(cx, Stmt.Statement, this, 0);
+            VariableDeclarations.Populate(Context, Stmt.Declaration, this, -1, childIncrement: -1);
+            Create(Context, Stmt.Statement, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
index 15c7151a8a6..678373168f6 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/For.cs
@@ -22,25 +22,25 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
             var child = -1;
 
             if (Stmt.Declaration != null)
-                VariableDeclarations.Populate(cx, Stmt.Declaration, this, child, childIncrement: -1);
+                VariableDeclarations.Populate(Context, Stmt.Declaration, this, child, childIncrement: -1);
 
             foreach (var init in Stmt.Initializers)
             {
-                Expression.Create(cx, init, this, child--);
+                Expression.Create(Context, init, this, child--);
             }
 
             if (Stmt.Condition != null)
             {
-                Expression.Create(cx, Stmt.Condition, this, 0);
+                Expression.Create(Context, Stmt.Condition, this, 0);
             }
 
             child = 1;
             foreach (var inc in Stmt.Incrementors)
             {
-                Expression.Create(cx, inc, this, child++);
+                Expression.Create(Context, inc, this, child++);
             }
 
-            Statement.Create(cx, Stmt.Statement, this, 1 + Stmt.Incrementors.Count);
+            Statement.Create(Context, Stmt.Statement, this, 1 + Stmt.Incrementors.Count);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
index 262b3f0e328..bd9b1528a13 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
@@ -8,6 +8,15 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 {
     internal class ForEach : Statement<ForEachStatementSyntax>
     {
+        internal enum ForeachSymbolType
+        {
+            GetEnumeratorMethod = 1,
+            CurrentProperty,
+            MoveNextMethod,
+            DisposeMethod,
+            ElementType
+        }
+
         private ForEach(Context cx, ForEachStatementSyntax stmt, IStatementParentEntity parent, int child)
             : base(cx, stmt, StmtKind.FOREACH, parent, child) { }
 
@@ -18,18 +27,59 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
             return ret;
         }
 
-        protected override void PopulateStatement(TextWriter _)
+        protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Expression, this, 1);
+            Expression.Create(Context, Stmt.Expression, this, 1);
 
-            var typeSymbol = cx.GetModel(Stmt).GetDeclaredSymbol(Stmt);
+            var semanticModel = Context.GetModel(Stmt);
+            var typeSymbol = semanticModel.GetDeclaredSymbol(Stmt);
             var type = typeSymbol.GetAnnotatedType();
 
-            var location = cx.Create(Stmt.Identifier.GetLocation());
+            var location = Context.CreateLocation(Stmt.Identifier.GetLocation());
 
-            Expressions.VariableDeclaration.Create(cx, typeSymbol, type, Stmt.Type, location, Stmt.Type.IsVar, this, 0);
+            Expressions.VariableDeclaration.Create(Context, typeSymbol, type, Stmt.Type, location, Stmt.Type.IsVar, this, 0);
 
-            Statement.Create(cx, Stmt.Statement, this, 2);
+            Statement.Create(Context, Stmt.Statement, this, 2);
+
+            var info = semanticModel.GetForEachStatementInfo(Stmt);
+
+            if (info.Equals(default))
+            {
+                Context.ExtractionError("Could not get foreach statement info", null, Context.CreateLocation(this.ReportingLocation), severity: Util.Logging.Severity.Info);
+                return;
+            }
+
+            trapFile.foreach_stmt_info(this, info.IsAsynchronous);
+
+            if (info.GetEnumeratorMethod != null)
+            {
+                var m = Method.Create(Context, info.GetEnumeratorMethod);
+                trapFile.foreach_stmt_desugar(this, m, ForeachSymbolType.GetEnumeratorMethod);
+            }
+
+            if (info.MoveNextMethod != null)
+            {
+                var m = Method.Create(Context, info.MoveNextMethod);
+                trapFile.foreach_stmt_desugar(this, m, ForeachSymbolType.MoveNextMethod);
+            }
+
+            if (info.DisposeMethod != null)
+            {
+                var m = Method.Create(Context, info.DisposeMethod);
+                trapFile.foreach_stmt_desugar(this, m, ForeachSymbolType.DisposeMethod);
+            }
+
+            if (info.CurrentProperty != null)
+            {
+                var p = Property.Create(Context, info.CurrentProperty);
+                trapFile.foreach_stmt_desugar(this, p, ForeachSymbolType.CurrentProperty);
+            }
+
+            if (info.ElementType != null)
+            {
+                var t = Type.Create(Context, info.ElementType);
+                trapFile.foreach_stmt_desugar(this, t, ForeachSymbolType.ElementType);
+            }
         }
     }
 
@@ -47,9 +97,9 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Variable, this, 0);
-            Expression.Create(cx, Stmt.Expression, this, 1);
-            Statement.Create(cx, Stmt.Statement, this, 2);
+            Expression.Create(Context, Stmt.Variable, this, 0);
+            Expression.Create(Context, Stmt.Expression, this, 1);
+            Statement.Create(Context, Stmt.Statement, this, 2);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/GlobalStatementsBlock.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/GlobalStatementsBlock.cs
new file mode 100644
index 00000000000..011437fac9b
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/GlobalStatementsBlock.cs
@@ -0,0 +1,42 @@
+using Semmle.Extraction.Kinds;
+using System.Linq;
+using System.IO;
+using Semmle.Extraction.Entities;
+
+namespace Semmle.Extraction.CSharp.Entities.Statements
+{
+    internal class GlobalStatementsBlock : Statement
+    {
+        private readonly Method parent;
+
+        private GlobalStatementsBlock(Context cx, Method parent)
+            : base(cx, StmtKind.BLOCK, parent, 0)
+        {
+            this.parent = parent;
+        }
+
+        public override Microsoft.CodeAnalysis.Location ReportingLocation
+        {
+            get
+            {
+                return parent.Symbol
+                    ?.DeclaringSyntaxReferences
+                    .FirstOrDefault()
+                    ?.GetSyntax()
+                    .GetLocation();
+            }
+        }
+
+        public static GlobalStatementsBlock Create(Context cx, Method parent)
+        {
+            var ret = new GlobalStatementsBlock(cx, parent);
+            ret.TryPopulate();
+            return ret;
+        }
+
+        protected override void PopulateStatement(TextWriter trapFile)
+        {
+            trapFile.stmt_location(this, Context.CreateLocation(ReportingLocation));
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Goto.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Goto.cs
index 772d69cff7c..20548dd056a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Goto.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Goto.cs
@@ -40,8 +40,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
                     trapFile.exprorstmt_name(this, target);
                     break;
                 case StmtKind.GOTO_CASE:
-                    Expr = Expression.Create(cx, Stmt.Expression, this, 0);
-                    ConstantValue = Switch.LabelForValue(cx.GetModel(Stmt).GetConstantValue(Stmt.Expression).Value);
+                    Expr = Expression.Create(Context, Stmt.Expression, this, 0);
+                    ConstantValue = Switch.LabelForValue(Context.GetModel(Stmt).GetConstantValue(Stmt.Expression).Value);
                     break;
                 case StmtKind.GOTO_DEFAULT:
                     ConstantValue = Switch.DefaultLabel;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/If.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/If.cs
index b132c6ebe54..010cd9a793b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/If.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/If.cs
@@ -18,12 +18,12 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Condition, this, 0);
+            Expression.Create(Context, Stmt.Condition, this, 0);
 
-            Create(cx, Stmt.Statement, this, 1);
+            Create(Context, Stmt.Statement, this, 1);
 
             if (Stmt.Else != null)
-                Create(cx, Stmt.Else.Statement, this, 2);
+                Create(Context, Stmt.Else.Statement, this, 2);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Labeled.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Labeled.cs
index 1fce622b347..d549008daaf 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Labeled.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Labeled.cs
@@ -6,17 +6,18 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 {
     internal class Labeled : Statement<LabeledStatementSyntax>
     {
-        private readonly Statement parent;
+        private readonly IStatementParentEntity parent;
         private readonly int child;
+        private Statement labelledStmt;
 
-        private Labeled(Context cx, LabeledStatementSyntax stmt, Statement parent, int child)
+        private Labeled(Context cx, LabeledStatementSyntax stmt, IStatementParentEntity parent, int child)
             : base(cx, stmt, StmtKind.LABEL, parent, child)
         {
             this.parent = parent;
             this.child = child;
         }
 
-        public static Labeled Create(Context cx, LabeledStatementSyntax node, Statement parent, int child)
+        public static Labeled Create(Context cx, LabeledStatementSyntax node, IStatementParentEntity parent, int child)
         {
             var ret = new Labeled(cx, node, parent, child);
             ret.TryPopulate();
@@ -27,13 +28,11 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         {
             trapFile.exprorstmt_name(this, Stmt.Identifier.ToString());
 
-            // For compatilibty with the Mono extractor, make insert the labelled statement into the same block
+            // For compatibility with the Mono extractor, make insert the labelled statement into the same block
             // as this one. The parent MUST be a block statement.
-            labelledStmt = Statement.Create(cx, Stmt.Statement, parent, child + 1);
+            labelledStmt = Statement.Create(Context, Stmt.Statement, parent, child + 1);
         }
 
-        private Statement labelledStmt;
-
         public override int NumberOfStatements => 1 + labelledStmt.NumberOfStatements;
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalDeclaration.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalDeclaration.cs
index 87559681fd8..b147e5693ca 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalDeclaration.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalDeclaration.cs
@@ -30,8 +30,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            VariableDeclarations.Populate(cx, Stmt.Declaration, this, 0);
-            cx.BindComments(this, Stmt.GetLocation());
+            VariableDeclarations.Populate(Context, Stmt.Declaration, this, 0);
+            Context.BindComments(this, Stmt.GetLocation());
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalFunction.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalFunction.cs
index eb81f27cb3a..aaebd538c67 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalFunction.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/LocalFunction.cs
@@ -10,7 +10,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
     internal class LocalFunction : Statement<LocalFunctionStatementSyntax>
     {
         private LocalFunction(Context cx, LocalFunctionStatementSyntax node, IStatementParentEntity parent, int child)
-            : base(cx, node, StmtKind.LOCAL_FUNCTION, parent, child, cx.Create(node.GetLocation())) { }
+            : base(cx, node, StmtKind.LOCAL_FUNCTION, parent, child, cx.CreateLocation(node.GetLocation())) { }
 
         public static LocalFunction Create(Context cx, LocalFunctionStatementSyntax node, IStatementParentEntity parent, int child)
         {
@@ -26,7 +26,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         {
             get
             {
-                var m = cx.GetModel(Stmt);
+                var m = Context.GetModel(Stmt);
                 return m.GetDeclaredSymbol(Stmt) as IMethodSymbol;
             }
         }
@@ -34,7 +34,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         /// <summary>
         /// Gets the function defined by this local statement.
         /// </summary>
-        private Entities.LocalFunction Function => Entities.LocalFunction.Create(cx, Symbol);
+        private Entities.LocalFunction Function => Entities.LocalFunction.Create(Context, Symbol);
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Lock.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Lock.cs
index fbcb346b367..141edcea63a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Lock.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Lock.cs
@@ -18,8 +18,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Expression, this, 0);
-            Statement.Create(cx, Stmt.Statement, this, 1);
+            Expression.Create(Context, Stmt.Expression, this, 0);
+            Statement.Create(Context, Stmt.Statement, this, 1);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Return.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Return.cs
index 2ff04b82b87..64692630b4c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Return.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Return.cs
@@ -19,7 +19,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             if (Stmt.Expression != null)
-                Expression.Create(cx, Stmt.Expression, this, 0);
+                Expression.Create(Context, Stmt.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Switch.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Switch.cs
index f64067be9c4..df73554f389 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Switch.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Switch.cs
@@ -30,17 +30,17 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Expression, this, 0);
+            Expression.Create(Context, Stmt.Expression, this, 0);
             var childIndex = 0;
 
             foreach (var section in Stmt.Sections)
             {
-                foreach (var stmt in section.Labels.Select(label => Case<SwitchLabelSyntax>.Create(cx, label, this, childIndex)))
+                foreach (var stmt in section.Labels.Select(label => Case<SwitchLabelSyntax>.Create(Context, label, this, childIndex)))
                 {
                     childIndex += stmt.NumberOfStatements;
                 }
 
-                foreach (var stmt in section.Statements.Select(s => Create(cx, s, this, childIndex)))
+                foreach (var stmt in section.Statements.Select(s => Create(Context, s, this, childIndex)))
                 {
                     childIndex += stmt.NumberOfStatements;
                 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Throw.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Throw.cs
index c550b1f1e39..dbff60d890b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Throw.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Throw.cs
@@ -19,7 +19,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             if (Stmt.Expression != null)
-                Expression.Create(cx, Stmt.Expression, this, 0);
+                Expression.Create(Context, Stmt.Expression, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Try.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Try.cs
index 5a6937790c2..bb17c2beaa2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Try.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Try.cs
@@ -22,14 +22,14 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
             var child = 1;
             foreach (var c in Stmt.Catches)
             {
-                Catch.Create(cx, c, this, child++);
+                Catch.Create(Context, c, this, child++);
             }
 
-            Create(cx, Stmt.Block, this, 0);
+            Create(Context, Stmt.Block, this, 0);
 
             if (Stmt.Finally != null)
             {
-                Create(cx, Stmt.Finally.Block, this, -1);
+                Create(Context, Stmt.Finally.Block, this, -1);
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unchecked.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unchecked.cs
index 2d69bdc8d4c..37de04f870b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unchecked.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unchecked.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Statement.Create(cx, Stmt.Block, this, 0);
+            Statement.Create(Context, Stmt.Block, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unsafe.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unsafe.cs
index 4e371604333..936c5e84296 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unsafe.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Unsafe.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Create(cx, Stmt.Block, this, 0);
+            Create(Context, Stmt.Block, this, 0);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Using.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Using.cs
index 93d0f6a88ff..b62e6556a8c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Using.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Using.cs
@@ -20,13 +20,13 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         protected override void PopulateStatement(TextWriter trapFile)
         {
             if (Stmt.Declaration != null)
-                VariableDeclarations.Populate(cx, Stmt.Declaration, this, -1, childIncrement: -1);
+                VariableDeclarations.Populate(Context, Stmt.Declaration, this, -1, childIncrement: -1);
 
             if (Stmt.Expression != null)
-                Expression.Create(cx, Stmt.Expression, this, 0);
+                Expression.Create(Context, Stmt.Expression, this, 0);
 
             if (Stmt.Statement != null)
-                Statement.Create(cx, Stmt.Statement, this, 1);
+                Statement.Create(Context, Stmt.Statement, this, 1);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/While.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/While.cs
index 8def91a8418..99e96e7b683 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/While.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/While.cs
@@ -18,8 +18,8 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
 
         protected override void PopulateStatement(TextWriter trapFile)
         {
-            Expression.Create(cx, Stmt.Condition, this, 0);
-            Create(cx, Stmt.Statement, this, 1);
+            Expression.Create(Context, Stmt.Condition, this, 0);
+            Create(Context, Stmt.Statement, this, 1);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Yield.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Yield.cs
index 9aace8e0b83..605a7cacdbc 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Yield.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Yield.cs
@@ -20,7 +20,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
         {
             if (Stmt.Expression != null)
             {
-                Expression.Create(cx, Stmt.Expression, this, 0);
+                Expression.Create(Context, Stmt.Expression, this, 0);
             }
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Symbol.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Symbol.cs
index 5e0850ba8c8..2ac5c6e90e5 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Symbol.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Symbol.cs
@@ -14,18 +14,18 @@ namespace Semmle.Extraction.CSharp.Entities
         protected CachedSymbol(Context cx, T init)
             : base(cx, init) { }
 
-        public virtual Type ContainingType => symbol.ContainingType != null ? Type.Create(Context, symbol.ContainingType) : null;
+        public virtual Type ContainingType => Symbol.ContainingType != null ? Type.Create(Context, Symbol.ContainingType) : null;
 
         public void PopulateModifiers(TextWriter trapFile)
         {
-            Modifier.ExtractModifiers(Context, trapFile, this, symbol);
+            Modifier.ExtractModifiers(Context, trapFile, this, Symbol);
         }
 
         protected void PopulateAttributes()
         {
             // Only extract attributes for source declarations
-            if (ReferenceEquals(symbol, symbol.OriginalDefinition))
-                Attribute.ExtractAttributes(Context, symbol, this);
+            if (ReferenceEquals(Symbol, Symbol.OriginalDefinition))
+                Attribute.ExtractAttributes(Context, Symbol, this);
         }
 
         protected void PopulateNullability(TextWriter trapFile, AnnotatedTypeSymbol type)
@@ -55,7 +55,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected void ExtractCompilerGenerated(TextWriter trapFile)
         {
-            if (symbol.IsImplicitlyDeclared)
+            if (Symbol.IsImplicitlyDeclared)
                 trapFile.compiler_generated(this);
         }
 
@@ -63,12 +63,12 @@ namespace Semmle.Extraction.CSharp.Entities
         /// The location which is stored in the database and is used when highlighing source code.
         /// It's generally short, e.g. a method name.
         /// </summary>
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => symbol.Locations.FirstOrDefault();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.Locations.FirstOrDefault();
 
         /// <summary>
         /// The full text span of the entity, e.g. for binding comments.
         /// </summary>
-        public virtual Microsoft.CodeAnalysis.Location FullLocation => symbol.Locations.FirstOrDefault();
+        public virtual Microsoft.CodeAnalysis.Location FullLocation => Symbol.Locations.FirstOrDefault();
 
         public virtual IEnumerable<Extraction.Entities.Location> Locations
         {
@@ -78,7 +78,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 if (loc != null)
                 {
                     // Some built in operators lack locations, so loc is null.
-                    yield return Context.Create(ReportingLocation);
+                    yield return Context.CreateLocation(ReportingLocation);
                     if (Context.Extractor.OutputPath != null && loc.Kind == LocationKind.SourceFile)
                         yield return Assembly.CreateOutputAssembly(Context);
                 }
@@ -91,11 +91,11 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         protected void BindComments()
         {
-            if (!symbol.IsImplicitlyDeclared && IsSourceDeclaration && symbol.FromSource())
+            if (!Symbol.IsImplicitlyDeclared && IsSourceDeclaration && Symbol.FromSource())
                 Context.BindComments(this, FullLocation);
         }
 
-        protected virtual T BodyDeclaringSymbol => symbol;
+        protected virtual T BodyDeclaringSymbol => Symbol;
 
         public BlockSyntax Block
         {
@@ -120,11 +120,11 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
-        public virtual bool IsSourceDeclaration => symbol.IsSourceDeclaration();
+        public virtual bool IsSourceDeclaration => Symbol.IsSourceDeclaration();
 
-        public override bool NeedsPopulation => Context.Defines(symbol);
+        public override bool NeedsPopulation => Context.Defines(Symbol);
 
-        public Extraction.Entities.Location Location => Context.Create(ReportingLocation);
+        public Extraction.Entities.Location Location => Context.CreateLocation(ReportingLocation);
 
         protected void PopulateMetadataHandle(TextWriter trapFile)
         {
@@ -143,15 +143,15 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                var handleProp = GetPropertyInfo(symbol, "Handle");
-                object handleObj = symbol;
+                var handleProp = GetPropertyInfo(Symbol, "Handle");
+                object handleObj = Symbol;
 
                 if (handleProp is null)
                 {
-                    var underlyingSymbolProp = GetPropertyInfo(symbol, "UnderlyingSymbol");
+                    var underlyingSymbolProp = GetPropertyInfo(Symbol, "UnderlyingSymbol");
                     if (underlyingSymbolProp is object)
                     {
-                        if (underlyingSymbolProp.GetValue(symbol) is object underlying)
+                        if (underlyingSymbolProp.GetValue(Symbol) is object underlying)
                         {
                             handleProp = GetPropertyInfo(underlying, "Handle");
                             handleObj = underlying;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
index 8d6074f3e8d..e2fd72eae56 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
@@ -32,7 +32,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 case NullableTypeSyntax nts:
                     // int[]? -> int[] -> int
                     // int?   -> int?
-                    return cx.GetTypeInfo(nts.ElementType).Type.IsReferenceType
+                    return Context.GetTypeInfo(nts.ElementType).Type.IsReferenceType
                         ? GetArrayElementType(nts.ElementType)
                         : nts;
                 case PointerTypeSyntax pts:
@@ -48,8 +48,8 @@ namespace Semmle.Extraction.CSharp.Entities
             {
                 case ArrayType at:
                     return GetArrayElementType(at.ElementType);
-                case NamedType nt when nt.symbol.IsBoundSpan() ||
-                                       nt.symbol.IsBoundReadOnlySpan():
+                case NamedType nt when nt.Symbol.IsBoundSpan() ||
+                                       nt.Symbol.IsBoundReadOnlySpan():
                     return nt.TypeArguments.Single();
                 case PointerType pt:
                     return GetArrayElementType(pt.PointedAtType);
@@ -65,48 +65,48 @@ namespace Semmle.Extraction.CSharp.Entities
                 case SyntaxKind.ArrayType:
                 case SyntaxKind.PointerType:
                     Emit(trapFile, loc ?? syntax.GetLocation(), parent, type);
-                    Create(cx, GetArrayElementType(syntax), this, GetArrayElementType(type));
+                    Create(Context, GetArrayElementType(syntax), this, GetArrayElementType(type));
                     return;
                 case SyntaxKind.NullableType:
                     var nts = (NullableTypeSyntax)syntax;
                     if (type is NamedType nt)
                     {
-                        if (!nt.symbol.IsReferenceType)
+                        if (!nt.Symbol.IsReferenceType)
                         {
                             Emit(trapFile, loc ?? syntax.GetLocation(), parent, type);
-                            Create(cx, nts.ElementType, this, nt.TypeArguments[0]);
+                            Create(Context, nts.ElementType, this, nt.TypeArguments[0]);
                         }
                         else
                         {
-                            Create(cx, nts.ElementType, parent, type);
+                            Create(Context, nts.ElementType, parent, type);
                         }
                     }
                     else if (type is ArrayType)
                     {
-                        Create(cx, nts.ElementType, parent, type);
+                        Create(Context, nts.ElementType, parent, type);
                     }
                     return;
                 case SyntaxKind.TupleType:
                     var tts = (TupleTypeSyntax)syntax;
                     var tt = (TupleType)type;
                     Emit(trapFile, loc ?? syntax.GetLocation(), parent, type);
-                    tts.Elements.Zip(tt.TupleElements, (s, t) => Create(cx, s.Type, this, t.Type)).Enumerate();
+                    tts.Elements.Zip(tt.TupleElements, (s, t) => Create(Context, s.Type, this, t.Type)).Enumerate();
                     return;
                 case SyntaxKind.GenericName:
                     Emit(trapFile, loc ?? syntax.GetLocation(), parent, type);
-                    cx.PopulateLater(() =>
+                    Context.PopulateLater(() =>
                         ((GenericNameSyntax)syntax)
                             .TypeArgumentList
                             .Arguments
-                            .Zip(type.TypeMentions, (s, t) => Create(cx, s, this, t)).Enumerate());
+                            .Zip(type.TypeMentions, (s, t) => Create(Context, s, this, t)).Enumerate());
                     return;
                 case SyntaxKind.QualifiedName:
                     var qns = (QualifiedNameSyntax)syntax;
-                    var right = Create(cx, qns.Right, parent, type);
+                    var right = Create(Context, qns.Right, parent, type);
                     if (type.ContainingType is object)
                     {
                         // Type qualifier
-                        Create(cx, qns.Left, right, type.ContainingType);
+                        Create(Context, qns.Left, right, type.ContainingType);
                     }
                     return;
                 default:
@@ -118,7 +118,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private void Emit(TextWriter trapFile, Microsoft.CodeAnalysis.Location loc, IEntity parent, Type type)
         {
             trapFile.type_mention(this, type.TypeRef, parent);
-            trapFile.type_mention_location(this, cx.Create(loc));
+            trapFile.type_mention_location(this, Context.CreateLocation(loc));
         }
 
         public static TypeMention Create(Context cx, TypeSyntax syntax, IEntity parent, Type type, Microsoft.CodeAnalysis.Location loc = null)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
index 4ec1db558e5..62a10396b4b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
@@ -9,12 +9,12 @@ namespace Semmle.Extraction.CSharp.Entities
         private ArrayType(Context cx, IArrayTypeSymbol init)
             : base(cx, init)
         {
-            elementLazy = new Lazy<Type>(() => Create(cx, symbol.ElementType));
+            elementLazy = new Lazy<Type>(() => Create(cx, Symbol.ElementType));
         }
 
         private readonly Lazy<Type> elementLazy;
 
-        public int Rank => symbol.Rank;
+        public int Rank => Symbol.Rank;
 
         public Type ElementType => elementLazy.Value;
 
@@ -33,7 +33,7 @@ namespace Semmle.Extraction.CSharp.Entities
         public override void WriteId(TextWriter trapFile)
         {
             trapFile.WriteSubId(ElementType);
-            symbol.BuildArraySuffix(trapFile);
+            Symbol.BuildArraySuffix(trapFile);
             trapFile.Write(";type");
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
index 1bf68a4c3c2..903de837a73 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
@@ -13,7 +13,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            symbol.BuildTypeId(Context, trapFile, symbol);
+            Symbol.BuildTypeId(Context, trapFile, Symbol);
             trapFile.Write(";functionpointertype");
         }
 
@@ -21,8 +21,8 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.function_pointer_calling_conventions(this, (int)symbol.Signature.CallingConvention);
-            foreach (var (conv, i) in symbol.Signature.UnmanagedCallingConventionTypes.Select((nt, i) => (Create(Context, nt), i)))
+            trapFile.function_pointer_calling_conventions(this, (int)Symbol.Signature.CallingConvention);
+            foreach (var (conv, i) in Symbol.Signature.UnmanagedCallingConventionTypes.Select((nt, i) => (Create(Context, nt), i)))
             {
                 trapFile.has_unmanaged_calling_conventions(this, i, conv.TypeRef);
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
index bded5f60c57..4c250e22692 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private NamedType(Context cx, INamedTypeSymbol init, bool constructUnderlyingTupleType)
             : base(cx, init)
         {
-            typeArgumentsLazy = new Lazy<Type[]>(() => symbol.TypeArguments.Select(t => Create(cx, t)).ToArray());
+            typeArgumentsLazy = new Lazy<Type[]>(() => Symbol.TypeArguments.Select(t => Create(cx, t)).ToArray());
             this.constructUnderlyingTupleType = constructUnderlyingTupleType;
         }
 
@@ -30,32 +30,32 @@ namespace Semmle.Extraction.CSharp.Entities
         public static NamedType CreateNamedTypeFromTupleType(Context cx, INamedTypeSymbol type) =>
             UnderlyingTupleTypeFactory.Instance.CreateEntity(cx, (new SymbolEqualityWrapper(type), typeof(TupleType)), type);
 
-        public override bool NeedsPopulation => base.NeedsPopulation || symbol.TypeKind == TypeKind.Error;
+        public override bool NeedsPopulation => base.NeedsPopulation || Symbol.TypeKind == TypeKind.Error;
 
         public override void Populate(TextWriter trapFile)
         {
-            if (symbol.TypeKind == TypeKind.Error)
+            if (Symbol.TypeKind == TypeKind.Error)
             {
-                Context.Extractor.MissingType(symbol.ToString(), Context.FromSource);
+                Context.Extractor.MissingType(Symbol.ToString(), Context.FromSource);
                 return;
             }
 
             if (UsesTypeRef)
                 trapFile.typeref_type((NamedTypeRef)TypeRef, this);
 
-            if (symbol.IsGenericType)
+            if (Symbol.IsGenericType)
             {
-                if (symbol.IsBoundNullable())
+                if (Symbol.IsBoundNullable())
                 {
                     // An instance of Nullable<T>
-                    trapFile.nullable_underlying_type(this, Create(Context, symbol.TypeArguments[0]).TypeRef);
+                    trapFile.nullable_underlying_type(this, Create(Context, Symbol.TypeArguments[0]).TypeRef);
                 }
-                else if (symbol.IsReallyUnbound())
+                else if (Symbol.IsReallyUnbound())
                 {
-                    for (var i = 0; i < symbol.TypeParameters.Length; ++i)
+                    for (var i = 0; i < Symbol.TypeParameters.Length; ++i)
                     {
-                        TypeParameter.Create(Context, symbol.TypeParameters[i]);
-                        var param = symbol.TypeParameters[i];
+                        TypeParameter.Create(Context, Symbol.TypeParameters[i]);
+                        var param = Symbol.TypeParameters[i];
                         var typeParameter = TypeParameter.Create(Context, param);
                         trapFile.type_parameters(typeParameter, i, this);
                     }
@@ -63,11 +63,11 @@ namespace Semmle.Extraction.CSharp.Entities
                 else
                 {
                     var unbound = constructUnderlyingTupleType
-                        ? CreateNamedTypeFromTupleType(Context, symbol.ConstructedFrom)
-                        : Type.Create(Context, symbol.ConstructedFrom);
+                        ? CreateNamedTypeFromTupleType(Context, Symbol.ConstructedFrom)
+                        : Type.Create(Context, Symbol.ConstructedFrom);
                     trapFile.constructed_generic(this, unbound.TypeRef);
 
-                    for (var i = 0; i < symbol.TypeArguments.Length; ++i)
+                    for (var i = 0; i < Symbol.TypeArguments.Length; ++i)
                     {
                         trapFile.type_arguments(TypeArguments[i].TypeRef, i, this);
                     }
@@ -76,19 +76,19 @@ namespace Semmle.Extraction.CSharp.Entities
 
             PopulateType(trapFile, constructUnderlyingTupleType);
 
-            if (symbol.EnumUnderlyingType != null)
+            if (Symbol.EnumUnderlyingType != null)
             {
-                trapFile.enum_underlying_type(this, Type.Create(Context, symbol.EnumUnderlyingType).TypeRef);
+                trapFile.enum_underlying_type(this, Type.Create(Context, Symbol.EnumUnderlyingType).TypeRef);
             }
 
             // Class location
-            if (!symbol.IsGenericType || symbol.IsReallyUnbound())
+            if (!Symbol.IsGenericType || Symbol.IsReallyUnbound())
             {
                 foreach (var l in Locations)
                     trapFile.type_location(this, l);
             }
 
-            if (symbol.IsAnonymousType)
+            if (Symbol.IsAnonymousType)
             {
                 trapFile.anonymous_types(this);
             }
@@ -105,10 +105,10 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                foreach (var l in GetLocations(symbol))
-                    yield return Context.Create(l);
+                foreach (var l in GetLocations(Symbol))
+                    yield return Context.CreateLocation(l);
 
-                if (Context.Extractor.OutputPath != null && symbol.DeclaringSyntaxReferences.Any())
+                if (Context.Extractor.OutputPath != null && Symbol.DeclaringSyntaxReferences.Any())
                     yield return Assembly.CreateOutputAssembly(Context);
             }
         }
@@ -124,9 +124,9 @@ namespace Semmle.Extraction.CSharp.Entities
                 );
         }
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => GetLocations(symbol).FirstOrDefault();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => GetLocations(Symbol).FirstOrDefault();
 
-        private bool IsAnonymousType() => symbol.IsAnonymousType || symbol.Name.Contains("__AnonymousType");
+        private bool IsAnonymousType() => Symbol.IsAnonymousType || Symbol.Name.Contains("__AnonymousType");
 
         public override void WriteId(TextWriter trapFile)
         {
@@ -136,7 +136,7 @@ namespace Semmle.Extraction.CSharp.Entities
             }
             else
             {
-                symbol.BuildTypeId(Context, trapFile, symbol, constructUnderlyingTupleType);
+                Symbol.BuildTypeId(Context, trapFile, Symbol, constructUnderlyingTupleType);
                 trapFile.Write(";type");
             }
         }
@@ -167,9 +167,9 @@ namespace Semmle.Extraction.CSharp.Entities
         // Create typerefs for constructed error types in case they are fully defined elsewhere.
         // We cannot use `!this.NeedsPopulation` because this would not be stable as it would depend on
         // the assembly that was being extracted at the time.
-        private bool UsesTypeRef => symbol.TypeKind == TypeKind.Error || SymbolEqualityComparer.Default.Equals(symbol.OriginalDefinition, symbol);
+        private bool UsesTypeRef => Symbol.TypeKind == TypeKind.Error || SymbolEqualityComparer.Default.Equals(Symbol.OriginalDefinition, Symbol);
 
-        public override Type TypeRef => UsesTypeRef ? (Type)NamedTypeRef.Create(Context, symbol) : this;
+        public override Type TypeRef => UsesTypeRef ? (Type)NamedTypeRef.Create(Context, Symbol) : this;
     }
 
     internal class NamedTypeRef : Type<INamedTypeSymbol>
@@ -203,7 +203,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.typerefs(this, symbol.Name);
+            trapFile.typerefs(this, Symbol.Name);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Nullability.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Nullability.cs
index 106efdd0cde..a0d9e2a1f8c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Nullability.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Nullability.cs
@@ -110,10 +110,10 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.nullability(this, symbol.Annotation);
+            trapFile.nullability(this, Symbol.Annotation);
 
             var i = 0;
-            foreach (var s in symbol.NullableParameters)
+            foreach (var s in Symbol.NullableParameters)
             {
                 trapFile.nullability_parent(Create(Context, s), i, this);
                 i++;
@@ -122,7 +122,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            symbol.WriteId(trapFile);
+            Symbol.WriteId(trapFile);
         }
 
         public static NullabilityEntity Create(Context cx, Nullability init) => NullabilityFactory.Instance.CreateEntity(cx, init, init);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/PointerType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/PointerType.cs
index e2fbb8677cc..dd9b749f53e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/PointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/PointerType.cs
@@ -8,7 +8,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private PointerType(Context cx, IPointerTypeSymbol init)
             : base(cx, init)
         {
-            PointedAtType = Create(cx, symbol.PointedAtType);
+            PointedAtType = Create(cx, Symbol.PointedAtType);
         }
 
         public override void WriteId(TextWriter trapFile)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
index 4ddc258f5c7..18321f84d32 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
@@ -24,7 +24,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         private TupleType(Context cx, INamedTypeSymbol init) : base(cx, init)
         {
-            tupleElementsLazy = new Lazy<Field[]>(() => symbol.TupleElements.Select(t => Field.Create(cx, t)).ToArray());
+            tupleElementsLazy = new Lazy<Field[]>(() => Symbol.TupleElements.Select(t => Field.Create(cx, t)).ToArray());
         }
 
         // All tuple types are "local types"
@@ -32,7 +32,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void WriteId(TextWriter trapFile)
         {
-            symbol.BuildTypeId(Context, trapFile, symbol);
+            Symbol.BuildTypeId(Context, trapFile, Symbol);
             trapFile.Write(";tuple");
         }
 
@@ -41,7 +41,7 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateType(trapFile);
             PopulateGenerics();
 
-            var underlyingType = NamedType.CreateNamedTypeFromTupleType(Context, symbol.TupleUnderlyingType ?? symbol);
+            var underlyingType = NamedType.CreateNamedTypeFromTupleType(Context, Symbol.TupleUnderlyingType ?? Symbol);
 
             trapFile.tuple_underlying_type(this, underlyingType);
 
@@ -52,8 +52,8 @@ namespace Semmle.Extraction.CSharp.Entities
             // Note: symbol.Locations seems to be very inconsistent
             // about what locations are available for a tuple type.
             // Sometimes it's the source code, and sometimes it's empty.
-            foreach (var l in symbol.Locations)
-                trapFile.type_location(this, Context.Create(l));
+            foreach (var l in Symbol.Locations)
+                trapFile.type_location(this, Context.CreateLocation(l));
         }
 
         private readonly Lazy<Field[]> tupleElementsLazy;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
index 8c96a334565..3931c6ef1d8 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
@@ -15,7 +15,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
 
         public override bool NeedsPopulation =>
-            base.NeedsPopulation || symbol.TypeKind == TypeKind.Dynamic || symbol.TypeKind == TypeKind.TypeParameter;
+            base.NeedsPopulation || Symbol.TypeKind == TypeKind.Dynamic || Symbol.TypeKind == TypeKind.TypeParameter;
 
         public static bool ConstructedOrParentIsConstructed(INamedTypeSymbol symbol)
         {
@@ -75,24 +75,24 @@ namespace Semmle.Extraction.CSharp.Entities
             trapFile.Write("types(");
             trapFile.WriteColumn(this);
             trapFile.Write(',');
-            trapFile.WriteColumn((int)GetClassType(Context, symbol, constructUnderlyingTupleType));
+            trapFile.WriteColumn((int)GetClassType(Context, Symbol, constructUnderlyingTupleType));
             trapFile.Write(",\"");
-            symbol.BuildDisplayName(Context, trapFile, constructUnderlyingTupleType);
+            Symbol.BuildDisplayName(Context, trapFile, constructUnderlyingTupleType);
             trapFile.WriteLine("\")");
 
             // Visit base types
             var baseTypes = new List<Type>();
-            if (symbol.GetNonObjectBaseType(Context) is INamedTypeSymbol @base)
+            if (Symbol.GetNonObjectBaseType(Context) is INamedTypeSymbol @base)
             {
                 var baseKey = Create(Context, @base);
                 trapFile.extend(this, baseKey.TypeRef);
-                if (symbol.TypeKind != TypeKind.Struct)
+                if (Symbol.TypeKind != TypeKind.Struct)
                     baseTypes.Add(baseKey);
             }
 
-            if (!(base.symbol is IArrayTypeSymbol))
+            if (!(base.Symbol is IArrayTypeSymbol))
             {
-                foreach (var t in base.symbol.Interfaces.Select(i => Create(Context, i)))
+                foreach (var t in base.Symbol.Interfaces.Select(i => Create(Context, i)))
                 {
                     trapFile.implement(this, t.TypeRef);
                     baseTypes.Add(t);
@@ -100,17 +100,17 @@ namespace Semmle.Extraction.CSharp.Entities
             }
 
             var containingType = ContainingType;
-            if (containingType != null && symbol.Kind != SymbolKind.TypeParameter)
+            if (containingType != null && Symbol.Kind != SymbolKind.TypeParameter)
             {
-                var originalDefinition = symbol.TypeKind == TypeKind.Error ? this : Create(Context, symbol.OriginalDefinition);
+                var originalDefinition = Symbol.TypeKind == TypeKind.Error ? this : Create(Context, Symbol.OriginalDefinition);
                 trapFile.nested_types(this, containingType, originalDefinition);
             }
-            else if (symbol.ContainingNamespace != null)
+            else if (Symbol.ContainingNamespace != null)
             {
-                trapFile.parent_namespace(this, Namespace.Create(Context, symbol.ContainingNamespace));
+                trapFile.parent_namespace(this, Namespace.Create(Context, Symbol.ContainingNamespace));
             }
 
-            if (symbol is IArrayTypeSymbol array)
+            if (Symbol is IArrayTypeSymbol array)
             {
                 // They are in the namespace of the original object
                 var elementType = array.ElementType;
@@ -119,7 +119,7 @@ namespace Semmle.Extraction.CSharp.Entities
                     trapFile.parent_namespace(this, Namespace.Create(Context, ns));
             }
 
-            if (symbol is IPointerTypeSymbol pointer)
+            if (Symbol is IPointerTypeSymbol pointer)
             {
                 var elementType = pointer.PointedAtType;
                 var ns = elementType.TypeKind == TypeKind.TypeParameter ? Context.Compilation.GlobalNamespace : elementType.ContainingNamespace;
@@ -128,26 +128,26 @@ namespace Semmle.Extraction.CSharp.Entities
                     trapFile.parent_namespace(this, Namespace.Create(Context, ns));
             }
 
-            if (symbol.BaseType != null && symbol.BaseType.SpecialType == SpecialType.System_MulticastDelegate)
+            if (Symbol.BaseType != null && Symbol.BaseType.SpecialType == SpecialType.System_MulticastDelegate)
             {
                 // This is a delegate.
                 // The method "Invoke" has the return type.
-                var invokeMethod = ((INamedTypeSymbol)symbol).DelegateInvokeMethod;
+                var invokeMethod = ((INamedTypeSymbol)Symbol).DelegateInvokeMethod;
                 ExtractParametersForDelegateLikeType(trapFile, invokeMethod,
                     t => trapFile.delegate_return_type(this, t));
             }
 
-            if (symbol is IFunctionPointerTypeSymbol functionPointer)
+            if (Symbol is IFunctionPointerTypeSymbol functionPointer)
             {
                 ExtractParametersForDelegateLikeType(trapFile, functionPointer.Signature,
                     t => trapFile.function_pointer_return_type(this, t));
             }
 
-            Modifier.ExtractModifiers(Context, trapFile, this, symbol);
+            Modifier.ExtractModifiers(Context, trapFile, this, Symbol);
 
-            if (IsSourceDeclaration && symbol.FromSource())
+            if (IsSourceDeclaration && Symbol.FromSource())
             {
-                var declSyntaxReferences = symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).ToArray();
+                var declSyntaxReferences = Symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).ToArray();
 
                 var baseLists = declSyntaxReferences.OfType<ClassDeclarationSyntax>().Select(c => c.BaseList);
                 baseLists = baseLists.Concat(declSyntaxReferences.OfType<InterfaceDeclarationSyntax>().Select(c => c.BaseList));
@@ -157,7 +157,7 @@ namespace Semmle.Extraction.CSharp.Entities
                     .Where(bl => bl != null)
                     .SelectMany(bl => bl.Types)
                     .Zip(
-                        baseTypes.Where(bt => bt.symbol.SpecialType != SpecialType.System_Object),
+                        baseTypes.Where(bt => bt.Symbol.SpecialType != SpecialType.System_Object),
                         (s, t) => TypeMention.Create(Context, s.Type, this, t))
                     .Enumerate();
             }
@@ -171,7 +171,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 var originalParam = invokeMethod.OriginalDefinition.Parameters[i];
                 var originalParamEntity = SymbolEqualityComparer.Default.Equals(param, originalParam)
                     ? null
-                    : DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)symbol).OriginalDefinition));
+                    : DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)Symbol).OriginalDefinition));
                 DelegateTypeParameter.Create(Context, param, this, originalParamEntity);
             }
 
@@ -187,12 +187,12 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         public void ExtractRecursive()
         {
-            foreach (var l in symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax().GetLocation()))
+            foreach (var l in Symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax().GetLocation()))
             {
                 Context.BindComments(this, l);
             }
 
-            foreach (var member in symbol.GetMembers())
+            foreach (var member in Symbol.GetMembers())
             {
                 switch (member.Kind)
                 {
@@ -211,21 +211,21 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         public void PopulateGenerics()
         {
-            if (symbol == null || !NeedsPopulation || !Context.ExtractGenerics(this))
+            if (Symbol == null || !NeedsPopulation || !Context.ExtractGenerics(this))
                 return;
 
             var members = new List<ISymbol>();
 
-            foreach (var member in symbol.GetMembers())
+            foreach (var member in Symbol.GetMembers())
                 members.Add(member);
-            foreach (var member in symbol.GetTypeMembers())
+            foreach (var member in Symbol.GetTypeMembers())
                 members.Add(member);
 
             // Mono extractor puts all BASE interface members as members of the current interface.
 
-            if (symbol.TypeKind == TypeKind.Interface)
+            if (Symbol.TypeKind == TypeKind.Interface)
             {
-                foreach (var baseInterface in symbol.Interfaces)
+                foreach (var baseInterface in Symbol.Interfaces)
                 {
                     foreach (var member in baseInterface.GetMembers())
                         members.Add(member);
@@ -239,10 +239,10 @@ namespace Semmle.Extraction.CSharp.Entities
                 Context.CreateEntity(member);
             }
 
-            if (symbol.BaseType != null)
-                Create(Context, symbol.BaseType).PopulateGenerics();
+            if (Symbol.BaseType != null)
+                Create(Context, Symbol.BaseType).PopulateGenerics();
 
-            foreach (var i in symbol.Interfaces)
+            foreach (var i in Symbol.Interfaces)
             {
                 Create(Context, i).PopulateGenerics();
             }
@@ -250,7 +250,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public void ExtractRecursive(TextWriter trapFile, IEntity parent)
         {
-            if (symbol.ContainingSymbol.Kind == SymbolKind.Namespace && !symbol.ContainingNamespace.IsGlobalNamespace)
+            if (Symbol.ContainingSymbol.Kind == SymbolKind.Namespace && !Symbol.ContainingNamespace.IsGlobalNamespace)
             {
                 trapFile.parent_namespace_declaration(this, (NamespaceDeclaration)parent);
             }
@@ -315,10 +315,10 @@ namespace Semmle.Extraction.CSharp.Entities
         public override bool Equals(object obj)
         {
             var other = obj as Type;
-            return other?.GetType() == GetType() && SymbolEqualityComparer.Default.Equals(other.symbol, symbol);
+            return other?.GetType() == GetType() && SymbolEqualityComparer.Default.Equals(other.Symbol, Symbol);
         }
 
-        public override int GetHashCode() => SymbolEqualityComparer.Default.GetHashCode(symbol);
+        public override int GetHashCode() => SymbolEqualityComparer.Default.GetHashCode(Symbol);
     }
 
     internal abstract class Type<T> : Type where T : ITypeSymbol
@@ -326,6 +326,7 @@ namespace Semmle.Extraction.CSharp.Entities
         protected Type(Context cx, T init)
             : base(cx, init) { }
 
-        public new T symbol => (T)base.symbol;
+        // todo: change this with .net 5 to be an override
+        public new T Symbol => (T)base.Symbol;
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameter.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameter.cs
index b4d35f7b506..fc8ac7e39d8 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameter.cs
@@ -24,22 +24,22 @@ namespace Semmle.Extraction.CSharp.Entities
             var constraints = new TypeParameterConstraints(Context);
             trapFile.type_parameter_constraints(constraints, this);
 
-            if (symbol.HasReferenceTypeConstraint)
+            if (Symbol.HasReferenceTypeConstraint)
                 trapFile.general_type_parameter_constraints(constraints, 1);
 
-            if (symbol.HasValueTypeConstraint)
+            if (Symbol.HasValueTypeConstraint)
                 trapFile.general_type_parameter_constraints(constraints, 2);
 
-            if (symbol.HasConstructorConstraint)
+            if (Symbol.HasConstructorConstraint)
                 trapFile.general_type_parameter_constraints(constraints, 3);
 
-            if (symbol.HasUnmanagedTypeConstraint)
+            if (Symbol.HasUnmanagedTypeConstraint)
                 trapFile.general_type_parameter_constraints(constraints, 4);
 
-            if (symbol.ReferenceTypeConstraintNullableAnnotation == NullableAnnotation.Annotated)
+            if (Symbol.ReferenceTypeConstraintNullableAnnotation == NullableAnnotation.Annotated)
                 trapFile.general_type_parameter_constraints(constraints, 5);
 
-            foreach (var abase in symbol.GetAnnotatedTypeConstraints())
+            foreach (var abase in Symbol.GetAnnotatedTypeConstraints())
             {
                 var t = Create(Context, abase.Symbol);
                 trapFile.specific_type_parameter_constraints(constraints, t.TypeRef);
@@ -47,19 +47,19 @@ namespace Semmle.Extraction.CSharp.Entities
                     trapFile.specific_type_parameter_nullability(constraints, t.TypeRef, NullabilityEntity.Create(Context, Nullability.Create(abase)));
             }
 
-            trapFile.types(this, Kinds.TypeKind.TYPE_PARAMETER, symbol.Name);
+            trapFile.types(this, Kinds.TypeKind.TYPE_PARAMETER, Symbol.Name);
 
-            var parentNs = Namespace.Create(Context, symbol.TypeParameterKind == TypeParameterKind.Method ? Context.Compilation.GlobalNamespace : symbol.ContainingNamespace);
+            var parentNs = Namespace.Create(Context, Symbol.TypeParameterKind == TypeParameterKind.Method ? Context.Compilation.GlobalNamespace : Symbol.ContainingNamespace);
             trapFile.parent_namespace(this, parentNs);
 
-            foreach (var l in symbol.Locations)
+            foreach (var l in Symbol.Locations)
             {
-                trapFile.type_location(this, Context.Create(l));
+                trapFile.type_location(this, Context.CreateLocation(l));
             }
 
             if (IsSourceDeclaration)
             {
-                var declSyntaxReferences = symbol.DeclaringSyntaxReferences
+                var declSyntaxReferences = Symbol.DeclaringSyntaxReferences
                     .Select(d => d.GetSyntax())
                     .Select(s => s.Parent)
                     .Where(p => p != null)
@@ -69,7 +69,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 clauses = clauses.Concat(declSyntaxReferences.OfType<ClassDeclarationSyntax>().SelectMany(c => c.ConstraintClauses));
                 clauses = clauses.Concat(declSyntaxReferences.OfType<InterfaceDeclarationSyntax>().SelectMany(c => c.ConstraintClauses));
                 clauses = clauses.Concat(declSyntaxReferences.OfType<StructDeclarationSyntax>().SelectMany(c => c.ConstraintClauses));
-                foreach (var clause in clauses.Where(c => c.Name.Identifier.Text == symbol.Name))
+                foreach (var clause in clauses.Where(c => c.Name.Identifier.Text == Symbol.Name))
                 {
                     TypeMention.Create(Context, clause.Name, this, this);
                     foreach (var constraint in clause.Constraints.OfType<TypeConstraintSyntax>())
@@ -92,13 +92,13 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             get
             {
-                switch (symbol.Variance)
+                switch (Symbol.Variance)
                 {
                     case VarianceKind.None: return Variance.None;
                     case VarianceKind.Out: return Variance.Out;
                     case VarianceKind.In: return Variance.In;
                     default:
-                        throw new InternalError($"Unexpected VarianceKind {symbol.Variance}");
+                        throw new InternalError($"Unexpected VarianceKind {Symbol.Variance}");
                 }
             }
         }
@@ -107,22 +107,22 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             string kind;
             IEntity containingEntity;
-            switch (symbol.TypeParameterKind)
+            switch (Symbol.TypeParameterKind)
             {
                 case TypeParameterKind.Method:
                     kind = "methodtypeparameter";
-                    containingEntity = Method.Create(Context, (IMethodSymbol)symbol.ContainingSymbol);
+                    containingEntity = Method.Create(Context, (IMethodSymbol)Symbol.ContainingSymbol);
                     break;
                 case TypeParameterKind.Type:
                     kind = "typeparameter";
-                    containingEntity = Create(Context, symbol.ContainingType);
+                    containingEntity = Create(Context, Symbol.ContainingType);
                     break;
                 default:
-                    throw new InternalError(symbol, $"Unhandled type parameter kind {symbol.TypeParameterKind}");
+                    throw new InternalError(Symbol, $"Unhandled type parameter kind {Symbol.TypeParameterKind}");
             }
             trapFile.WriteSubId(containingEntity);
             trapFile.Write('_');
-            trapFile.Write(symbol.Ordinal);
+            trapFile.Write(Symbol.Ordinal);
             trapFile.Write(';');
             trapFile.Write(kind);
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs
index d4c6fa457c1..2643363773b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs
@@ -15,10 +15,10 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateMethod(trapFile);
             PopulateModifiers(trapFile);
 
-            var returnType = Type.Create(Context, symbol.ReturnType);
+            var returnType = Type.Create(Context, Symbol.ReturnType);
             trapFile.operators(this,
-                symbol.Name,
-                OperatorSymbol(Context, symbol.Name),
+                Symbol.Name,
+                OperatorSymbol(Context, Symbol.Name),
                 ContainingType,
                 returnType.TypeRef,
                 (UserOperator)OriginalDefinition);
@@ -28,7 +28,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             if (IsSourceDeclaration)
             {
-                var declSyntaxReferences = symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax()).ToArray();
+                var declSyntaxReferences = Symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax()).ToArray();
                 foreach (var declaration in declSyntaxReferences.OfType<OperatorDeclarationSyntax>())
                     TypeMention.Create(Context, declaration.ReturnType, this, returnType);
                 foreach (var declaration in declSyntaxReferences.OfType<ConversionOperatorDeclarationSyntax>())
@@ -38,7 +38,7 @@ namespace Semmle.Extraction.CSharp.Entities
             ContainingType.PopulateGenerics();
         }
 
-        public override bool NeedsPopulation => Context.Defines(symbol) || IsImplicitOperator(out _);
+        public override bool NeedsPopulation => Context.Defines(Symbol) || IsImplicitOperator(out _);
 
         public override Type ContainingType
         {
@@ -57,22 +57,22 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <returns></returns>
         private bool IsImplicitOperator(out ITypeSymbol containingType)
         {
-            containingType = symbol.ContainingType;
+            containingType = Symbol.ContainingType;
             if (containingType != null)
             {
                 var containingNamedType = containingType as INamedTypeSymbol;
                 return containingNamedType == null ||
-                    !containingNamedType.GetMembers(symbol.Name).Contains(symbol);
+                    !containingNamedType.GetMembers(Symbol.Name).Contains(Symbol);
             }
 
-            var pointerType = symbol.Parameters.Select(p => p.Type).OfType<IPointerTypeSymbol>().FirstOrDefault();
+            var pointerType = Symbol.Parameters.Select(p => p.Type).OfType<IPointerTypeSymbol>().FirstOrDefault();
             if (pointerType != null)
             {
                 containingType = pointerType;
                 return true;
             }
 
-            Context.ModelError(symbol, "Unexpected implicit operator");
+            Context.ModelError(Symbol, "Unexpected implicit operator");
             return true;
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/UsingDirective.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/UsingDirective.cs
index caa12ab0082..96ce5f339cf 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/UsingDirective.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/UsingDirective.cs
@@ -21,30 +21,30 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
-            var info = cx.GetModel(node).GetSymbolInfo(node.Name);
+            var info = Context.GetModel(node).GetSymbolInfo(node.Name);
 
             if (node.StaticKeyword.Kind() == SyntaxKind.None)
             {
                 // A normal using
                 if (info.Symbol is INamespaceSymbol namespaceSymbol)
                 {
-                    var ns = Namespace.Create(cx, namespaceSymbol);
+                    var ns = Namespace.Create(Context, namespaceSymbol);
                     trapFile.using_namespace_directives(this, ns);
-                    trapFile.using_directive_location(this, cx.Create(ReportingLocation));
+                    trapFile.using_directive_location(this, Context.CreateLocation(ReportingLocation));
                 }
                 else
                 {
-                    cx.Extractor.MissingNamespace(node.Name.ToFullString(), cx.FromSource);
-                    cx.ModelError(node, "Namespace not found");
+                    Context.Extractor.MissingNamespace(node.Name.ToFullString(), Context.FromSource);
+                    Context.ModelError(node, "Namespace not found");
                     return;
                 }
             }
             else
             {
                 // A "using static"
-                var m = Type.Create(cx, (ITypeSymbol)info.Symbol);
+                var m = Type.Create(Context, (ITypeSymbol)info.Symbol);
                 trapFile.using_static_directives(this, m.TypeRef);
-                trapFile.using_directive_location(this, cx.Create(ReportingLocation));
+                trapFile.using_directive_location(this, Context.CreateLocation(ReportingLocation));
             }
 
             if (parent != null)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
index 292e8c47d98..de48df1dc71 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
@@ -124,7 +124,7 @@ namespace Semmle.Extraction.Kinds
         AND_PATTERN = 127,
         OR_PATTERN = 128,
         FUNCTION_POINTER_INVOCATION = 129,
-
+        WITH = 130,
         DEFINE_SYMBOL = 999
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/AstLineCounter.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/AstLineCounter.cs
new file mode 100644
index 00000000000..a185675ee27
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/AstLineCounter.cs
@@ -0,0 +1,48 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Semmle.Util;
+
+namespace Semmle.Extraction.CSharp.Populators
+{
+    internal class AstLineCounter : CSharpSyntaxVisitor<LineCounts>
+    {
+        public override LineCounts DefaultVisit(SyntaxNode node)
+        {
+            var text = node.SyntaxTree.GetText().GetSubText(node.GetLocation().SourceSpan).ToString();
+            return LineCounter.ComputeLineCounts(text);
+        }
+
+        public override LineCounts VisitMethodDeclaration(MethodDeclarationSyntax method)
+        {
+            return Visit(method.Identifier, method.Body ?? (SyntaxNode)method.ExpressionBody);
+        }
+
+        public static LineCounts Visit(SyntaxToken identifier, SyntaxNode body)
+        {
+            var start = identifier.GetLocation().SourceSpan.Start;
+            var end = body.GetLocation().SourceSpan.End - 1;
+
+            var textSpan = new Microsoft.CodeAnalysis.Text.TextSpan(start, end - start);
+
+            var text = body.SyntaxTree.GetText().GetSubText(textSpan) + "\r\n";
+            return LineCounter.ComputeLineCounts(text);
+        }
+
+        public override LineCounts VisitConstructorDeclaration(ConstructorDeclarationSyntax method)
+        {
+            return Visit(method.Identifier, (SyntaxNode)method.Body ?? method.ExpressionBody);
+        }
+
+        public override LineCounts VisitDestructorDeclaration(DestructorDeclarationSyntax method)
+        {
+            return Visit(method.Identifier, (SyntaxNode)method.Body ?? method.ExpressionBody);
+        }
+
+        public override LineCounts VisitOperatorDeclaration(OperatorDeclarationSyntax node)
+        {
+            return Visit(node.OperatorToken, node.Body ?? (SyntaxNode)node.ExpressionBody);
+        }
+    }
+
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/CompilationUnitVisitor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/CompilationUnitVisitor.cs
index bebdee933cd..58e5404ccd7 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/CompilationUnitVisitor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/CompilationUnitVisitor.cs
@@ -2,6 +2,9 @@ using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Util.Logging;
+using Semmle.Extraction.CSharp.Entities;
+using Semmle.Extraction.CSharp.Entities.Statements;
+using System.Linq;
 
 namespace Semmle.Extraction.CSharp.Populators
 {
@@ -13,30 +16,57 @@ namespace Semmle.Extraction.CSharp.Populators
         public override void VisitExternAliasDirective(ExternAliasDirectiveSyntax node)
         {
             // This information is not yet extracted.
-            cx.ExtractionError("Not implemented extern alias directive", node.ToFullString(), Extraction.Entities.Location.Create(cx, node.GetLocation()), "", Severity.Info);
+            Cx.ExtractionError("Not implemented extern alias directive", node.ToFullString(), Cx.CreateLocation(node.GetLocation()), "", Severity.Info);
         }
 
         public override void VisitCompilationUnit(CompilationUnitSyntax compilationUnit)
         {
             foreach (var m in compilationUnit.ChildNodes())
             {
-                cx.Try(m, null, () => ((CSharpSyntaxNode)m).Accept(this));
+                Cx.Try(m, null, () => ((CSharpSyntaxNode)m).Accept(this));
             }
 
+            ExtractGlobalStatements(compilationUnit);
+
             // Gather comments:
             foreach (var trivia in compilationUnit.DescendantTrivia(compilationUnit.Span, descendIntoTrivia: true))
             {
-                CommentPopulator.ExtractComment(cx, trivia);
+                CommentPopulator.ExtractComment(Cx, trivia);
             }
 
             foreach (var trivia in compilationUnit.GetLeadingTrivia())
             {
-                CommentPopulator.ExtractComment(cx, trivia);
+                CommentPopulator.ExtractComment(Cx, trivia);
             }
 
             foreach (var trivia in compilationUnit.GetTrailingTrivia())
             {
-                CommentPopulator.ExtractComment(cx, trivia);
+                CommentPopulator.ExtractComment(Cx, trivia);
+            }
+        }
+
+        private void ExtractGlobalStatements(CompilationUnitSyntax compilationUnit)
+        {
+            var globalStatements = compilationUnit
+                .ChildNodes()
+                .OfType<GlobalStatementSyntax>()
+                .ToList();
+
+            if (!globalStatements.Any())
+            {
+                return;
+            }
+
+            var entryPoint = Cx.Compilation.GetEntryPoint(System.Threading.CancellationToken.None);
+            var entryMethod = Method.Create(Cx, entryPoint);
+            var block = GlobalStatementsBlock.Create(Cx, entryMethod);
+
+            for (var i = 0; i < globalStatements.Count; i++)
+            {
+                if (globalStatements[i].Statement is object)
+                {
+                    Statement.Create(Cx, globalStatements[i].Statement, block, i);
+                }
             }
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/DirectiveVisitor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/DirectiveVisitor.cs
index 9ec8d095290..0c400728554 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/DirectiveVisitor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/DirectiveVisitor.cs
@@ -67,7 +67,7 @@ namespace Semmle.Extraction.CSharp.Populators
             if (regionStarts.Count == 0)
             {
                 cx.ExtractionError("Couldn't find start region", null,
-                    Extraction.Entities.Location.Create(cx, node.GetLocation()), null, Util.Logging.Severity.Warning);
+                    cx.CreateLocation(node.GetLocation()), null, Util.Logging.Severity.Warning);
                 return;
             }
 
@@ -100,7 +100,7 @@ namespace Semmle.Extraction.CSharp.Populators
             if (ifStarts.Count == 0)
             {
                 cx.ExtractionError("Couldn't find start if", null,
-                    Extraction.Entities.Location.Create(cx, node.GetLocation()), null, Util.Logging.Severity.Warning);
+                    cx.CreateLocation(node.GetLocation()), null, Util.Logging.Severity.Warning);
                 return;
             }
 
@@ -113,7 +113,7 @@ namespace Semmle.Extraction.CSharp.Populators
             if (ifStarts.Count == 0)
             {
                 cx.ExtractionError("Couldn't find start if", null,
-                    Extraction.Entities.Location.Create(cx, node.GetLocation()), null, Util.Logging.Severity.Warning);
+                    cx.CreateLocation(node.GetLocation()), null, Util.Logging.Severity.Warning);
                 return;
             }
 
@@ -126,7 +126,7 @@ namespace Semmle.Extraction.CSharp.Populators
             if (ifStarts.Count == 0)
             {
                 cx.ExtractionError("Couldn't find start if", null,
-                    Extraction.Entities.Location.Create(cx, node.GetLocation()), null, Util.Logging.Severity.Warning);
+                    cx.CreateLocation(node.GetLocation()), null, Util.Logging.Severity.Warning);
                 return;
             }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/Methods.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/Methods.cs
deleted file mode 100644
index 148160b8815..00000000000
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/Methods.cs
+++ /dev/null
@@ -1,65 +0,0 @@
-using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.CSharp;
-using Microsoft.CodeAnalysis.CSharp.Syntax;
-using Semmle.Util;
-using System.IO;
-
-namespace Semmle.Extraction.CSharp.Populators
-{
-    public static class MethodExtensions
-    {
-        private class AstLineCounter : CSharpSyntaxVisitor<LineCounts>
-        {
-            public override LineCounts DefaultVisit(SyntaxNode node)
-            {
-                var text = node.SyntaxTree.GetText().GetSubText(node.GetLocation().SourceSpan).ToString();
-                return Semmle.Util.LineCounter.ComputeLineCounts(text);
-            }
-
-            public override LineCounts VisitMethodDeclaration(MethodDeclarationSyntax method)
-            {
-                return Visit(method.Identifier, method.Body ?? (SyntaxNode)method.ExpressionBody);
-            }
-
-            public static LineCounts Visit(SyntaxToken identifier, SyntaxNode body)
-            {
-                var start = identifier.GetLocation().SourceSpan.Start;
-                var end = body.GetLocation().SourceSpan.End - 1;
-
-                var textSpan = new Microsoft.CodeAnalysis.Text.TextSpan(start, end - start);
-
-                var text = body.SyntaxTree.GetText().GetSubText(textSpan) + "\r\n";
-                return Semmle.Util.LineCounter.ComputeLineCounts(text);
-            }
-
-            public override LineCounts VisitConstructorDeclaration(ConstructorDeclarationSyntax method)
-            {
-                return Visit(method.Identifier, (SyntaxNode)method.Body ?? method.ExpressionBody);
-            }
-
-            public override LineCounts VisitDestructorDeclaration(DestructorDeclarationSyntax method)
-            {
-                return Visit(method.Identifier, (SyntaxNode)method.Body ?? method.ExpressionBody);
-            }
-
-            public override LineCounts VisitOperatorDeclaration(OperatorDeclarationSyntax node)
-            {
-                return Visit(node.OperatorToken, node.Body ?? (SyntaxNode)node.ExpressionBody);
-            }
-        }
-
-        public static void NumberOfLines(this Context cx, TextWriter trapFile, ISymbol symbol, IEntity callable)
-        {
-            foreach (var decl in symbol.DeclaringSyntaxReferences)
-            {
-                cx.NumberOfLines(trapFile, (CSharpSyntaxNode)decl.GetSyntax(), callable);
-            }
-        }
-
-        public static void NumberOfLines(this Context cx, TextWriter trapFile, CSharpSyntaxNode node, IEntity callable)
-        {
-            var lineCounts = node.Accept(new AstLineCounter());
-            trapFile.numlines(callable, lineCounts);
-        }
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeContainerVisitor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeContainerVisitor.cs
index 6e5b45e9e3a..ededf2978b9 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeContainerVisitor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeContainerVisitor.cs
@@ -11,16 +11,17 @@ namespace Semmle.Extraction.CSharp.Populators
 {
     public class TypeContainerVisitor : CSharpSyntaxVisitor
     {
-        protected Context cx { get; }
-        protected IEntity parent { get; }
-        protected TextWriter trapFile { get; }
+        protected Context Cx { get; }
+        protected IEntity Parent { get; }
+        protected TextWriter TrapFile { get; }
         private readonly Lazy<Func<SyntaxNode, AttributeData>> attributeLookup;
 
         public TypeContainerVisitor(Context cx, TextWriter trapFile, IEntity parent)
         {
-            this.cx = cx;
-            this.parent = parent;
-            this.trapFile = trapFile;
+            Cx = cx;
+            Parent = parent;
+            TrapFile = trapFile;
+
             attributeLookup = new Lazy<Func<SyntaxNode, AttributeData>>(() =>
                 {
                     var dict = new Dictionary<SyntaxNode, AttributeData>();
@@ -38,48 +39,59 @@ namespace Semmle.Extraction.CSharp.Populators
             throw new InternalError(node, "Unhandled top-level syntax node");
         }
 
+        public override void VisitGlobalStatement(GlobalStatementSyntax node)
+        {
+            // Intentionally left empty.
+            // Global statements are handled in CompilationUnitVisitor
+        }
+
         public override void VisitDelegateDeclaration(DelegateDeclarationSyntax node)
         {
-            Entities.NamedType.Create(cx, cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(trapFile, parent);
+            Entities.NamedType.Create(Cx, Cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(TrapFile, Parent);
         }
 
         public override void VisitRecordDeclaration(RecordDeclarationSyntax node)
         {
-            Entities.Type.Create(cx, cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(trapFile, parent);
+            ExtractTypeDeclaration(node);
         }
 
-        public override void VisitClassDeclaration(ClassDeclarationSyntax classDecl)
+        public override void VisitClassDeclaration(ClassDeclarationSyntax node)
         {
-            Entities.Type.Create(cx, cx.GetModel(classDecl).GetDeclaredSymbol(classDecl)).ExtractRecursive(trapFile, parent);
+            ExtractTypeDeclaration(node);
         }
 
         public override void VisitStructDeclaration(StructDeclarationSyntax node)
         {
-            Entities.Type.Create(cx, cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(trapFile, parent);
+            ExtractTypeDeclaration(node);
         }
 
         public override void VisitEnumDeclaration(EnumDeclarationSyntax node)
         {
-            Entities.Type.Create(cx, cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(trapFile, parent);
+            ExtractTypeDeclaration(node);
         }
 
         public override void VisitInterfaceDeclaration(InterfaceDeclarationSyntax node)
         {
-            Entities.Type.Create(cx, cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(trapFile, parent);
+            ExtractTypeDeclaration(node);
+        }
+
+        private void ExtractTypeDeclaration(BaseTypeDeclarationSyntax node)
+        {
+            Entities.Type.Create(Cx, Cx.GetModel(node).GetDeclaredSymbol(node)).ExtractRecursive(TrapFile, Parent);
         }
 
         public override void VisitAttributeList(AttributeListSyntax node)
         {
-            if (cx.Extractor.Standalone)
+            if (Cx.Extractor.Standalone)
                 return;
 
-            var outputAssembly = Assembly.CreateOutputAssembly(cx);
+            var outputAssembly = Assembly.CreateOutputAssembly(Cx);
             foreach (var attribute in node.Attributes)
             {
                 if (attributeLookup.Value(attribute) is AttributeData attributeData)
                 {
-                    var ae = Semmle.Extraction.CSharp.Entities.Attribute.Create(cx, attributeData, outputAssembly);
-                    cx.BindComments(ae, attribute.GetLocation());
+                    var ae = Entities.Attribute.Create(Cx, attributeData, outputAssembly);
+                    Cx.BindComments(ae, attribute.GetLocation());
                 }
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeOrNamespaceVisitor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeOrNamespaceVisitor.cs
index aacdc5d2a4f..a3daae08a60 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeOrNamespaceVisitor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeOrNamespaceVisitor.cs
@@ -13,12 +13,12 @@ namespace Semmle.Extraction.CSharp.Populators
         {
             // Only deal with "using namespace" not "using X = Y"
             if (usingDirective.Alias == null)
-                new UsingDirective(cx, usingDirective, (NamespaceDeclaration)parent);
+                new UsingDirective(Cx, usingDirective, (NamespaceDeclaration)Parent);
         }
 
         public override void VisitNamespaceDeclaration(NamespaceDeclarationSyntax node)
         {
-            NamespaceDeclaration.Create(cx, node, (NamespaceDeclaration)parent);
+            NamespaceDeclaration.Create(Cx, node, (NamespaceDeclaration)Parent);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
index ec2bd66d32e..df39d6a836c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
@@ -53,6 +53,17 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("catch_type", @catch, type, explicityCaught ? 1 : 2);
         }
 
+        internal static void foreach_stmt_info(this TextWriter trapFile, Entities.Statements.ForEach @foreach, bool isAsync)
+        {
+            trapFile.WriteTuple("foreach_stmt_info", @foreach, isAsync ? 2 : 1);
+        }
+
+        internal static void foreach_stmt_desugar(this TextWriter trapFile, Entities.Statements.ForEach @foreach, IEntity entity,
+            Entities.Statements.ForEach.ForeachSymbolType type)
+        {
+            trapFile.WriteTuple("foreach_stmt_desugar", @foreach, entity, (int)type);
+        }
+
         internal static void commentblock(this TextWriter trapFile, CommentBlock k)
         {
             trapFile.WriteTuple("commentblock", k);
diff --git a/csharp/extractor/Semmle.Extraction/AssemblyScope.cs b/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
index 84c117d17c4..27c9377bb30 100644
--- a/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
+++ b/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
@@ -21,7 +21,5 @@ namespace Semmle.Extraction
         public bool InScope(ISymbol symbol) =>
             SymbolEqualityComparer.Default.Equals(symbol.ContainingAssembly, assembly) ||
             SymbolEqualityComparer.Default.Equals(symbol, assembly);
-
-        public bool FromSource => false;
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index e6b4826f2ef..a4b84d5d047 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -18,7 +18,7 @@ namespace Semmle.Extraction
         /// <summary>
         /// Access various extraction functions, e.g. logger, trap writer.
         /// </summary>
-        public IExtractor Extractor { get; }
+        public Extractor Extractor { get; }
 
         /// <summary>
         /// The program database provided by Roslyn.
@@ -51,7 +51,7 @@ namespace Semmle.Extraction
         // A recursion guard against writing to the trap file whilst writing an id to the trap file.
         private bool writingLabel = false;
 
-        public void DefineLabel(IEntity entity, TextWriter trapFile, IExtractor extractor)
+        public void DefineLabel(IEntity entity, TextWriter trapFile, Extractor extractor)
         {
             if (writingLabel)
             {
@@ -73,11 +73,11 @@ namespace Semmle.Extraction
         }
 
 #if DEBUG_LABELS
-        private void CheckEntityHasUniqueLabel(string id, ICachedEntity entity)
+        private void CheckEntityHasUniqueLabel(string id, CachedEntity entity)
         {
             if (idLabelCache.ContainsKey(id))
             {
-                this.Extractor.Message(new Message("Label collision for " + id, entity.Label.ToString(), Entities.Location.Create(this, entity.ReportingLocation), "", Severity.Warning));
+                this.Extractor.Message(new Message("Label collision for " + id, entity.Label.ToString(), CreateLocation(entity.ReportingLocation), "", Severity.Warning));
             }
             else
             {
@@ -89,12 +89,12 @@ namespace Semmle.Extraction
         public Label GetNewLabel() => new Label(GetNewId());
 
         public TEntity CreateEntity<TInit, TEntity>(ICachedEntityFactory<TInit, TEntity> factory, object cacheKey, TInit init)
-            where TEntity : ICachedEntity =>
+            where TEntity : CachedEntity =>
             cacheKey is ISymbol s ? CreateEntity(factory, s, init, symbolEntityCache) : CreateEntity(factory, cacheKey, init, objectEntityCache);
 
         public TEntity CreateEntityFromSymbol<TSymbol, TEntity>(ICachedEntityFactory<TSymbol, TEntity> factory, TSymbol init)
             where TSymbol : ISymbol
-            where TEntity : ICachedEntity => CreateEntity(factory, init, init, symbolEntityCache);
+            where TEntity : CachedEntity => CreateEntity(factory, init, init, symbolEntityCache);
 
         /// <summary>
         /// Creates and populates a new entity, or returns the existing one from the cache.
@@ -104,9 +104,9 @@ namespace Semmle.Extraction
         /// <param name="init">The initializer for the entity.</param>
         /// <param name="dictionary">The dictionary to use for caching.</param>
         /// <returns>The new/existing entity.</returns>
-        private TEntity CreateEntity<TInit, TCacheKey, TEntity>(ICachedEntityFactory<TInit, TEntity> factory, TCacheKey cacheKey, TInit init, IDictionary<TCacheKey, ICachedEntity> dictionary)
+        private TEntity CreateEntity<TInit, TCacheKey, TEntity>(ICachedEntityFactory<TInit, TEntity> factory, TCacheKey cacheKey, TInit init, IDictionary<TCacheKey, CachedEntity> dictionary)
             where TCacheKey : notnull
-            where TEntity : ICachedEntity
+            where TEntity : CachedEntity
         {
             if (dictionary.TryGetValue(cacheKey, out var cached))
                 return (TEntity)cached;
@@ -143,7 +143,7 @@ namespace Semmle.Extraction
         /// </summary>
         /// <param name="entity">The entity to extract.</param>
         /// <returns>True only on the first call for a particular entity.</returns>
-        public bool ExtractGenerics(ICachedEntity entity)
+        public bool ExtractGenerics(CachedEntity entity)
         {
             if (extractedGenerics.Contains(entity.Label))
             {
@@ -158,18 +158,18 @@ namespace Semmle.Extraction
         /// Creates a fresh label with ID "*", and set it on the
         /// supplied <paramref name="entity"/> object.
         /// </summary>
-        public void AddFreshLabel(IEntity entity)
+        public void AddFreshLabel(Entity entity)
         {
             entity.Label = GetNewLabel();
             entity.DefineFreshLabel(TrapWriter.Writer);
         }
 
 #if DEBUG_LABELS
-        private readonly Dictionary<string, ICachedEntity> idLabelCache = new Dictionary<string, ICachedEntity>();
+        private readonly Dictionary<string, CachedEntity> idLabelCache = new Dictionary<string, CachedEntity>();
 #endif
 
-        private readonly IDictionary<object, ICachedEntity> objectEntityCache = new Dictionary<object, ICachedEntity>();
-        private readonly IDictionary<ISymbol, ICachedEntity> symbolEntityCache = new Dictionary<ISymbol, ICachedEntity>(10000, SymbolEqualityComparer.Default);
+        private readonly IDictionary<object, CachedEntity> objectEntityCache = new Dictionary<object, CachedEntity>();
+        private readonly IDictionary<ISymbol, CachedEntity> symbolEntityCache = new Dictionary<ISymbol, CachedEntity>(10000, SymbolEqualityComparer.Default);
         private readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
 
         /// <summary>
@@ -211,11 +211,11 @@ namespace Semmle.Extraction
                 }
                 catch (InternalError ex)
                 {
-                    ExtractionError(new Message(ex.Text, ex.EntityText, Entities.Location.Create(this, ex.Location), ex.StackTrace));
+                    ExtractionError(new Message(ex.Text, ex.EntityText, CreateLocation(ex.Location), ex.StackTrace));
                 }
                 catch (Exception ex)  // lgtm[cs/catch-of-all-exceptions]
                 {
-                    ExtractionError($"Uncaught exception. {ex.Message}", null, Entities.Location.Create(this), ex.StackTrace);
+                    ExtractionError($"Uncaught exception. {ex.Message}", null, CreateLocation(), ex.StackTrace);
                 }
             }
         }
@@ -225,15 +225,7 @@ namespace Semmle.Extraction
         /// </summary>
         public Compilation Compilation { get; }
 
-        /// <summary>
-        /// Create a new context, one per source file/assembly.
-        /// </summary>
-        /// <param name="e">The extractor.</param>
-        /// <param name="c">The Roslyn compilation.</param>
-        /// <param name="extractedEntity">Name of the source/dll file.</param>
-        /// <param name="scope">Defines which symbols are included in the trap file (e.g. AssemblyScope or SourceScope)</param>
-        /// <param name="addAssemblyTrapPrefix">Whether to add assembly prefixes to TRAP labels.</param>
-        public Context(IExtractor e, Compilation c, TrapWriter trapWriter, IExtractionScope scope, bool addAssemblyTrapPrefix)
+        public Context(Extractor e, Compilation c, TrapWriter trapWriter, IExtractionScope scope, bool addAssemblyTrapPrefix)
         {
             Extractor = e;
             Compilation = c;
@@ -242,7 +234,12 @@ namespace Semmle.Extraction
             ShouldAddAssemblyTrapPrefix = addAssemblyTrapPrefix;
         }
 
-        public bool FromSource => scope.FromSource;
+        public Context(Extractor e, TrapWriter trapWriter)
+            : this(e, null, trapWriter, null, false)
+        {
+        }
+
+        public bool FromSource => scope is SourceScope;
 
         public ICommentGenerator CommentGenerator { get; } = new CommentProcessor();
 
@@ -328,7 +325,7 @@ namespace Semmle.Extraction
         /// <param name="optionalSymbol">Symbol for reporting errors.</param>
         /// <param name="entity">The entity to populate.</param>
         /// <exception cref="InternalError">Thrown on invalid trap stack behaviour.</exception>
-        public void Populate(ISymbol? optionalSymbol, ICachedEntity entity)
+        public void Populate(ISymbol? optionalSymbol, CachedEntity entity)
         {
             if (writingLabel)
             {
@@ -364,7 +361,7 @@ namespace Semmle.Extraction
                     throw new InternalError("Unexpected TrapStackBehaviour");
             }
 
-            var a = duplicationGuard && this.Create(entity.ReportingLocation) is NonGeneratedSourceLocation loc
+            var a = duplicationGuard && CreateLocation(entity.ReportingLocation) is NonGeneratedSourceLocation loc
                 ? (Action)(() => WithDuplicationGuard(new Key(entity, loc), () => entity.Populate(TrapWriter.Writer)))
                 : (Action)(() => this.Try(null, optionalSymbol, () => entity.Populate(TrapWriter.Writer)));
 
@@ -409,7 +406,7 @@ namespace Semmle.Extraction
         /// <param name="cx">Extractor context.</param>
         /// <param name="entity">Program entity.</param>
         /// <param name="l">Location of the entity.</param>
-        public void BindComments(IEntity entity, Microsoft.CodeAnalysis.Location l)
+        public void BindComments(Entity entity, Microsoft.CodeAnalysis.Location l)
         {
             var duplicationGuardKey = tagStack.Count > 0 ? tagStack.Peek() : null;
             CommentGenerator.AddElement(entity.Label, duplicationGuardKey, l);
@@ -435,19 +432,19 @@ namespace Semmle.Extraction
         /// <param name="message">The text of the message.</param>
         /// <param name="optionalSymbol">The symbol of the error, or null.</param>
         /// <param name="optionalEntity">The entity of the error, or null.</param>
-        public void ExtractionError(string message, ISymbol? optionalSymbol, IEntity optionalEntity)
+        public void ExtractionError(string message, ISymbol? optionalSymbol, Entity optionalEntity)
         {
             if (!(optionalSymbol is null))
             {
-                ExtractionError(message, optionalSymbol.ToDisplayString(), Entities.Location.Create(this, optionalSymbol.Locations.FirstOrDefault()));
+                ExtractionError(message, optionalSymbol.ToDisplayString(), CreateLocation(optionalSymbol.Locations.FirstOrDefault()));
             }
             else if (!(optionalEntity is null))
             {
-                ExtractionError(message, optionalEntity.Label.ToString(), Entities.Location.Create(this, optionalEntity.ReportingLocation));
+                ExtractionError(message, optionalEntity.Label.ToString(), CreateLocation(optionalEntity.ReportingLocation));
             }
             else
             {
-                ExtractionError(message, null, Entities.Location.Create(this));
+                ExtractionError(message, null, CreateLocation());
             }
         }
 
@@ -460,42 +457,36 @@ namespace Semmle.Extraction
             new Entities.ExtractionMessage(this, msg);
             Extractor.Message(msg);
         }
-    }
 
-    public static class ContextExtensions
-    {
         /// <summary>
         /// Signal an error in the program model.
         /// </summary>
-        /// <param name="cx">The context.</param>
         /// <param name="node">The syntax node causing the failure.</param>
         /// <param name="msg">The error message.</param>
-        public static void ModelError(this Context cx, SyntaxNode node, string msg)
+        public void ModelError(SyntaxNode node, string msg)
         {
-            if (!cx.Extractor.Standalone)
+            if (!Extractor.Standalone)
                 throw new InternalError(node, msg);
         }
 
         /// <summary>
         /// Signal an error in the program model.
         /// </summary>
-        /// <param name="context">The context.</param>
         /// <param name="node">Symbol causing the error.</param>
         /// <param name="msg">The error message.</param>
-        public static void ModelError(this Context cx, ISymbol symbol, string msg)
+        public void ModelError(ISymbol symbol, string msg)
         {
-            if (!cx.Extractor.Standalone)
+            if (!Extractor.Standalone)
                 throw new InternalError(symbol, msg);
         }
 
         /// <summary>
         /// Signal an error in the program model.
         /// </summary>
-        /// <param name="context">The context.</param>
         /// <param name="msg">The error message.</param>
-        public static void ModelError(this Context cx, string msg)
+        public void ModelError(string msg)
         {
-            if (!cx.Extractor.Standalone)
+            if (!Extractor.Standalone)
                 throw new InternalError(msg);
         }
 
@@ -503,11 +494,10 @@ namespace Semmle.Extraction
         /// Tries the supplied action <paramref name="a"/>, and logs an uncaught
         /// exception error if the action fails.
         /// </summary>
-        /// <param name="context">The context.</param>
         /// <param name="node">Optional syntax node for error reporting.</param>
         /// <param name="symbol">Optional symbol for error reporting.</param>
         /// <param name="a">The action to perform.</param>
-        public static void Try(this Context context, SyntaxNode? node, ISymbol? symbol, Action a)
+        public void Try(SyntaxNode? node, ISymbol? symbol, Action a)
         {
             try
             {
@@ -519,33 +509,48 @@ namespace Semmle.Extraction
 
                 if (node != null)
                 {
-                    message = Message.Create(context, ex.Message, node, ex.StackTrace);
+                    message = Message.Create(this, ex.Message, node, ex.StackTrace);
                 }
                 else if (symbol != null)
                 {
-                    message = Message.Create(context, ex.Message, symbol, ex.StackTrace);
+                    message = Message.Create(this, ex.Message, symbol, ex.StackTrace);
                 }
                 else if (ex is InternalError ie)
                 {
-                    message = new Message(ie.Text, ie.EntityText, Entities.Location.Create(context, ie.Location), ex.StackTrace);
+                    message = new Message(ie.Text, ie.EntityText, CreateLocation(ie.Location), ex.StackTrace);
                 }
                 else
                 {
-                    message = new Message($"Uncaught exception. {ex.Message}", null, Entities.Location.Create(context), ex.StackTrace);
+                    message = new Message($"Uncaught exception. {ex.Message}", null, CreateLocation(), ex.StackTrace);
                 }
 
-                context.ExtractionError(message);
+                ExtractionError(message);
             }
         }
 
         /// <summary>
         /// Write the given tuple to the trap file.
         /// </summary>
-        /// <param name="cx">Extractor context.</param>
         /// <param name="tuple">Tuple to write.</param>
-        public static void Emit(this Context cx, Tuple tuple)
+        public void Emit(Tuple tuple)
         {
-            cx.TrapWriter.Emit(tuple);
+            TrapWriter.Emit(tuple);
+        }
+
+        public Entities.Location CreateLocation()
+        {
+            return SourceTree == null
+                ? GeneratedLocation.Create(this)
+                : CreateLocation(Microsoft.CodeAnalysis.Location.Create(SourceTree, Microsoft.CodeAnalysis.Text.TextSpan.FromBounds(0, 0)));
+        }
+
+        public Entities.Location CreateLocation(Microsoft.CodeAnalysis.Location? location)
+        {
+            return (location == null || location.Kind == LocationKind.None)
+                ? GeneratedLocation.Create(this)
+                : location.IsInSource
+                    ? NonGeneratedSourceLocation.Create(this, location)
+                    : Assembly.Create(this, location);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index df3a5757618..42fe1f2b30b 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -38,17 +38,17 @@ namespace Semmle.Extraction.Entities
         public override bool NeedsPopulation => true;
 
         public override int GetHashCode() =>
-            symbol == null ? 91187354 : symbol.GetHashCode();
+            Symbol == null ? 91187354 : Symbol.GetHashCode();
 
         public override bool Equals(object? obj)
         {
             if (obj is Assembly other && other.GetType() == typeof(Assembly))
-                return Equals(symbol, other.symbol);
+                return Equals(Symbol, other.Symbol);
 
             return false;
         }
 
-        public static new Location Create(Context cx, Microsoft.CodeAnalysis.Location loc) => AssemblyConstructorFactory.Instance.CreateEntity(cx, loc, loc);
+        public static Location Create(Context cx, Microsoft.CodeAnalysis.Location loc) => AssemblyConstructorFactory.Instance.CreateEntity(cx, loc, loc);
 
         private class AssemblyConstructorFactory : ICachedEntityFactory<Microsoft.CodeAnalysis.Location?, Assembly>
         {
diff --git a/csharp/extractor/Semmle.Extraction/Symbol.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/CachedEntity`1.cs
similarity index 57%
rename from csharp/extractor/Semmle.Extraction/Symbol.cs
rename to csharp/extractor/Semmle.Extraction/Entities/Base/CachedEntity`1.cs
index 2585ffd037f..6e676ab90e1 100644
--- a/csharp/extractor/Semmle.Extraction/Symbol.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/CachedEntity`1.cs
@@ -3,26 +3,40 @@ using Microsoft.CodeAnalysis;
 
 namespace Semmle.Extraction
 {
+    /// <summary>
+    /// A cached entity.
+    ///
+    /// The <see cref="Entity.Id"/> property is used as label in caching.
+    /// </summary>
+    public abstract class CachedEntity : LabelledEntity
+    {
+        protected CachedEntity(Context context) : base(context)
+        {
+        }
+
+        /// <summary>
+        /// Populates the <see cref="Label"/> field and generates output in the trap file
+        /// as required. Is only called when <see cref="NeedsPopulation"/> returns
+        /// <code>true</code> and the entity has not already been populated.
+        /// </summary>
+        public abstract void Populate(TextWriter trapFile);
+
+        public abstract bool NeedsPopulation { get; }
+    }
+
     /// <summary>
     /// An abstract symbol, which encapsulates a data type (such as a C# symbol).
     /// </summary>
     /// <typeparam name="TSymbol">The type of the symbol.</typeparam>
-    public abstract class CachedEntity<TSymbol> : ICachedEntity
+    public abstract class CachedEntity<TSymbol> : CachedEntity
     {
-        protected CachedEntity(Context context, TSymbol init)
+        public TSymbol Symbol { get; }
+
+        protected CachedEntity(Context context, TSymbol symbol) : base(context)
         {
-            Context = context;
-            symbol = init;
+            this.Symbol = symbol;
         }
 
-        public Label Label { get; set; }
-
-        public abstract Microsoft.CodeAnalysis.Location? ReportingLocation { get; }
-
-        public override string ToString() => Label.ToString();
-
-        public abstract void Populate(TextWriter trapFile);
-
         /// <summary>
         /// For debugging.
         /// </summary>
@@ -36,43 +50,17 @@ namespace Semmle.Extraction
             }
         }
 
-        public Context Context
-        {
-            get;
-        }
+        public override bool NeedsPopulation { get; }
 
-        public TSymbol symbol
-        {
-            get;
-        }
-
-        object? ICachedEntity.UnderlyingObject => symbol;
-
-        public TSymbol UnderlyingObject => symbol;
-
-        public abstract void WriteId(System.IO.TextWriter trapFile);
-
-        public virtual void WriteQuotedId(TextWriter trapFile)
-        {
-            trapFile.Write("@\"");
-            WriteId(trapFile);
-            trapFile.Write('\"');
-        }
-
-        public abstract bool NeedsPopulation
-        {
-            get;
-        }
-
-        public override int GetHashCode() => symbol is null ? 0 : symbol.GetHashCode();
+        public override int GetHashCode() => Symbol is null ? 0 : Symbol.GetHashCode();
 
         public override bool Equals(object? obj)
         {
             var other = obj as CachedEntity<TSymbol>;
-            return other?.GetType() == GetType() && Equals(other.symbol, symbol);
+            return other?.GetType() == GetType() && Equals(other.Symbol, Symbol);
         }
 
-        public abstract TrapStackBehaviour TrapStackBehaviour { get; }
+        public override TrapStackBehaviour TrapStackBehaviour { get; }
     }
 
     /// <summary>
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/Entity.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/Entity.cs
new file mode 100644
index 00000000000..888f6a4329e
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/Entity.cs
@@ -0,0 +1,64 @@
+using Microsoft.CodeAnalysis;
+using System;
+using System.IO;
+
+namespace Semmle.Extraction
+{
+    public abstract class Entity : IEntity
+    {
+        protected Context Context { get; }
+
+        protected Entity(Context context)
+        {
+            this.Context = context;
+        }
+
+        public Label Label { get; set; }
+
+        public abstract void WriteId(TextWriter trapFile);
+
+        public abstract void WriteQuotedId(TextWriter trapFile);
+
+        public abstract Location? ReportingLocation { get; }
+
+        public abstract TrapStackBehaviour TrapStackBehaviour { get; }
+
+        public void DefineLabel(TextWriter trapFile, Extractor extractor)
+        {
+            trapFile.WriteLabel(this);
+            trapFile.Write("=");
+            try
+            {
+                WriteQuotedId(trapFile);
+            }
+            catch (Exception ex)  // lgtm[cs/catch-of-all-exceptions]
+            {
+                trapFile.WriteLine("\"");
+                extractor.Message(new Message($"Unhandled exception generating id: {ex.Message}", ToString() ?? "", null, ex.StackTrace));
+            }
+            trapFile.WriteLine();
+        }
+
+        public void DefineFreshLabel(TextWriter trapFile)
+        {
+            trapFile.WriteLabel(this);
+            trapFile.WriteLine("=*");
+        }
+
+#if DEBUG_LABELS
+        /// <summary>
+        /// Generates a debug string for this entity.
+        /// </summary>
+        public string GetDebugLabel()
+        {
+            using var writer = new StringWriter();
+            writer.WriteLabel(Label.Value);
+            writer.Write('=');
+            WriteQuotedId(writer);
+            return writer.ToString();
+        }
+#endif
+
+        public override string ToString() => Label.ToString();
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/FreshEntity.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/FreshEntity.cs
new file mode 100644
index 00000000000..721a6f05e21
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/FreshEntity.cs
@@ -0,0 +1,38 @@
+using System.IO;
+
+namespace Semmle.Extraction
+{
+    /// <summary>
+    /// An entity which has a default "*" ID assigned to it.
+    /// </summary>
+    public abstract class FreshEntity : UnlabelledEntity
+    {
+        protected FreshEntity(Context cx) : base(cx)
+        {
+        }
+
+        protected abstract void Populate(TextWriter trapFile);
+
+        protected void TryPopulate()
+        {
+            Context.Try(null, null, () => Populate(Context.TrapWriter.Writer));
+        }
+
+        /// <summary>
+        /// For debugging.
+        /// </summary>
+        public string DebugContents
+        {
+            get
+            {
+                using var writer = new StringWriter();
+                Populate(writer);
+                return writer.ToString();
+            }
+        }
+
+        public override Microsoft.CodeAnalysis.Location? ReportingLocation => null;
+
+        public override TrapStackBehaviour TrapStackBehaviour { get; }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactory.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactory.cs
new file mode 100644
index 00000000000..7c03dd61002
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactory.cs
@@ -0,0 +1,14 @@
+namespace Semmle.Extraction
+{
+    /// <summary>
+    /// A factory for creating cached entities.
+    /// </summary>
+    /// <typeparam name="TInit">The type of the initializer.</typeparam>
+    public interface ICachedEntityFactory<in TInit, out TEntity> where TEntity : CachedEntity
+    {
+        /// <summary>
+        /// Initializes the entity, but does not generate any trap code.
+        /// </summary>
+        TEntity Create(Context cx, TInit init);
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactoryExtensions.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactoryExtensions.cs
new file mode 100644
index 00000000000..b311fccb7ab
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/ICachedEntityFactoryExtensions.cs
@@ -0,0 +1,35 @@
+using Microsoft.CodeAnalysis;
+
+namespace Semmle.Extraction
+{
+    public static class ICachedEntityFactoryExtensions
+    {
+        /// <summary>
+        /// Creates and populates a new entity, or returns the existing one from the cache,
+        /// based on the supplied cache key.
+        /// </summary>
+        /// <typeparam name="TInit">The type used to construct the entity.</typeparam>
+        /// <typeparam name="TEntity">The type of the entity to create.</typeparam>
+        /// <param name="factory">The factory used to construct the entity.</param>
+        /// <param name="cx">The extractor context.</param>
+        /// <param name="cacheKey">The key used for caching.</param>
+        /// <param name="init">The initializer for the entity.</param>
+        /// <returns>The entity.</returns>
+        public static TEntity CreateEntity<TInit, TEntity>(this ICachedEntityFactory<TInit, TEntity> factory, Context cx, object cacheKey, TInit init)
+            where TEntity : CachedEntity => cx.CreateEntity(factory, cacheKey, init);
+
+        /// <summary>
+        /// Creates and populates a new entity from an `ISymbol`, or returns the existing one
+        /// from the cache.
+        /// </summary>
+        /// <typeparam name="TSymbol">The type used to construct the entity.</typeparam>
+        /// <typeparam name="TEntity">The type of the entity to create.</typeparam>
+        /// <param name="factory">The factory used to construct the entity.</param>
+        /// <param name="cx">The extractor context.</param>
+        /// <param name="init">The initializer for the entity.</param>
+        /// <returns>The entity.</returns>
+        public static TEntity CreateEntityFromSymbol<TSymbol, TEntity>(this ICachedEntityFactory<TSymbol, TEntity> factory, Context cx, TSymbol init)
+            where TSymbol : ISymbol
+            where TEntity : CachedEntity => cx.CreateEntityFromSymbol(factory, init);
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/IEntity.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/IEntity.cs
new file mode 100644
index 00000000000..5aadbeb9e4d
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/IEntity.cs
@@ -0,0 +1,53 @@
+using Microsoft.CodeAnalysis;
+using System.IO;
+
+namespace Semmle.Extraction
+{
+    /// <summary>
+    /// Any program entity which has a corresponding label in the trap file.
+    ///
+    /// Entities are divided into two types: normal entities and cached
+    /// entities.
+    ///
+    /// Normal entities implement <see cref="FreshEntity"/> directly, and they
+    /// (may) emit contents to the trap file during object construction.
+    ///
+    /// Cached entities implement <see cref="CachedEntity"/>, and they
+    /// emit contents to the trap file when <see cref="CachedEntity.Populate"/>
+    /// is called. Caching prevents <see cref="CachedEntity.Populate"/>
+    /// from being called on entities that have already been emitted.
+    /// </summary>
+    public interface IEntity
+    {
+        /// <summary>
+        /// The label of the entity, as it is in the trap file.
+        /// For example, "#123".
+        /// </summary>
+        Label Label { get; set; }
+
+        /// <summary>
+        /// Writes the unique identifier of this entitiy to a trap file.
+        /// </summary>
+        /// <param name="trapFile">The trapfile to write to.</param>
+        void WriteId(TextWriter trapFile);
+
+        /// <summary>
+        /// Writes the quoted identifier of this entity,
+        /// which could be @"..." or *
+        /// </summary>
+        /// <param name="trapFile">The trapfile to write to.</param>
+        void WriteQuotedId(TextWriter trapFile);
+
+        /// <summary>
+        /// The location for reporting purposes.
+        /// </summary>
+        Location? ReportingLocation { get; }
+
+        /// <summary>
+        /// How the entity handles .push and .pop.
+        /// </summary>
+        TrapStackBehaviour TrapStackBehaviour { get; }
+
+        void DefineLabel(TextWriter trapFile, Extractor extractor);
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/LabelledEntity.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/LabelledEntity.cs
new file mode 100644
index 00000000000..12a98ce2303
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/LabelledEntity.cs
@@ -0,0 +1,18 @@
+using System.IO;
+
+namespace Semmle.Extraction
+{
+    public abstract class LabelledEntity : Entity
+    {
+        protected LabelledEntity(Context cx) : base(cx)
+        {
+        }
+
+        public override void WriteQuotedId(TextWriter trapFile)
+        {
+            trapFile.Write("@\"");
+            WriteId(trapFile);
+            trapFile.Write('\"');
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Base/UnlabelledEntity.cs b/csharp/extractor/Semmle.Extraction/Entities/Base/UnlabelledEntity.cs
new file mode 100644
index 00000000000..6b6a22eb4b5
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/Entities/Base/UnlabelledEntity.cs
@@ -0,0 +1,22 @@
+using System.IO;
+
+namespace Semmle.Extraction
+{
+    public abstract class UnlabelledEntity : Entity
+    {
+        protected UnlabelledEntity(Context cx) : base(cx)
+        {
+            cx.AddFreshLabel(this);
+        }
+
+        public sealed override void WriteId(TextWriter writer)
+        {
+            writer.Write('*');
+        }
+
+        public sealed override void WriteQuotedId(TextWriter writer)
+        {
+            WriteId(writer);
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction/Entities/ExtractionError.cs b/csharp/extractor/Semmle.Extraction/Entities/ExtractionError.cs
index 3df0ce3bb61..f7be2995923 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/ExtractionError.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/ExtractionError.cs
@@ -15,7 +15,7 @@ namespace Semmle.Extraction.Entities
         protected override void Populate(TextWriter trapFile)
         {
             trapFile.extractor_messages(this, msg.Severity, "C# extractor", msg.Text, msg.EntityText ?? string.Empty,
-                msg.Location ?? Location.Create(cx), msg.StackTrace ?? string.Empty);
+                msg.Location ?? Context.CreateLocation(), msg.StackTrace ?? string.Empty);
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
diff --git a/csharp/extractor/Semmle.Extraction/Entities/File.cs b/csharp/extractor/Semmle.Extraction/Entities/File.cs
index 4c339e49f7b..9ad618512a4 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/File.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/File.cs
@@ -62,7 +62,7 @@ namespace Semmle.Extraction.Entities
                 }
                 catch (Exception exc)
                 {
-                    Context.ExtractionError($"Couldn't read file: {originalPath}", null, null, exc.StackTrace);
+                    Context.ExtractionError($"Couldn't read file: {originalPath}. {exc.Message}", null, null, exc.StackTrace);
                 }
             }
 
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
index 917d15419e8..c84a6247d69 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Folder.cs
@@ -8,8 +8,8 @@ namespace Semmle.Extraction.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.folders(this, symbol.Value, symbol.NameWithoutExtension);
-            if (symbol.ParentDirectory is PathTransformer.ITransformedPath parent)
+            trapFile.folders(this, Symbol.Value, Symbol.NameWithoutExtension);
+            if (Symbol.ParentDirectory is PathTransformer.ITransformedPath parent)
                 trapFile.containerparent(Create(Context, parent), this);
         }
 
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.Entities
 
         public override void WriteId(System.IO.TextWriter trapFile)
         {
-            trapFile.Write(symbol.DatabaseId);
+            trapFile.Write(Symbol.DatabaseId);
             trapFile.Write(";folder");
         }
 
@@ -35,11 +35,11 @@ namespace Semmle.Extraction.Entities
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NoLabel;
 
-        public override int GetHashCode() => symbol.GetHashCode();
+        public override int GetHashCode() => Symbol.GetHashCode();
 
         public override bool Equals(object? obj)
         {
-            return obj is Folder folder && Equals(folder.symbol, symbol);
+            return obj is Folder folder && Equals(folder.Symbol, Symbol);
         }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Entities/GeneratedLocation.cs b/csharp/extractor/Semmle.Extraction/Entities/GeneratedLocation.cs
index 31b5f55b0e6..6d05263aecd 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/GeneratedLocation.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/GeneratedLocation.cs
@@ -28,7 +28,7 @@ namespace Semmle.Extraction.Entities
 
         public override bool Equals(object? obj) => obj != null && obj.GetType() == typeof(GeneratedLocation);
 
-        public static new GeneratedLocation Create(Context cx) => GeneratedLocationFactory.Instance.CreateEntity(cx, typeof(GeneratedLocation), null);
+        public static GeneratedLocation Create(Context cx) => GeneratedLocationFactory.Instance.CreateEntity(cx, typeof(GeneratedLocation), null);
 
         private class GeneratedLocationFactory : ICachedEntityFactory<string?, GeneratedLocation>
         {
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Location.cs b/csharp/extractor/Semmle.Extraction/Entities/Location.cs
index b25436e9a41..b2bfff06374 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Location.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Location.cs
@@ -8,34 +8,8 @@ namespace Semmle.Extraction.Entities
         protected Location(Context cx, Microsoft.CodeAnalysis.Location? init)
             : base(cx, init) { }
 
-        public static Location Create(Context cx, Microsoft.CodeAnalysis.Location? loc) =>
-            (loc == null || loc.Kind == Microsoft.CodeAnalysis.LocationKind.None)
-                ? GeneratedLocation.Create(cx)
-                : loc.IsInSource
-                    ? NonGeneratedSourceLocation.Create(cx, loc)
-                    : Assembly.Create(cx, loc);
-
-        public static Location Create(Context cx)
-        {
-            return cx.SourceTree == null
-                ? GeneratedLocation.Create(cx)
-                : Create(cx, Microsoft.CodeAnalysis.Location.Create(cx.SourceTree, TextSpan.FromBounds(0, 0)));
-        }
-
-        public override Microsoft.CodeAnalysis.Location? ReportingLocation => symbol;
+        public override Microsoft.CodeAnalysis.Location? ReportingLocation => Symbol;
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.OptionalLabel;
     }
-
-    public static class LocationExtensions
-    {
-        /// <summary>
-        /// Creates a Location entity.
-        /// </summary>
-        /// <param name="cx">The extraction context.</param>
-        /// <param name="location">The CodeAnalysis location.</param>
-        /// <returns>The Location entity.</returns>
-        public static Location Create(this Context cx, Microsoft.CodeAnalysis.Location? location) =>
-            Location.Create(cx, location);
-    }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Entities/SourceLocation.cs b/csharp/extractor/Semmle.Extraction/Entities/SourceLocation.cs
index e7bc4e3ea44..4e1726d6d07 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/SourceLocation.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/SourceLocation.cs
@@ -19,10 +19,10 @@ namespace Semmle.Extraction.Entities
             : base(cx, init)
         {
             Position = init.GetLineSpan();
-            FileEntity = File.Create(Context, Position.Path);
+            FileEntity = File.Create(base.Context, Position.Path);
         }
 
-        public static new Location Create(Context cx, Microsoft.CodeAnalysis.Location loc) => SourceLocationFactory.Instance.CreateEntity(cx, loc, loc);
+        public static Location Create(Context cx, Microsoft.CodeAnalysis.Location loc) => SourceLocationFactory.Instance.CreateEntity(cx, loc, loc);
 
         public override void Populate(TextWriter trapFile)
         {
@@ -30,7 +30,7 @@ namespace Semmle.Extraction.Entities
                 Position.Span.Start.Line + 1, Position.Span.Start.Character + 1,
                 Position.Span.End.Line + 1, Position.Span.End.Character);
 
-            var mapped = symbol!.GetMappedLineSpan();
+            var mapped = Symbol!.GetMappedLineSpan();
             if (mapped.HasMappedPath && mapped.IsValid)
             {
                 var mappedLoc = Create(Context, Microsoft.CodeAnalysis.Location.Create(mapped.Path, default, mapped.Span));
diff --git a/csharp/extractor/Semmle.Extraction/Entity.cs b/csharp/extractor/Semmle.Extraction/Entity.cs
deleted file mode 100644
index 5479c93fee9..00000000000
--- a/csharp/extractor/Semmle.Extraction/Entity.cs
+++ /dev/null
@@ -1,177 +0,0 @@
-using Microsoft.CodeAnalysis;
-using System;
-using System.IO;
-
-namespace Semmle.Extraction
-{
-    /// <summary>
-    /// Any program entity which has a corresponding label in the trap file.
-    ///
-    /// Entities are divided into two types: normal entities and cached
-    /// entities.
-    ///
-    /// Normal entities implement <see cref="IEntity"/> directly, and they
-    /// (may) emit contents to the trap file during object construction.
-    ///
-    /// Cached entities implement <see cref="ICachedEntity"/>, and they
-    /// emit contents to the trap file when <see cref="ICachedEntity.Populate"/>
-    /// is called. Caching prevents <see cref="ICachedEntity.Populate"/>
-    /// from being called on entities that have already been emitted.
-    /// </summary>
-    public interface IEntity
-    {
-        /// <summary>
-        /// The label of the entity, as it is in the trap file.
-        /// For example, "#123".
-        /// </summary>
-        Label Label { set; get; }
-
-        /// <summary>
-        /// Writes the unique identifier of this entitiy to a trap file.
-        /// </summary>
-        /// <param name="trapFile">The trapfile to write to.</param>
-        void WriteId(TextWriter trapFile);
-
-        /// <summary>
-        /// Writes the quoted identifier of this entity,
-        /// which could be @"..." or *
-        /// </summary>
-        /// <param name="trapFile">The trapfile to write to.</param>
-        void WriteQuotedId(TextWriter trapFile);
-
-        /// <summary>
-        /// The location for reporting purposes.
-        /// </summary>
-        Location? ReportingLocation { get; }
-
-        /// <summary>
-        /// How the entity handles .push and .pop.
-        /// </summary>
-        TrapStackBehaviour TrapStackBehaviour { get; }
-    }
-
-    /// <summary>
-    /// How an entity behaves with respect to .push and .pop
-    /// </summary>
-    public enum TrapStackBehaviour
-    {
-        /// <summary>
-        /// The entity must not be extracted inside a .push/.pop
-        /// </summary>
-        NoLabel,
-
-        /// <summary>
-        /// The entity defines its own label, creating a .push/.pop
-        /// </summary>
-        PushesLabel,
-
-        /// <summary>
-        /// The entity must be extracted inside a .push/.pop
-        /// </summary>
-        NeedsLabel,
-
-        /// <summary>
-        /// The entity can be extracted inside or outside of a .push/.pop
-        /// </summary>
-        OptionalLabel
-    }
-
-    /// <summary>
-    /// A cached entity.
-    ///
-    /// The <see cref="IEntity.Id"/> property is used as label in caching.
-    /// </summary>
-    public interface ICachedEntity : IEntity
-    {
-        /// <summary>
-        /// Populates the <see cref="Label"/> field and generates output in the trap file
-        /// as required. Is only called when <see cref="NeedsPopulation"/> returns
-        /// <code>true</code> and the entity has not already been populated.
-        /// </summary>
-        void Populate(TextWriter trapFile);
-
-        bool NeedsPopulation { get; }
-
-        object? UnderlyingObject { get; }
-    }
-
-    /// <summary>
-    /// A factory for creating cached entities.
-    /// </summary>
-    /// <typeparam name="TInit">The type of the initializer.</typeparam>
-    public interface ICachedEntityFactory<in TInit, out TEntity> where TEntity : ICachedEntity
-    {
-        /// <summary>
-        /// Initializes the entity, but does not generate any trap code.
-        /// </summary>
-        TEntity Create(Context cx, TInit init);
-    }
-
-    public static class ICachedEntityFactoryExtensions
-    {
-        /// <summary>
-        /// Creates and populates a new entity, or returns the existing one from the cache,
-        /// based on the supplied cache key.
-        /// </summary>
-        /// <typeparam name="TInit">The type used to construct the entity.</typeparam>
-        /// <typeparam name="TEntity">The type of the entity to create.</typeparam>
-        /// <param name="factory">The factory used to construct the entity.</param>
-        /// <param name="cx">The extractor context.</param>
-        /// <param name="cacheKey">The key used for caching.</param>
-        /// <param name="init">The initializer for the entity.</param>
-        /// <returns>The entity.</returns>
-        public static TEntity CreateEntity<TInit, TEntity>(this ICachedEntityFactory<TInit, TEntity> factory, Context cx, object cacheKey, TInit init)
-            where TEntity : ICachedEntity => cx.CreateEntity(factory, cacheKey, init);
-
-        /// <summary>
-        /// Creates and populates a new entity from an `ISymbol`, or returns the existing one
-        /// from the cache.
-        /// </summary>
-        /// <typeparam name="TSymbol">The type used to construct the entity.</typeparam>
-        /// <typeparam name="TEntity">The type of the entity to create.</typeparam>
-        /// <param name="factory">The factory used to construct the entity.</param>
-        /// <param name="cx">The extractor context.</param>
-        /// <param name="init">The initializer for the entity.</param>
-        /// <returns>The entity.</returns>
-        public static TEntity CreateEntityFromSymbol<TSymbol, TEntity>(this ICachedEntityFactory<TSymbol, TEntity> factory, Context cx, TSymbol init)
-            where TSymbol : ISymbol
-            where TEntity : ICachedEntity => cx.CreateEntityFromSymbol(factory, init);
-
-        public static void DefineLabel(this IEntity entity, TextWriter trapFile, IExtractor extractor)
-        {
-            trapFile.WriteLabel(entity);
-            trapFile.Write("=");
-            try
-            {
-                entity.WriteQuotedId(trapFile);
-            }
-            catch (Exception ex)  // lgtm[cs/catch-of-all-exceptions]
-            {
-                trapFile.WriteLine("\"");
-                extractor.Message(new Message($"Unhandled exception generating id: {ex.Message}", entity.ToString() ?? "", null, ex.StackTrace));
-            }
-            trapFile.WriteLine();
-        }
-
-        public static void DefineFreshLabel(this IEntity entity, TextWriter trapFile)
-        {
-            trapFile.WriteLabel(entity);
-            trapFile.WriteLine("=*");
-        }
-
-        /// <summary>
-        /// Generates a debug string for this entity.
-        /// </summary>
-        /// <param name="entity">The entity to view.</param>
-        /// <returns>The debug string.</returns>
-        public static string GetDebugLabel(this IEntity entity)
-        {
-            using var writer = new StringWriter();
-            writer.WriteLabel(entity.Label.Value);
-            writer.Write('=');
-            entity.WriteQuotedId(writer);
-            return writer.ToString();
-        }
-
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction/Extractor.cs b/csharp/extractor/Semmle.Extraction/Extractor.cs
index 4f5c27f3a90..6e031fbca52 100644
--- a/csharp/extractor/Semmle.Extraction/Extractor.cs
+++ b/csharp/extractor/Semmle.Extraction/Extractor.cs
@@ -4,101 +4,10 @@ using Semmle.Util.Logging;
 
 namespace Semmle.Extraction
 {
-    /// <summary>
-    /// Provides common extraction functions for use during extraction.
-    /// </summary>
-    ///
-    /// <remarks>
-    /// This is held in the <see cref="Context"/> passed to each entity.
-    /// </remarks>
-    public interface IExtractor
-    {
-        /// <summary>
-        /// Logs a message (to csharp.log).
-        /// Increases the error count if msg.severity is Error.
-        /// </summary>
-        /// <param name="msg">The message to log.</param>
-        void Message(Message msg);
-
-        /// <summary>
-        /// Cache assembly names.
-        /// </summary>
-        /// <param name="assembly">The assembly name.</param>
-        /// <param name="file">The file defining the assembly.</param>
-        void SetAssemblyFile(string assembly, string file);
-
-        /// <summary>
-        /// Maps assembly names to file names.
-        /// </summary>
-        /// <param name="assembly">The assembly name</param>
-        /// <returns>The file defining the assmebly.</returns>
-        string GetAssemblyFile(string assembly);
-
-        /// <summary>
-        /// How many errors encountered during extraction?
-        /// </summary>
-        int Errors { get; }
-
-        /// <summary>
-        /// The extraction is standalone - meaning there will be a lot of errors.
-        /// </summary>
-        bool Standalone { get; }
-
-        /// <summary>
-        /// Record a new error type.
-        /// </summary>
-        /// <param name="fqn">The display name of the type, qualified where possible.</param>
-        /// <param name="fromSource">If the missing type was referenced from a source file.</param>
-        void MissingType(string fqn, bool fromSource);
-
-        /// <summary>
-        /// Record an unresolved `using namespace` directive.
-        /// </summary>
-        /// <param name="fqn">The full name of the namespace.</param>
-        /// <param name="fromSource">If the missing namespace was referenced from a source file.</param>
-        void MissingNamespace(string fqn, bool fromSource);
-
-        /// <summary>
-        /// The list of missing types.
-        /// </summary>
-        IEnumerable<string> MissingTypes { get; }
-
-        /// <summary>
-        /// The list of missing namespaces.
-        /// </summary>
-        IEnumerable<string> MissingNamespaces { get; }
-
-        /// <summary>
-        /// The full path of the generated DLL/EXE.
-        /// null if not specified.
-        /// </summary>
-        string OutputPath { get; }
-
-        /// <summary>
-        /// The object used for logging.
-        /// </summary>
-        ILogger Logger { get; }
-
-        /// <summary>
-        /// The path transformer to apply.
-        /// </summary>
-        PathTransformer PathTransformer { get; }
-
-        /// <summary>
-        /// Creates a new context.
-        /// </summary>
-        /// <param name="c">The C# compilation.</param>
-        /// <param name="trapWriter">The trap writer.</param>
-        /// <param name="scope">The extraction scope (what to include in this trap file).</param>
-        /// <param name="addAssemblyTrapPrefix">Whether to add assembly prefixes to TRAP labels.</param>
-        /// <returns></returns>
-        Context CreateContext(Compilation c, TrapWriter trapWriter, IExtractionScope scope, bool addAssemblyTrapPrefix);
-    }
-
     /// <summary>
     /// Implementation of the main extractor state.
     /// </summary>
-    public class Extractor : IExtractor
+    public class Extractor
     {
         public bool Standalone
         {
@@ -189,11 +98,6 @@ namespace Semmle.Extraction
             }
         }
 
-        public Context CreateContext(Compilation c, TrapWriter trapWriter, IExtractionScope scope, bool addAssemblyTrapPrefix)
-        {
-            return new Context(this, c, trapWriter, scope, addAssemblyTrapPrefix);
-        }
-
         public IEnumerable<string> MissingTypes => missingTypes;
 
         public IEnumerable<string> MissingNamespaces => missingNamespaces;
diff --git a/csharp/extractor/Semmle.Extraction/FreshEntity.cs b/csharp/extractor/Semmle.Extraction/FreshEntity.cs
deleted file mode 100644
index e8569cd9c91..00000000000
--- a/csharp/extractor/Semmle.Extraction/FreshEntity.cs
+++ /dev/null
@@ -1,59 +0,0 @@
-using System.IO;
-
-namespace Semmle.Extraction
-{
-    /// <summary>
-    /// An entity which has a default "*" ID assigned to it.
-    /// </summary>
-    public abstract class FreshEntity : IEntity
-    {
-        protected Context cx { get; }
-
-        protected FreshEntity(Context cx)
-        {
-            this.cx = cx;
-            cx.AddFreshLabel(this);
-        }
-
-        public Label Label
-        {
-            get; set;
-        }
-
-        public void WriteId(TextWriter writer)
-        {
-            writer.Write('*');
-        }
-
-        public void WriteQuotedId(TextWriter writer)
-        {
-            WriteId(writer);
-        }
-
-        protected abstract void Populate(TextWriter trapFile);
-
-        protected void TryPopulate()
-        {
-            cx.Try(null, null, () => Populate(cx.TrapWriter.Writer));
-        }
-
-        /// <summary>
-        /// For debugging.
-        /// </summary>
-        public string DebugContents
-        {
-            get
-            {
-                using var writer = new StringWriter();
-                Populate(writer);
-                return writer.ToString();
-            }
-        }
-
-        public override string ToString() => Label.ToString();
-
-        public virtual Microsoft.CodeAnalysis.Location? ReportingLocation => null;
-
-        public abstract TrapStackBehaviour TrapStackBehaviour { get; }
-    }
-}
diff --git a/csharp/extractor/Semmle.Extraction/IExtractionScope.cs b/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
index 78b4a29d0d1..f12823b3f96 100644
--- a/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
+++ b/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
@@ -22,7 +22,5 @@ namespace Semmle.Extraction
         /// </summary>
         /// <param name="path">The path to populate.</param>
         bool InFileScope(string path);
-
-        bool FromSource { get; }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/Message.cs b/csharp/extractor/Semmle.Extraction/Message.cs
index 0a2a62e13a2..c68efa66ce0 100644
--- a/csharp/extractor/Semmle.Extraction/Message.cs
+++ b/csharp/extractor/Semmle.Extraction/Message.cs
@@ -28,12 +28,12 @@ namespace Semmle.Extraction
 
         public static Message Create(Context cx, string text, ISymbol symbol, string? stackTrace = null, Severity severity = Severity.Error)
         {
-            return new Message(text, symbol.ToString(), Entities.Location.Create(cx, symbol.Locations.FirstOrDefault()), stackTrace, severity);
+            return new Message(text, symbol.ToString(), cx.CreateLocation(symbol.Locations.FirstOrDefault()), stackTrace, severity);
         }
 
         public static Message Create(Context cx, string text, SyntaxNode node, string? stackTrace = null, Severity severity = Severity.Error)
         {
-            return new Message(text, node.ToString(), Entities.Location.Create(cx, node.GetLocation()), stackTrace, severity);
+            return new Message(text, node.ToString(), cx.CreateLocation(node.GetLocation()), stackTrace, severity);
         }
 
         public override string ToString() => Text;
@@ -44,8 +44,8 @@ namespace Semmle.Extraction
             sb.Append(Text);
             if (!string.IsNullOrEmpty(EntityText))
                 sb.Append(" in ").Append(EntityText);
-            if (!(Location is null) && !(Location.UnderlyingObject is null))
-                sb.Append(" at ").Append(Location.UnderlyingObject.GetLineSpan());
+            if (!(Location is null) && !(Location.Symbol is null))
+                sb.Append(" at ").Append(Location.Symbol.GetLineSpan());
             if (!string.IsNullOrEmpty(StackTrace))
                 sb.Append(" ").Append(StackTrace);
             return sb.ToString();
diff --git a/csharp/extractor/Semmle.Extraction/SourceScope.cs b/csharp/extractor/Semmle.Extraction/SourceScope.cs
index 48a89decba9..fba816f6363 100644
--- a/csharp/extractor/Semmle.Extraction/SourceScope.cs
+++ b/csharp/extractor/Semmle.Extraction/SourceScope.cs
@@ -19,7 +19,5 @@ namespace Semmle.Extraction
         public bool InFileScope(string path) => path == SourceTree.FilePath;
 
         public bool InScope(ISymbol symbol) => symbol.Locations.Any(loc => loc.SourceTree == SourceTree);
-
-        public bool FromSource => true;
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/TrapStackBehaviour.cs b/csharp/extractor/Semmle.Extraction/TrapStackBehaviour.cs
new file mode 100644
index 00000000000..0966a4816af
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction/TrapStackBehaviour.cs
@@ -0,0 +1,28 @@
+namespace Semmle.Extraction
+{
+    /// <summary>
+    /// How an entity behaves with respect to .push and .pop
+    /// </summary>
+    public enum TrapStackBehaviour
+    {
+        /// <summary>
+        /// The entity must not be extracted inside a .push/.pop
+        /// </summary>
+        NoLabel,
+
+        /// <summary>
+        /// The entity defines its own label, creating a .push/.pop
+        /// </summary>
+        PushesLabel,
+
+        /// <summary>
+        /// The entity must be extracted inside a .push/.pop
+        /// </summary>
+        NeedsLabel,
+
+        /// <summary>
+        /// The entity can be extracted inside or outside of a .push/.pop
+        /// </summary>
+        OptionalLabel
+    }
+}
diff --git a/csharp/ql/src/Dead Code/DeadCode.qll b/csharp/ql/src/Dead Code/DeadCode.qll
index e3584eaa1a4..dd0f6104e31 100644
--- a/csharp/ql/src/Dead Code/DeadCode.qll	
+++ b/csharp/ql/src/Dead Code/DeadCode.qll	
@@ -43,6 +43,8 @@ Expr getAMethodAccess(Method m) {
 predicate potentiallyAccessedByForEach(Method m) {
   m.hasName("GetEnumerator") and
   m.getDeclaringType().getABaseType+().hasQualifiedName("System.Collections.IEnumerable")
+  or
+  foreach_stmt_desugar(_, m, 1)
 }
 
 predicate isRecursivelyLiveExpression(Expr e) {
diff --git a/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql b/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql
index 3e89dc89e9d..f0eb93926c0 100644
--- a/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql	
+++ b/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql	
@@ -27,6 +27,13 @@ class NestedForConditions extends SC::StructuralComparisonConfiguration {
   }
 }
 
+private predicate hasChild(Stmt outer, Element child) {
+  outer = child.getParent() and
+  (outer instanceof ForStmt or outer = any(ForStmt f).getBody())
+  or
+  hasChild(outer, child.getParent())
+}
+
 /** A nested `for` statement that shares the same iteration variable as an outer `for` statement. */
 class NestedForLoopSameVariable extends ForStmt {
   ForStmt outer;
@@ -35,7 +42,7 @@ class NestedForLoopSameVariable extends ForStmt {
   MutatorOperation outerUpdate;
 
   NestedForLoopSameVariable() {
-    outer = this.getParent+() and
+    hasChild(outer, this) and
     innerUpdate = this.getAnUpdate() and
     outerUpdate = outer.getAnUpdate() and
     innerUpdate.getOperand() = iteration.getAnAccess() and
@@ -88,7 +95,7 @@ class NestedForLoopSameVariable extends ForStmt {
 
   /** Finds elements inside the outer loop that are no longer guarded by the loop invariant. */
   private ControlFlow::Node getAnUnguardedNode() {
-    result.getElement().getParent+() = getOuterForStmt().getBody() and
+    hasChild(getOuterForStmt().getBody(), result.getElement()) and
     (
       result =
         this.getCondition().(ControlFlowElement).getAControlFlowExitNode().getAFalseSuccessor()
diff --git a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
index 5d2ef55cd1f..7c93d25d646 100644
--- a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql	
+++ b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql	
@@ -12,12 +12,18 @@
 import csharp
 import semmle.code.csharp.frameworks.System
 
+private predicate equalsMethodChild(EqualsMethod equals, Element child) {
+  child = equals
+  or
+  equalsMethodChild(equals, child.getParent())
+}
+
 predicate nodeBeforeParameterAccess(ControlFlow::Node node) {
   exists(EqualsMethod equals | equals.getBody() = node.getElement())
   or
   exists(EqualsMethod equals, Parameter param, ControlFlow::Node mid |
     equals.getParameter(0) = param and
-    equals.getAChild*() = mid.getElement() and
+    equalsMethodChild(equals, mid.getElement()) and
     nodeBeforeParameterAccess(mid) and
     not param.getAnAccess() = mid.getElement() and
     mid.getASuccessor() = node
diff --git a/csharp/ql/src/codeql-suites/solorigate.qls b/csharp/ql/src/codeql-suites/solorigate.qls
new file mode 100644
index 00000000000..f6e575bb700
--- /dev/null
+++ b/csharp/ql/src/codeql-suites/solorigate.qls
@@ -0,0 +1,4 @@
+- description: Queries related to Solorigate
+- qlpack: codeql-csharp
+- include:
+    tags contain: solorigate
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp
new file mode 100644
index 00000000000..f499eebfdbf
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp	
@@ -0,0 +1,14 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query finds native calls to external functions that are often used in creating backdoors or are generally attributed to unsafe code practices. This is an example of a query that may be useful for detecting potential backdoors. Solorigate is one example that uses this mechanism.</p>
+  </overview>
+
+  <recommendation>
+    <p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql b/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql
new file mode 100644
index 00000000000..c9d247d69f3
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql	
@@ -0,0 +1,54 @@
+/**
+ * @name Potential dangerous use of native functions
+ * @description Detects the use of native functions that can be used for malicious intent or unsafe handling.
+ * @kind problem
+ * @problem.severity warning
+ * @precision low
+ * @id cs/backdoor/dangerous-native-functions
+ * @tags security
+ *       solorigate
+ */
+
+import csharp
+import semmle.code.csharp.frameworks.system.runtime.InteropServices
+
+predicate isDangerousMethod(Method m) {
+  m.getName() = "OpenProcessToken" or
+  m.getName() = "OpenThreadToken" or
+  m.getName() = "DuplicateToken" or
+  m.getName() = "DuplicateTokenEx" or
+  m.getName().matches("LogonUser%") or
+  m.getName().matches("WNetAddConnection%") or
+  m.getName() = "DeviceIoControl" or
+  m.getName().matches("LoadLibrary%") or
+  m.getName() = "GetProcAddress" or
+  m.getName().matches("CreateProcess%") or
+  m.getName().matches("InitiateSystemShutdown%") or
+  m.getName() = "GetCurrentProcess" or
+  m.getName() = "GetCurrentProcessToken" or
+  m.getName() = "GetCurrentThreadToken" or
+  m.getName() = "GetCurrentThreadEffectiveToken" or
+  m.getName() = "OpenThreadToken" or
+  m.getName() = "SetTokenInformation" or
+  m.getName().matches("LookupPrivilegeValue%") or
+  m.getName() = "AdjustTokenPrivileges" or
+  m.getName() = "SetProcessPrivilege" or
+  m.getName() = "ImpersonateLoggedOnUser" or
+  m.getName().matches("Add%Ace%")
+}
+
+predicate isExternMethod(Method externMethod) {
+  externMethod.isExtern()
+  or
+  externMethod.getAnAttribute().getType() instanceof
+    SystemRuntimeInteropServicesDllImportAttributeClass
+  or
+  externMethod.getDeclaringType().getAnAttribute().getType() instanceof
+    SystemRuntimeInteropServicesComImportAttributeClass
+}
+
+from MethodCall mc
+where
+  isExternMethod(mc.getTarget()) and
+  isDangerousMethod(mc.getTarget())
+select mc, "Call to an external method '" + mc.getTarget().getName() + "'."
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp
new file mode 100644
index 00000000000..57a8c5719fa
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp	
@@ -0,0 +1,14 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects situations in which an offset to a last file modification time is used to conditionally execute a particular block of code. This is a common pattern in backdoors, where the file's modification timestamp is the time at which the backdoor was planted, and the time offset is used as a time bomb before a particular code block is executed.</p>
+  </overview>
+
+  <recommendation>
+    <p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql b/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql
new file mode 100644
index 00000000000..31c00e8a378
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql	
@@ -0,0 +1,180 @@
+/**
+ * @name Potential Timebomb
+ * @description If there is data flow from a file's last modification date and an offset to a condition statement, this could trigger a "time bomb".
+ * @kind path-problem
+ * @precision Low
+ * @problem.severity warning
+ * @id cs/backdoor/potential-time-bomb
+ * @tags security
+ *       solorigate
+ */
+
+import csharp
+import DataFlow
+
+query predicate nodes = PathGraph::nodes/3;
+
+query predicate edges(DataFlow::PathNode a, DataFlow::PathNode b) {
+  PathGraph::edges(a, b)
+  or
+  exists(
+    FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable conf1,
+    FlowsFromTimeSpanArithmeticToTimeComparisonCallable conf2
+  |
+    conf1 = a.getConfiguration() and
+    conf1.isSink(a.getNode()) and
+    conf2 = b.getConfiguration() and
+    b.isSource()
+  )
+  or
+  exists(
+    FlowsFromTimeSpanArithmeticToTimeComparisonCallable conf1,
+    FlowsFromTimeComparisonCallableToSelectionStatementCondition conf2
+  |
+    conf1 = a.getConfiguration() and
+    conf1.isSink(a.getNode()) and
+    conf2 = b.getConfiguration() and
+    b.isSource()
+  )
+}
+
+/**
+ * Class that will help to find the source for the trigger file-modification date.
+ *
+ * May be extended as new patterns for similar time bombs are found.
+ */
+class GetLastWriteTimeMethod extends Method {
+  GetLastWriteTimeMethod() {
+    this.getQualifiedName() in [
+        "System.IO.File.GetLastWriteTime", "System.IO.File.GetFileCreationTime",
+        "System.IO.File.GetCreationTimeUtc", "System.IO.File.GetLastAccessTimeUtc"
+      ]
+  }
+}
+
+/**
+ * Abstracts `System.DateTime` structure
+ */
+class DateTimeStruct extends Struct {
+  DateTimeStruct() { this.getQualifiedName() = "System.DateTime" }
+
+  /**
+   * holds if the Callable is used for DateTime arithmetic operations
+   */
+  Callable getATimeSpanArtithmeticCallable() {
+    (result = this.getAnOperator() or result = this.getAMethod()) and
+    result.getName() in [
+        "Add", "AddDays", "AddHours", "AddMilliseconds", "AddMinutes", "AddMonths", "AddSeconds",
+        "AddTicks", "AddYears", "+", "-"
+      ]
+  }
+
+  /**
+   * Holds if the Callable is used for DateTime comparision
+   */
+  Callable getAComparisonCallable() {
+    (result = this.getAnOperator() or result = this.getAMethod()) and
+    result.getName() in ["Compare", "CompareTo", "Equals", "==", "!=", "<", ">", "<=", ">="]
+  }
+}
+
+/**
+ * Dataflow configuration to find flow from a GetLastWriteTime source to a DateTime arithmetic operation
+ */
+private class FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable extends TaintTracking::Configuration {
+  FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable() {
+    this = "FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(Call call, GetLastWriteTimeMethod m |
+      m.getACall() = call and
+      source.asExpr() = call
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(Call call, DateTimeStruct dateTime |
+      call.getAChild*() = sink.asExpr() and
+      call = dateTime.getATimeSpanArtithmeticCallable().getACall()
+    )
+  }
+}
+
+/**
+ * Dataflow configuration to find flow from a DateTime arithmetic operation to a DateTime comparison operation
+ */
+private class FlowsFromTimeSpanArithmeticToTimeComparisonCallable extends TaintTracking::Configuration {
+  FlowsFromTimeSpanArithmeticToTimeComparisonCallable() {
+    this = "FlowsFromTimeSpanArithmeticToTimeComparisonCallable"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(DateTimeStruct dateTime, Call call | source.asExpr() = call |
+      call = dateTime.getATimeSpanArtithmeticCallable().getACall()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(Call call, DateTimeStruct dateTime |
+      call.getAnArgument().getAChild*() = sink.asExpr() and
+      call = dateTime.getAComparisonCallable().getACall()
+    )
+  }
+}
+
+/**
+ * Dataflow configuration to find flow from a DateTime comparison operation to a Selection Statement (such as an If)
+ */
+private class FlowsFromTimeComparisonCallableToSelectionStatementCondition extends TaintTracking::Configuration {
+  FlowsFromTimeComparisonCallableToSelectionStatementCondition() {
+    this = "FlowsFromTimeComparisonCallableToSelectionStatementCondition"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(DateTimeStruct dateTime, Call call | source.asExpr() = call |
+      call = dateTime.getAComparisonCallable().getACall()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(SelectionStmt sel | sel.getCondition().getAChild*() = sink.asExpr())
+  }
+}
+
+/**
+ * Holds if the last file modification date from the call to getLastWriteTimeMethodCall will be used in a DateTime arithmetic operation timeArithmeticCall,
+ * which is then used for a DateTime comparison timeComparisonCall and the result flows to a Selection statement which is likely a TimeBomb trigger
+ */
+predicate isPotentialTimeBomb(
+  DataFlow::PathNode pathSource, DataFlow::PathNode pathSink, Call getLastWriteTimeMethodCall,
+  Call timeArithmeticCall, Call timeComparisonCall, SelectionStmt selStatement
+) {
+  exists(
+    FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable config1, Node sink,
+    DateTimeStruct dateTime, FlowsFromTimeSpanArithmeticToTimeComparisonCallable config2,
+    Node sink2, FlowsFromTimeComparisonCallableToSelectionStatementCondition config3, Node sink3
+  |
+    pathSource.getNode() = exprNode(getLastWriteTimeMethodCall) and
+    config1.hasFlow(exprNode(getLastWriteTimeMethodCall), sink) and
+    timeArithmeticCall = dateTime.getATimeSpanArtithmeticCallable().getACall() and
+    timeArithmeticCall.getAChild*() = sink.asExpr() and
+    config2.hasFlow(exprNode(timeArithmeticCall), sink2) and
+    timeComparisonCall = dateTime.getAComparisonCallable().getACall() and
+    timeComparisonCall.getAnArgument().getAChild*() = sink2.asExpr() and
+    config3.hasFlow(exprNode(timeComparisonCall), sink3) and
+    selStatement.getCondition().getAChild*() = sink3.asExpr() and
+    pathSink.getNode() = sink3
+  )
+}
+
+from
+  DataFlow::PathNode source, DataFlow::PathNode sink, Call getLastWriteTimeMethodCall,
+  Call timeArithmeticCall, Call timeComparisonCall, SelectionStmt selStatement
+where
+  isPotentialTimeBomb(source, sink, getLastWriteTimeMethodCall, timeArithmeticCall,
+    timeComparisonCall, selStatement)
+select selStatement, source, sink,
+  "Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger.",
+  timeComparisonCall, timeComparisonCall.toString(), timeArithmeticCall, "an offset",
+  getLastWriteTimeMethodCall, "last modification time of a file"
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp b/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp
new file mode 100644
index 00000000000..cb1faf86974
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp	
@@ -0,0 +1,15 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects code flow from ProcessName property on the Process class into a hash function.</p>
+    <p>Such flow is often used in code backdoors to detect running processes and compare them to an obfuscated list of antivirus processes to avoid detection. Solorigate is one example that uses this mechanism.</p>
+  </overview>
+
+  <recommendation>
+    <p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
+    <p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
+  </recommendation>
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql b/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql
new file mode 100644
index 00000000000..14d0cc02e44
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql	
@@ -0,0 +1,54 @@
+/**
+ * @name ProcessName to hash function flow
+ * @description Flow from a function retrieving process name to a hash function.
+ * @kind path-problem
+ * @tags security
+ *       solorigate
+ * @problem.severity warning
+ * @precision medium
+ * @id cs/backdoor/process-name-to-hash-function
+ */
+
+import csharp
+import DataFlow::PathGraph
+import experimental.code.csharp.Cryptography.NonCryptographicHashes
+
+class DataFlowFromMethodToHash extends TaintTracking::Configuration {
+  DataFlowFromMethodToHash() { this = "DataFlowFromMethodNameToHashFunction" }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  override predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  override predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
+}
+
+predicate isGetHash(Expr arg) {
+  exists(MethodCall mc |
+    (
+      mc.getTarget().getName().matches("%Hash%") or
+      mc.getTarget().getName().regexpMatch("Md[4-5]|Sha[1-9]{1,3}")
+    ) and
+    mc.getAnArgument() = arg
+  )
+  or
+  exists(Callable callable, Parameter param, Call call |
+    isCallableAPotentialNonCryptographicHashFunction(callable, param) and
+    call = callable.getACall() and
+    arg = call.getArgumentForParameter(param)
+  )
+}
+
+predicate isSuspiciousPropertyName(PropertyRead pr) {
+  pr.getTarget().getQualifiedName() = "System.Diagnostics.Process.ProcessName"
+}
+
+from DataFlow::PathNode src, DataFlow::PathNode sink, DataFlowFromMethodToHash conf
+where conf.hasFlow(src.getNode(), sink.getNode())
+select src.getNode(), src, sink,
+  "The hash is calculated on the process name $@, may be related to a backdoor. Please review the code for possible malicious intent.",
+  sink.getNode(), "here"
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate-Readme.md b/csharp/ql/src/experimental/Security Features/campaign/Solorigate-Readme.md
new file mode 100644
index 00000000000..c6bdb98c73e
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate-Readme.md	
@@ -0,0 +1,121 @@
+# Working with Solorigate queries
+
+In early December, 2020 a sophisticated compromise campaign was uncovered, dubbed [Solorigate](https://aka.ms/solorigate).  A key feature of the campaign was a malicious software implant inserted into SolarWinds' Orion product on the build server. Studying the coding patterns and techniques used in the implant, Microsoft authored CodeQL queries as part of a larger effort to analyze our source code for any malicious modification - a brief summary of those efforts can be [found here](https://aka.ms/Solorigate-CodeQL-Blog). These queries here represent a mixture of techniques to look for code that shares features with the malicious Implant code.
+
+This ReadMe walks through what each query does and limitations of the approaches taken, suggestions for modifications, and general advice on using CodeQL to author backdoor hunting queries.  There are two approaches taken with the queries; the first is to look for syntactic characteristics used in the malicious implant, things like names and particular literals.  The second approach looks for semantic patterns – particular functionality and flow associated with the implant.  In both cases it is possible, and sometimes likely, that benign code will coincidentally match the patterns these queries look for, so all findings will need to be reviewed to either verify or rule out the providence of the source code being flagged.  The descriptions of each query try to capture the likely coincidence of findings in code of benign providence.
+
+When editing this queries for open sourcing, we tried to find the right balance between detection capability and false positive rate, mindful that different organizations have differing resources to review the findings.  We also excluded queries that we found to be resource intensive when executing without providing significant detective value over these queries here.  
+
+## Syntactic queries
+
+These queries are targeting specific names/values and other syntactic traits present in the Solorigate IoCs.  They tend to either target syntax that is easy for the malicious actor to alter between operations or syntax that is going to be fairly coincidental, so are either very precise but very fragile, or imprecise but more durable.  However, they are very fast to execute, and very easy to modify, so can be easily repurposed to do first pass analysis in future campaigns to hunt for code IoCs.  Several of them use a list syntax introduced in CodeQL 1.26, so require that version of newer to compile and execute.
+
+### cs/Solorigate/number-of-known-commands-in-enum-above-threshold
+
+**Implemented in:** NumberOfKnownCommandsAboveThreshold.ql
+
+This query looks for enumerations that look like they are defining Command and Control functionality, based on the enumeration in Solorigate.  Enumerations are a convenient way of defining and referencing this functionality, so are likely to be used in other implants.  This query does allow some fuzziness to how many commands are defined, by default looking for any enumeration with at least 10 of the 18 commands but is brittle to changes in the names of the commands.
+
+The specific list of commands it looks for within the enumeration is defined in Solorigate.qll in countSolorigateCommandInEnum.  There are several “clusters” of commands – for example, commands to interact with the file system, with the registry, etc.  If implementing an API for file system or registry interactions it is possible to coincidentally include similar command names, but it is unlikely a single enumeration would coincidentally contain commands to interact with the file system, assembly, handle process execution, etc.  If you know your code performs a subset of those functions, deleting those specific commands from countSolorigateCommandInEnum and lowering the threshold of the query should reduce false positives, though does increase the chance of false negatives.  
+
+This query could be modified to reduce false negatives by decreasing the threshold and changing the name comparisons of the enumeration values to fuzzy matches, but doing so will produce higher false positives.  Fuzzy matching is also more computationally costly, so will increase the execution time.  
+
+### cs/Solorigate/number-of-known-hashes-above-threshold
+
+**Implemented in:** NumberofKnownHashesAboveThreshold.ql
+
+This query looks for the presence of 5 or more of the XOR’ed hashes Solorigate derived from the names of running processes they wanted to avoid(various anti-malware, etc.).  The Solorigate implant would first hash the process name with FNV-1A, and then XOR it with the magic number 6605813339339102567, and then compared to a list of these derived hashes to see if any of the processes the implant wanted to evade were currently running.  Likely the reason for the XOR with a magic number is so that comparison values can be unique per implant, so it is very unlikely they were reused elsewhere.  However, these values are incredibly unlikely to appear coincidentally in source, so if this query does have findings there is a high probability the findings are malicious.
+
+The derived hash literals are defined in Solorigate.qll in “solorigateSuspiciousHashes”.  If a similar campaign happens in the future this query can easily be repurposed by swapping the current hash values with the values for that campaign.  Like now, doing so probably won’t trigger findings as the malicious actor would likely make the values unique per implant, but this is a very quick query to both author/tweak and to execute, so the cost of checking “just in case” is quite low.
+
+“cs/Solorigate/modified-fnv-function-detection” and “cs/backdoor/process-name-to-hash-function” attempt to detect the actual process name hashing technique rather than the particular values, so will be durable to use of different magic numbers.
+
+### cs/Solorigate/number-of-known-literals-above-threshold
+
+**Implemented In:** NumberOfKnownLiteralsAboveThreshold.ql
+
+This query looks for literals present in the implant, however since many of the literals would appear coincidentally in a great deal of code (common IP addresses, host names, etc.), this query does not fire unless at least 30 of the literals are all present.  Many of the literals would need to be reused in other implants if similar functionality were desired (though they could be hidden with a reversable obfuscation technique).
+
+The query is ensuring that these are semantic literals, so will not incorrectly count usages in comments/method names/variable names/etc. – this shows that even for a relatively simple detection CodeQL provides advantages over more simplistic text parsing.  As previously mentioned, many of these literals are incredibly common, so the likelihood that a finding represents malicious modification is low.  Its recommended to triage the other queries first, as triaging the results of this query is more labor intensive and results are less likely to represent malicious activity.  Reducing the threshold value in NumberOfKnownLiteralsAboveThreshold.ql will increase the chance that it catches other implants that used a subset of the literals, but will also significantly increase false positives.  Alternatively, if the first run produces a large number of results, moving the threshold value up helps reduce the findings to only code that more completely mirrors the literals used in Solorigate, while increasing the possibility potential false negatives.
+
+The list of literals is defined in Solorigate.qll in solorigateSuspiciousLiterals.  When run against specific code bases the result set may be more manageable by removing methods and literals known to be legitimately used in that code base, though trimming the list too extensively will increase the chances of false negatives.  This query can easily be repurposed for future campaigns by replacing the literals here with the literals that were features of IoCs in those campaigns.  If the number of IoC literals is greater in future campaigns, moving the threshold value up from 30 would likely increase detection accuracy without significantly increasing false negative rates.  On the flip side, if the number of literals is significantly less, the threshold value will likely need to be decreased from 30.
+
+### cs/solorigate/number-of-known-method-names-above-threshold
+
+**Implemented In:** NumberOfKnownMethodNamesAboveThreshold.ql
+
+This query looks for method names present within the implant, but as with the literals, the method names would appear coincidentally in many code bases as they were intended to blend in.  Because the individual method names are highly likely to be coincidentally used, this query only fires if 50 or more are present.  This query is ensuring that these are used as method names, so will not incorrectly count usage in literals/comments/variable names/etc. While these are common method names, it would be uncommon (but still possible – we had plenty of false positives) for many of them to all be defined within the same project.  Excluding methods that are common overrides in class declarations (ex. ToString) will lower the false positive rate, but with the threshold of 50 we found the result set manageable without that adjustment.  
+
+The list of literals is defined in Solorigate.qll in solorigateSuspiciousMethodNames.  While the previous queries looking for the command Enumeration, Derived process hashes, and literals may provide some value if ported to cover other languages, the specific method list for this query does not, as the methods are particular for C#.  However, if an additional implant targeting another language is discovered in the future, the basic approach used in this query is re-usable even if the method names are not.
+
+## Semantic Queries
+
+The semantic queries are not looking for any specific names or terms unique to the IoCs, but rather techniques or patterns used for the implant’s functionality.  Some can be evaded by implementing the functionality via different semantics, but a malicious agent would need to specifically take pains to do so.  These queries may detect unrelated backdoors, and can also be ported to cover other programming languages to detect the same techniques in those languages.
+
+### cs/Solorigate/modified-fnv-function-detection
+
+**Implemented in:** ModifiedFnvFunctionDetection.ql
+
+The Solorigate implant tries to evade various security detection software by comparing hashes of the process names against an embedded list of values.  However, to make the embedded list unique per implant, the hashes were then XOR’ed with a magic value.  The implant embedded a version of the FNV-1A hash function for this purpose, so this query looks for use of an “FNV-like” implementation with XOR.
+
+The logic that determines what is “FNV-like” is in NonCryptographicHashes.qll, in the predicate “maybeUsedInFNVFunction”.  This logic is not looking for specific known implementations of an FNV function, but rather method code that looks like it is trying to implement one of the FNV functions.  This should avoid evasions based purely on the name of the function, but deliberate attempts to obfuscate the implementation of the function may be able to evade this analysis.  
+
+Separately, and unrelated to Solorigate, this predicate (as well as the one looking for “Elfhash-like”) can be combined with control flow analysis to ensure that these hash functions are not being used in a cryptographic context where their use would be insecure.  
+
+### cs/backdoor/process-name-to-hash-function
+
+**Implemented in:** ProcessNameToHashTaintFlow.ql
+
+This query takes a different approach than the previous two – rather than looking for use of FNV-like methods used specifically in conjunction with an XOR, it instead looks for flow from System.Diagnostics.Process.ProcessName to something that “looks like” a hash function.  It determines what looks like a hash function by looking for methods whose names contain “Hash” or MD4/5 or some variation of SHA, or whose implementation is either “FNV-Like” or “Elf-Like” (see NonCryptographicHashes.qll for the logic that determines FNV or Elf-like – looking at the implementation is durable to simple renaming of the methods). This approach should catch a variety of process name hashing schemes, though it should be noted that there are legitimate reasons to hash a process name.  The flow analysis is interprocedural, so can detect attempts to obfuscate the hashing of process names by distributing the steps across the source.  As the definition of a hash function is intentionally a bit fuzzy this query has a medium precision (i.e. it may falsely catch code that is not attempting to hash the process name), and as there are legitimate reasons to hash a process name the chance that an accurate finding represents a malicious implant is moderate to low depending on the code base.
+
+To add additional hash detections logic to cast a wider net, modify isGetHash in ProcessNameToHashTaintFlow.ql. 
+
+### cs/backdoor/potential-time-bomb
+
+**Implemented in:** PotentialTimeBomb.ql
+
+This query looks for a the Solorigate Implant's time delay functionality.  The Backdoor would not initially activate until 12-14 days *after* the Orion update with the implanted code was installed.  It did this by checking the last file write time, randomly adding between 288 and 336 hours to it, and comparing that against the current system time before it initially called back to the C2 servers controlling the campaign.  This query detects that technique by looking for flow from GetLastWriteTime to an arithmetic operation, and from there to a comparison against the current time.  This query will coincidentally flag any software that invokes an action a certain time after installation - for example, prompting the user to register or activate the product after a certain period has elapsed.  
+
+The accuracy of this query could be improved to reduce those coincidental findings by checking if there is then flow to a remote source (which is the case in the Solorigate implant) or to shell or process execution as they are often features of time bombed malicious code, however the additional flow steps do increase the execution time and increase the chance of false negatives.  This query as is produced a manageable set of false positives when run across our thousands of databases, so we suggest first running it as is, and only making those modifications if the practice appears to be common in your code bases.
+
+To make this query more generic, it could be modified to check for other ways of persisting an initial data on the system - reading a registry key, file contents, system reboot time, etc.  However, each additional data source will increase false positives.  
+
+### cs/Solorigate/swallow-everything-exception
+
+**Implemented in:** SwallowEverythingExceptionHandler.ql
+
+The Solorigate Implant wraps the implanted code in a
+
+    try {  
+     //stuff
+    } 
+    catch (Exception) {}
+
+to ensure that runtime exceptions didn’t tip anyone off.  This query looks for all catches of generic exceptions, with empty exception blocks.  The detection is high precision – it will accurately find all empty generic exception handlers.  However, it is unfortunately a common enough bad programming practice that there are plenty of writeups in existence explaining that it is a bad programming practice, so the likelihood of the findings being a malicious implant are low.  It’s recommended that they be reviewed to ensure this bad practice isn’t hiding latent (or not so latent) bugs in the code.
+
+It can be evaded by including any statements in the catch block, but the existing cs/catch-of-all-exceptions query can be used to catch that evasion.  That query’s findings will be a superset of this query, as it will catch many legitimate situations where the exception was anticipated and the catch block can take action that would make swallowing the exception and continuing on relatively risk free.  By looking at empty catch statements, this query looks for the exact pattern in the Solorigate implant and will generate fewer findings to review.
+
+### cs/backdoor/dangerous-native-functions
+
+**Implemented in:** DangerousNativeFunctionCalls.ql
+
+This query looks for several native Windows API that might be present in backdoor functionality, including several used in Solorigate.  It is also more broadly useful in looking for a technique that can be used to evade queries looking for malicious execution of processes by calling the native platform libraries instead of the .Net Class libraries.  We are including it to act as inspiration for other query developers to think about how they can query not just for backdoor patterns but also how they can hunt for attempts to then evade those queries.
+
+While the results of this query are useful on their own, both to cast a wide net to find this evasion technique, and to review why the developers chose the more error prone PInvoke implementation in benign findings, this query was kept simple specifically to use as an example. It can easily be combined with Data Flow or Taint Flow by adding a call to the isExternMethod predicate in DangerousNativeFunctionCalls to an overridden isSink implementation.  With this relatively simple addition, flow from untrusted sources like web requests into the potentially dangerous API can easily be detected, and at the very least represent a potential security vulnerability that should be reviewed, but may also represent a C2 implementation attempting to evade searches for the standard Class Library functions.
+
+## Build CodeQL Databases from the production Build Servers/Pipelines
+
+The malicious modifications of SolarWinds’ code took place on the build server (more details from [CrowdStrike](https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/)), so CodeQL databases used for analysis should ideally be built from the same build servers.  CodeQL utilizes the same Roslyn Compiler as MSBuild, so absent the malicious actor specifically building checks for the presence of CodeQL, it is likely the injection technique utilized by the malicious actor would replicate when CodeQL was run.  Alternatively, if building CodeQL databases in an independent environment, other techniques can be used to validate that the code that was compiled into the final binaries is the same as the source code in the source repository.
+
+### FYI
+
+While the step-by-step details are outside the scope of this ReadMe, if the build environment is configured to perform deterministic builds (not all compilers support this, nor default to this if they do), the binaries produced by the build environment can be compared to binaries produced from the same source compiled in a distinct environment.  Additionally, some compilers can be configured to emit a manifest of the source code hashes for the source files that were compiled (MSBuild puts them in the PDB files emitted during compilation), which can be compared to source hashes created in an independent environment.  If the comparison of either the deterministically built binaries or source hashes do not match, that is a clear indicator that further investigation is warranted.  These two techniques can be automated to provide ongoing validation of the build output.  
+
+If comparing source hashes, it is strongly recommended that SHA256 rather than weaker hashes be used.  This can be configured in the following Microsoft compilers by using the specified compiler flags below:
+
+* cl.exe /ZH:SHA_256
+* ml.exe /ZH:SHA_256
+* ml64.exe /ZH:SHA_256
+* armasm.exe -gh:SHA_256
+* armasm64.exe -gh:SHA_256
+* csc.exe /checksumalgorithm:SHA256
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qhelp
new file mode 100644
index 00000000000..dab8e033caa
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qhelp	
@@ -0,0 +1,12 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>In Solorigate, the malicious code tried to evade various security detection software by comparing hashes of the process names against an embedded list of values. The malicious code used in the SolarWinds attack included hash values calculated using a standard FNV-1A 64-bit hash with an additional XOR by a literal after computing the FNV-1A.</p>
+    <p>This query detects FNV-like hash calculations where there is an additional XOR (with any static value) after the hash calculation loop.</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.ql
new file mode 100644
index 00000000000..e9f81596e04
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.ql	
@@ -0,0 +1,32 @@
+/**
+ * @name Detects a modified FNV function
+ * @description Possible indication of Solorigate. Detects a modified FNV1 function, where there is an additional xor using a literal after the regular FNV hash
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @precision high
+ * @id cs/solorigate/modified-fnv-function-detection
+ * @problem.severity error
+ */
+
+import csharp
+import Solorigate
+import experimental.code.csharp.Cryptography.NonCryptographicHashes
+
+from Variable v, Literal l, LoopStmt loop, Expr additional_xor
+where
+  maybeUsedInFNVFunction(v, _, _, loop) and
+  (
+    exists(BitwiseXorExpr xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
+      loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
+      xor2.getAnOperand() = v.getAnAccess()
+    )
+    or
+    exists(AssignXorExpr xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
+      loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
+      xor2.getAnOperand() = v.getAnAccess()
+    )
+  )
+select l,
+  "The variable $@ seems to be used as part of a FNV-like hash calculation, that is modified by an additional $@ expression using literal $@.",
+  v, v.toString(), additional_xor, "xor", l, l.toString()
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qhelp
new file mode 100644
index 00000000000..adad2a1ba04
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qhelp	
@@ -0,0 +1,12 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects enumerations that include various commands that were also used in the Solorigate implant.</p>
+    <p>By themselves, the names of these enumeration constants are not malicious, so the query only detects enumerations that includes at least 10 of the 18 Solorigate commands.</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.ql
new file mode 100644
index 00000000000..42fb738f157
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.ql	
@@ -0,0 +1,38 @@
+/**
+ * @name Number of Solorigate-related command names in enum is above the threshold
+ * @description The enum contains several values that look similar to command and control command names, which may indicate that the code may have been tampered with by an external agent.
+ *      It is recommended to review the code and verify that there is no unexpected code in this project.
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @problem.severity warning
+ * @precision medium
+ * @id cs/solorigate/number-of-known-commands-in-enum-above-threshold
+ */
+
+import csharp
+import Solorigate
+
+/*
+ * Returns the total number of Solorigate-related commands in the given enum
+ *
+ * This command list is described at https://www.fireeye.com/blog/products-and-services/2020/12/global-intrusion-campaign-leverages-software-supply-chain-compromise.html
+ * and the enum names are based from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
+ */
+
+int countSolorigateCommandInEnum(Enum e) {
+  result =
+    count(string s, EnumConstant ec |
+      e.getAnEnumConstant() = ec and
+      s = ec.getName() and
+      s = solorigateSuspiciousCommandsInEnum()
+    )
+}
+
+from Enum e, int total
+where
+  total = countSolorigateCommandInEnum(e) and
+  total > 10
+select e,
+  "The enum $@ may be related to Solorigate. It matches " + total +
+    " of the values used for commands in the enum.", e, e.getName()
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qhelp
new file mode 100644
index 00000000000..3188a45d7a6
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qhelp	
@@ -0,0 +1,13 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects literals that look like Solorigate Hash values used in the Solorigate code.</p>
+    <p>This query detects when the code includes at least 5 of the Hash literals used in the Solorigate tampered code</p>
+    <p>Please notice that by themselves these literals are not malign, but several of the values together would be less likely to be coincidental.</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.ql
new file mode 100644
index 00000000000..541f3205c01
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.ql	
@@ -0,0 +1,33 @@
+/**
+ * @name Number of Solorigate-related hashes as literals is above the threshold
+ * @description The total number of Solorigate-related hash literals found in the code is above a threshold, which may indicate that an external agent has tampered with the code.
+ *      It is recommended to review the code and verify that there is no unexpected code in this project, however it is highly unlikely the hash values would be present coincidentally.
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @problem.severity warning
+ * @precision medium
+ * @id cs/solorigate/number-of-known-hashes-above-threshold
+ */
+
+import csharp
+import Solorigate
+
+/*
+ * Returns the total number of Solorigate-related hashes found in the project
+ */
+
+int countSolorigateSuspiciousHash() {
+  result =
+    count(string s | exists(Literal l | s = l.getValue() and s = solorigateSuspiciousHashes()))
+}
+
+from Literal l, int total, int threshold
+where
+  total = countSolorigateSuspiciousHash() and
+  threshold = 5 and // out of ~200 known literals
+  isSolorigateHash(l) and
+  total > threshold
+select l,
+  "The Hash literal $@ may be related to the Solorigate campaign. Total count = " + total +
+    " is above the threshold " + threshold + ".", l, l.getValue()
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qhelp
new file mode 100644
index 00000000000..fe6e1d0a936
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qhelp	
@@ -0,0 +1,13 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects literals used in the Solorigate code.</p>
+    <p>This query detects when the code includes at least 30 of the literals used in the Solorigate tampered code</p>
+    <p>Please notice that by themselves these literals are not malign.</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.ql
new file mode 100644
index 00000000000..a18f0c40916
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.ql	
@@ -0,0 +1,33 @@
+/**
+ * @name Number of Solorigate-related literals is above the threshold
+ * @description The total number of Solorigate-related literals found in the code is above a threshold, which may indicate that an external agent has tampered with the code.
+ *      It is recommended to review the code and verify that there is no unexpected code in this project.
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @problem.severity warning
+ * @precision medium
+ * @id cs/solorigate/number-of-known-literals-above-threshold
+ */
+
+import csharp
+import Solorigate
+
+/*
+ * Returns the total number of Solorigate-related literals found in the project
+ */
+
+int countSolorigateSuspiciousLiterals() {
+  result =
+    count(string s | exists(Literal l | s = l.getValue() and s = solorigateSuspiciousLiterals()))
+}
+
+from Literal l, int total, int threshold
+where
+  total = countSolorigateSuspiciousLiterals() and
+  threshold = 30 and // out of ~150 known literals
+  isSolorigateLiteral(l) and
+  total > threshold
+select l,
+  "The literal $@ may be related to the Solorigate campaign. Total count = " + total +
+    " is above the threshold " + threshold + ".", l, l.getValue()
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qhelp
new file mode 100644
index 00000000000..d99821def93
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qhelp	
@@ -0,0 +1,13 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>This query detects method names used in the Solorigate code.</p>
+    <p>This query detects when the code includes at least 50 of the methods used in the Solorigate tampered code</p>
+    <p>Please notice that by themselves these method names are not malign.</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.ql
new file mode 100644
index 00000000000..430329c3a10
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.ql	
@@ -0,0 +1,32 @@
+/**
+ * @name Number of Solorigate-related method names is above the threshold
+ * @description The total number of Solorigate-related method names found in the code is above a threshold, which may indicate that an external agent has tampered with the code.
+ *      It is recommended to review the code and verify that there is no unexpected code in this project.
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @problem.severity warning
+ * @precision medium
+ * @id cs/solorigate/number-of-known-method-names-above-threshold
+ */
+
+import csharp
+import Solorigate
+
+/*
+ * Returns the total number of Solorigate-related method names found in the project
+ */
+
+int countSolorigateSuspiciousMethodNames() {
+  result = count(string s | s = any(Method m | isSolorigateSuspiciousMethodName(m)).getName())
+}
+
+from Method m, int total, int threshold
+where
+  total = countSolorigateSuspiciousMethodNames() and
+  threshold = 50 and // out of ~ 100 known names
+  isSolorigateSuspiciousMethodName(m) and
+  total > threshold
+select m,
+  "The method $@ may be related to Solorigate. Total count = " + total + " is above the threshold " +
+    threshold + ".", m, m.getName()
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qhelp.inc b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qhelp.inc
new file mode 100644
index 00000000000..bba4df25c7d
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qhelp.inc	
@@ -0,0 +1,13 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+ <overview>
+  <p>The nation-state supply chain attack on SolarWinds known as Solorigate or SunBurst gave nation-state actors access to some victims' networks.</p>
+  <p>The purpose of these rules is to identify potentially tampered code that requires further analysis.</p>
+</overview> 
+<recommendation>
+  <p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
+  <p>For more information, please visit https://aka.ms/solorigate. </p>
+</recommendation>
+</qhelp>
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qll b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qll
new file mode 100644
index 00000000000..6947fc05bb1
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/Solorigate.qll	
@@ -0,0 +1,210 @@
+/*
+ * Provides reusable predicates related to Solorigate
+ */
+
+import csharp
+
+/*
+ * Returns a list of Literals representing process hashes.  These are unlikely to be recycled between campaigns, so not expected to have hits, but if present
+ * are almost certainly an indicator of compromise
+ * This data was extracted from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
+ * and https://github.com/fireeye/sunburst_countermeasures/blob/main/fnv1a_xor_hashes.txt
+ */
+
+string solorigateSuspiciousHashes() {
+  result =
+    [
+      "10063651499895178962", "10235971842993272939", "10296494671777307979",
+      "10336842116636872171", "10374841591685794123", "10393903804869831898",
+      "10463926208560207521", "10484659978517092504", "10501212300031893463",
+      "10545868833523019926", "10657751674541025650", "106672141413120087", "10734127004244879770",
+      "10829648878147112121", "1099511628211", "11073283311104541690", "1109067043404435916",
+      "11109294216876344399", "11266044540366291518", "11385275378891906608",
+      "11771945869106552231", "11801746708619571308", "11818825521849580123",
+      "11913842725949116895", "12027963942392743532", "12094027092655598256",
+      "12343334044036541897", "12445177985737237804", "12445232961318634374",
+      "12574535824074203265", "12679195163651834776", "12709986806548166638",
+      "12718416789200275332", "12785322942775634499", "12790084614253405985",
+      "12969190449276002545", "13014156621614176974", "13029357933491444455",
+      "13135068273077306806", "13260224381505715848", "13316211011159594063",
+      "13464308873961738403", "13544031715334011032", "13581776705111912829",
+      "13599785766252827703", "13611051401579634621", "13611814135072561278",
+      "13655261125244647696", "1367627386496056834", "1368907909245890092", "13693525876560827283",
+      "13783346438774742614", "13799353263187722717", "13825071784440082496",
+      "13852439084267373191", "13876356431472225791", "14055243717250701608",
+      "14079676299181301772", "14095938998438966337", "14111374107076822891",
+      "14193859431895170587", "14226582801651130532", "14243671177281069512",
+      "14256853800858727521", "14480775929210717493", "14482658293117931546",
+      "14513577387099045298", "14630721578341374856", "14695981039346656037",
+      "14710585101020280896", "1475579823244607677", "14868920869169964081", "14968320160131875803",
+      "14971809093655817917", "15039834196857999838", "15092207615430402812",
+      "15114163911481793350", "15194901817027173566", "15267980678929160412",
+      "15457732070353984570", "15514036435533858158", "15535773470978271326",
+      "15587050164583443069", "155978580751494388", "15695338751700748390", "15997665423159927228",
+      "16066522799090129502", "16066651430762394116", "16112751343173365533",
+      "16130138450758310172", "1614465773938842903", "16292685861617888592", "16335643316870329598",
+      "16423314183614230717", "16570804352575357627", "1682585410644922036", "16858955978146406642",
+      "16990567851129491937", "17017923349298346219", "17097380490166623672",
+      "17109238199226571972", "17204844226884380288", "17291806236368054941",
+      "17351543633914244545", "17439059603042731363", "17574002783607647274",
+      "17624147599670377042", "17633734304611248415", "17683972236092287897",
+      "17849680105131524334", "17939405613729073960", "17956969551821596225",
+      "17978774977754553159", "17984632978012874803", "17997967489723066537",
+      "18147627057830191163", "18150909006539876521", "18159703063075866524",
+      "18246404330670877335", "18294908219222222902", "18392881921099771407",
+      "18446744073709551613", "191060519014405309", "2032008861530788751", "2128122064571842954",
+      "2147483647", "2147745794", "2380224015317016190", "2478231962306073784",
+      "2532538262737333146", "2589926981877829912", "2597124982561782591", "2600364143812063535",
+      "2717025511528702475", "2734787258623754862", "27407921587843457", "2760663353550280147",
+      "2797129108883749491", "2810460305047003196", "292198192373389586", "2934149816356927366",
+      "3045986759481489935", "3178468437029279937", "3200333496547938354", "3320026265773918739",
+      "3320767229281015341", "3341747963119755850", "3407972863931386250", "3413052607651207697",
+      "3413886037471417852", "3421197789791424393", "3421213182954201407", "3425260965299690882",
+      "3538022140597504361", "3575761800716667678", "3588624367609827560", "3626142665768487764",
+      "3642525650883269872", "3656637464651387014", "3660705254426876796", "3769837838875367802",
+      "3778500091710709090", "3796405623695665524", "3869935012404164040", "3890769468012566366",
+      "3890794756780010537", "397780960855462669", "4030236413975199654", "4088976323439621041",
+      "4454255944391929578", "4501656691368064027", "4578480846255629462", "4821863173800309721",
+      "4931721628717906635", "506634811745884560", "5132256620104998637", "5183687599225757871",
+      "521157249538507889", "5219431737322569038", "541172992193764396", "5415426428750045503",
+      "5449730069165757263", "5587557070429522647", "5614586596107908838", "576626207276463000",
+      "5942282052525294911", "5945487981219695001", "5984963105389676759", "607197993339007484",
+      "6088115528707848728", "6116246686670134098", "6180361713414290679", "6195833633417633900",
+      "6274014997237900919", "640589622539783622", "6461429591783621719", "6491986958834001955",
+      "6508141243778577344", "6605813339339102567", "682250828679635420", "6827032273910657891",
+      "6943102301517884811", "700598796416086955", "7080175711202577138", "7175363135479931834",
+      "7315838824213522000", "7412338704062093516", "7516148236133302073", "7574774749059321801",
+      "7701683279824397773", "7775177810774851294", "7810436520414958497", "7878537243757499832",
+      "79089792725215063", "7982848972385914508", "8052533790968282297", "8129411991672431889",
+      "8146185202538899243", "835151375515278827", "8381292265993977266", "8408095252303317471",
+      "8473756179280619170", "8478833628889826985", "8612208440357175863", "8697424601205169055",
+      "8698326794961817906", "8709004393777297355", "8727477769544302060", "8760312338504300643",
+      "8799118153397725683", "8873858923435176895", "8994091295115840290", "9007106680104765185",
+      "9061219083560670602", "9149947745824492274", "917638920165491138", "9234894663364701749",
+      "9333057603143916814", "9384605490088500348", "9531326785919727076", "9555688264681862794",
+      "9559632696372799208", "9903758755917170407"
+    ]
+}
+
+/*
+ * Holds if the literal is one that matches a literal found in Solorigate code.
+ *
+ * NOTE: Some of the values have been commented out as they are commonly found elsewhere.
+ */
+
+predicate isSolorigateHash(Literal l) { l.getValue() = solorigateSuspiciousHashes() }
+
+/*
+ * Returns a list of Literals used by Solorigate
+ *
+ * This data was extracted from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
+ * and https://github.com/fireeye/sunburst_countermeasures/blob/main/fnv1a_xor_hashes.txt
+ */
+
+string solorigateSuspiciousLiterals() {
+  result =
+    [
+      "(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n",
+      "[{0,5}] {1}\n", "[E] {0} {1} {2}",
+      "\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion",
+      "\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",",
+      "\\OrionImprovement\\SolarWinds.OrionImprovement.exe",
+      "0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[",
+      "\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",",
+      "{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0",
+      "184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0",
+      "224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382",
+      "41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e",
+      "65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040",
+      "99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com",
+      "api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp",
+      "-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer",
+      "DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet",
+      "DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser",
+      "fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD",
+      "HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA",
+      "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography",
+      "HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match",
+      "Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans",
+      "Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone",
+      "ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege",
+      "SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/",
+      "SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events",
+      "swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1",
+      "us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2",
+      "fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c",
+      "pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj",
+      "Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true",
+      "Select * From Win32_OperatingSystem", "Select * From Win32_Process",
+      "Select * From Win32_SystemDriver", "Select * From Win32_UserAccount"
+    ]
+}
+
+/*
+ * Holds if the literal is one that matches a literal found in Solorigate code.
+ *
+ * NOTE: Some of the values have been commented out as they are commonly found elsewhere.
+ */
+
+predicate isSolorigateLiteral(Literal l) { l.getValue() = solorigateSuspiciousLiterals() }
+
+/*
+ * Returns a list of method names used by Solorigate
+ *
+ * This data was extracted from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
+ */
+
+string solorigateSuspiciousMethodNames() {
+  result =
+    [
+      "Abort", "AddFileExecutionEngine", "AddRegistryExecutionEngine", "AdjustTokenPrivileges",
+      "Base64Decode", "Base64Encode", "ByteArrayToHexString", "CheckServerConnection", "Close",
+      "CloseHandle", "CollectSystemDescription", "Compress", "CreateSecureString", "CreateString",
+      "CreateUploadRequest", "CreateUploadRequestImpl", "Decompress", "DecryptShort", "Deflate",
+      "DelayMin", "DelayMs", "DeleteFile", "DeleteRegistryValue", "DeleteValue", "ExecuteEngine",
+      "FileExists", "GetAddresses", "GetAddressFamily", "GetArgumentIndex", "GetBaseUri",
+      "GetBaseUriImpl", "GetCache", "GetCurrentProcess", "GetCurrentString", "GetDescriptionId",
+      "GetFileHash", "GetFileSystemEntries", "GetHash", "GetHive", "GetIntArray", "GetIPHostEntry",
+      "GetManagementObjectProperty", "GetNetworkAdapterConfiguration", "GetNewOwnerName",
+      "GetNextString", "GetNextStringEx", "GetOrCreateUserID", "GetOrionImprovementCustomerId",
+      "GetOSVersion", "GetPreviousString", "GetProcessByDescription",
+      "GetRegistrySubKeyAndValueNames", "GetStatus", "GetStringHash", "GetSubKeyAndValueNames",
+      "GetUserAgent", "GetValue", "GetWebProxy", "HexStringToByteArray", "Inflate", "Initialize",
+      "InitiateSystemShutdownExW", "IsNullOrInvalidName", "IsSynchronized", "KillTask",
+      "LookupPrivilegeValueW", "OpenProcessToken", "ParseServiceResponse", "Quote", "ReadConfig",
+      "ReadDeviceInfo", "ReadRegistryValue", "ReadReportStatus", "ReadServiceStatus",
+      "RebootComputer", "RunTask", "SearchAssemblies", "SearchConfigurations", "SearchServices",
+      "SetAutomaticMode", "SetKeyOwner", "SetKeyOwnerWithPrivileges", "SetKeyPermissions",
+      "SetManualMode", "SetProcessPrivilege", "SetRegistryValue", "SetTime", "SetValue",
+      "SplitString", "ToString", "TrackEvent", "TrackProcesses", "Unquote", "Unzip", "Update",
+      "UpdateBuffer", "UpdateNotification", "UploadSystemDescription", "Valid", "WriteConfig",
+      "WriteFile", "WriteReportStatus", "WriteServiceStatus", "Zip"
+    ]
+}
+
+/*
+ * Holds if the method is one that matches a method found in Solorigate code.
+ *
+ * NOTE: Pretty much all of these method names are common.
+ */
+
+predicate isSolorigateSuspiciousMethodName(Method m) {
+  m.fromSource() and
+  m.getName() = solorigateSuspiciousMethodNames()
+}
+
+/*
+ * Returns a list of enum values used by Solorigate to represent commands
+ *
+ * This data was extracted from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
+ */
+
+string solorigateSuspiciousCommandsInEnum() {
+  result =
+    [
+      "Idle", "Exit", "SetTime", "CollectSystemDescription", "UploadSystemDescription", "RunTask",
+      "GetProcessByDescription", "KillTask", "GetFileSystemEntries", "WriteFile", "FileExists",
+      "DeleteFile", "GetFileHash", "ReadRegistryValue", "SetRegistryValue", "DeleteRegistryValue",
+      "GetRegistrySubKeyAndValueNames", "Reboot", "None"
+    ]
+}
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qhelp b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qhelp
new file mode 100644
index 00000000000..7c52a5e2e5e
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qhelp	
@@ -0,0 +1,12 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>In Solorigate, the malicious code was wrapped in generic exception catch blocks that lacked any statements. This made it harder to find any suspicious runtime exceptions.</p>
+    <p>This query detects all generic exception empty catch blocks, but it is strongly suggested that the results for cs/catch-of-all-exceptions also be reviewed in the event that a malicious swallow everything exception handler was not empty</p>
+  </overview>
+
+  <include src="Solorigate.qhelp.inc" />
+
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.ql b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.ql
new file mode 100644
index 00000000000..f481956883c
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.ql	
@@ -0,0 +1,30 @@
+/**
+ * @name Looks for use of a Swallow Everything empty catch block
+ * @description Possible indication of Solorigate. The maliciously inserted source was wrapped in a Swallow Everything catch to hide any runtime exceptions
+ * @kind problem
+ * @tags security
+ *       solorigate
+ * @precision high
+ * @id cs/solorigate/swallow-everything-exception
+ * @problem.severity error
+ */
+
+import csharp
+import Solorigate
+import semmle.code.csharp.frameworks.System
+
+class GenericCatchClause extends CatchClause {
+  GenericCatchClause() {
+    this instanceof GeneralCatchClause
+    or
+    this =
+      any(SpecificCatchClause scc |
+        scc.getCaughtExceptionType() instanceof SystemExceptionClass and
+        not scc.hasFilterClause()
+      )
+  }
+}
+
+from GenericCatchClause gcc
+where gcc.getBlock().getNumberOfStmts() = 0
+select gcc, "Empty Swallow Everything Exception."
diff --git a/csharp/ql/src/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll b/csharp/ql/src/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
new file mode 100644
index 00000000000..03585e32a77
--- /dev/null
+++ b/csharp/ql/src/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
@@ -0,0 +1,83 @@
+/*
+ * Predicates that help detect potential non-cryptographic hash functions
+ *
+ * By themselves, non-cryptographic functions are common and not dangerous
+ * These predicates are intended for helping detect non-cryptographic hashes that may be used
+ * in a context that is not appropriate, or for detecting modified hash functions
+ */
+
+import csharp
+private import DataFlow
+private import semmle.code.csharp.dataflow.TaintTracking2
+
+predicate maybeANonCryptogrphicHash(Callable callable, Variable v, Expr xor, Expr mul, LoopStmt loop) {
+  callable = loop.getEnclosingCallable() and
+  (
+    maybeUsedInFNVFunction(v, xor, mul, loop) or
+    maybeUsedInElfHashFunction(v, xor, mul, loop)
+  )
+}
+
+/**
+ * Holds if the arguments are used in a way that resembles a FNV hash function
+ * where there is a loop statement `loop` where the variable `v` is used in an xor `xor` expression
+ * followed by a multiplication `mul` expression.
+ */
+predicate maybeUsedInFNVFunction(Variable v, Operation xor, Operation mul, LoopStmt loop) {
+  exists(Expr e1, Expr e2 |
+    e1.getAChild*() = v.getAnAccess() and
+    e2.getAChild*() = v.getAnAccess() and
+    e1 = xor.getAnOperand() and
+    e2 = mul.getAnOperand() and
+    xor.getAControlFlowNode().getASuccessor*() = mul.getAControlFlowNode() and
+    (xor instanceof AssignXorExpr or xor instanceof BitwiseXorExpr) and
+    (mul instanceof AssignMulExpr or mul instanceof MulExpr)
+  ) and
+  loop.getAChild*() = mul.getEnclosingStmt() and
+  loop.getAChild*() = xor.getEnclosingStmt()
+}
+
+/**
+ * Holds if the arguments are used in a way that resembles an Elf-Hash hash function
+ * where there is a loop statement `loop` where the variable `v` is used in an xor `xor` expression
+ * followed by an addition `add` expression.
+ */
+private predicate maybeUsedInElfHashFunction(Variable v, Operation xor, Operation add, LoopStmt loop) {
+  exists(
+    Expr e1, Expr e2, AssignExpr addAssign, AssignExpr xorAssign, Operation notOp,
+    AssignExpr notAssign
+  |
+    (add instanceof AddExpr or add instanceof AssignAddExpr) and
+    e1.getAChild*() = add.getAnOperand() and
+    e1 instanceof BinaryBitwiseOperation and
+    e2 = e1.(BinaryBitwiseOperation).getLeftOperand() and
+    v = addAssign.getTargetVariable() and
+    addAssign.getAChild*() = add and
+    (xor instanceof BitwiseXorExpr or xor instanceof AssignXorExpr) and
+    addAssign.getAControlFlowNode().getASuccessor*() = xor.getAControlFlowNode() and
+    xorAssign.getAChild*() = xor and
+    v = xorAssign.getTargetVariable() and
+    (notOp instanceof UnaryBitwiseOperation or notOp instanceof AssignBitwiseOperation) and
+    xor.getAControlFlowNode().getASuccessor*() = notOp.getAControlFlowNode() and
+    notAssign.getAChild*() = notOp and
+    v = notAssign.getTargetVariable() and
+    loop.getAChild*() = add.getEnclosingStmt() and
+    loop.getAChild*() = xor.getEnclosingStmt()
+  )
+}
+
+/**
+ * Holds if the Callable is a function that behaves like a non-cryptographic hash
+ * where the parameter `param` is likely the message to hash
+ */
+predicate isCallableAPotentialNonCryptographicHashFunction(Callable callable, Parameter param) {
+  exists(Variable v, Expr op1, Expr op2, LoopStmt loop |
+    maybeANonCryptogrphicHash(callable, v, op1, op2, loop) and
+    callable.getAParameter() = param and
+    exists(ParameterNode p, ExprNode n |
+      p.getParameter() = param and
+      localFlow(p, n) and
+      n.getExpr() in [op1.(Operation).getAChild*(), op2.(Operation).getAChild*()]
+    )
+  )
+}
diff --git a/csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Foreach.qll b/csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Foreach.qll
index 9dee8221235..a526ec5bdcd 100644
--- a/csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Foreach.qll
+++ b/csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Foreach.qll
@@ -171,11 +171,7 @@ private class TranslatedForeachMoveNext extends TranslatedCompilerGeneratedCall,
 
   override Callable getInstructionFunction(InstructionTag tag) {
     tag = CallTargetTag() and
-    exists(Callable internal |
-      internal.getName() = "MoveNext" and
-      internal.getReturnType() instanceof BoolType and
-      result = internal
-    )
+    result = generatedBy.getMoveNext()
   }
 
   override Type getCallResultType() { result instanceof BoolType }
@@ -205,28 +201,9 @@ private class TranslatedForeachGetEnumerator extends TranslatedCompilerGenerated
     result = getInstructionFunction(CallTargetTag()).getReturnType()
   }
 
-  private Callable getEnumeratorCallable() {
-    if exists(generatedBy.getIterableExpr().getType().(ValueOrRefType).getAMember("GetEnumerator"))
-    then
-      result = generatedBy.getIterableExpr().getType().(ValueOrRefType).getAMember("GetEnumerator")
-    else
-      exists(Interface inter |
-        inter =
-          generatedBy
-              .getIterableExpr()
-              .getType()
-              .(ValueOrRefType)
-              // There could be some abstract base types until we reach `IEnumerable` (eg. `Array`)
-              .getABaseType*()
-              .getABaseInterface() and
-        inter.getName() = "IEnumerable" and
-        result = inter.getAMember("GetEnumerator")
-      )
-  }
-
   override Callable getInstructionFunction(InstructionTag tag) {
     tag = CallTargetTag() and
-    result = getEnumeratorCallable()
+    result = generatedBy.getGetEnumerator()
   }
 
   override TranslatedExpr getArgument(int id) { none() }
@@ -247,7 +224,7 @@ private class TranslatedForeachCurrent extends TranslatedCompilerGeneratedCall,
 
   TranslatedForeachCurrent() { this = TTranslatedCompilerGeneratedElement(generatedBy, 5) }
 
-  override Type getCallResultType() { result = generatedBy.getAVariable().getType() }
+  override Type getCallResultType() { result = generatedBy.getElementType() }
 
   override TranslatedExpr getArgument(int id) { none() }
 
@@ -262,10 +239,7 @@ private class TranslatedForeachCurrent extends TranslatedCompilerGeneratedCall,
 
   override Callable getInstructionFunction(InstructionTag tag) {
     tag = CallTargetTag() and
-    exists(Property prop |
-      prop.getName() = "Current" and
-      result = prop.getGetter()
-    )
+    result = generatedBy.getCurrent().getGetter()
   }
 }
 
@@ -280,10 +254,7 @@ private class TranslatedForeachDispose extends TranslatedCompilerGeneratedCall,
 
   override Callable getInstructionFunction(InstructionTag tag) {
     tag = CallTargetTag() and
-    exists(Callable dispose |
-      dispose.getName() = "Dispose" and
-      result = dispose
-    )
+    result = generatedBy.getDispose()
   }
 
   final override Type getCallResultType() { result instanceof VoidType }
diff --git a/csharp/ql/src/semmle/code/csharp/Callable.qll b/csharp/ql/src/semmle/code/csharp/Callable.qll
index 7238f4576f9..6dc7cfced9b 100644
--- a/csharp/ql/src/semmle/code/csharp/Callable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Callable.qll
@@ -461,6 +461,15 @@ class Operator extends Callable, Member, Attributable, @operator {
   override Parameter getRawParameter(int i) { result = getParameter(i) }
 }
 
+/** A clone method on a record. */
+class RecordCloneMethod extends Method, DotNet::RecordCloneCallable {
+  override Constructor getConstructor() {
+    result = DotNet::RecordCloneCallable.super.getConstructor()
+  }
+
+  override string toString() { result = Method.super.toString() }
+}
+
 /**
  * A user-defined unary operator - an operator taking one operand.
  *
diff --git a/csharp/ql/src/semmle/code/csharp/PrintAst.qll b/csharp/ql/src/semmle/code/csharp/PrintAst.qll
index 024dfc2a05e..1cac4a5f238 100644
--- a/csharp/ql/src/semmle/code/csharp/PrintAst.qll
+++ b/csharp/ql/src/semmle/code/csharp/PrintAst.qll
@@ -134,7 +134,8 @@ private newtype TPrintAstNode =
   TParametersNode(Parameterizable parameterizable) {
     shouldPrint(parameterizable, _) and
     parameterizable.getNumberOfParameters() > 0 and
-    not isNotNeeded(parameterizable)
+    not isNotNeeded(parameterizable) and
+    exists(Parameter p | p.getDeclaringElement() = parameterizable and shouldPrint(p, _))
   } or
   TAttributesNode(Attributable attributable) {
     shouldPrint(attributable, _) and
diff --git a/csharp/ql/src/semmle/code/csharp/Stmt.qll b/csharp/ql/src/semmle/code/csharp/Stmt.qll
index 8fadbc1267b..375e698d1cb 100644
--- a/csharp/ql/src/semmle/code/csharp/Stmt.qll
+++ b/csharp/ql/src/semmle/code/csharp/Stmt.qll
@@ -33,6 +33,9 @@ class Stmt extends ControlFlowElement, @stmt {
 
   override Location getALocation() { stmt_location(this, result) }
 
+  /** Holds if this statement is a global statement. */
+  predicate isGlobal() { this.getParent().(BlockStmt).isGlobalStatementContainer() }
+
   /**
    * Gets the singleton statement contained in this statement, by removing
    * enclosing block statements.
@@ -70,6 +73,11 @@ class BlockStmt extends Stmt, @block_stmt {
   /** Holds if this block is an empty block with no statements. */
   predicate isEmpty() { not exists(this.getAStmt()) }
 
+  /** Holds if this block is the container of the global statements. */
+  predicate isGlobalStatementContainer() {
+    this.getEnclosingCallable().hasQualifiedName("<Program>$.<Main>$")
+  }
+
   override Stmt stripSingletonBlocks() {
     if getNumberOfStmts() = 1
     then result = getAChildStmt().stripSingletonBlocks()
@@ -582,6 +590,27 @@ class ForeachStmt extends LoopStmt, @foreach_stmt {
    */
   Expr getIterableExpr() { result = this.getChild(1) }
 
+  /** Gets the called `GetEnumerator` method. */
+  Method getGetEnumerator() { foreach_stmt_desugar(this, result, 1) }
+
+  /** Gets the called `MoveNext` or `MoveNextAsync` method. */
+  Method getMoveNext() { foreach_stmt_desugar(this, result, 3) }
+
+  /** Gets the called `Dispose` or `DisposeAsync` method, if any. */
+  Method getDispose() { foreach_stmt_desugar(this, result, 4) }
+
+  /** Gets the called `Current` property. */
+  Property getCurrent() { foreach_stmt_desugar(this, result, 2) }
+
+  /**
+   * Gets the intermediate type to which the `Current` property is converted before
+   * being converted to the iteration variable type.
+   */
+  Type getElementType() { foreach_stmt_desugar(this, result, 5) }
+
+  /** Holds if this `foreach` statement is asynchronous. */
+  predicate isAsync() { foreach_stmt_info(this, 2) }
+
   override string toString() { result = "foreach (... ... in ...) ..." }
 
   override string getAPrimaryQlClass() { result = "ForeachStmt" }
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index c9e89da9943..13b7f8275df 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -748,6 +748,9 @@ class Class extends RefType, @class_type {
 class Record extends Class {
   Record() { this.isRecord() }
 
+  /** Gets the clone method of this record. */
+  RecordCloneMethod getCloneMethod() { result = this.getAMember() }
+
   override string getAPrimaryQlClass() { result = "Record" }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/commons/Util.qll b/csharp/ql/src/semmle/code/csharp/commons/Util.qll
index 203d84cbef6..d1b9b3b7894 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Util.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Util.qll
@@ -5,7 +5,11 @@ import csharp
 /** A `Main` method. */
 class MainMethod extends Method {
   MainMethod() {
-    this.hasName("Main") and
+    (
+      this.hasName("Main")
+      or
+      this.hasQualifiedName("<Program>$", "<Main>$")
+    ) and
     this.isStatic() and
     (this.getReturnType() instanceof VoidType or this.getReturnType() instanceof IntType) and
     if this.getNumberOfParameters() = 1
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
index 40f352e73d3..547d269a24c 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
@@ -2416,3 +2416,22 @@ class StringValuesFlow extends LibraryTypeDataFlow, Struct {
     preservesValue = false
   }
 }
+
+private class RecordConstructorFlow extends SummarizedCallable {
+  RecordConstructorFlow() { this = any(Record r).getAMember().(Constructor) }
+
+  override predicate propagatesFlow(
+    SummaryInput input, ContentList inputContents, SummaryOutput output, ContentList outputContents,
+    boolean preservesValue
+  ) {
+    exists(int i, Property p, string name |
+      this.getParameter(i).getName() = name and
+      this.getDeclaringType().getAMember(name) = p and
+      input = SummaryInput::parameter(i) and
+      inputContents = ContentList::empty() and
+      output = SummaryOutput::return() and
+      outputContents = ContentList::property(p) and
+      preservesValue = true
+    )
+  }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll b/csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll
index 2964353ce69..2a58cba6209 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll
@@ -268,9 +268,7 @@ predicate exprModulus(Expr e, Bound b, int val, int mod) {
 private predicate condExprBranchModulus(
   ConditionalExpr cond, boolean branch, Bound b, int val, int mod
 ) {
-  exprModulus(cond.getTrueExpr(), b, val, mod) and branch = true
-  or
-  exprModulus(cond.getFalseExpr(), b, val, mod) and branch = false
+  exprModulus(cond.getBranchExpr(branch), b, val, mod)
 }
 
 private predicate addModulus(Expr add, boolean isLeft, Bound b, int val, int mod) {
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll
index b8eaa2310d8..a83e91a9c46 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll
@@ -61,7 +61,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e1` and `e2` are expressions for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */
@@ -74,7 +74,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e` and `def` are elements for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 64452768185..9e1498afc77 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -209,6 +209,17 @@ module LocalFlow {
         e1 = e2.(SwitchExpr).getACase().getBody() and
         scope = e2 and
         isSuccessor = true
+        or
+        exists(WithExpr we |
+          scope = we and
+          isSuccessor = true
+        |
+          e1 = we.getExpr() and
+          e2 = we.getInitializer()
+          or
+          e1 = we.getInitializer() and
+          e2 = we
+        )
       )
     }
 
@@ -451,10 +462,23 @@ private predicate fieldOrPropertyStore(Expr e, Content c, Expr src, Expr q, bool
       postUpdate = true
     )
     or
+    // `with` expression initializer, `x with { f = src }`
+    e =
+      any(WithExpr we |
+        exists(MemberInitializer mi |
+          q = we and
+          mi = we.getInitializer().getAMemberInitializer() and
+          f = mi.getInitializedMember() and
+          src = mi.getRValue() and
+          postUpdate = false
+        )
+      )
+    or
     // Object initializer, `new C() { f = src }`
     exists(MemberInitializer mi |
       e = q and
       mi = q.(ObjectInitializer).getAMemberInitializer() and
+      q.getParent() instanceof ObjectCreation and
       f = mi.getInitializedMember() and
       src = mi.getRValue() and
       postUpdate = false
@@ -792,6 +816,13 @@ private module Cached {
       input = SummaryInput::parameter(i) and
       n.(ArgumentNode).argumentOf(call, i)
     )
+    or
+    exists(WithExpr we, ObjectInitializer oi, FieldOrProperty f |
+      oi = we.getInitializer() and
+      n.asExpr() = oi and
+      f = oi.getAMemberInitializer().getInitializedMember() and
+      c = f.getContent()
+    )
   }
 
   /**
@@ -885,6 +916,8 @@ private module Cached {
     n instanceof SummaryNodeImpl
     or
     n instanceof ParamsArgumentNode
+    or
+    n.asExpr() = any(WithExpr we).getInitializer()
   }
 }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll
index b8eaa2310d8..a83e91a9c46 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll
@@ -61,7 +61,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e1` and `e2` are expressions for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */
@@ -74,7 +74,7 @@ abstract class ControlFlowReachabilityConfiguration extends string {
   /**
    * Holds if `e` and `def` are elements for which we want to find a
    * control-flow path that follows control flow successors (resp.
-   * predecessors, as specified by `isSuccesor`) inside the syntactic scope
+   * predecessors, as specified by `isSuccessor`) inside the syntactic scope
    * `scope`. The Boolean `exactScope` indicates whether a transitive child
    * of `scope` is allowed (`exactScope = false`).
    */
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
index 4d765f769ad..70ff26c1c58 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
@@ -415,5 +415,15 @@ module ExprNode {
 
     /** Gets the "else" expression of this conditional expression. */
     ExprNode getFalseExpr() { hasChild(e, e.getElse(), this, result) }
+
+    /**
+     * If `branch` is `true` gets the "then" expression, if `false` gets the
+     * "else" expression of this conditional expression.
+     */
+    ExprNode getBranchExpr(boolean branch) {
+      branch = true and result = getTrueExpr()
+      or
+      branch = false and result = getFalseExpr()
+    }
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index 5a954b7a925..9db7f70461e 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -1152,3 +1152,21 @@ class DefineSymbolExpr extends Expr, @define_symbol_expr {
 
   override string getAPrimaryQlClass() { result = "DefineSymbolExpr" }
 }
+
+/**
+ * A `with` expression called on a record.
+ */
+class WithExpr extends Expr, @with_expr {
+  /** Gets the object initializer of this `with` expression. */
+  ObjectInitializer getInitializer() { result = this.getChild(1) }
+
+  /** Gets the expression on which this `with` is called. */
+  Expr getExpr() { result = this.getChild(0) }
+
+  /** Gets the clone method of the `record` that is targetted by this `with` expression. */
+  RecordCloneMethod getCloneMethod() { result = this.getExpr().getType().(Record).getCloneMethod() }
+
+  override string toString() { result = "... with { ... }" }
+
+  override string getAPrimaryQlClass() { result = "WithExpr" }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll b/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
index 3ebd7028504..a00f7d21a05 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/microsoft/AspNetCore.qll
@@ -195,7 +195,13 @@ class MicrosoftAspNetCoreMvcController extends Class {
   /** Gets a `Redirect*` method. */
   Method getARedirectMethod() {
     result = this.getAMethod() and
-    result.getName().matches("Redirect%")
+    (
+      result.getName().matches("Redirect%")
+      or
+      result.getName().matches("Accepted%")
+      or
+      result.getName().matches("Created%")
+    )
   }
 }
 
diff --git a/csharp/ql/src/semmle/code/dotnet/Callable.qll b/csharp/ql/src/semmle/code/dotnet/Callable.qll
index 7cdb248d669..4af6c02a853 100644
--- a/csharp/ql/src/semmle/code/dotnet/Callable.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Callable.qll
@@ -91,3 +91,34 @@ abstract class Constructor extends Callable { }
 
 /** A destructor/finalizer. */
 abstract class Destructor extends Callable { }
+
+pragma[nomagic]
+private ValueOrRefType getARecordBaseType(ValueOrRefType t) {
+  exists(Callable c |
+    c.hasName("<Clone>$") and
+    c.getNumberOfParameters() = 0 and
+    t = c.getDeclaringType() and
+    result = t
+  )
+  or
+  result = getARecordBaseType(t).getABaseType()
+}
+
+/** A clone method on a record. */
+class RecordCloneCallable extends Callable {
+  RecordCloneCallable() {
+    this.getDeclaringType() instanceof ValueOrRefType and
+    this.hasName("<Clone>$") and
+    this.getNumberOfParameters() = 0 and
+    this.getReturnType() = getARecordBaseType(this.getDeclaringType()) and
+    this.(Member).isPublic() and
+    not this.(Member).isStatic()
+  }
+
+  /** Gets the constructor that this clone method calls. */
+  Constructor getConstructor() {
+    result.getDeclaringType() = this.getDeclaringType() and
+    result.getNumberOfParameters() = 1 and
+    result.getParameter(0).getType() = this.getDeclaringType()
+  }
+}
diff --git a/csharp/ql/src/semmle/code/dotnet/Type.qll b/csharp/ql/src/semmle/code/dotnet/Type.qll
index cfb6748cf7b..5dc9c409c18 100644
--- a/csharp/ql/src/semmle/code/dotnet/Type.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Type.qll
@@ -51,16 +51,7 @@ class ValueOrRefType extends Type, @dotnet_valueorreftype {
   ValueOrRefType getABaseType() { none() }
 
   /** Holds if this type is a `record`. */
-  predicate isRecord() {
-    exists(Callable c |
-      c.getDeclaringType() = this and
-      c.hasName("<Clone>$") and
-      c.getNumberOfParameters() = 0 and
-      c.getReturnType() = this.getABaseType*() and
-      c.(Member).isPublic() and
-      not c.(Member).isStatic()
-    )
-  }
+  predicate isRecord() { exists(RecordCloneCallable c | c.getDeclaringType() = this) }
 }
 
 /**
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 68db341c2ed..9258e9b38d8 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -982,6 +982,18 @@ catch_type(
   int type_id: @type_or_ref ref,
   int kind: int ref /* explicit = 1, implicit = 2 */);
 
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
 /** EXPRESSIONS **/
 
 expressions(
@@ -1144,6 +1156,7 @@ case @expr.kind of
 | 127 = @and_pattern_expr
 | 128 = @or_pattern_expr
 | 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
 /* Preprocessor */
 | 999 = @define_symbol_expr
 ;
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index c294897e009..f1fbd130ff8 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -1,7 +1,7 @@
 <dbstats>
   <typesizes><e>
 <k>@compilation</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>@diagnostic</k>
@@ -9,7 +9,7 @@
 </e>
 <e>
 <k>@extractor_message</k>
-<v>750</v>
+<v>7638</v>
 </e>
 <e>
 <k>@externalDefect</k>
@@ -21,11 +21,11 @@
 </e>
 <e>
 <k>@externalDataElement</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>@duplication</k>
-<v>11701</v>
+<v>22747</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,67 +33,67 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>11326677</v>
+<v>14080135</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>2160</v>
+<v>4200</v>
 </e>
 <e>
 <k>@file</k>
-<v>24351</v>
+<v>47336</v>
 </e>
 <e>
 <k>@folder</k>
-<v>9177</v>
+<v>17839</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>11293</v>
+<v>21952</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>8355</v>
+<v>19769</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>66100</v>
+<v>144323</v>
 </e>
 <e>
 <k>@using_static_directive</k>
-<v>199</v>
+<v>390</v>
 </e>
 <e>
 <k>@directive_if</k>
-<v>2550</v>
+<v>5164</v>
 </e>
 <e>
 <k>@directive_elif</k>
-<v>7</v>
+<v>59</v>
 </e>
 <e>
 <k>@directive_else</k>
-<v>1140</v>
+<v>2316</v>
 </e>
 <e>
 <k>@directive_endif</k>
-<v>2550</v>
+<v>5164</v>
 </e>
 <e>
 <k>@directive_region</k>
-<v>565</v>
+<v>1954</v>
 </e>
 <e>
 <k>@directive_endregion</k>
-<v>565</v>
+<v>1954</v>
 </e>
 <e>
 <k>@directive_line</k>
-<v>128896</v>
+<v>250558</v>
 </e>
 <e>
 <k>@directive_nullable</k>
-<v>83477</v>
+<v>162270</v>
 </e>
 <e>
 <k>@directive_warning</k>
@@ -101,7 +101,7 @@
 </e>
 <e>
 <k>@directive_error</k>
-<v>1</v>
+<v>28</v>
 </e>
 <e>
 <k>@directive_undefine</k>
@@ -109,119 +109,119 @@
 </e>
 <e>
 <k>@directive_define</k>
-<v>5</v>
+<v>22</v>
 </e>
 <e>
 <k>@pragma_checksum</k>
-<v>2494</v>
+<v>4848</v>
 </e>
 <e>
 <k>@pragma_warning</k>
-<v>14725</v>
+<v>28623</v>
 </e>
 <e>
 <k>@bool_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@char_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@decimal_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@sbyte_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@short_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@int_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@long_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@byte_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@ushort_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@uint_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@ulong_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@float_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@double_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@enum_type</k>
-<v>6141</v>
+<v>11958</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>24822</v>
+<v>49689</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>154426</v>
+<v>305248</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>88664</v>
+<v>178200</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>52237</v>
+<v>107619</v>
 </e>
 <e>
 <k>@null_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@type_parameter</k>
-<v>102321</v>
+<v>202696</v>
 </e>
 <e>
 <k>@pointer_type</k>
-<v>112</v>
+<v>219</v>
 </e>
 <e>
 <k>@nullable_type</k>
-<v>550</v>
+<v>979</v>
 </e>
 <e>
 <k>@array_type</k>
-<v>4384</v>
+<v>9127</v>
 </e>
 <e>
 <k>@void_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@int_ptr_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@tuple_type</k>
-<v>857</v>
+<v>1783</v>
 </e>
 <e>
 <k>@uint_ptr_type</k>
@@ -229,7 +229,7 @@
 </e>
 <e>
 <k>@dynamic_type</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@arglist_type</k>
@@ -241,495 +241,495 @@
 </e>
 <e>
 <k>@function_pointer_type</k>
-<v>9</v>
+<v>11</v>
 </e>
 <e>
 <k>@typeref</k>
-<v>120781</v>
+<v>234906</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>368399</v>
+<v>745834</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>622003</v>
+<v>1252818</v>
 </e>
 <e>
 <k>@oblivious</k>
-<v>664</v>
+<v>1315</v>
 </e>
 <e>
 <k>@not_annotated</k>
-<v>300</v>
+<v>618</v>
 </e>
 <e>
 <k>@annotated</k>
-<v>75</v>
+<v>113</v>
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>273733</v>
+<v>594420</v>
 </e>
 <e>
 <k>@modifier</k>
-<v>42</v>
+<v>82</v>
 </e>
 <e>
 <k>@property</k>
-<v>212542</v>
+<v>425801</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>7590</v>
+<v>17050</v>
 </e>
 <e>
 <k>@getter</k>
-<v>220012</v>
+<v>442617</v>
 </e>
 <e>
 <k>@setter</k>
-<v>64470</v>
+<v>127589</v>
 </e>
 <e>
 <k>@event</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>@operator</k>
-<v>6201</v>
+<v>12416</v>
 </e>
 <e>
 <k>@method</k>
-<v>549172</v>
+<v>1118417</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>138720</v>
+<v>278115</v>
 </e>
 <e>
 <k>@destructor</k>
-<v>225</v>
+<v>443</v>
 </e>
 <e>
 <k>@local_function</k>
-<v>488</v>
+<v>1801</v>
 </e>
 <e>
 <k>@addressable_field</k>
-<v>188270</v>
+<v>371603</v>
 </e>
 <e>
 <k>@constant</k>
-<v>95194</v>
+<v>185304</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>72587</v>
+<v>162457</v>
 </e>
 <e>
 <k>@local_constant</k>
-<v>373</v>
+<v>799</v>
 </e>
 <e>
 <k>@local_variable_ref</k>
-<v>67</v>
-</e>
-<e>
-<k>@parameter</k>
-<v>1189134</v>
-</e>
-<e>
-<k>@block_stmt</k>
-<v>159797</v>
-</e>
-<e>
-<k>@expr_stmt</k>
-<v>178398</v>
-</e>
-<e>
-<k>@return_stmt</k>
-<v>40051</v>
-</e>
-<e>
-<k>@using_block_stmt</k>
-<v>517</v>
-</e>
-<e>
-<k>@var_decl_stmt</k>
-<v>67553</v>
-</e>
-<e>
-<k>@if_stmt</k>
-<v>50740</v>
-</e>
-<e>
-<k>@switch_stmt</k>
-<v>1447</v>
-</e>
-<e>
-<k>@while_stmt</k>
-<v>1984</v>
-</e>
-<e>
-<k>@do_stmt</k>
-<v>386</v>
-</e>
-<e>
-<k>@for_stmt</k>
-<v>3124</v>
-</e>
-<e>
-<k>@foreach_stmt</k>
-<v>1910</v>
-</e>
-<e>
-<k>@break_stmt</k>
-<v>5413</v>
-</e>
-<e>
-<k>@continue_stmt</k>
-<v>1168</v>
-</e>
-<e>
-<k>@goto_stmt</k>
-<v>1045</v>
-</e>
-<e>
-<k>@goto_case_stmt</k>
-<v>154</v>
-</e>
-<e>
-<k>@goto_default_stmt</k>
-<v>61</v>
-</e>
-<e>
-<k>@throw_stmt</k>
-<v>50988</v>
-</e>
-<e>
-<k>@yield_stmt</k>
-<v>194</v>
-</e>
-<e>
-<k>@try_stmt</k>
-<v>2011</v>
-</e>
-<e>
-<k>@checked_stmt</k>
-<v>146</v>
-</e>
-<e>
-<k>@unchecked_stmt</k>
-<v>36</v>
-</e>
-<e>
-<k>@lock_stmt</k>
-<v>496</v>
-</e>
-<e>
-<k>@const_decl_stmt</k>
-<v>373</v>
-</e>
-<e>
-<k>@empty_stmt</k>
-<v>115</v>
-</e>
-<e>
-<k>@unsafe_stmt</k>
-<v>53</v>
-</e>
-<e>
-<k>@fixed_stmt</k>
-<v>496</v>
-</e>
-<e>
-<k>@label_stmt</k>
-<v>423</v>
-</e>
-<e>
-<k>@catch</k>
-<v>1719</v>
-</e>
-<e>
-<k>@case_stmt</k>
-<v>10966</v>
-</e>
-<e>
-<k>@local_function_stmt</k>
-<v>488</v>
-</e>
-<e>
-<k>@using_decl_stmt</k>
-<v>189</v>
-</e>
-<e>
-<k>@bool_literal_expr</k>
-<v>40242</v>
-</e>
-<e>
-<k>@int_literal_expr</k>
-<v>408062</v>
-</e>
-<e>
-<k>@long_literal_expr</k>
-<v>153</v>
-</e>
-<e>
-<k>@double_literal_expr</k>
-<v>337</v>
-</e>
-<e>
-<k>@string_literal_expr</k>
-<v>207177</v>
-</e>
-<e>
-<k>@null_literal_expr</k>
-<v>64946</v>
-</e>
-<e>
-<k>@local_variable_access_expr</k>
-<v>233847</v>
-</e>
-<e>
-<k>@parameter_access_expr</k>
-<v>146824</v>
-</e>
-<e>
-<k>@field_access_expr</k>
-<v>226547</v>
-</e>
-<e>
-<k>@property_access_expr</k>
-<v>168128</v>
-</e>
-<e>
-<k>@type_access_expr</k>
-<v>170095</v>
-</e>
-<e>
-<k>@typeof_expr</k>
-<v>23893</v>
-</e>
-<e>
-<k>@method_invocation_expr</k>
-<v>259436</v>
-</e>
-<e>
-<k>@cast_expr</k>
-<v>107752</v>
-</e>
-<e>
-<k>@object_creation_expr</k>
-<v>28063</v>
-</e>
-<e>
-<k>@array_creation_expr</k>
-<v>90105</v>
-</e>
-<e>
-<k>@array_init_expr</k>
-<v>89964</v>
-</e>
-<e>
-<k>@local_var_decl_expr</k>
-<v>72969</v>
-</e>
-<e>
-<k>@char_literal_expr</k>
-<v>8057</v>
-</e>
-<e>
-<k>@decimal_literal_expr</k>
-<v>49</v>
-</e>
-<e>
-<k>@uint_literal_expr</k>
-<v>811</v>
-</e>
-<e>
-<k>@ulong_literal_expr</k>
-<v>189</v>
-</e>
-<e>
-<k>@float_literal_expr</k>
-<v>123</v>
-</e>
-<e>
-<k>@this_access_expr</k>
-<v>293267</v>
-</e>
-<e>
-<k>@base_access_expr</k>
-<v>1617</v>
-</e>
-<e>
-<k>@method_access_expr</k>
-<v>3188</v>
-</e>
-<e>
-<k>@event_access_expr</k>
-<v>162</v>
-</e>
-<e>
-<k>@indexer_access_expr</k>
-<v>14740</v>
-</e>
-<e>
-<k>@array_access_expr</k>
-<v>10091</v>
-</e>
-<e>
-<k>@delegate_invocation_expr</k>
-<v>783</v>
-</e>
-<e>
-<k>@operator_invocation_expr</k>
-<v>12666</v>
-</e>
-<e>
-<k>@explicit_delegate_creation_expr</k>
-<v>482</v>
-</e>
-<e>
-<k>@implicit_delegate_creation_expr</k>
-<v>2546</v>
-</e>
-<e>
-<k>@default_expr</k>
-<v>3354</v>
-</e>
-<e>
-<k>@plus_expr</k>
-<v>12</v>
-</e>
-<e>
-<k>@minus_expr</k>
-<v>2658</v>
-</e>
-<e>
-<k>@bit_not_expr</k>
 <v>264</v>
 </e>
 <e>
+<k>@parameter</k>
+<v>2418845</v>
+</e>
+<e>
+<k>@block_stmt</k>
+<v>306609</v>
+</e>
+<e>
+<k>@expr_stmt</k>
+<v>367388</v>
+</e>
+<e>
+<k>@return_stmt</k>
+<v>94410</v>
+</e>
+<e>
+<k>@using_block_stmt</k>
+<v>1141</v>
+</e>
+<e>
+<k>@var_decl_stmt</k>
+<v>147603</v>
+</e>
+<e>
+<k>@if_stmt</k>
+<v>117761</v>
+</e>
+<e>
+<k>@switch_stmt</k>
+<v>3066</v>
+</e>
+<e>
+<k>@while_stmt</k>
+<v>4449</v>
+</e>
+<e>
+<k>@do_stmt</k>
+<v>982</v>
+</e>
+<e>
+<k>@for_stmt</k>
+<v>6797</v>
+</e>
+<e>
+<k>@foreach_stmt</k>
+<v>5355</v>
+</e>
+<e>
+<k>@break_stmt</k>
+<v>11009</v>
+</e>
+<e>
+<k>@continue_stmt</k>
+<v>2219</v>
+</e>
+<e>
+<k>@goto_stmt</k>
+<v>2735</v>
+</e>
+<e>
+<k>@goto_case_stmt</k>
+<v>329</v>
+</e>
+<e>
+<k>@goto_default_stmt</k>
+<v>145</v>
+</e>
+<e>
+<k>@throw_stmt</k>
+<v>75169</v>
+</e>
+<e>
+<k>@yield_stmt</k>
+<v>680</v>
+</e>
+<e>
+<k>@try_stmt</k>
+<v>4296</v>
+</e>
+<e>
+<k>@checked_stmt</k>
+<v>253</v>
+</e>
+<e>
+<k>@unchecked_stmt</k>
+<v>104</v>
+</e>
+<e>
+<k>@lock_stmt</k>
+<v>1524</v>
+</e>
+<e>
+<k>@const_decl_stmt</k>
+<v>799</v>
+</e>
+<e>
+<k>@empty_stmt</k>
+<v>351</v>
+</e>
+<e>
+<k>@unsafe_stmt</k>
+<v>182</v>
+</e>
+<e>
+<k>@fixed_stmt</k>
+<v>1149</v>
+</e>
+<e>
+<k>@label_stmt</k>
+<v>1018</v>
+</e>
+<e>
+<k>@catch</k>
+<v>3421</v>
+</e>
+<e>
+<k>@case_stmt</k>
+<v>22729</v>
+</e>
+<e>
+<k>@local_function_stmt</k>
+<v>1792</v>
+</e>
+<e>
+<k>@using_decl_stmt</k>
+<v>551</v>
+</e>
+<e>
+<k>@bool_literal_expr</k>
+<v>69362</v>
+</e>
+<e>
+<k>@int_literal_expr</k>
+<v>753770</v>
+</e>
+<e>
+<k>@long_literal_expr</k>
+<v>331</v>
+</e>
+<e>
+<k>@double_literal_expr</k>
+<v>865</v>
+</e>
+<e>
+<k>@string_literal_expr</k>
+<v>411844</v>
+</e>
+<e>
+<k>@null_literal_expr</k>
+<v>107866</v>
+</e>
+<e>
+<k>@local_variable_access_expr</k>
+<v>522604</v>
+</e>
+<e>
+<k>@parameter_access_expr</k>
+<v>353858</v>
+</e>
+<e>
+<k>@field_access_expr</k>
+<v>459853</v>
+</e>
+<e>
+<k>@property_access_expr</k>
+<v>359280</v>
+</e>
+<e>
+<k>@type_access_expr</k>
+<v>346662</v>
+</e>
+<e>
+<k>@typeof_expr</k>
+<v>33673</v>
+</e>
+<e>
+<k>@method_invocation_expr</k>
+<v>547088</v>
+</e>
+<e>
+<k>@cast_expr</k>
+<v>264368</v>
+</e>
+<e>
+<k>@object_creation_expr</k>
+<v>62542</v>
+</e>
+<e>
+<k>@array_creation_expr</k>
+<v>180049</v>
+</e>
+<e>
+<k>@array_init_expr</k>
+<v>179598</v>
+</e>
+<e>
+<k>@local_var_decl_expr</k>
+<v>163325</v>
+</e>
+<e>
+<k>@char_literal_expr</k>
+<v>16191</v>
+</e>
+<e>
+<k>@decimal_literal_expr</k>
+<v>93</v>
+</e>
+<e>
+<k>@uint_literal_expr</k>
+<v>2408</v>
+</e>
+<e>
+<k>@ulong_literal_expr</k>
+<v>390</v>
+</e>
+<e>
+<k>@float_literal_expr</k>
+<v>455</v>
+</e>
+<e>
+<k>@this_access_expr</k>
+<v>592106</v>
+</e>
+<e>
+<k>@base_access_expr</k>
+<v>2841</v>
+</e>
+<e>
+<k>@method_access_expr</k>
+<v>9222</v>
+</e>
+<e>
+<k>@event_access_expr</k>
+<v>433</v>
+</e>
+<e>
+<k>@indexer_access_expr</k>
+<v>30772</v>
+</e>
+<e>
+<k>@array_access_expr</k>
+<v>19366</v>
+</e>
+<e>
+<k>@delegate_invocation_expr</k>
+<v>2002</v>
+</e>
+<e>
+<k>@operator_invocation_expr</k>
+<v>29946</v>
+</e>
+<e>
+<k>@explicit_delegate_creation_expr</k>
+<v>680</v>
+</e>
+<e>
+<k>@implicit_delegate_creation_expr</k>
+<v>5111</v>
+</e>
+<e>
+<k>@default_expr</k>
+<v>6147</v>
+</e>
+<e>
+<k>@plus_expr</k>
+<v>45</v>
+</e>
+<e>
+<k>@minus_expr</k>
+<v>7072</v>
+</e>
+<e>
+<k>@bit_not_expr</k>
+<v>738</v>
+</e>
+<e>
 <k>@log_not_expr</k>
-<v>12491</v>
+<v>26396</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>5382</v>
+<v>12318</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
-<v>698</v>
+<v>1698</v>
 </e>
 <e>
 <k>@pre_incr_expr</k>
-<v>671</v>
+<v>1261</v>
 </e>
 <e>
 <k>@pre_decr_expr</k>
-<v>125</v>
+<v>406</v>
 </e>
 <e>
 <k>@mul_expr</k>
-<v>1387</v>
+<v>4628</v>
 </e>
 <e>
 <k>@div_expr</k>
-<v>612</v>
+<v>1792</v>
 </e>
 <e>
 <k>@rem_expr</k>
-<v>276</v>
+<v>704</v>
 </e>
 <e>
 <k>@add_expr</k>
-<v>12723</v>
+<v>27765</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>4948</v>
+<v>12579</v>
 </e>
 <e>
 <k>@lshift_expr</k>
-<v>914</v>
+<v>4123</v>
 </e>
 <e>
 <k>@rshift_expr</k>
-<v>707</v>
+<v>1764</v>
 </e>
 <e>
 <k>@lt_expr</k>
-<v>6804</v>
+<v>15930</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>3980</v>
+<v>9383</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>1422</v>
+<v>3831</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>2380</v>
+<v>6017</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>23261</v>
+<v>53541</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>16042</v>
+<v>37237</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>2303</v>
+<v>6301</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
-<v>217</v>
+<v>528</v>
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>6954</v>
+<v>15235</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>9148</v>
+<v>21273</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>6420</v>
+<v>14204</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>3108</v>
+<v>6489</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>1363</v>
+<v>2730</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>1422</v>
+<v>3617</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>3413</v>
+<v>8977</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>79093</v>
+<v>167284</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -737,67 +737,67 @@
 </e>
 <e>
 <k>@assign_sub_expr</k>
-<v>434</v>
+<v>1021</v>
 </e>
 <e>
 <k>@assign_mul_expr</k>
-<v>81</v>
+<v>182</v>
 </e>
 <e>
 <k>@assign_div_expr</k>
-<v>44</v>
+<v>99</v>
 </e>
 <e>
 <k>@assign_rem_expr</k>
-<v>3</v>
+<v>14</v>
 </e>
 <e>
 <k>@assign_and_expr</k>
-<v>103</v>
+<v>340</v>
 </e>
 <e>
 <k>@assign_xor_expr</k>
-<v>49</v>
+<v>114</v>
 </e>
 <e>
 <k>@assign_or_expr</k>
-<v>562</v>
+<v>1413</v>
 </e>
 <e>
 <k>@assign_lshift_expr</k>
-<v>31</v>
+<v>118</v>
 </e>
 <e>
 <k>@assign_rshift_expr</k>
-<v>64</v>
+<v>216</v>
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>3456</v>
+<v>7689</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
-<v>265</v>
+<v>594</v>
 </e>
 <e>
 <k>@checked_expr</k>
-<v>140</v>
+<v>326</v>
 </e>
 <e>
 <k>@unchecked_expr</k>
-<v>609</v>
+<v>1422</v>
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>3163</v>
+<v>5799</v>
 </e>
 <e>
 <k>@add_event_expr</k>
-<v>63</v>
+<v>172</v>
 </e>
 <e>
 <k>@remove_event_expr</k>
-<v>53</v>
+<v>121</v>
 </e>
 <e>
 <k>@par_expr</k>
@@ -805,11 +805,11 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>23125</v>
+<v>48793</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
-<v>41</v>
+<v>86</v>
 </e>
 <e>
 <k>@namespace_expr</k>
@@ -817,35 +817,35 @@
 </e>
 <e>
 <k>@dynamic_element_access_expr</k>
-<v>117</v>
+<v>331</v>
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>2975</v>
+<v>6846</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>1878</v>
+<v>4143</v>
 </e>
 <e>
 <k>@address_of_expr</k>
-<v>475</v>
+<v>1290</v>
 </e>
 <e>
 <k>@sizeof_expr</k>
-<v>255</v>
+<v>1061</v>
 </e>
 <e>
 <k>@await_expr</k>
-<v>25782</v>
+<v>54777</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>5774</v>
+<v>15592</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
-<v>894</v>
+<v>3044</v>
 </e>
 <e>
 <k>@unknown_expr</k>
@@ -853,71 +853,71 @@
 </e>
 <e>
 <k>@throw_expr</k>
-<v>643</v>
+<v>1527</v>
 </e>
 <e>
 <k>@tuple_expr</k>
-<v>440</v>
+<v>1450</v>
 </e>
 <e>
 <k>@local_function_invocation_expr</k>
-<v>1187</v>
+<v>7490</v>
 </e>
 <e>
 <k>@ref_expr</k>
-<v>124</v>
+<v>459</v>
 </e>
 <e>
 <k>@discard_expr</k>
-<v>317</v>
+<v>903</v>
 </e>
 <e>
 <k>@range_expr</k>
-<v>15</v>
+<v>33</v>
 </e>
 <e>
 <k>@index_expr</k>
-<v>21</v>
+<v>47</v>
 </e>
 <e>
 <k>@switch_expr</k>
-<v>199</v>
+<v>508</v>
 </e>
 <e>
 <k>@recursive_pattern_expr</k>
-<v>199</v>
+<v>1011</v>
 </e>
 <e>
 <k>@property_pattern_expr</k>
-<v>154</v>
+<v>836</v>
 </e>
 <e>
 <k>@positional_pattern_expr</k>
-<v>45</v>
+<v>172</v>
 </e>
 <e>
 <k>@switch_case_expr</k>
-<v>2068</v>
+<v>4336</v>
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
-<v>183</v>
+<v>544</v>
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>5940</v>
+<v>13856</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
-<v>11</v>
+<v>20</v>
 </e>
 <e>
 <k>@lt_pattern_expr</k>
-<v>1</v>
+<v>2</v>
 </e>
 <e>
 <k>@gt_pattern_expr</k>
-<v>2</v>
+<v>5</v>
 </e>
 <e>
 <k>@le_pattern_expr</k>
@@ -929,27 +929,31 @@
 </e>
 <e>
 <k>@not_pattern_expr</k>
-<v>19</v>
+<v>70</v>
 </e>
 <e>
 <k>@and_pattern_expr</k>
-<v>2</v>
+<v>3</v>
 </e>
 <e>
 <k>@or_pattern_expr</k>
-<v>21</v>
+<v>34</v>
 </e>
 <e>
 <k>@function_pointer_invocation_expr</k>
+<v>6</v>
+</e>
+<e>
+<k>@with_expr</k>
 <v>4</v>
 </e>
 <e>
 <k>@define_symbol_expr</k>
-<v>3314</v>
+<v>6229</v>
 </e>
 <e>
 <k>@xmldtd</k>
-<v>5</v>
+<v>6</v>
 </e>
 <e>
 <k>@xmlelement</k>
@@ -973,19 +977,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>86064</v>
+<v>189165</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>7533</v>
+<v>22578</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>638</v>
+<v>208054</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>42325</v>
+<v>147875</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -1025,7 +1029,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>712327</v>
+<v>837747</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -1033,147 +1037,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>2043128</v>
+<v>3971592</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>625320</v>
+<v>1215545</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>228137</v>
+<v>443470</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>107503</v>
+<v>208972</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>477604</v>
+<v>928405</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>253859</v>
+<v>493472</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>148392</v>
+<v>288456</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>98711</v>
+<v>191883</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>269813</v>
+<v>524483</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>133892</v>
+<v>260270</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>101925</v>
+<v>198130</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>71081</v>
+<v>138173</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>135953</v>
+<v>264276</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>38429</v>
+<v>74702</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>19107</v>
+<v>37141</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>352774</v>
+<v>685750</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>323414</v>
+<v>628677</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>247141</v>
+<v>480412</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>310296</v>
+<v>603177</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>64864</v>
+<v>126088</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>321534</v>
+<v>625023</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>254240</v>
+<v>494212</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>62207</v>
+<v>120923</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>32972</v>
+<v>64094</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>30262</v>
+<v>58826</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>19881</v>
+<v>38647</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>11957</v>
+<v>23244</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>10666</v>
+<v>20734</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>17209</v>
+<v>33453</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>217583</v>
+<v>422955</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>262565</v>
+<v>510396</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>2511</v>
+<v>4882</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>5274</v>
+<v>10252</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>5309</v>
+<v>10320</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>432865</v>
+<v>841437</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>131816</v>
+<v>256236</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1181,7 +1185,7 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>1409225</v>
+<v>2739361</v>
 </e>
 <e>
 <k>@cil_calli</k>
@@ -1189,283 +1193,283 @@
 </e>
 <e>
 <k>@cil_ret</k>
-<v>918306</v>
+<v>1785075</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>191079</v>
+<v>345552</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>239525</v>
+<v>465608</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>221401</v>
+<v>430376</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>42285</v>
+<v>82197</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>17953</v>
+<v>34900</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>8480</v>
+<v>16485</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>15010</v>
+<v>29179</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>31322</v>
+<v>60887</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>52771</v>
+<v>102581</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>1123</v>
+<v>2183</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>4489</v>
+<v>8727</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>3146</v>
+<v>6115</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
-<v>754</v>
+<v>1466</v>
 </e>
 <e>
 <k>@cil_br</k>
-<v>49429</v>
+<v>96085</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>16652</v>
+<v>32371</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>14050</v>
+<v>27313</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>11057</v>
+<v>21494</v>
 </e>
 <e>
 <k>@cil_bge</k>
-<v>714</v>
+<v>1388</v>
 </e>
 <e>
 <k>@cil_bgt</k>
-<v>752</v>
+<v>1461</v>
 </e>
 <e>
 <k>@cil_ble</k>
-<v>2386</v>
+<v>4639</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>4078</v>
+<v>7928</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>3720</v>
+<v>7231</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
-<v>140</v>
+<v>142</v>
 </e>
 <e>
 <k>@cil_bgt_un</k>
-<v>355</v>
+<v>691</v>
 </e>
 <e>
 <k>@cil_ble_un</k>
-<v>566</v>
+<v>1101</v>
 </e>
 <e>
 <k>@cil_blt_un</k>
-<v>92</v>
+<v>180</v>
 </e>
 <e>
 <k>@cil_switch</k>
-<v>12275</v>
+<v>23862</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
-<v>75</v>
+<v>88</v>
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>3165</v>
+<v>5506</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
-<v>263</v>
+<v>511</v>
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2123</v>
+<v>2497</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>5026</v>
+<v>9770</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
-<v>762</v>
+<v>1481</v>
 </e>
 <e>
 <k>@cil_ldind_i8</k>
-<v>1012</v>
+<v>1968</v>
 </e>
 <e>
 <k>@cil_ldind_i</k>
-<v>212</v>
+<v>249</v>
 </e>
 <e>
 <k>@cil_ldind_r4</k>
-<v>360</v>
+<v>701</v>
 </e>
 <e>
 <k>@cil_ldind_r8</k>
-<v>135</v>
+<v>263</v>
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>3421</v>
+<v>6651</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>8706</v>
+<v>16923</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>4381</v>
+<v>8517</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
-<v>1195</v>
+<v>1406</v>
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>5705</v>
+<v>10355</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>1205</v>
+<v>2343</v>
 </e>
 <e>
 <k>@cil_stind_r4</k>
-<v>105</v>
+<v>185</v>
 </e>
 <e>
 <k>@cil_stind_r8</k>
-<v>115</v>
+<v>224</v>
 </e>
 <e>
 <k>@cil_add</k>
-<v>115141</v>
+<v>223820</v>
 </e>
 <e>
 <k>@cil_sub</k>
-<v>43842</v>
+<v>85223</v>
 </e>
 <e>
 <k>@cil_mul</k>
-<v>15396</v>
+<v>29929</v>
 </e>
 <e>
 <k>@cil_div</k>
-<v>4690</v>
+<v>9117</v>
 </e>
 <e>
 <k>@cil_div_un</k>
-<v>194</v>
+<v>253</v>
 </e>
 <e>
 <k>@cil_rem</k>
-<v>1752</v>
+<v>3406</v>
 </e>
 <e>
 <k>@cil_rem_un</k>
-<v>117</v>
+<v>229</v>
 </e>
 <e>
 <k>@cil_and</k>
-<v>30503</v>
+<v>59294</v>
 </e>
 <e>
 <k>@cil_or</k>
-<v>11386</v>
+<v>22133</v>
 </e>
 <e>
 <k>@cil_xor</k>
-<v>11676</v>
+<v>22698</v>
 </e>
 <e>
 <k>@cil_shl</k>
-<v>9751</v>
+<v>18955</v>
 </e>
 <e>
 <k>@cil_shr</k>
-<v>4717</v>
+<v>9170</v>
 </e>
 <e>
 <k>@cil_shr_un</k>
-<v>13421</v>
+<v>26089</v>
 </e>
 <e>
 <k>@cil_neg</k>
-<v>1200</v>
+<v>2334</v>
 </e>
 <e>
 <k>@cil_not</k>
-<v>749</v>
+<v>1457</v>
 </e>
 <e>
 <k>@cil_conv_i1</k>
-<v>711</v>
+<v>1383</v>
 </e>
 <e>
 <k>@cil_conv_i2</k>
-<v>744</v>
+<v>1447</v>
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>30731</v>
+<v>59737</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>25852</v>
+<v>50255</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>1268</v>
+<v>2465</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>2714</v>
+<v>5277</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>4025</v>
+<v>7826</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>10047</v>
+<v>19530</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>1054079</v>
+<v>2049001</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1473,27 +1477,27 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>6505</v>
+<v>12645</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>476424</v>
+<v>926110</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>337788</v>
+<v>656619</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>49901</v>
+<v>97001</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>29019</v>
+<v>56409</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
-<v>135</v>
+<v>263</v>
 </e>
 <e>
 <k>@cil_unbox</k>
@@ -1501,59 +1505,59 @@
 </e>
 <e>
 <k>@cil_throw</k>
-<v>271796</v>
+<v>380964</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>861960</v>
+<v>1675545</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>154586</v>
+<v>300497</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>551659</v>
+<v>1072358</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>209405</v>
+<v>407059</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
-<v>1301</v>
+<v>2529</v>
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>67303</v>
+<v>130829</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>3609</v>
+<v>7017</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i2_un</k>
-<v>7</v>
+<v>14</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i4_un</k>
-<v>87</v>
+<v>170</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i8_un</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u1_un</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u2_un</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u4_un</k>
@@ -1565,7 +1569,7 @@
 </e>
 <e>
 <k>@cil_conv_ovf_i_un</k>
-<v>67</v>
+<v>131</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u_un</k>
@@ -1573,139 +1577,139 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>41044</v>
+<v>79785</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>57634</v>
+<v>112034</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>28445</v>
+<v>55293</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>5073</v>
+<v>9862</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
-<v>90</v>
+<v>175</v>
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>8006</v>
+<v>15564</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
-<v>220</v>
+<v>428</v>
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>3131</v>
+<v>6086</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>9039</v>
+<v>17571</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>9826</v>
+<v>19102</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>6129</v>
+<v>11914</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
-<v>7</v>
+<v>14</v>
 </e>
 <e>
 <k>@cil_ldelem_r4</k>
-<v>145</v>
+<v>282</v>
 </e>
 <e>
 <k>@cil_ldelem_r8</k>
-<v>235</v>
+<v>458</v>
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>15783</v>
+<v>30680</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
-<v>11</v>
+<v>14</v>
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>4519</v>
+<v>8785</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>4620</v>
+<v>8980</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>11734</v>
+<v>22810</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>4845</v>
+<v>9419</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
-<v>102</v>
+<v>199</v>
 </e>
 <e>
 <k>@cil_stelem_r8</k>
-<v>245</v>
+<v>477</v>
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>186586</v>
+<v>362700</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
-<v>1170</v>
+<v>2275</v>
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>27565</v>
+<v>53583</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>7397</v>
+<v>14380</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
-<v>12</v>
+<v>24</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u1</k>
-<v>57</v>
+<v>112</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i2</k>
-<v>40</v>
+<v>77</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u2</k>
-<v>27</v>
+<v>53</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i4</k>
-<v>147</v>
+<v>287</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u4</k>
-<v>40</v>
+<v>77</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i8</k>
-<v>7</v>
+<v>14</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u8</k>
-<v>23</v>
+<v>29</v>
 </e>
 <e>
 <k>@cil_refanyval</k>
@@ -1721,23 +1725,23 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>36662</v>
+<v>71267</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>2231</v>
+<v>4336</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>5788</v>
+<v>11251</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
-<v>3181</v>
+<v>3742</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i</k>
-<v>137</v>
+<v>268</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u</k>
@@ -1745,47 +1749,47 @@
 </e>
 <e>
 <k>@cil_add_ovf</k>
-<v>889</v>
+<v>1729</v>
 </e>
 <e>
 <k>@cil_add_ovf_un</k>
-<v>77</v>
+<v>151</v>
 </e>
 <e>
 <k>@cil_mul_ovf</k>
-<v>228</v>
+<v>443</v>
 </e>
 <e>
 <k>@cil_mul_ovf_un</k>
-<v>195</v>
+<v>253</v>
 </e>
 <e>
 <k>@cil_sub_ovf</k>
-<v>571</v>
+<v>1111</v>
 </e>
 <e>
 <k>@cil_sub_ovf_un</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>29252</v>
+<v>56862</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>34373</v>
+<v>66818</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>76776</v>
+<v>149244</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
-<v>108</v>
+<v>128</v>
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5046</v>
+<v>5935</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1793,31 +1797,31 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>84249</v>
+<v>99083</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>10049</v>
+<v>11819</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>31892</v>
+<v>37508</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>16960</v>
+<v>19947</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
-<v>1141</v>
+<v>1342</v>
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>41092</v>
+<v>79877</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
-<v>571</v>
+<v>1111</v>
 </e>
 <e>
 <k>@cil_ldarg</k>
@@ -1845,11 +1849,11 @@
 </e>
 <e>
 <k>@cil_localloc</k>
-<v>849</v>
+<v>999</v>
 </e>
 <e>
 <k>@cil_endfilter</k>
-<v>416</v>
+<v>808</v>
 </e>
 <e>
 <k>@cil_unaligned</k>
@@ -1857,7 +1861,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>4389</v>
+<v>8532</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1865,27 +1869,27 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>52322</v>
+<v>101708</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>13012</v>
+<v>25295</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>@cil_initblk</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>1937</v>
+<v>3766</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
-<v>889</v>
+<v>1729</v>
 </e>
 <e>
 <k>@cil_refanytype</k>
@@ -1893,23 +1897,23 @@
 </e>
 <e>
 <k>@cil_readonly</k>
-<v>17</v>
+<v>34</v>
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>306365</v>
+<v>595536</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>95089</v>
+<v>184841</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>7292</v>
+<v>14175</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
-<v>308</v>
+<v>599</v>
 </e>
 <e>
 <k>@cil_function_pointer_type</k>
@@ -1917,64 +1921,64 @@
 </e>
 <e>
 <k>@cil_method</k>
-<v>1189816</v>
+<v>2312858</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>888189</v>
+<v>1726531</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>518960</v>
+<v>1008794</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>2339980</v>
+<v>4548636</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>195525</v>
+<v>380077</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>10726</v>
+<v>20851</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>592197</v>
+<v>1151159</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>22546</v>
+<v>43827</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
-<v>416</v>
+<v>808</v>
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>28495</v>
+<v>55391</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
-<v>757</v>
+<v>1471</v>
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>168950</v>
+<v>328419</v>
 </e>
 </typesizes>
   <stats><relation>
 <name>compilations</name>
-<cardinality>564</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>cwd</k>
-<v>403</v>
+<v>784</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1988,7 +1992,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -2004,12 +2008,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>243</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160</v>
+<v>311</v>
 </b>
 </bs>
 </hist>
@@ -2019,19 +2023,19 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>2524</cardinality>
+<cardinality>4595</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>12</v>
+<v>24</v>
 </e>
 <e>
 <k>arg</k>
-<v>576</v>
+<v>1120</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2045,12 +2049,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>295</v>
+<v>886</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>268</v>
+<v>209</v>
 </b>
 </bs>
 </hist>
@@ -2066,12 +2070,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>295</v>
+<v>886</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>268</v>
+<v>209</v>
 </b>
 </bs>
 </hist>
@@ -2085,14 +2089,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>107</a>
-<b>108</b>
-<v>2</v>
+<a>43</a>
+<b>44</b>
+<v>4</v>
 </b>
 <b>
 <a>225</a>
 <b>226</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -2108,17 +2112,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
-<a>107</a>
-<b>108</b>
-<v>2</v>
+<a>43</a>
+<b>44</b>
+<v>4</v>
 </b>
 <b>
-<a>119</a>
-<b>120</b>
-<v>2</v>
+<a>183</a>
+<b>184</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2134,12 +2138,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 <b>
-<a>107</a>
+<a>43</a>
 <b>226</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -2155,12 +2159,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>571</v>
+<v>1111</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -2170,19 +2174,19 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>12395</cardinality>
+<cardinality>22596</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>548</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>1435</v>
+<v>711</v>
 </e>
 <e>
 <k>file</k>
-<v>10384</v>
+<v>22591</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2194,49 +2198,74 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>1</a>
+<b>3</b>
+<v>48</v>
+</b>
+<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>58</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>155</v>
+<v>82</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>151</v>
+<v>87</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>36</v>
+<v>68</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>43</v>
+<b>9</b>
+<v>97</v>
 </b>
 <b>
-<a>10</a>
+<a>9</a>
+<b>12</b>
+<v>87</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>82</v>
+</b>
+<b>
+<a>15</a>
 <b>17</b>
-<v>41</v>
+<v>82</v>
 </b>
 <b>
 <a>17</a>
-<b>31</b>
-<v>41</v>
+<b>21</b>
+<v>82</v>
 </b>
 <b>
-<a>31</a>
-<b>59</b>
-<v>41</v>
+<a>21</a>
+<b>27</b>
+<v>87</v>
 </b>
 <b>
-<a>59</a>
-<b>1359</b>
-<v>36</v>
+<a>28</a>
+<b>37</b>
+<v>82</v>
+</b>
+<b>
+<a>37</a>
+<b>65</b>
+<v>82</v>
+</b>
+<b>
+<a>67</a>
+<b>147</b>
+<v>63</v>
 </b>
 </bs>
 </hist>
@@ -2250,49 +2279,74 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>1</a>
+<b>3</b>
+<v>48</v>
+</b>
+<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>58</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>155</v>
+<v>82</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>151</v>
+<v>87</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>36</v>
+<v>68</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>43</v>
+<b>9</b>
+<v>97</v>
 </b>
 <b>
-<a>10</a>
+<a>9</a>
+<b>12</b>
+<v>87</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>82</v>
+</b>
+<b>
+<a>15</a>
 <b>17</b>
-<v>41</v>
+<v>82</v>
 </b>
 <b>
 <a>17</a>
-<b>31</b>
-<v>41</v>
+<b>21</b>
+<v>82</v>
 </b>
 <b>
-<a>31</a>
-<b>59</b>
-<v>41</v>
+<a>21</a>
+<b>27</b>
+<v>87</v>
 </b>
 <b>
-<a>59</a>
-<b>1359</b>
-<v>36</v>
+<a>28</a>
+<b>37</b>
+<v>82</v>
+</b>
+<b>
+<a>37</a>
+<b>65</b>
+<v>82</v>
+</b>
+<b>
+<a>67</a>
+<b>147</b>
+<v>63</v>
 </b>
 </bs>
 </hist>
@@ -2307,28 +2361,73 @@
 <bs>
 <b>
 <a>1</a>
-<b>2</b>
-<v>739</v>
-</b>
-<b>
-<a>2</a>
 <b>3</b>
-<v>411</v>
+<v>43</v>
 </b>
 <b>
 <a>3</a>
-<b>17</b>
-<v>118</v>
+<b>4</b>
+<v>29</v>
 </b>
 <b>
-<a>17</a>
-<b>38</b>
-<v>108</v>
+<a>4</a>
+<b>5</b>
+<v>58</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>9</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>97</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>53</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>77</v>
+</b>
+<b>
+<a>12</a>
+<b>18</b>
+<v>63</v>
+</b>
+<b>
+<a>18</a>
+<b>24</b>
+<v>53</v>
+</b>
+<b>
+<a>25</a>
+<b>33</b>
+<v>53</v>
 </b>
 <b>
 <a>38</a>
-<b>520</b>
-<v>57</v>
+<b>52</b>
+<v>53</v>
+</b>
+<b>
+<a>56</a>
+<b>103</b>
+<v>53</v>
+</b>
+<b>
+<a>108</a>
+<b>216</b>
+<v>53</v>
+</b>
+<b>
+<a>217</a>
+<b>226</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -2343,29 +2442,74 @@
 <bs>
 <b>
 <a>1</a>
-<b>2</b>
-<v>739</v>
-</b>
-<b>
-<a>2</a>
 <b>3</b>
-<v>411</v>
+<v>43</v>
 </b>
 <b>
 <a>3</a>
-<b>16</b>
-<v>116</v>
+<b>4</b>
+<v>29</v>
 </b>
 <b>
-<a>16</a>
-<b>36</b>
-<v>109</v>
-</b>
-<b>
-<a>36</a>
-<b>476</b>
+<a>4</a>
+<b>5</b>
 <v>58</v>
 </b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>9</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>97</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>53</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>77</v>
+</b>
+<b>
+<a>12</a>
+<b>18</b>
+<v>63</v>
+</b>
+<b>
+<a>18</a>
+<b>24</b>
+<v>53</v>
+</b>
+<b>
+<a>25</a>
+<b>33</b>
+<v>53</v>
+</b>
+<b>
+<a>38</a>
+<b>52</b>
+<v>53</v>
+</b>
+<b>
+<a>56</a>
+<b>103</b>
+<v>53</v>
+</b>
+<b>
+<a>108</a>
+<b>216</b>
+<v>53</v>
+</b>
+<b>
+<a>217</a>
+<b>226</b>
+<v>9</v>
+</b>
 </bs>
 </hist>
 </val>
@@ -2380,17 +2524,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9343</v>
+<v>22586</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>822</v>
-</b>
-<b>
-<a>3</a>
-<b>187</b>
-<v>218</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2406,12 +2545,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9831</v>
+<v>22586</v>
 </b>
 <b>
 <a>2</a>
-<b>78</b>
-<v>552</v>
+<b>3</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2421,19 +2560,19 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>184906</cardinality>
+<cardinality>359436</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>1411</v>
+<v>2743</v>
 </e>
 <e>
 <k>file</k>
-<v>1757</v>
+<v>3415</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2447,67 +2586,67 @@
 <b>
 <a>5</a>
 <b>284</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>284</a>
 <b>288</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>288</a>
 <b>292</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>293</a>
 <b>309</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>309</a>
 <b>311</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>311</a>
 <b>328</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>328</a>
 <b>344</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>344</a>
 <b>346</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>346</a>
 <b>349</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>349</a>
 <b>353</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>353</a>
 <b>359</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>359</a>
 <b>369</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>369</a>
 <b>564</b>
-<v>20</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -2523,67 +2662,67 @@
 <b>
 <a>5</a>
 <b>284</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>284</a>
 <b>288</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>288</a>
 <b>292</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>293</a>
 <b>309</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>309</a>
 <b>311</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>311</a>
 <b>328</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>328</a>
 <b>344</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>344</a>
 <b>346</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>346</a>
 <b>349</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>349</a>
 <b>353</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>353</a>
 <b>359</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>359</a>
 <b>369</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>369</a>
 <b>564</b>
-<v>20</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -2599,42 +2738,42 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>358</v>
+<v>696</v>
 </b>
 <b>
 <a>8</a>
 <b>118</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>118</a>
 <b>214</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>328</v>
+<v>638</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>365</v>
+<v>711</v>
 </b>
 <b>
 <a>225</a>
 <b>226</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -2650,62 +2789,67 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>338</v>
+<v>253</v>
 </b>
 <b>
 <a>6</a>
+<b>7</b>
+<v>458</v>
+</b>
+<b>
+<a>7</a>
 <b>20</b>
-<v>125</v>
+<v>170</v>
 </b>
 <b>
 <a>20</a>
-<b>27</b>
-<v>115</v>
+<b>24</b>
+<v>219</v>
 </b>
 <b>
-<a>27</a>
-<b>32</b>
-<v>122</v>
+<a>24</a>
+<b>31</b>
+<v>229</v>
 </b>
 <b>
-<a>32</a>
-<b>38</b>
-<v>112</v>
+<a>31</a>
+<b>36</b>
+<v>224</v>
 </b>
 <b>
-<a>38</a>
-<b>50</b>
-<v>107</v>
+<a>36</a>
+<b>47</b>
+<v>219</v>
 </b>
 <b>
-<a>50</a>
-<b>60</b>
-<v>112</v>
+<a>47</a>
+<b>59</b>
+<v>248</v>
 </b>
 <b>
-<a>60</a>
+<a>59</a>
 <b>62</b>
-<v>100</v>
+<v>238</v>
 </b>
 <b>
 <a>62</a>
-<b>65</b>
-<v>110</v>
+<b>66</b>
+<v>219</v>
 </b>
 <b>
-<a>65</a>
-<b>71</b>
-<v>47</v>
+<a>66</a>
+<b>69</b>
+<v>34</v>
 </b>
 </bs>
 </hist>
@@ -2721,57 +2865,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>270</v>
+<v>526</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>162</v>
+<v>316</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>142</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>23</a>
 <b>122</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>124</a>
 <b>214</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>220</a>
 <b>221</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>248</v>
+<v>482</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>368</v>
+<v>716</v>
 </b>
 </bs>
 </hist>
@@ -2787,67 +2931,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>290</v>
+<v>555</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>155</v>
+<v>263</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>95</v>
+<v>175</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>155</v>
+<v>321</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>135</v>
+<v>272</v>
 </b>
 <b>
 <a>11</a>
-<b>20</b>
-<v>137</v>
+<b>19</b>
+<v>306</v>
 </b>
 <b>
-<a>20</a>
-<b>25</b>
-<v>132</v>
+<a>19</a>
+<b>24</b>
+<v>302</v>
 </b>
 <b>
-<a>25</a>
-<b>29</b>
-<v>135</v>
+<a>24</a>
+<b>30</b>
+<v>282</v>
 </b>
 <b>
-<a>29</a>
-<b>48</b>
-<v>132</v>
+<a>30</a>
+<b>59</b>
+<v>248</v>
 </b>
 <b>
-<a>49</a>
+<a>59</a>
 <b>62</b>
-<v>120</v>
+<v>243</v>
 </b>
 <b>
 <a>62</a>
-<b>64</b>
-<v>105</v>
-</b>
-<b>
-<a>64</a>
 <b>68</b>
-<v>150</v>
+<v>306</v>
 </b>
 <b>
 <a>68</a>
-<b>72</b>
-<v>10</v>
+<b>73</b>
+<v>136</v>
 </b>
 </bs>
 </hist>
@@ -2857,23 +2996,23 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>3948</cardinality>
+<cardinality>7674</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>kind</k>
-<v>17</v>
+<v>34</v>
 </e>
 <e>
 <k>seconds</k>
-<v>2862</v>
+<v>5350</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2887,7 +3026,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -2903,7 +3042,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -2919,12 +3058,12 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>561</v>
+<v>1091</v>
 </b>
 </bs>
 </hist>
@@ -2940,7 +3079,7 @@
 <b>
 <a>225</a>
 <b>226</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2956,7 +3095,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2970,9 +3109,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1142</a>
-<b>1143</b>
-<v>2</v>
+<a>1098</a>
+<b>1099</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -2988,7 +3127,7 @@
 <b>
 <a>225</a>
 <b>226</b>
-<v>17</v>
+<v>34</v>
 </b>
 </bs>
 </hist>
@@ -3004,7 +3143,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17</v>
+<v>34</v>
 </b>
 </bs>
 </hist>
@@ -3018,24 +3157,29 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>158</a>
-<b>159</b>
-<v>2</v>
+<a>149</a>
+<b>150</b>
+<v>4</v>
 </b>
 <b>
-<a>161</a>
-<b>162</b>
-<v>2</v>
+<a>154</a>
+<b>155</b>
+<v>4</v>
 </b>
 <b>
-<a>174</a>
-<b>175</b>
-<v>5</v>
+<a>173</a>
+<b>174</b>
+<v>4</v>
+</b>
+<b>
+<a>176</a>
+<b>177</b>
+<v>4</v>
 </b>
 <b>
 <a>225</a>
 <b>226</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -3051,22 +3195,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2243</v>
+<v>4190</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>353</v>
+<v>501</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>248</v>
+<b>4</b>
+<v>326</v>
 </b>
 <b>
-<a>6</a>
-<b>9</b>
-<v>17</v>
+<a>4</a>
+<b>8</b>
+<v>331</v>
 </b>
 </bs>
 </hist>
@@ -3082,7 +3226,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2862</v>
+<v>5350</v>
 </b>
 </bs>
 </hist>
@@ -3098,17 +3242,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2436</v>
+<v>4468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>353</v>
+<v>667</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>72</v>
+<v>214</v>
 </b>
 </bs>
 </hist>
@@ -4351,11 +4495,11 @@
 </relation>
 <relation>
 <name>extractor_messages</name>
-<cardinality>750</cardinality>
+<cardinality>7638</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750</v>
+<v>7638</v>
 </e>
 <e>
 <k>severity</k>
@@ -4367,19 +4511,19 @@
 </e>
 <e>
 <k>text</k>
-<v>11</v>
+<v>12</v>
 </e>
 <e>
 <k>entity</k>
-<v>541</v>
+<v>5272</v>
 </e>
 <e>
 <k>location</k>
-<v>622</v>
+<v>6707</v>
 </e>
 <e>
 <k>stack_trace</k>
-<v>121</v>
+<v>187</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4393,7 +4537,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4409,7 +4553,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4425,7 +4569,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4441,7 +4585,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4457,7 +4601,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4473,7 +4617,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750</v>
+<v>7638</v>
 </b>
 </bs>
 </hist>
@@ -4492,13 +4636,13 @@
 <v>1</v>
 </b>
 <b>
-<a>24</a>
-<b>25</b>
+<a>49</a>
+<b>50</b>
 <v>1</v>
 </b>
 <b>
-<a>721</a>
-<b>722</b>
+<a>7584</a>
+<b>7585</b>
 <v>1</v>
 </b>
 </bs>
@@ -4531,7 +4675,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
 </b>
 <b>
 <a>9</a>
@@ -4555,13 +4704,13 @@
 <v>1</v>
 </b>
 <b>
-<a>5</a>
-<b>6</b>
+<a>6</a>
+<b>7</b>
 <v>1</v>
 </b>
 <b>
-<a>535</a>
-<b>536</b>
+<a>5267</a>
+<b>5268</b>
 <v>1</v>
 </b>
 </bs>
@@ -4581,13 +4730,13 @@
 <v>1</v>
 </b>
 <b>
-<a>12</a>
-<b>13</b>
+<a>37</a>
+<b>38</b>
 <v>1</v>
 </b>
 <b>
-<a>610</a>
-<b>611</b>
+<a>6670</a>
+<b>6671</b>
 <v>1</v>
 </b>
 </bs>
@@ -4607,8 +4756,8 @@
 <v>2</v>
 </b>
 <b>
-<a>120</a>
-<b>121</b>
+<a>186</a>
+<b>187</b>
 <v>1</v>
 </b>
 </bs>
@@ -4623,8 +4772,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>750</a>
-<b>751</b>
+<a>7638</a>
+<b>7639</b>
 <v>1</v>
 </b>
 </bs>
@@ -4655,8 +4804,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>11</a>
-<b>12</b>
+<a>12</a>
+<b>13</b>
 <v>1</v>
 </b>
 </bs>
@@ -4671,8 +4820,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>541</a>
-<b>542</b>
+<a>5272</a>
+<b>5273</b>
 <v>1</v>
 </b>
 </bs>
@@ -4687,8 +4836,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>622</a>
-<b>623</b>
+<a>6707</a>
+<b>6708</b>
 <v>1</v>
 </b>
 </bs>
@@ -4703,8 +4852,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>121</a>
-<b>122</b>
+<a>187</a>
+<b>188</b>
 <v>1</v>
 </b>
 </bs>
@@ -4724,23 +4873,13 @@
 <v>1</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>1</v>
-</b>
-<b>
 <a>5</a>
 <b>6</b>
 <v>1</v>
 </b>
 <b>
-<a>16</a>
-<b>17</b>
-<v>1</v>
-</b>
-<b>
-<a>19</a>
-<b>20</b>
+<a>11</a>
+<b>12</b>
 <v>1</v>
 </b>
 <b>
@@ -4749,23 +4888,38 @@
 <v>2</v>
 </b>
 <b>
-<a>30</a>
-<b>31</b>
+<a>25</a>
+<b>26</b>
 <v>1</v>
 </b>
 <b>
-<a>49</a>
-<b>50</b>
+<a>38</a>
+<b>39</b>
 <v>1</v>
 </b>
 <b>
-<a>244</a>
-<b>245</b>
+<a>104</a>
+<b>105</b>
 <v>1</v>
 </b>
 <b>
-<a>334</a>
-<b>335</b>
+<a>216</a>
+<b>217</b>
+<v>1</v>
+</b>
+<b>
+<a>324</a>
+<b>325</b>
+<v>1</v>
+</b>
+<b>
+<a>2414</a>
+<b>2415</b>
+<v>1</v>
+</b>
+<b>
+<a>4451</a>
+<b>4452</b>
 <v>1</v>
 </b>
 </bs>
@@ -4782,7 +4936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11</v>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -4798,7 +4952,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11</v>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -4814,12 +4968,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>1</v>
+<v>4</v>
 </b>
 <b>
 <a>5</a>
@@ -4827,11 +4976,6 @@
 <v>1</v>
 </b>
 <b>
-<a>8</a>
-<b>9</b>
-<v>1</v>
-</b>
-<b>
 <a>11</a>
 <b>12</b>
 <v>1</v>
@@ -4842,18 +4986,28 @@
 <v>1</v>
 </b>
 <b>
-<a>20</a>
-<b>21</b>
+<a>47</a>
+<b>48</b>
 <v>1</v>
 </b>
 <b>
-<a>189</a>
-<b>190</b>
+<a>51</a>
+<b>52</b>
 <v>1</v>
 </b>
 <b>
-<a>284</a>
-<b>285</b>
+<a>274</a>
+<b>275</b>
+<v>1</v>
+</b>
+<b>
+<a>1649</a>
+<b>1650</b>
+<v>1</v>
+</b>
+<b>
+<a>3224</a>
+<b>3225</b>
 <v>1</v>
 </b>
 </bs>
@@ -4873,13 +5027,8 @@
 <v>3</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>1</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
+<a>11</a>
+<b>12</b>
 <v>1</v>
 </b>
 <b>
@@ -4893,23 +5042,33 @@
 <v>1</v>
 </b>
 <b>
-<a>26</a>
-<b>27</b>
+<a>25</a>
+<b>26</b>
 <v>1</v>
 </b>
 <b>
-<a>30</a>
-<b>31</b>
+<a>104</a>
+<b>105</b>
 <v>1</v>
 </b>
 <b>
-<a>216</a>
-<b>217</b>
+<a>113</a>
+<b>114</b>
 <v>1</v>
 </b>
 <b>
-<a>306</a>
-<b>307</b>
+<a>324</a>
+<b>325</b>
+<v>1</v>
+</b>
+<b>
+<a>2020</a>
+<b>2021</b>
+<v>1</v>
+</b>
+<b>
+<a>4077</a>
+<b>4078</b>
 <v>1</v>
 </b>
 </bs>
@@ -4929,23 +5088,23 @@
 <v>6</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
+<a>2</a>
+<b>3</b>
+<v>3</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
 <v>1</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>2</v>
-</b>
-<b>
-<a>34</a>
-<b>35</b>
+<a>48</a>
+<b>49</b>
 <v>1</v>
 </b>
 <b>
-<a>71</a>
-<b>72</b>
+<a>119</a>
+<b>120</b>
 <v>1</v>
 </b>
 </bs>
@@ -4962,17 +5121,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>425</v>
+<v>4192</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92</v>
+<v>792</v>
 </b>
 <b>
 <a>3</a>
-<b>25</b>
-<v>24</v>
+<b>133</b>
+<v>288</v>
 </b>
 </bs>
 </hist>
@@ -4988,7 +5147,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>541</v>
+<v>5271</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -5004,7 +5168,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>541</v>
+<v>5272</v>
 </b>
 </bs>
 </hist>
@@ -5020,12 +5184,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>540</v>
+<v>5262</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>1</v>
+<b>5</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -5041,17 +5205,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>490</v>
+<v>4587</v>
 </b>
 <b>
 <a>2</a>
-<b>4</b>
-<v>47</v>
+<b>3</b>
+<v>478</v>
 </b>
 <b>
-<a>4</a>
-<b>17</b>
-<v>4</v>
+<a>3</a>
+<b>67</b>
+<v>207</v>
 </b>
 </bs>
 </hist>
@@ -5067,12 +5231,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>512</v>
+<v>5192</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>29</v>
+<v>80</v>
 </b>
 </bs>
 </hist>
@@ -5088,12 +5252,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>521</v>
+<v>5803</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>100</v>
+<v>903</v>
 </b>
 <b>
 <a>29</a>
@@ -5114,7 +5278,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>621</v>
+<v>6706</v>
 </b>
 <b>
 <a>2</a>
@@ -5135,7 +5299,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>622</v>
+<v>6707</v>
 </b>
 </bs>
 </hist>
@@ -5151,7 +5315,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>621</v>
+<v>6706</v>
 </b>
 <b>
 <a>2</a>
@@ -5172,12 +5336,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>621</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
+<v>6707</v>
 </b>
 </bs>
 </hist>
@@ -5193,12 +5352,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>596</v>
+<v>6682</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26</v>
+<v>25</v>
 </b>
 </bs>
 </hist>
@@ -5214,42 +5373,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42</v>
+<v>51</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22</v>
+<v>30</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9</v>
+<v>16</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11</v>
+<v>14</v>
 </b>
 <b>
 <a>5</a>
-<b>6</b>
-<v>6</v>
+<b>8</b>
+<v>17</v>
 </b>
 <b>
-<a>6</a>
-<b>9</b>
-<v>11</v>
+<a>8</a>
+<b>12</b>
+<v>16</v>
 </b>
 <b>
-<a>9</a>
-<b>21</b>
-<v>10</v>
+<a>12</a>
+<b>39</b>
+<v>15</v>
 </b>
 <b>
-<a>21</a>
-<b>76</b>
-<v>10</v>
+<a>42</a>
+<b>122</b>
+<v>15</v>
+</b>
+<b>
+<a>170</a>
+<b>1182</b>
+<v>13</v>
 </b>
 </bs>
 </hist>
@@ -5265,7 +5429,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120</v>
+<v>186</v>
 </b>
 <b>
 <a>2</a>
@@ -5286,7 +5450,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121</v>
+<v>187</v>
 </b>
 </bs>
 </hist>
@@ -5302,11 +5466,11 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120</v>
+<v>186</v>
 </b>
 <b>
-<a>2</a>
-<b>3</b>
+<a>3</a>
+<b>4</b>
 <v>1</v>
 </b>
 </bs>
@@ -5323,42 +5487,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55</v>
+<v>67</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17</v>
+<v>24</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10</v>
+<v>23</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>8</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>6</v>
+<v>13</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11</v>
+<v>16</v>
 </b>
 <b>
 <a>9</a>
-<b>21</b>
-<v>10</v>
+<b>20</b>
+<v>15</v>
 </b>
 <b>
-<a>25</a>
-<b>76</b>
-<v>4</v>
+<a>20</a>
+<b>72</b>
+<v>15</v>
+</b>
+<b>
+<a>86</a>
+<b>952</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -5374,41 +5538,46 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50</v>
+<v>60</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18</v>
+<v>25</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8</v>
+<v>19</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10</v>
+<v>14</v>
 </b>
 <b>
 <a>5</a>
-<b>6</b>
-<v>6</v>
+<b>8</b>
+<v>16</v>
 </b>
 <b>
-<a>6</a>
-<b>9</b>
-<v>11</v>
+<a>8</a>
+<b>13</b>
+<v>15</v>
 </b>
 <b>
-<a>9</a>
-<b>19</b>
-<v>10</v>
+<a>13</a>
+<b>57</b>
+<v>15</v>
 </b>
 <b>
-<a>20</a>
-<b>76</b>
+<a>58</a>
+<b>284</b>
+<v>15</v>
+</b>
+<b>
+<a>296</a>
+<b>1182</b>
 <v>8</v>
 </b>
 </bs>
@@ -5419,19 +5588,19 @@
 </relation>
 <relation>
 <name>compilation_finished</name>
-<cardinality>564</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>501</v>
+<v>950</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
-<v>564</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5445,7 +5614,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5461,7 +5630,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5477,17 +5646,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>448</v>
+<v>813</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>126</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>5</v>
+<b>4</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -5503,17 +5672,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>448</v>
+<v>813</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>126</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>5</v>
+<b>4</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -5529,7 +5698,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5545,7 +5714,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5555,15 +5724,15 @@
 </relation>
 <relation>
 <name>compilation_assembly</name>
-<cardinality>564</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>564</v>
+<v>1096</v>
 </e>
 <e>
 <k>assembly</k>
-<v>564</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5577,7 +5746,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5593,7 +5762,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -6017,23 +6186,23 @@
 </relation>
 <relation>
 <name>externalData</name>
-<cardinality>30</cardinality>
+<cardinality>58</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>path</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>column</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>value</k>
-<v>30</v>
+<v>58</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6047,7 +6216,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -6063,7 +6232,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -6079,7 +6248,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -6095,7 +6264,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -6111,7 +6280,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -6127,7 +6296,7 @@
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -6143,7 +6312,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -6159,7 +6328,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -6175,7 +6344,7 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -6191,7 +6360,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -6207,7 +6376,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -6223,7 +6392,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -6233,41 +6402,41 @@
 </relation>
 <relation>
 <name>snapshotDate</name>
-<cardinality>2</cardinality>
+<cardinality>4</cardinality>
 <columnsizes>
 <e>
 <k>snapshotDate</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>sourceLocationPrefix</name>
-<cardinality>2</cardinality>
+<cardinality>4</cardinality>
 <columnsizes>
 <e>
 <k>prefix</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>11701</cardinality>
+<cardinality>22747</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>11701</v>
+<v>22747</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>1957</v>
+<v>3805</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>3607</v>
+<v>7012</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6281,7 +6450,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11701</v>
+<v>22747</v>
 </b>
 </bs>
 </hist>
@@ -6297,7 +6466,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11701</v>
+<v>22747</v>
 </b>
 </bs>
 </hist>
@@ -6313,52 +6482,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>546</v>
+<v>1062</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>290</v>
+<v>565</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>218</v>
+<v>423</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>172</v>
+<v>336</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>142</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>162</v>
+<v>316</v>
 </b>
 <b>
 <a>14</a>
 <b>28</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>29</a>
 <b>77</b>
-<v>50</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -6374,52 +6543,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>581</v>
+<v>1130</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>268</v>
+<v>521</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>228</v>
+<v>443</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>117</v>
+<v>229</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>167</v>
+<v>326</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>142</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>160</v>
+<v>311</v>
 </b>
 <b>
 <a>14</a>
 <b>32</b>
-<v>150</v>
+<v>292</v>
 </b>
 <b>
 <a>33</a>
 <b>45</b>
-<v>20</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -6435,32 +6604,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1937</v>
+<v>3766</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>589</v>
+<v>1145</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>403</v>
+<v>784</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>220</v>
+<v>428</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>293</v>
+<v>570</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>162</v>
+<v>316</v>
 </b>
 </bs>
 </hist>
@@ -6476,37 +6645,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>348</v>
+<v>677</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1769</v>
+<v>3440</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>554</v>
+<v>1076</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>348</v>
+<v>677</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>198</v>
+<v>384</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>298</v>
+<v>579</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>90</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -8584,11 +8753,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>11326677</cardinality>
+<cardinality>14080135</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>11326677</v>
+<v>14080135</v>
 </e>
 <e>
 <k>file</k>
@@ -8596,19 +8765,19 @@
 </e>
 <e>
 <k>beginLine</k>
-<v>157416</v>
+<v>164761</v>
 </e>
 <e>
 <k>beginColumn</k>
-<v>1453</v>
+<v>1456</v>
 </e>
 <e>
 <k>endLine</k>
-<v>175851</v>
+<v>177711</v>
 </e>
 <e>
 <k>endColumn</k>
-<v>1620</v>
+<v>1641</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -8622,7 +8791,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11326677</v>
+<v>14080135</v>
 </b>
 </bs>
 </hist>
@@ -8638,7 +8807,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11326677</v>
+<v>14080135</v>
 </b>
 </bs>
 </hist>
@@ -8654,7 +8823,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11326677</v>
+<v>14080135</v>
 </b>
 </bs>
 </hist>
@@ -8670,7 +8839,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11326677</v>
+<v>14080135</v>
 </b>
 </bs>
 </hist>
@@ -8686,7 +8855,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11326677</v>
+<v>14080135</v>
 </b>
 </bs>
 </hist>
@@ -8701,73 +8870,73 @@
 <bs>
 <b>
 <a>1</a>
-<b>5</b>
-<v>420</v>
+<b>19</b>
+<v>472</v>
 </b>
 <b>
-<a>5</a>
-<b>7</b>
-<v>419</v>
+<a>19</a>
+<b>34</b>
+<v>470</v>
 </b>
 <b>
-<a>7</a>
-<b>9</b>
-<v>444</v>
+<a>34</a>
+<b>50</b>
+<v>497</v>
 </b>
 <b>
-<a>9</a>
-<b>12</b>
-<v>461</v>
+<a>50</a>
+<b>74</b>
+<v>468</v>
 </b>
 <b>
-<a>12</a>
-<b>17</b>
-<v>496</v>
+<a>74</a>
+<b>106</b>
+<v>473</v>
 </b>
 <b>
-<a>17</a>
-<b>28</b>
-<v>488</v>
+<a>106</a>
+<b>150</b>
+<v>476</v>
 </b>
 <b>
-<a>28</a>
-<b>45</b>
-<v>515</v>
+<a>150</a>
+<b>208</b>
+<v>476</v>
 </b>
 <b>
-<a>45</a>
-<b>76</b>
-<v>474</v>
+<a>208</a>
+<b>297</b>
+<v>473</v>
 </b>
 <b>
-<a>76</a>
-<b>129</b>
+<a>297</a>
+<b>446</b>
 <v>469</v>
 </b>
 <b>
-<a>129</a>
-<b>218</b>
+<a>446</a>
+<b>687</b>
 <v>468</v>
 </b>
 <b>
-<a>218</a>
-<b>424</b>
+<a>687</a>
+<b>1204</b>
 <v>468</v>
 </b>
 <b>
-<a>424</a>
-<b>1086</b>
+<a>1204</a>
+<b>2639</b>
 <v>468</v>
 </b>
 <b>
-<a>1087</a>
-<b>28809</b>
-<v>468</v>
+<a>2639</a>
+<b>42820</b>
+<v>494</v>
 </b>
 <b>
-<a>31722</a>
+<a>43087</a>
 <b>474768</b>
-<v>174</v>
+<v>60</v>
 </b>
 </bs>
 </hist>
@@ -8782,68 +8951,68 @@
 <bs>
 <b>
 <a>1</a>
-<b>5</b>
-<v>569</v>
+<b>12</b>
+<v>541</v>
 </b>
 <b>
-<a>5</a>
-<b>7</b>
-<v>499</v>
-</b>
-<b>
-<a>7</a>
-<b>9</b>
-<v>447</v>
-</b>
-<b>
-<a>9</a>
-<b>11</b>
-<v>392</v>
-</b>
-<b>
-<a>11</a>
-<b>14</b>
-<v>504</v>
-</b>
-<b>
-<a>14</a>
+<a>12</a>
 <b>19</b>
-<v>521</v>
+<v>506</v>
 </b>
 <b>
 <a>19</a>
-<b>28</b>
-<v>533</v>
+<b>27</b>
+<v>519</v>
 </b>
 <b>
-<a>28</a>
-<b>40</b>
-<v>488</v>
+<a>27</a>
+<b>35</b>
+<v>494</v>
 </b>
 <b>
-<a>40</a>
-<b>60</b>
-<v>480</v>
+<a>35</a>
+<b>46</b>
+<v>512</v>
 </b>
 <b>
-<a>60</a>
-<b>94</b>
+<a>46</a>
+<b>61</b>
+<v>474</v>
+</b>
+<b>
+<a>61</a>
+<b>82</b>
+<v>504</v>
+</b>
+<b>
+<a>82</a>
+<b>114</b>
+<v>477</v>
+</b>
+<b>
+<a>114</a>
+<b>168</b>
 <v>475</v>
 </b>
 <b>
-<a>94</a>
-<b>205</b>
-<v>469</v>
-</b>
-<b>
-<a>205</a>
-<b>658</b>
+<a>168</a>
+<b>273</b>
 <v>468</v>
 </b>
 <b>
-<a>662</a>
+<a>273</a>
+<b>504</b>
+<v>486</v>
+</b>
+<b>
+<a>504</a>
+<b>1742</b>
+<v>468</v>
+</b>
+<b>
+<a>1746</a>
 <b>143014</b>
-<v>387</v>
+<v>308</v>
 </b>
 </bs>
 </hist>
@@ -8858,68 +9027,68 @@
 <bs>
 <b>
 <a>1</a>
-<b>3</b>
-<v>143</v>
+<b>7</b>
+<v>563</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>606</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>675</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>461</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>533</v>
-</b>
-<b>
-<a>8</a>
+<a>7</a>
 <b>13</b>
-<v>535</v>
+<v>499</v>
 </b>
 <b>
 <a>13</a>
-<b>20</b>
-<v>535</v>
-</b>
-<b>
-<a>20</a>
-<b>30</b>
+<b>19</b>
 <v>486</v>
 </b>
 <b>
-<a>30</a>
+<a>19</a>
+<b>26</b>
+<v>486</v>
+</b>
+<b>
+<a>26</a>
+<b>34</b>
+<v>511</v>
+</b>
+<b>
+<a>34</a>
 <b>43</b>
-<v>500</v>
+<v>498</v>
 </b>
 <b>
 <a>43</a>
-<b>59</b>
-<v>479</v>
+<b>53</b>
+<v>484</v>
 </b>
 <b>
-<a>59</a>
-<b>82</b>
-<v>474</v>
+<a>53</a>
+<b>64</b>
+<v>481</v>
 </b>
 <b>
-<a>82</a>
-<b>127</b>
-<v>469</v>
+<a>64</a>
+<b>76</b>
+<v>481</v>
 </b>
 <b>
-<a>127</a>
+<a>76</a>
+<b>91</b>
+<v>476</v>
+</b>
+<b>
+<a>91</a>
+<b>112</b>
+<v>477</v>
+</b>
+<b>
+<a>112</a>
+<b>166</b>
+<v>473</v>
+</b>
+<b>
+<a>166</a>
 <b>930</b>
-<v>336</v>
+<v>317</v>
 </b>
 </bs>
 </hist>
@@ -8934,68 +9103,73 @@
 <bs>
 <b>
 <a>1</a>
-<b>5</b>
-<v>561</v>
-</b>
-<b>
-<a>5</a>
-<b>7</b>
-<v>504</v>
-</b>
-<b>
-<a>7</a>
-<b>9</b>
-<v>449</v>
-</b>
-<b>
-<a>9</a>
 <b>12</b>
-<v>546</v>
+<v>480</v>
 </b>
 <b>
 <a>12</a>
-<b>16</b>
-<v>573</v>
+<b>18</b>
+<v>476</v>
 </b>
 <b>
-<a>16</a>
-<b>22</b>
-<v>499</v>
+<a>18</a>
+<b>25</b>
+<v>481</v>
 </b>
 <b>
-<a>22</a>
-<b>33</b>
-<v>489</v>
+<a>25</a>
+<b>34</b>
+<v>496</v>
 </b>
 <b>
-<a>33</a>
-<b>46</b>
-<v>489</v>
-</b>
-<b>
-<a>46</a>
-<b>73</b>
-<v>484</v>
-</b>
-<b>
-<a>73</a>
-<b>129</b>
-<v>487</v>
-</b>
-<b>
-<a>129</a>
-<b>326</b>
+<a>34</a>
+<b>44</b>
 <v>468</v>
 </b>
 <b>
-<a>326</a>
-<b>2738</b>
+<a>44</a>
+<b>56</b>
+<v>483</v>
+</b>
+<b>
+<a>56</a>
+<b>76</b>
+<v>473</v>
+</b>
+<b>
+<a>76</a>
+<b>104</b>
+<v>478</v>
+</b>
+<b>
+<a>104</a>
+<b>146</b>
+<v>469</v>
+</b>
+<b>
+<a>146</a>
+<b>230</b>
 <v>468</v>
 </b>
 <b>
-<a>2749</a>
+<a>230</a>
+<b>405</b>
+<v>468</v>
+</b>
+<b>
+<a>405</a>
+<b>840</b>
+<v>468</v>
+</b>
+<b>
+<a>845</a>
+<b>28774</b>
+<v>472</v>
+</b>
+<b>
+<a>46287</a>
 <b>171760</b>
-<v>215</v>
+<v>52</v>
 </b>
 </bs>
 </hist>
@@ -9010,68 +9184,68 @@
 <bs>
 <b>
 <a>1</a>
-<b>5</b>
-<v>442</v>
-</b>
-<b>
-<a>5</a>
-<b>7</b>
-<v>534</v>
-</b>
-<b>
-<a>7</a>
-<b>9</b>
-<v>416</v>
-</b>
-<b>
-<a>9</a>
-<b>12</b>
-<v>536</v>
-</b>
-<b>
-<a>12</a>
-<b>16</b>
-<v>469</v>
-</b>
-<b>
-<a>16</a>
-<b>23</b>
-<v>499</v>
-</b>
-<b>
-<a>23</a>
-<b>34</b>
-<v>498</v>
-</b>
-<b>
-<a>34</a>
-<b>48</b>
-<v>470</v>
-</b>
-<b>
-<a>48</a>
-<b>64</b>
-<v>482</v>
-</b>
-<b>
-<a>64</a>
-<b>82</b>
+<b>15</b>
 <v>475</v>
 </b>
 <b>
-<a>82</a>
-<b>109</b>
-<v>472</v>
+<a>15</a>
+<b>23</b>
+<v>481</v>
 </b>
 <b>
-<a>109</a>
-<b>161</b>
-<v>485</v>
+<a>23</a>
+<b>33</b>
+<v>519</v>
 </b>
 <b>
-<a>161</a>
+<a>33</a>
+<b>44</b>
+<v>503</v>
+</b>
+<b>
+<a>44</a>
+<b>54</b>
+<v>481</v>
+</b>
+<b>
+<a>54</a>
+<b>66</b>
+<v>490</v>
+</b>
+<b>
+<a>66</a>
+<b>77</b>
+<v>479</v>
+</b>
+<b>
+<a>77</a>
+<b>91</b>
+<v>475</v>
+</b>
+<b>
+<a>91</a>
+<b>105</b>
+<v>490</v>
+</b>
+<b>
+<a>105</a>
+<b>123</b>
+<v>491</v>
+</b>
+<b>
+<a>123</a>
+<b>148</b>
+<v>470</v>
+</b>
+<b>
+<a>148</a>
+<b>186</b>
+<v>473</v>
+</b>
+<b>
+<a>186</a>
 <b>1038</b>
-<v>454</v>
+<v>405</v>
 </b>
 </bs>
 </hist>
@@ -9087,57 +9261,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2678</v>
+<v>4162</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41791</v>
+<v>30681</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>15680</v>
+<v>15896</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>16871</v>
+<v>16240</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8775</v>
+<v>9901</v>
 </b>
 <b>
 <a>6</a>
-<b>9</b>
-<v>12511</v>
+<b>8</b>
+<v>13417</v>
 </b>
 <b>
-<a>9</a>
-<b>99</b>
-<v>11909</v>
+<a>8</a>
+<b>13</b>
+<v>13925</v>
 </b>
 <b>
-<a>99</a>
-<b>109</b>
-<v>11941</v>
+<a>13</a>
+<b>101</b>
+<v>14154</v>
 </b>
 <b>
-<a>109</a>
-<b>164</b>
-<v>11942</v>
+<a>101</a>
+<b>117</b>
+<v>12389</v>
 </b>
 <b>
-<a>164</a>
-<b>250</b>
-<v>11862</v>
+<a>117</a>
+<b>182</b>
+<v>12558</v>
 </b>
 <b>
-<a>250</a>
-<b>7392</b>
-<v>11456</v>
+<a>182</a>
+<b>301</b>
+<v>12385</v>
+</b>
+<b>
+<a>301</a>
+<b>10804</b>
+<v>9053</v>
 </b>
 </bs>
 </hist>
@@ -9153,42 +9332,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>92520</v>
+<v>72389</v>
 </b>
 <b>
 <a>2</a>
-<b>18</b>
-<v>11816</v>
+<b>3</b>
+<v>30310</v>
 </b>
 <b>
-<a>18</a>
-<b>50</b>
-<v>6689</v>
+<a>3</a>
+<b>38</b>
+<v>12534</v>
 </b>
 <b>
-<a>50</a>
-<b>51</b>
-<v>10035</v>
+<a>38</a>
+<b>52</b>
+<v>14356</v>
 </b>
 <b>
-<a>51</a>
-<b>65</b>
-<v>12205</v>
+<a>52</a>
+<b>79</b>
+<v>12462</v>
 </b>
 <b>
-<a>65</a>
-<b>105</b>
-<v>12183</v>
+<a>79</a>
+<b>118</b>
+<v>12565</v>
 </b>
 <b>
-<a>105</a>
-<b>708</b>
-<v>11807</v>
-</b>
-<b>
-<a>709</a>
-<b>5267</b>
-<v>161</v>
+<a>118</a>
+<b>6166</b>
+<v>10145</v>
 </b>
 </bs>
 </hist>
@@ -9204,52 +9378,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28742</v>
+<v>23471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36135</v>
+<v>30016</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6197</v>
+<v>11007</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>27310</v>
+<v>22185</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6023</v>
+<v>10197</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>11735</v>
+<v>11740</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>13098</v>
+<b>9</b>
+<v>13756</v>
 </b>
 <b>
-<a>10</a>
-<b>16</b>
-<v>12302</v>
+<a>9</a>
+<b>12</b>
+<v>13097</v>
 </b>
 <b>
-<a>16</a>
-<b>48</b>
-<v>11897</v>
+<a>12</a>
+<b>19</b>
+<v>12777</v>
 </b>
 <b>
-<a>48</a>
-<b>335</b>
-<v>3977</v>
+<a>19</a>
+<b>66</b>
+<v>12384</v>
+</b>
+<b>
+<a>66</a>
+<b>352</b>
+<v>4131</v>
 </b>
 </bs>
 </hist>
@@ -9265,27 +9444,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72276</v>
+<v>67387</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48541</v>
+<v>51814</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>14456</v>
+<v>18654</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>12667</v>
+<v>13928</v>
 </b>
 <b>
 <a>6</a>
+<b>34</b>
+<v>12361</v>
+</b>
+<b>
+<a>34</a>
 <b>306</b>
-<v>9476</v>
+<v>617</v>
 </b>
 </bs>
 </hist>
@@ -9301,57 +9485,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2731</v>
+<v>4192</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43580</v>
+<v>31624</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16640</v>
+<v>16670</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20845</v>
+<v>18713</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11859</v>
+<v>12088</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>9405</v>
+<v>10186</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>11941</v>
+<v>14626</v>
 </b>
 <b>
 <a>9</a>
-<b>14</b>
-<v>13283</v>
+<b>12</b>
+<v>14505</v>
 </b>
 <b>
-<a>14</a>
-<b>24</b>
-<v>12004</v>
+<a>12</a>
+<b>17</b>
+<v>13374</v>
 </b>
 <b>
-<a>24</a>
-<b>94</b>
-<v>11811</v>
+<a>17</a>
+<b>29</b>
+<v>12447</v>
 </b>
 <b>
-<a>94</a>
-<b>378</b>
-<v>3317</v>
+<a>29</a>
+<b>111</b>
+<v>12416</v>
+</b>
+<b>
+<a>111</a>
+<b>389</b>
+<v>3920</v>
 </b>
 </bs>
 </hist>
@@ -9367,22 +9556,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>351</v>
+<v>352</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>185</v>
+<v>184</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>100</v>
+<v>101</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>128</v>
+<v>129</v>
 </b>
 <b>
 <a>6</a>
@@ -9391,33 +9580,33 @@
 </b>
 <b>
 <a>13</a>
-<b>39</b>
-<v>109</v>
+<b>40</b>
+<v>111</v>
 </b>
 <b>
-<a>39</a>
-<b>106</b>
-<v>109</v>
+<a>40</a>
+<b>110</b>
+<v>111</v>
 </b>
 <b>
-<a>106</a>
-<b>392</b>
-<v>109</v>
+<a>112</a>
+<b>476</b>
+<v>110</v>
 </b>
 <b>
-<a>400</a>
-<b>3801</b>
-<v>109</v>
+<a>490</a>
+<b>5418</b>
+<v>110</v>
 </b>
 <b>
-<a>4033</a>
-<b>35252</b>
-<v>109</v>
+<a>5447</a>
+<b>74991</b>
+<v>110</v>
 </b>
 <b>
-<a>37256</a>
-<b>1800792</b>
-<v>30</v>
+<a>76227</a>
+<b>2221412</b>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -9433,17 +9622,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>481</v>
+<v>482</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>188</v>
+<v>187</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113</v>
+<v>115</v>
 </b>
 <b>
 <a>4</a>
@@ -9453,31 +9642,31 @@
 <b>
 <a>6</a>
 <b>11</b>
-<v>117</v>
+<v>115</v>
 </b>
 <b>
 <a>11</a>
-<b>59</b>
+<b>58</b>
 <v>110</v>
 </b>
 <b>
-<a>59</a>
-<b>177</b>
-<v>109</v>
+<a>58</a>
+<b>194</b>
+<v>110</v>
 </b>
 <b>
-<a>177</a>
-<b>695</b>
-<v>109</v>
+<a>195</a>
+<b>1098</b>
+<v>110</v>
 </b>
 <b>
-<a>698</a>
-<b>2521</b>
-<v>109</v>
+<a>1112</a>
+<b>3852</b>
+<v>110</v>
 </b>
 <b>
-<a>2548</a>
-<b>6053</b>
+<a>3882</a>
+<b>6231</b>
 <v>8</v>
 </b>
 </bs>
@@ -9504,12 +9693,12 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>112</v>
+<v>114</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>109</v>
+<v>110</v>
 </b>
 <b>
 <a>7</a>
@@ -9518,28 +9707,28 @@
 </b>
 <b>
 <a>18</a>
-<b>53</b>
-<v>111</v>
+<b>54</b>
+<v>113</v>
 </b>
 <b>
-<a>53</a>
-<b>128</b>
-<v>109</v>
+<a>54</a>
+<b>139</b>
+<v>110</v>
 </b>
 <b>
-<a>128</a>
-<b>585</b>
-<v>109</v>
+<a>140</a>
+<b>803</b>
+<v>110</v>
 </b>
 <b>
-<a>602</a>
-<b>4407</b>
-<v>109</v>
+<a>804</a>
+<b>6771</b>
+<v>110</v>
 </b>
 <b>
-<a>4493</a>
+<a>6786</a>
 <b>116262</b>
-<v>84</v>
+<v>79</v>
 </b>
 </bs>
 </hist>
@@ -9565,12 +9754,12 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>112</v>
+<v>114</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>109</v>
+<v>110</v>
 </b>
 <b>
 <a>7</a>
@@ -9579,28 +9768,28 @@
 </b>
 <b>
 <a>18</a>
-<b>53</b>
-<v>111</v>
+<b>54</b>
+<v>113</v>
 </b>
 <b>
-<a>53</a>
-<b>129</b>
-<v>109</v>
+<a>54</a>
+<b>139</b>
+<v>110</v>
 </b>
 <b>
-<a>129</a>
-<b>586</b>
-<v>109</v>
+<a>140</a>
+<b>797</b>
+<v>110</v>
 </b>
 <b>
-<a>603</a>
-<b>4408</b>
-<v>109</v>
+<a>803</a>
+<b>6771</b>
+<v>110</v>
 </b>
 <b>
-<a>4493</a>
-<b>124735</b>
-<v>84</v>
+<a>6783</a>
+<b>124736</b>
+<v>79</v>
 </b>
 </bs>
 </hist>
@@ -9616,17 +9805,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>422</v>
+<v>423</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>230</v>
+<v>229</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>93</v>
+<v>96</v>
 </b>
 <b>
 <a>4</a>
@@ -9640,28 +9829,28 @@
 </b>
 <b>
 <a>12</a>
-<b>24</b>
-<v>112</v>
+<b>25</b>
+<v>114</v>
 </b>
 <b>
-<a>24</a>
-<b>48</b>
+<a>25</a>
+<b>53</b>
 <v>110</v>
 </b>
 <b>
-<a>48</a>
-<b>103</b>
-<v>109</v>
+<a>53</a>
+<b>108</b>
+<v>111</v>
 </b>
 <b>
-<a>103</a>
-<b>176</b>
-<v>110</v>
+<a>108</a>
+<b>204</b>
+<v>111</v>
 </b>
 <b>
-<a>176</a>
-<b>724</b>
-<v>43</v>
+<a>204</a>
+<b>727</b>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -9677,57 +9866,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43052</v>
+<v>30736</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15495</v>
+<v>14517</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16141</v>
+<v>16816</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11843</v>
+<v>12515</v>
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>15117</v>
+<b>6</b>
+<v>10358</v>
 </b>
 <b>
-<a>7</a>
+<a>6</a>
+<b>9</b>
+<v>14907</v>
+</b>
+<b>
+<a>9</a>
 <b>51</b>
-<v>13292</v>
+<v>14737</v>
 </b>
 <b>
 <a>51</a>
-<b>67</b>
-<v>13277</v>
+<b>64</b>
+<v>13404</v>
 </b>
 <b>
-<a>67</a>
-<b>108</b>
-<v>13666</v>
+<a>64</a>
+<b>109</b>
+<v>13430</v>
 </b>
 <b>
-<a>108</a>
+<a>109</a>
 <b>170</b>
-<v>13281</v>
+<v>13424</v>
 </b>
 <b>
 <a>170</a>
-<b>273</b>
-<v>13192</v>
+<b>277</b>
+<v>13375</v>
 </b>
 <b>
-<a>273</a>
-<b>6927</b>
-<v>7495</v>
+<a>277</a>
+<b>10707</b>
+<v>9492</v>
 </b>
 </bs>
 </hist>
@@ -9743,37 +9937,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102373</v>
+<v>74587</v>
 </b>
 <b>
 <a>2</a>
-<b>50</b>
-<v>10686</v>
+<b>3</b>
+<v>32293</v>
 </b>
 <b>
-<a>50</a>
+<a>3</a>
 <b>51</b>
-<v>14316</v>
+<v>15351</v>
 </b>
 <b>
 <a>51</a>
-<b>61</b>
-<v>13298</v>
+<b>53</b>
+<v>14842</v>
 </b>
 <b>
-<a>61</a>
-<b>105</b>
-<v>13198</v>
+<a>53</a>
+<b>91</b>
+<v>13579</v>
 </b>
 <b>
-<a>105</a>
-<b>140</b>
-<v>13318</v>
+<a>91</a>
+<b>136</b>
+<v>14119</v>
 </b>
 <b>
-<a>140</a>
-<b>5438</b>
-<v>8662</v>
+<a>136</a>
+<b>5796</b>
+<v>12940</v>
 </b>
 </bs>
 </hist>
@@ -9789,27 +9983,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>108963</v>
+<v>94269</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30801</v>
+<v>38080</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>14008</v>
+<v>18054</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>15017</v>
+<b>6</b>
+<v>14148</v>
 </b>
 <b>
-<a>7</a>
-<b>50</b>
-<v>7062</v>
+<a>6</a>
+<b>61</b>
+<v>13160</v>
 </b>
 </bs>
 </hist>
@@ -9825,52 +10019,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44241</v>
+<v>31573</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>33451</v>
+<v>28818</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9654</v>
+<v>12789</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>22023</v>
+<v>19691</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9633</v>
+<v>11849</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>10956</v>
+<v>11679</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>15510</v>
+<b>9</b>
+<v>15126</v>
 </b>
 <b>
-<a>10</a>
-<b>16</b>
-<v>13744</v>
+<a>9</a>
+<b>12</b>
+<v>14464</v>
 </b>
 <b>
-<a>16</a>
-<b>55</b>
-<v>13266</v>
+<a>12</a>
+<b>18</b>
+<v>13367</v>
 </b>
 <b>
-<a>55</a>
-<b>334</b>
-<v>3373</v>
+<a>18</a>
+<b>58</b>
+<v>13376</v>
+</b>
+<b>
+<a>58</a>
+<b>353</b>
+<v>4979</v>
 </b>
 </bs>
 </hist>
@@ -9886,57 +10085,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43633</v>
+<v>31276</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19238</v>
+<v>18345</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20512</v>
+<v>19308</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15969</v>
+<v>15250</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14483</v>
+<v>13460</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>8953</v>
+<v>9784</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>12318</v>
+<v>14539</v>
 </b>
 <b>
 <a>9</a>
-<b>14</b>
+<b>12</b>
 <v>13943</v>
 </b>
 <b>
-<a>14</a>
-<b>27</b>
-<v>13475</v>
+<a>12</a>
+<b>17</b>
+<v>13348</v>
 </b>
 <b>
-<a>27</a>
-<b>206</b>
-<v>13190</v>
+<a>17</a>
+<b>32</b>
+<v>13514</v>
 </b>
 <b>
-<a>206</a>
-<b>378</b>
-<v>137</v>
+<a>32</a>
+<b>156</b>
+<v>13329</v>
+</b>
+<b>
+<a>156</a>
+<b>388</b>
+<v>1615</v>
 </b>
 </bs>
 </hist>
@@ -9952,12 +10156,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>393</v>
+<v>406</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>202</v>
+<v>205</v>
 </b>
 <b>
 <a>3</a>
@@ -9967,42 +10171,42 @@
 <b>
 <a>4</a>
 <b>7</b>
-<v>122</v>
+<v>126</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>123</v>
-</b>
-<b>
-<a>51</a>
-<b>121</b>
 <v>124</v>
 </b>
 <b>
-<a>121</a>
-<b>301</b>
-<v>122</v>
+<a>51</a>
+<b>122</b>
+<v>126</v>
 </b>
 <b>
-<a>311</a>
-<b>1031</b>
-<v>122</v>
+<a>122</a>
+<b>325</b>
+<v>124</v>
 </b>
 <b>
-<a>1037</a>
-<b>6674</b>
-<v>122</v>
+<a>328</a>
+<b>1118</b>
+<v>124</v>
 </b>
 <b>
-<a>6754</a>
-<b>56985</b>
-<v>122</v>
+<a>1126</a>
+<b>9603</b>
+<v>124</v>
 </b>
 <b>
-<a>57295</a>
-<b>866412</b>
-<v>52</v>
+<a>9620</a>
+<b>82632</b>
+<v>124</v>
+</b>
+<b>
+<a>82698</a>
+<b>908740</b>
+<v>42</v>
 </b>
 </bs>
 </hist>
@@ -10018,52 +10222,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>507</v>
+<v>521</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>182</v>
+<v>186</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>120</v>
+<v>119</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>127</v>
+<v>130</v>
 </b>
 <b>
 <a>9</a>
-<b>61</b>
-<v>125</v>
+<b>62</b>
+<v>132</v>
 </b>
 <b>
-<a>61</a>
-<b>124</b>
-<v>123</v>
+<a>62</a>
+<b>128</b>
+<v>127</v>
 </b>
 <b>
-<a>124</a>
-<b>205</b>
-<v>122</v>
+<a>129</a>
+<b>222</b>
+<v>124</v>
 </b>
 <b>
-<a>206</a>
-<b>441</b>
-<v>122</v>
+<a>222</a>
+<b>710</b>
+<v>124</v>
 </b>
 <b>
-<a>441</a>
-<b>1921</b>
-<v>122</v>
+<a>717</a>
+<b>3690</b>
+<v>124</v>
 </b>
 <b>
-<a>1944</a>
-<b>4225</b>
-<v>70</v>
+<a>3701</a>
+<b>5368</b>
+<v>54</v>
 </b>
 </bs>
 </hist>
@@ -10079,12 +10283,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>400</v>
+<v>414</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>209</v>
+<v>211</v>
 </b>
 <b>
 <a>3</a>
@@ -10094,42 +10298,42 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>123</v>
+<v>127</v>
 </b>
 <b>
 <a>6</a>
 <b>14</b>
-<v>130</v>
+<v>131</v>
 </b>
 <b>
 <a>14</a>
-<b>43</b>
-<v>123</v>
+<b>44</b>
+<v>125</v>
 </b>
 <b>
-<a>43</a>
-<b>120</b>
-<v>123</v>
+<a>44</a>
+<b>124</b>
+<v>124</v>
 </b>
 <b>
-<a>121</a>
-<b>466</b>
-<v>122</v>
+<a>126</a>
+<b>541</b>
+<v>124</v>
 </b>
 <b>
-<a>471</a>
-<b>4055</b>
-<v>122</v>
+<a>549</a>
+<b>5840</b>
+<v>124</v>
 </b>
 <b>
-<a>4055</a>
-<b>13772</b>
-<v>122</v>
+<a>6139</a>
+<b>19157</b>
+<v>124</v>
 </b>
 <b>
-<a>13909</a>
-<b>47532</b>
-<v>23</v>
+<a>19476</a>
+<b>47830</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -10145,22 +10349,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>502</v>
+<v>518</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>231</v>
+<v>232</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>95</v>
+<v>96</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>146</v>
+<v>147</v>
 </b>
 <b>
 <a>7</a>
@@ -10169,28 +10373,28 @@
 </b>
 <b>
 <a>16</a>
-<b>33</b>
-<v>127</v>
-</b>
-<b>
-<a>33</a>
-<b>78</b>
-<v>122</v>
-</b>
-<b>
-<a>78</a>
-<b>107</b>
-<v>122</v>
-</b>
-<b>
-<a>107</a>
-<b>151</b>
+<b>34</b>
 <v>124</v>
 </b>
 <b>
-<a>151</a>
-<b>337</b>
-<v>18</v>
+<a>34</a>
+<b>83</b>
+<v>128</v>
+</b>
+<b>
+<a>83</a>
+<b>114</b>
+<v>125</v>
+</b>
+<b>
+<a>114</a>
+<b>164</b>
+<v>127</v>
+</b>
+<b>
+<a>164</a>
+<b>338</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -10206,7 +10410,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>400</v>
+<v>416</v>
 </b>
 <b>
 <a>2</a>
@@ -10221,42 +10425,42 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>123</v>
+<v>127</v>
 </b>
 <b>
 <a>6</a>
 <b>14</b>
-<v>130</v>
+<v>131</v>
 </b>
 <b>
 <a>14</a>
-<b>43</b>
-<v>123</v>
+<b>44</b>
+<v>125</v>
 </b>
 <b>
-<a>43</a>
-<b>120</b>
-<v>123</v>
+<a>44</a>
+<b>124</b>
+<v>124</v>
 </b>
 <b>
-<a>121</a>
-<b>466</b>
-<v>122</v>
+<a>126</a>
+<b>537</b>
+<v>124</v>
 </b>
 <b>
-<a>475</a>
-<b>4050</b>
-<v>122</v>
+<a>541</a>
+<b>5831</b>
+<v>124</v>
 </b>
 <b>
-<a>4064</a>
-<b>13686</b>
-<v>122</v>
+<a>6123</a>
+<b>19067</b>
+<v>124</v>
 </b>
 <b>
-<a>13833</a>
-<b>47528</b>
-<v>23</v>
+<a>19460</a>
+<b>47823</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -10266,15 +10470,15 @@
 </relation>
 <relation>
 <name>locations_mapped</name>
-<cardinality>248620</cardinality>
+<cardinality>483287</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>248620</v>
+<v>483287</v>
 </e>
 <e>
 <k>mapped_to</k>
-<v>211461</v>
+<v>411055</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -10288,7 +10492,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>248620</v>
+<v>483287</v>
 </b>
 </bs>
 </hist>
@@ -10304,12 +10508,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>205510</v>
+<v>399487</v>
 </b>
 <b>
 <a>2</a>
 <b>119</b>
-<v>5951</v>
+<v>11568</v>
 </b>
 </bs>
 </hist>
@@ -10319,23 +10523,23 @@
 </relation>
 <relation>
 <name>numlines</name>
-<cardinality>4532217</cardinality>
+<cardinality>4586385</cardinality>
 <columnsizes>
 <e>
 <k>element_id</k>
-<v>4532216</v>
+<v>4586378</v>
 </e>
 <e>
 <k>num_lines</k>
-<v>1349</v>
+<v>1354</v>
 </e>
 <e>
 <k>num_code</k>
-<v>1242</v>
+<v>1247</v>
 </e>
 <e>
 <k>num_comment</k>
-<v>635</v>
+<v>637</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -10349,12 +10553,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4532215</v>
+<v>4586371</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1</v>
+<v>7</v>
 </b>
 </bs>
 </hist>
@@ -10370,12 +10574,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4532215</v>
+<v>4586371</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1</v>
+<v>7</v>
 </b>
 </bs>
 </hist>
@@ -10391,7 +10595,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4532216</v>
+<v>4586374</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -10407,37 +10616,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>660</v>
+<v>651</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>208</v>
+<v>207</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>94</v>
+<v>97</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>94</v>
+<b>7</b>
+<v>125</v>
 </b>
 <b>
-<a>6</a>
-<b>12</b>
-<v>108</v>
+<a>7</a>
+<b>19</b>
+<v>105</v>
 </b>
 <b>
-<a>12</a>
-<b>50</b>
-<v>104</v>
+<a>19</a>
+<b>121</b>
+<v>102</v>
 </b>
 <b>
-<a>52</a>
-<b>1598592</b>
-<v>81</v>
+<a>126</a>
+<b>1600586</b>
+<v>67</v>
 </b>
 </bs>
 </hist>
@@ -10453,32 +10662,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>733</v>
+<v>723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>198</v>
+<v>194</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>99</v>
+<v>106</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>121</v>
+<v>111</v>
 </b>
 <b>
 <a>7</a>
-<b>15</b>
-<v>102</v>
+<b>16</b>
+<v>103</v>
 </b>
 <b>
-<a>15</a>
-<b>34</b>
-<v>96</v>
+<a>16</a>
+<b>35</b>
+<v>104</v>
+</b>
+<b>
+<a>35</a>
+<b>39</b>
+<v>13</v>
 </b>
 </bs>
 </hist>
@@ -10494,32 +10708,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>733</v>
+<v>723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>198</v>
+<v>196</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>97</v>
+<v>102</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>118</v>
+<v>105</v>
 </b>
 <b>
 <a>7</a>
 <b>17</b>
-<v>109</v>
+<v>104</v>
 </b>
 <b>
 <a>17</a>
+<b>32</b>
+<v>106</v>
+</b>
+<b>
+<a>32</a>
 <b>81</b>
-<v>94</v>
+<v>18</v>
 </b>
 </bs>
 </hist>
@@ -10535,37 +10754,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>651</v>
+<v>647</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>149</v>
+<v>152</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>83</v>
+<v>79</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>99</v>
+<v>93</v>
 </b>
 <b>
 <a>6</a>
 <b>14</b>
-<v>102</v>
+<v>98</v>
 </b>
 <b>
 <a>14</a>
-<b>77</b>
-<v>94</v>
+<b>50</b>
+<v>95</v>
 </b>
 <b>
-<a>83</a>
-<b>1607845</b>
-<v>64</v>
+<a>52</a>
+<b>1615186</b>
+<v>83</v>
 </b>
 </bs>
 </hist>
@@ -10581,32 +10800,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>728</v>
+<v>723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>140</v>
+<v>143</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>84</v>
+<v>82</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>107</v>
+<v>100</v>
 </b>
 <b>
 <a>7</a>
-<b>18</b>
+<b>19</b>
 <v>96</v>
 </b>
 <b>
-<a>18</a>
-<b>42</b>
-<v>87</v>
+<a>19</a>
+<b>43</b>
+<v>94</v>
+</b>
+<b>
+<a>43</a>
+<b>49</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -10622,32 +10846,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>728</v>
+<v>723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>141</v>
+<v>145</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>80</v>
+<v>77</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>106</v>
+<v>102</v>
 </b>
 <b>
 <a>7</a>
-<b>15</b>
+<b>16</b>
+<v>95</v>
+</b>
+<b>
+<a>16</a>
+<b>50</b>
 <v>94</v>
 </b>
 <b>
-<a>15</a>
-<b>83</b>
-<v>93</v>
+<a>50</a>
+<b>85</b>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -10668,12 +10897,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>134</v>
+<v>131</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>55</v>
+<v>56</v>
 </b>
 <b>
 <a>4</a>
@@ -10683,17 +10912,17 @@
 <b>
 <a>6</a>
 <b>14</b>
-<v>50</v>
+<v>49</v>
 </b>
 <b>
 <a>14</a>
-<b>178</b>
+<b>173</b>
 <v>48</v>
 </b>
 <b>
-<a>178</a>
-<b>4511467</b>
-<v>14</v>
+<a>215</a>
+<b>4549896</b>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -10714,32 +10943,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>138</v>
+<v>135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>56</v>
+<v>57</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>50</v>
+<v>51</v>
 </b>
 <b>
 <a>6</a>
-<b>15</b>
+<b>16</b>
 <v>49</v>
 </b>
 <b>
-<a>15</a>
-<b>119</b>
-<v>49</v>
+<a>16</a>
+<b>128</b>
+<v>48</v>
 </b>
 <b>
-<a>131</a>
-<b>738</b>
-<v>8</v>
+<a>136</a>
+<b>746</b>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -10760,32 +10989,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>139</v>
+<v>135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>54</v>
+<v>56</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>51</v>
+<v>53</v>
 </b>
 <b>
 <a>6</a>
-<b>15</b>
+<b>16</b>
 <v>48</v>
 </b>
 <b>
-<a>15</a>
-<b>103</b>
-<v>49</v>
+<a>16</a>
+<b>117</b>
+<v>48</v>
 </b>
 <b>
-<a>116</a>
-<b>731</b>
-<v>9</v>
+<a>118</a>
+<b>739</b>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -10795,27 +11024,27 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>2160</cardinality>
+<cardinality>4200</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2160</v>
+<v>4200</v>
 </e>
 <e>
 <k>file</k>
-<v>2160</v>
+<v>4200</v>
 </e>
 <e>
 <k>fullname</k>
-<v>1769</v>
+<v>3440</v>
 </e>
 <e>
 <k>name</k>
-<v>1631</v>
+<v>3172</v>
 </e>
 <e>
 <k>version</k>
-<v>190</v>
+<v>370</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -10829,7 +11058,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10845,7 +11074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10861,7 +11090,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10877,7 +11106,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10893,7 +11122,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10909,7 +11138,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10925,7 +11154,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10941,7 +11170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2160</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10957,12 +11186,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1378</v>
+<v>2680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>391</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -10978,12 +11207,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1378</v>
+<v>2680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>391</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -10999,7 +11228,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1769</v>
+<v>3440</v>
 </b>
 </bs>
 </hist>
@@ -11015,7 +11244,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1769</v>
+<v>3440</v>
 </b>
 </bs>
 </hist>
@@ -11031,17 +11260,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125</v>
+<v>2187</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>483</v>
+<v>940</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22</v>
+<v>43</v>
 </b>
 </bs>
 </hist>
@@ -11057,17 +11286,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1125</v>
+<v>2187</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>483</v>
+<v>940</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22</v>
+<v>43</v>
 </b>
 </bs>
 </hist>
@@ -11083,12 +11312,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1516</v>
+<v>2948</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>115</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -11104,12 +11333,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1516</v>
+<v>2948</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>115</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -11125,32 +11354,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>17</v>
+<v>34</v>
 </b>
 <b>
 <a>11</a>
 <b>37</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>50</a>
 <b>386</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -11166,32 +11395,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>17</v>
+<v>34</v>
 </b>
 <b>
 <a>11</a>
 <b>37</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>50</a>
 <b>386</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -11207,32 +11436,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>17</v>
+<v>34</v>
 </b>
 <b>
 <a>11</a>
 <b>36</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>50</a>
 <b>234</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -11248,32 +11477,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>17</v>
+<v>34</v>
 </b>
 <b>
 <a>11</a>
 <b>36</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>50</a>
 <b>234</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -11283,27 +11512,27 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>24351</cardinality>
+<cardinality>47336</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>24351</v>
+<v>47336</v>
 </e>
 <e>
 <k>name</k>
-<v>24351</v>
+<v>47336</v>
 </e>
 <e>
 <k>simple</k>
-<v>13679</v>
+<v>26591</v>
 </e>
 <e>
 <k>ext</k>
-<v>22</v>
+<v>43</v>
 </e>
 <e>
 <k>fromSource</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11317,7 +11546,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11333,7 +11562,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11349,7 +11578,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11365,7 +11594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11381,7 +11610,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11397,7 +11626,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11413,7 +11642,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11429,7 +11658,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24351</v>
+<v>47336</v>
 </b>
 </bs>
 </hist>
@@ -11445,12 +11674,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12787</v>
+<v>24857</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>892</v>
+<v>1734</v>
 </b>
 </bs>
 </hist>
@@ -11466,12 +11695,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12787</v>
+<v>24857</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>892</v>
+<v>1734</v>
 </b>
 </bs>
 </hist>
@@ -11487,12 +11716,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13168</v>
+<v>25597</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>511</v>
+<v>994</v>
 </b>
 </bs>
 </hist>
@@ -11508,7 +11737,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13679</v>
+<v>26591</v>
 </b>
 </bs>
 </hist>
@@ -11524,47 +11753,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>166</a>
 <b>167</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>173</a>
 <b>174</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>861</a>
 <b>862</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>995</a>
 <b>996</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2875</a>
 <b>2876</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4635</a>
 <b>4636</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11580,47 +11809,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>166</a>
 <b>167</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>173</a>
 <b>174</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>861</a>
 <b>862</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>995</a>
 <b>996</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2875</a>
 <b>2876</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4635</a>
 <b>4636</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11636,42 +11865,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>166</a>
 <b>167</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>169</a>
 <b>170</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>214</a>
 <b>215</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>650</a>
 <b>651</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>790</a>
 <b>791</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3818</a>
 <b>3819</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11687,7 +11916,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22</v>
+<v>43</v>
 </b>
 </bs>
 </hist>
@@ -11703,7 +11932,7 @@
 <b>
 <a>9714</a>
 <b>9715</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11719,7 +11948,7 @@
 <b>
 <a>9714</a>
 <b>9715</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11735,7 +11964,7 @@
 <b>
 <a>5457</a>
 <b>5458</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11751,7 +11980,7 @@
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -11761,19 +11990,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>9177</cardinality>
+<cardinality>17839</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>9177</v>
+<v>17839</v>
 </e>
 <e>
 <k>name</k>
-<v>8036</v>
+<v>15622</v>
 </e>
 <e>
 <k>simple</k>
-<v>1428</v>
+<v>2777</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11787,7 +12016,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9177</v>
+<v>17839</v>
 </b>
 </bs>
 </hist>
@@ -11803,7 +12032,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9177</v>
+<v>17839</v>
 </b>
 </bs>
 </hist>
@@ -11819,7 +12048,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8036</v>
+<v>15622</v>
 </b>
 </bs>
 </hist>
@@ -11835,12 +12064,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6896</v>
+<v>13405</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1140</v>
+<v>2217</v>
 </b>
 </bs>
 </hist>
@@ -11856,27 +12085,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>842</v>
+<v>1637</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>278</v>
+<v>540</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>10</a>
 <b>383</b>
-<v>92</v>
+<v>180</v>
 </b>
 </bs>
 </hist>
@@ -11892,27 +12121,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>842</v>
+<v>1637</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>278</v>
+<v>540</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>10</a>
 <b>383</b>
-<v>92</v>
+<v>180</v>
 </b>
 </bs>
 </hist>
@@ -11922,15 +12151,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>32383</cardinality>
+<cardinality>62949</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>8036</v>
+<v>15622</v>
 </e>
 <e>
 <k>child</k>
-<v>32383</v>
+<v>62949</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11944,37 +12173,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4356</v>
+<v>8469</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1070</v>
+<v>2080</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>486</v>
+<v>945</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>541</v>
+<v>1052</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>629</v>
+<v>1223</v>
 </b>
 <b>
 <a>9</a>
 <b>17</b>
-<v>609</v>
+<v>1184</v>
 </b>
 <b>
 <a>17</a>
 <b>170</b>
-<v>343</v>
+<v>667</v>
 </b>
 </bs>
 </hist>
@@ -11990,7 +12219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32383</v>
+<v>62949</v>
 </b>
 </bs>
 </hist>
@@ -12000,15 +12229,15 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>16276</cardinality>
+<cardinality>31640</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>16276</v>
+<v>31640</v>
 </e>
 <e>
 <k>mode</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12022,7 +12251,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16276</v>
+<v>31640</v>
 </b>
 </bs>
 </hist>
@@ -12038,7 +12267,7 @@
 <b>
 <a>6493</a>
 <b>6494</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -12048,15 +12277,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>11293</cardinality>
+<cardinality>21952</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>11293</v>
+<v>21952</v>
 </e>
 <e>
 <k>name</k>
-<v>2516</v>
+<v>4892</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12070,7 +12299,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11293</v>
+<v>21952</v>
 </b>
 </bs>
 </hist>
@@ -12086,37 +12315,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1797</v>
+<v>3493</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>320</v>
+<v>623</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>190</v>
+<v>370</v>
 </b>
 <b>
 <a>10</a>
 <b>101</b>
-<v>190</v>
+<v>370</v>
 </b>
 <b>
 <a>110</a>
 <b>139</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -12126,15 +12355,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>8355</cardinality>
+<cardinality>19769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8355</v>
+<v>19769</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>1774</v>
+<v>3888</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12148,7 +12377,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8355</v>
+<v>19769</v>
 </b>
 </bs>
 </hist>
@@ -12164,37 +12393,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>669</v>
+<v>1398</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>406</v>
+<v>799</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>175</v>
+<v>414</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>140</v>
+<v>306</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>110</v>
+<v>224</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>140</v>
+<v>331</v>
 </b>
 <b>
 <a>9</a>
+<b>17</b>
+<v>302</v>
+</b>
+<b>
+<a>17</a>
 <b>996</b>
-<v>132</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -12204,15 +12438,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>8355</cardinality>
+<cardinality>19769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8355</v>
+<v>19769</v>
 </e>
 <e>
 <k>loc</k>
-<v>8355</v>
+<v>19769</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12226,7 +12460,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8355</v>
+<v>19769</v>
 </b>
 </bs>
 </hist>
@@ -12242,7 +12476,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8355</v>
+<v>19769</v>
 </b>
 </bs>
 </hist>
@@ -12252,15 +12486,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>388662</cardinality>
+<cardinality>777440</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>388662</v>
+<v>777440</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>6974</v>
+<v>13561</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12274,7 +12508,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>388662</v>
+<v>777440</v>
 </b>
 </bs>
 </hist>
@@ -12290,57 +12524,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1709</v>
+<v>3328</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>842</v>
+<v>1627</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>531</v>
+<v>1028</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>468</v>
+<v>916</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>641</v>
+<v>1252</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>561</v>
+<v>1091</v>
 </b>
 <b>
 <a>10</a>
 <b>15</b>
-<v>589</v>
+<v>1140</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>546</v>
+<v>1062</v>
 </b>
 <b>
 <a>23</a>
 <b>51</b>
-<v>523</v>
+<v>1028</v>
 </b>
 <b>
 <a>51</a>
 <b>835</b>
-<v>523</v>
+<v>1018</v>
 </b>
 <b>
 <a>900</a>
-<b>34743</b>
-<v>35</v>
+<b>35556</b>
+<v>68</v>
 </b>
 </bs>
 </hist>
@@ -12350,15 +12584,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>43445</cardinality>
+<cardinality>88347</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>43212</v>
+<v>87830</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>8355</v>
+<v>19769</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12372,12 +12606,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43145</v>
+<v>87679</v>
 </b>
 <b>
 <a>2</a>
 <b>60</b>
-<v>67</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -12393,32 +12627,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5412</v>
+<v>13785</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>747</v>
+<v>1715</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>656</v>
+<v>1276</v>
 </b>
 <b>
 <a>13</a>
 <b>16</b>
-<v>734</v>
+<v>1427</v>
 </b>
 <b>
 <a>16</a>
-<b>21</b>
-<v>508</v>
+<b>32</b>
+<v>1510</v>
 </b>
 <b>
-<a>31</a>
+<a>32</a>
 <b>33</b>
-<v>295</v>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -12428,15 +12662,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>66100</cardinality>
+<cardinality>144323</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>66100</v>
+<v>144323</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>1990</v>
+<v>4229</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12450,7 +12684,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66100</v>
+<v>144323</v>
 </b>
 </bs>
 </hist>
@@ -12466,47 +12700,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>696</v>
+<v>1496</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>285</v>
+<v>472</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>115</v>
+<v>297</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>182</v>
+<b>5</b>
+<v>238</v>
 </b>
 <b>
-<a>6</a>
-<b>11</b>
-<v>177</v>
+<a>5</a>
+<b>8</b>
+<v>365</v>
 </b>
 <b>
-<a>11</a>
-<b>21</b>
-<v>177</v>
+<a>8</a>
+<b>14</b>
+<v>336</v>
 </b>
 <b>
-<a>21</a>
-<b>45</b>
-<v>152</v>
+<a>14</a>
+<b>25</b>
+<v>321</v>
 </b>
 <b>
-<a>48</a>
-<b>206</b>
-<v>150</v>
+<a>25</a>
+<b>63</b>
+<v>326</v>
 </b>
 <b>
-<a>214</a>
-<b>2199</b>
-<v>50</v>
+<a>64</a>
+<b>465</b>
+<v>321</v>
+</b>
+<b>
+<a>510</a>
+<b>2519</b>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -12516,15 +12755,15 @@
 </relation>
 <relation>
 <name>using_static_directives</name>
-<cardinality>199</cardinality>
+<cardinality>390</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>199</v>
+<v>390</v>
 </e>
 <e>
 <k>type_id</k>
-<v>32</v>
+<v>54</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12538,7 +12777,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199</v>
+<v>390</v>
 </b>
 </bs>
 </hist>
@@ -12554,46 +12793,46 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4</v>
+<v>2</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15</v>
+<v>22</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>4</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3</v>
+<v>5</v>
 </b>
 <b>
 <a>5</a>
+<b>6</b>
+<v>2</v>
+</b>
+<b>
+<a>6</a>
 <b>7</b>
-<v>2</v>
+<v>5</v>
 </b>
 <b>
-<a>7</a>
+<a>8</a>
 <b>9</b>
-<v>2</v>
+<v>7</v>
 </b>
 <b>
-<a>16</a>
-<b>23</b>
-<v>2</v>
-</b>
-<b>
-<a>26</a>
-<b>27</b>
-<v>1</v>
-</b>
-<b>
-<a>30</a>
+<a>12</a>
 <b>31</b>
+<v>5</v>
+</b>
+<b>
+<a>46</a>
+<b>71</b>
 <v>2</v>
 </b>
 </bs>
@@ -12604,15 +12843,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>74275</cardinality>
+<cardinality>144381</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>74275</v>
+<v>144381</v>
 </e>
 <e>
 <k>loc</k>
-<v>74252</v>
+<v>144337</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12626,7 +12865,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74275</v>
+<v>144381</v>
 </b>
 </bs>
 </hist>
@@ -12642,12 +12881,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74229</v>
+<v>144293</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22</v>
+<v>43</v>
 </b>
 </bs>
 </hist>
@@ -12657,11 +12896,11 @@
 </relation>
 <relation>
 <name>directive_ifs</name>
-<cardinality>2550</cardinality>
+<cardinality>5164</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2550</v>
+<v>5164</v>
 </e>
 <e>
 <k>branchTaken</k>
@@ -12683,7 +12922,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2550</v>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -12699,7 +12938,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2550</v>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -12713,13 +12952,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1194</a>
-<b>1195</b>
+<a>1992</a>
+<b>1993</b>
 <v>1</v>
 </b>
 <b>
-<a>1219</a>
-<b>1220</b>
+<a>2162</a>
+<b>2163</b>
 <v>1</v>
 </b>
 </bs>
@@ -12755,13 +12994,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1199</a>
-<b>1200</b>
+<a>2013</a>
+<b>2014</b>
 <v>1</v>
 </b>
 <b>
-<a>1214</a>
-<b>1215</b>
+<a>2141</a>
+<b>2142</b>
 <v>1</v>
 </b>
 </bs>
@@ -12793,15 +13032,15 @@
 </relation>
 <relation>
 <name>directive_elifs</name>
-<cardinality>7</cardinality>
+<cardinality>59</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7</v>
+<v>59</v>
 </e>
 <e>
 <k>branchTaken</k>
-<v>1</v>
+<v>2</v>
 </e>
 <e>
 <k>conditionValue</k>
@@ -12809,11 +13048,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>7</v>
+<v>51</v>
 </e>
 <e>
 <k>index</k>
-<v>1</v>
+<v>2</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12827,7 +13066,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>59</v>
 </b>
 </bs>
 </hist>
@@ -12843,7 +13082,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>59</v>
 </b>
 </bs>
 </hist>
@@ -12859,7 +13098,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>59</v>
 </b>
 </bs>
 </hist>
@@ -12875,7 +13114,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>59</v>
 </b>
 </bs>
 </hist>
@@ -12889,8 +13128,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>41</a>
+<b>42</b>
 <v>1</v>
 </b>
 </bs>
@@ -12905,9 +13149,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
+<a>1</a>
+<b>2</b>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -12921,8 +13165,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>39</a>
+<b>40</b>
 <v>1</v>
 </b>
 </bs>
@@ -12937,9 +13186,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>1</v>
+<a>2</a>
+<b>3</b>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -12953,13 +13202,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
+<a>18</a>
+<b>19</b>
 <v>1</v>
 </b>
 <b>
-<a>6</a>
-<b>7</b>
+<a>41</a>
+<b>42</b>
 <v>1</v>
 </b>
 </bs>
@@ -12990,13 +13239,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
+<a>18</a>
+<b>19</b>
 <v>1</v>
 </b>
 <b>
-<a>6</a>
-<b>7</b>
+<a>39</a>
+<b>40</b>
 <v>1</v>
 </b>
 </bs>
@@ -13011,8 +13260,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
+<a>2</a>
+<b>3</b>
 <v>2</v>
 </b>
 </bs>
@@ -13029,7 +13278,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>43</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
 </b>
 </bs>
 </hist>
@@ -13045,7 +13299,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>45</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -13061,7 +13320,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>45</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -13077,7 +13341,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7</v>
+<v>43</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
 </b>
 </bs>
 </hist>
@@ -13091,8 +13360,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>51</a>
+<b>52</b>
 <v>1</v>
 </b>
 </bs>
@@ -13107,9 +13381,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>1</v>
+<a>2</a>
+<b>3</b>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -13125,7 +13399,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1</v>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -13139,8 +13413,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>51</a>
+<b>52</b>
 <v>1</v>
 </b>
 </bs>
@@ -13151,11 +13430,11 @@
 </relation>
 <relation>
 <name>directive_elses</name>
-<cardinality>1140</cardinality>
+<cardinality>2316</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1140</v>
+<v>2316</v>
 </e>
 <e>
 <k>branchTaken</k>
@@ -13163,11 +13442,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>1140</v>
+<v>2316</v>
 </e>
 <e>
 <k>index</k>
-<v>2</v>
+<v>3</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13181,7 +13460,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13197,7 +13476,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13213,7 +13492,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13227,13 +13506,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>329</a>
-<b>330</b>
+<a>496</a>
+<b>497</b>
 <v>1</v>
 </b>
 <b>
-<a>750</a>
-<b>751</b>
+<a>1367</a>
+<b>1368</b>
 <v>1</v>
 </b>
 </bs>
@@ -13248,13 +13527,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>329</a>
-<b>330</b>
+<a>496</a>
+<b>497</b>
 <v>1</v>
 </b>
 <b>
-<a>750</a>
-<b>751</b>
+<a>1367</a>
+<b>1368</b>
 <v>1</v>
 </b>
 </bs>
@@ -13271,7 +13550,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -13287,7 +13571,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13303,7 +13587,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13319,7 +13603,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1140</v>
+<v>2316</v>
 </b>
 </bs>
 </hist>
@@ -13333,13 +13617,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>1</a>
+<b>2</b>
 <v>1</v>
 </b>
 <b>
-<a>1072</a>
-<b>1073</b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>1852</a>
+<b>1853</b>
 <v>1</v>
 </b>
 </bs>
@@ -13354,6 +13643,11 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
 <a>2</a>
 <b>3</b>
 <v>2</v>
@@ -13370,13 +13664,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7</a>
-<b>8</b>
+<a>1</a>
+<b>2</b>
 <v>1</v>
 </b>
 <b>
-<a>1072</a>
-<b>1073</b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>1852</a>
+<b>1853</b>
 <v>1</v>
 </b>
 </bs>
@@ -13387,15 +13686,15 @@
 </relation>
 <relation>
 <name>directive_endifs</name>
-<cardinality>2550</cardinality>
+<cardinality>5164</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2550</v>
+<v>5164</v>
 </e>
 <e>
 <k>start</k>
-<v>2550</v>
+<v>5164</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13409,7 +13708,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2550</v>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -13425,7 +13724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2550</v>
+<v>5164</v>
 </b>
 </bs>
 </hist>
@@ -13435,15 +13734,15 @@
 </relation>
 <relation>
 <name>directive_define_symbols</name>
-<cardinality>3314</cardinality>
+<cardinality>6229</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3314</v>
+<v>6229</v>
 </e>
 <e>
 <k>name</k>
-<v>86</v>
+<v>170</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13457,7 +13756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3314</v>
+<v>6229</v>
 </b>
 </bs>
 </hist>
@@ -13473,52 +13772,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17</v>
+<v>37</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8</v>
+<v>27</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10</v>
+<v>13</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8</v>
+<v>11</v>
 </b>
 <b>
 <a>5</a>
-<b>6</b>
-<v>7</v>
-</b>
-<b>
-<a>6</a>
 <b>7</b>
-<v>5</v>
+<v>11</v>
 </b>
 <b>
 <a>7</a>
-<b>12</b>
-<v>7</v>
+<b>10</b>
+<v>12</v>
 </b>
 <b>
-<a>13</a>
-<b>23</b>
-<v>6</v>
+<a>10</a>
+<b>17</b>
+<v>14</v>
 </b>
 <b>
-<a>24</a>
-<b>55</b>
-<v>7</v>
+<a>17</a>
+<b>27</b>
+<v>14</v>
 </b>
 <b>
-<a>97</a>
-<b>656</b>
-<v>7</v>
+<a>27</a>
+<b>72</b>
+<v>13</v>
+</b>
+<b>
+<a>77</a>
+<b>1098</b>
+<v>13</v>
 </b>
 </bs>
 </hist>
@@ -13528,15 +13827,15 @@
 </relation>
 <relation>
 <name>directive_regions</name>
-<cardinality>565</cardinality>
+<cardinality>1954</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>565</v>
+<v>1954</v>
 </e>
 <e>
 <k>name</k>
-<v>216</v>
+<v>710</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13550,7 +13849,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>565</v>
+<v>1954</v>
 </b>
 </bs>
 </hist>
@@ -13566,27 +13865,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6</v>
+<v>8</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>175</v>
+<v>547</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>22</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>26</v>
+<v>81</v>
 </b>
 <b>
-<a>6</a>
-<b>31</b>
-<v>8</v>
+<a>5</a>
+<b>35</b>
+<v>52</v>
 </b>
 </bs>
 </hist>
@@ -13596,15 +13895,15 @@
 </relation>
 <relation>
 <name>directive_endregions</name>
-<cardinality>565</cardinality>
+<cardinality>1954</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>565</v>
+<v>1954</v>
 </e>
 <e>
 <k>start</k>
-<v>565</v>
+<v>1954</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13618,7 +13917,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>565</v>
+<v>1954</v>
 </b>
 </bs>
 </hist>
@@ -13634,7 +13933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>565</v>
+<v>1954</v>
 </b>
 </bs>
 </hist>
@@ -13644,15 +13943,15 @@
 </relation>
 <relation>
 <name>directive_lines</name>
-<cardinality>128896</cardinality>
+<cardinality>250558</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>128896</v>
+<v>250558</v>
 </e>
 <e>
 <k>kind</k>
-<v>7</v>
+<v>14</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13666,7 +13965,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>128896</v>
+<v>250558</v>
 </b>
 </bs>
 </hist>
@@ -13682,12 +13981,12 @@
 <b>
 <a>16650</a>
 <b>16651</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>18118</a>
 <b>18119</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -13697,15 +13996,15 @@
 </relation>
 <relation>
 <name>directive_line_value</name>
-<cardinality>41738</cardinality>
+<cardinality>81135</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41738</v>
+<v>81135</v>
 </e>
 <e>
 <k>line</k>
-<v>709</v>
+<v>1379</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13719,7 +14018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41738</v>
+<v>81135</v>
 </b>
 </bs>
 </hist>
@@ -13735,57 +14034,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70</v>
+<v>136</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>60</v>
+<v>116</v>
 </b>
 <b>
 <a>11</a>
 <b>15</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>15</a>
 <b>27</b>
-<v>62</v>
+<v>121</v>
 </b>
 <b>
 <a>27</a>
 <b>46</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>46</a>
 <b>104</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>106</a>
 <b>549</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>569</a>
 <b>727</b>
-<v>27</v>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -13795,15 +14094,15 @@
 </relation>
 <relation>
 <name>directive_line_file</name>
-<cardinality>41738</cardinality>
+<cardinality>81135</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41738</v>
+<v>81135</v>
 </e>
 <e>
 <k>file</k>
-<v>2396</v>
+<v>4658</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13817,7 +14116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41738</v>
+<v>81135</v>
 </b>
 </bs>
 </hist>
@@ -13833,57 +14132,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>308</v>
+<v>599</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>396</v>
+<v>769</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>255</v>
+<v>497</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>205</v>
+<v>399</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>110</v>
+<v>214</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>200</v>
+<v>389</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>180</v>
+<v>350</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>205</v>
+<v>399</v>
 </b>
 <b>
 <a>16</a>
 <b>27</b>
-<v>185</v>
+<v>360</v>
 </b>
 <b>
 <a>27</a>
 <b>42</b>
-<v>188</v>
+<v>365</v>
 </b>
 <b>
 <a>42</a>
 <b>2665</b>
-<v>160</v>
+<v>311</v>
 </b>
 </bs>
 </hist>
@@ -13893,19 +14192,19 @@
 </relation>
 <relation>
 <name>directive_nullables</name>
-<cardinality>83477</cardinality>
+<cardinality>162270</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>83477</v>
+<v>162270</v>
 </e>
 <e>
 <k>setting</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>target</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13919,7 +14218,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83477</v>
+<v>162270</v>
 </b>
 </bs>
 </hist>
@@ -13935,7 +14234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83477</v>
+<v>162270</v>
 </b>
 </bs>
 </hist>
@@ -13951,7 +14250,7 @@
 <b>
 <a>16650</a>
 <b>16651</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -13967,7 +14266,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -13983,7 +14282,7 @@
 <b>
 <a>33300</a>
 <b>33301</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -13999,7 +14298,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14057,15 +14356,15 @@
 </relation>
 <relation>
 <name>directive_errors</name>
-<cardinality>1</cardinality>
+<cardinality>28</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1</v>
+<v>28</v>
 </e>
 <e>
 <k>message</k>
-<v>1</v>
+<v>2</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14079,7 +14378,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1</v>
+<v>28</v>
 </b>
 </bs>
 </hist>
@@ -14093,8 +14392,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>24</a>
+<b>25</b>
 <v>1</v>
 </b>
 </bs>
@@ -14153,15 +14457,15 @@
 </relation>
 <relation>
 <name>directive_defines</name>
-<cardinality>5</cardinality>
+<cardinality>22</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5</v>
+<v>22</v>
 </e>
 <e>
 <k>name</k>
-<v>5</v>
+<v>12</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14175,7 +14479,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>22</v>
 </b>
 </bs>
 </hist>
@@ -14191,7 +14495,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>8</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -14201,23 +14520,23 @@
 </relation>
 <relation>
 <name>pragma_checksums</name>
-<cardinality>2494</cardinality>
+<cardinality>4848</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2494</v>
+<v>4848</v>
 </e>
 <e>
 <k>file</k>
-<v>2494</v>
+<v>4848</v>
 </e>
 <e>
 <k>guid</k>
-<v>2</v>
+<v>4</v>
 </e>
 <e>
 <k>bytes</k>
-<v>2338</v>
+<v>4546</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14231,7 +14550,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14247,7 +14566,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14263,7 +14582,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14279,7 +14598,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14295,7 +14614,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14311,7 +14630,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2494</v>
+<v>4848</v>
 </b>
 </bs>
 </hist>
@@ -14327,7 +14646,7 @@
 <b>
 <a>995</a>
 <b>996</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14343,7 +14662,7 @@
 <b>
 <a>995</a>
 <b>996</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14359,7 +14678,7 @@
 <b>
 <a>933</a>
 <b>934</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14375,12 +14694,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2288</v>
+<v>4449</v>
 </b>
 <b>
 <a>2</a>
 <b>19</b>
-<v>50</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -14396,12 +14715,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2288</v>
+<v>4449</v>
 </b>
 <b>
 <a>2</a>
 <b>19</b>
-<v>50</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -14417,7 +14736,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2338</v>
+<v>4546</v>
 </b>
 </bs>
 </hist>
@@ -14427,15 +14746,15 @@
 </relation>
 <relation>
 <name>pragma_warnings</name>
-<cardinality>14725</cardinality>
+<cardinality>28623</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14725</v>
+<v>28623</v>
 </e>
 <e>
 <k>kind</k>
-<v>5</v>
+<v>9</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14449,7 +14768,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14725</v>
+<v>28623</v>
 </b>
 </bs>
 </hist>
@@ -14465,7 +14784,7 @@
 <b>
 <a>2937</a>
 <b>2938</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14475,19 +14794,19 @@
 </relation>
 <relation>
 <name>pragma_warning_error_codes</name>
-<cardinality>14730</cardinality>
+<cardinality>28633</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14725</v>
+<v>28623</v>
 </e>
 <e>
 <k>errorCode</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>index</k>
-<v>5</v>
+<v>9</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14501,12 +14820,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14720</v>
+<v>28614</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14522,12 +14841,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14720</v>
+<v>28614</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14543,17 +14862,17 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>946</a>
 <b>947</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>1990</a>
 <b>1991</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14569,7 +14888,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -14585,12 +14904,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>5874</a>
 <b>5875</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14606,12 +14925,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14621,15 +14940,15 @@
 </relation>
 <relation>
 <name>preprocessor_directive_location</name>
-<cardinality>229688</cardinality>
+<cardinality>446589</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>229688</v>
+<v>446589</v>
 </e>
 <e>
 <k>loc</k>
-<v>229688</v>
+<v>446589</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14643,7 +14962,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229688</v>
+<v>446589</v>
 </b>
 </bs>
 </hist>
@@ -14659,7 +14978,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229688</v>
+<v>446589</v>
 </b>
 </bs>
 </hist>
@@ -14669,15 +14988,15 @@
 </relation>
 <relation>
 <name>preprocessor_directive_compilation</name>
-<cardinality>229688</cardinality>
+<cardinality>446589</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>229688</v>
+<v>446589</v>
 </e>
 <e>
 <k>compilation</k>
-<v>172</v>
+<v>345</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14691,7 +15010,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229688</v>
+<v>446589</v>
 </b>
 </bs>
 </hist>
@@ -14707,62 +15026,62 @@
 <b>
 <a>4</a>
 <b>11</b>
-<v>12</v>
+<v>29</v>
 </b>
 <b>
 <a>16</a>
-<b>62</b>
-<v>15</v>
+<b>48</b>
+<v>29</v>
 </b>
 <b>
-<a>75</a>
-<b>144</b>
-<v>15</v>
+<a>61</a>
+<b>140</b>
+<v>29</v>
 </b>
 <b>
-<a>149</a>
-<b>226</b>
-<v>15</v>
+<a>143</a>
+<b>198</b>
+<v>29</v>
 </b>
 <b>
-<a>248</a>
-<b>317</b>
-<v>15</v>
+<a>225</a>
+<b>300</b>
+<v>29</v>
 </b>
 <b>
-<a>342</a>
-<b>459</b>
-<v>15</v>
+<a>316</a>
+<b>453</b>
+<v>29</v>
 </b>
 <b>
-<a>503</a>
-<b>665</b>
-<v>15</v>
+<a>458</a>
+<b>634</b>
+<v>29</v>
 </b>
 <b>
-<a>772</a>
-<b>1090</b>
-<v>15</v>
+<a>664</a>
+<b>1055</b>
+<v>29</v>
 </b>
 <b>
-<a>1155</a>
-<b>1276</b>
-<v>15</v>
+<a>1089</a>
+<b>1250</b>
+<v>29</v>
 </b>
 <b>
-<a>1343</a>
-<b>2001</b>
-<v>15</v>
+<a>1275</a>
+<b>1989</b>
+<v>29</v>
 </b>
 <b>
-<a>2121</a>
-<b>4115</b>
-<v>15</v>
+<a>2000</a>
+<b>3215</b>
+<v>29</v>
 </b>
 <b>
-<a>6086</a>
+<a>4114</a>
 <b>19444</b>
-<v>10</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -14772,15 +15091,15 @@
 </relation>
 <relation>
 <name>preprocessor_directive_active</name>
-<cardinality>229688</cardinality>
+<cardinality>446589</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>229688</v>
+<v>446589</v>
 </e>
 <e>
 <k>active</k>
-<v>2</v>
+<v>9</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14794,7 +15113,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229688</v>
+<v>446589</v>
 </b>
 </bs>
 </hist>
@@ -14808,9 +15127,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>91625</a>
-<b>91626</b>
-<v>2</v>
+<a>7</a>
+<b>8</b>
+<v>4</v>
+</b>
+<b>
+<a>91639</a>
+<b>91640</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -14820,19 +15144,19 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>434504</cardinality>
+<cardinality>867590</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>434504</v>
+<v>867590</v>
 </e>
 <e>
 <k>kind</k>
-<v>67</v>
+<v>131</v>
 </e>
 <e>
 <k>name</k>
-<v>184347</v>
+<v>367037</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14846,7 +15170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434504</v>
+<v>867590</v>
 </b>
 </bs>
 </hist>
@@ -14862,7 +15186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434504</v>
+<v>867590</v>
 </b>
 </bs>
 </hist>
@@ -14878,32 +15202,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>45</a>
-<b>198</b>
-<v>5</v>
+<b>199</b>
+<v>9</v>
 </b>
 <b>
-<a>342</a>
-<b>1750</b>
-<v>5</v>
+<a>366</a>
+<b>1874</b>
+<v>9</v>
 </b>
 <b>
-<a>2450</a>
-<b>9903</b>
-<v>5</v>
+<a>2454</a>
+<b>10198</b>
+<v>9</v>
 </b>
 <b>
-<a>20838</a>
-<b>35370</b>
-<v>5</v>
+<a>22085</a>
+<b>36570</b>
+<v>9</v>
 </b>
 <b>
-<a>40817</a>
-<b>61603</b>
-<v>5</v>
+<a>41596</a>
+<b>62642</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14919,32 +15243,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>45</a>
-<b>154</b>
-<v>5</v>
+<b>158</b>
+<v>9</v>
 </b>
 <b>
-<a>168</a>
+<a>169</a>
 <b>701</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
-<a>1043</a>
+<a>1086</a>
 <b>2228</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
-<a>6467</a>
-<b>9921</b>
-<v>5</v>
+<a>6598</a>
+<b>10563</b>
+<v>9</v>
 </b>
 <b>
-<a>17642</a>
-<b>35459</b>
-<v>5</v>
+<a>18339</a>
+<b>35727</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -14960,17 +15284,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163114</v>
+<v>324769</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>14629</v>
+<v>28852</v>
 </b>
 <b>
 <a>5</a>
-<b>6327</b>
-<v>6603</v>
+<b>6356</b>
+<v>13415</v>
 </b>
 </bs>
 </hist>
@@ -14986,12 +15310,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>183613</v>
+<v>365600</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>734</v>
+<v>1437</v>
 </b>
 </bs>
 </hist>
@@ -15001,15 +15325,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>120781</cardinality>
+<cardinality>234906</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>120781</v>
+<v>234906</v>
 </e>
 <e>
 <k>name</k>
-<v>91080</v>
+<v>177069</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15023,7 +15347,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120781</v>
+<v>234906</v>
 </b>
 </bs>
 </hist>
@@ -15039,17 +15363,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83592</v>
+<v>162513</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>6938</v>
+<v>13488</v>
 </b>
 <b>
 <a>7</a>
 <b>2183</b>
-<v>548</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -15059,15 +15383,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>120694</cardinality>
+<cardinality>234726</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>120694</v>
+<v>234726</v>
 </e>
 <e>
 <k>typeId</k>
-<v>120694</v>
+<v>234726</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15081,7 +15405,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120694</v>
+<v>234726</v>
 </b>
 </bs>
 </hist>
@@ -15097,7 +15421,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120694</v>
+<v>234726</v>
 </b>
 </bs>
 </hist>
@@ -15107,23 +15431,23 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>4384</cardinality>
+<cardinality>9127</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>4384</v>
+<v>9127</v>
 </e>
 <e>
 <k>dimension</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>rank</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>element</k>
-<v>4379</v>
+<v>9117</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15137,7 +15461,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4384</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -15153,7 +15477,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4384</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -15169,7 +15493,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4384</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -15185,12 +15509,12 @@
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1729</a>
-<b>1730</b>
-<v>2</v>
+<a>1853</a>
+<b>1854</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15206,12 +15530,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15227,12 +15551,12 @@
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1727</a>
-<b>1728</b>
-<v>2</v>
+<a>1851</a>
+<b>1852</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15248,12 +15572,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1747</a>
-<b>1748</b>
-<v>2</v>
+<a>1871</a>
+<b>1872</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15269,12 +15593,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15290,12 +15614,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1747</a>
-<b>1748</b>
-<v>2</v>
+<a>1871</a>
+<b>1872</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15311,12 +15635,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4374</v>
+<v>9107</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -15332,7 +15656,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4379</v>
+<v>9117</v>
 </b>
 </bs>
 </hist>
@@ -15348,12 +15672,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4374</v>
+<v>9107</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -15363,15 +15687,15 @@
 </relation>
 <relation>
 <name>nullable_underlying_type</name>
-<cardinality>550</cardinality>
+<cardinality>979</cardinality>
 <columnsizes>
 <e>
 <k>nullable</k>
-<v>550</v>
+<v>979</v>
 </e>
 <e>
 <k>underlying</k>
-<v>550</v>
+<v>979</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15385,7 +15709,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>550</v>
+<v>979</v>
 </b>
 </bs>
 </hist>
@@ -15401,7 +15725,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>550</v>
+<v>979</v>
 </b>
 </bs>
 </hist>
@@ -15411,15 +15735,15 @@
 </relation>
 <relation>
 <name>pointer_referent_type</name>
-<cardinality>112</cardinality>
+<cardinality>219</cardinality>
 <columnsizes>
 <e>
 <k>pointer</k>
-<v>112</v>
+<v>219</v>
 </e>
 <e>
 <k>referent</k>
-<v>112</v>
+<v>219</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15433,7 +15757,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>219</v>
 </b>
 </bs>
 </hist>
@@ -15449,7 +15773,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>219</v>
 </b>
 </bs>
 </hist>
@@ -15459,15 +15783,15 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>6141</cardinality>
+<cardinality>11958</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>6141</v>
+<v>11958</v>
 </e>
 <e>
 <k>underlying_type_id</k>
-<v>20</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15481,7 +15805,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6141</v>
+<v>11958</v>
 </b>
 </bs>
 </hist>
@@ -15497,37 +15821,37 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>23</a>
 <b>24</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>25</a>
 <b>26</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>41</a>
 <b>42</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>172</a>
 <b>173</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>285</a>
 <b>286</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1894</a>
-<b>1895</b>
-<v>2</v>
+<a>1898</a>
+<b>1899</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -15537,15 +15861,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>52229</cardinality>
+<cardinality>107605</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>52229</v>
+<v>107605</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>26697</v>
+<v>55537</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15559,7 +15883,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52229</v>
+<v>107605</v>
 </b>
 </bs>
 </hist>
@@ -15575,12 +15899,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>25171</v>
+<v>52223</v>
 </b>
 <b>
 <a>2</a>
-<b>4000</b>
-<v>1526</v>
+<b>4178</b>
+<v>3313</v>
 </b>
 </bs>
 </hist>
@@ -15590,15 +15914,15 @@
 </relation>
 <relation>
 <name>function_pointer_return_type</name>
-<cardinality>9</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>function_pointer_id</k>
-<v>9</v>
+<v>11</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>6</v>
+<v>3</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15612,7 +15936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -15626,9 +15950,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>5</v>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
 </b>
 <b>
 <a>4</a>
@@ -15643,15 +15972,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>160600</cardinality>
+<cardinality>323643</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>160600</v>
+<v>323643</v>
 </e>
 <e>
 <k>super</k>
-<v>16246</v>
+<v>31581</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15665,7 +15994,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>160600</v>
+<v>323643</v>
 </b>
 </bs>
 </hist>
@@ -15681,27 +16010,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11646</v>
+<v>22639</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2050</v>
+<v>3981</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1240</v>
+<v>2416</v>
 </b>
 <b>
 <a>5</a>
 <b>70</b>
-<v>1223</v>
+<v>2378</v>
 </b>
 <b>
 <a>70</a>
-<b>20836</b>
-<v>85</v>
+<b>22083</b>
+<v>165</v>
 </b>
 </bs>
 </hist>
@@ -15711,26 +16040,26 @@
 </relation>
 <relation>
 <name>anonymous_types</name>
-<cardinality>571</cardinality>
+<cardinality>1213</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>571</v>
+<v>1213</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>266554</cardinality>
+<cardinality>541977</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>112586</v>
+<v>226462</v>
 </e>
 <e>
 <k>super</k>
-<v>60780</v>
+<v>122604</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15744,27 +16073,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51182</v>
+<v>100821</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27933</v>
+<v>57072</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>17643</v>
+<v>36128</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>9373</v>
+<v>18980</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>6455</v>
+<v>13459</v>
 </b>
 </bs>
 </hist>
@@ -15780,27 +16109,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33561</v>
+<v>66984</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14692</v>
+<v>29798</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4983</v>
+<v>10252</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>4168</v>
+<v>8698</v>
 </b>
 <b>
 <a>6</a>
-<b>20685</b>
-<v>3374</v>
+<b>21807</b>
+<v>6870</v>
 </b>
 </bs>
 </hist>
@@ -15810,15 +16139,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>277271</cardinality>
+<cardinality>553960</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>237743</v>
+<v>467192</v>
 </e>
 <e>
 <k>loc</k>
-<v>12499</v>
+<v>29890</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15832,17 +16161,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209975</v>
+<v>407585</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19400</v>
+<v>39251</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>8367</v>
+<v>20354</v>
 </b>
 </bs>
 </hist>
@@ -15858,22 +16187,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10568</v>
+<v>26016</v>
 </b>
 <b>
 <a>2</a>
-<b>20</b>
-<v>962</v>
+<b>26</b>
+<v>2270</v>
 </b>
 <b>
-<a>20</a>
-<b>1759</b>
-<v>937</v>
-</b>
-<b>
-<a>1782</a>
+<a>26</a>
 <b>12195</b>
-<v>30</v>
+<v>1603</v>
 </b>
 </bs>
 </hist>
@@ -15883,15 +16207,15 @@
 </relation>
 <relation>
 <name>tuple_underlying_type</name>
-<cardinality>857</cardinality>
+<cardinality>1783</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>857</v>
+<v>1783</v>
 </e>
 <e>
 <k>struct</k>
-<v>574</v>
+<v>1140</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15905,7 +16229,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>857</v>
+<v>1783</v>
 </b>
 </bs>
 </hist>
@@ -15921,17 +16245,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333</v>
+<v>643</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>213</v>
+<v>423</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>27</v>
+<b>9</b>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -15941,19 +16265,19 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>3374</cardinality>
+<cardinality>6792</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>854</v>
+<v>1778</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>field</k>
-<v>3374</v>
+<v>6792</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15967,37 +16291,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>523</v>
+<v>1135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>75</v>
+<v>146</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>55</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -16013,37 +16337,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>523</v>
+<v>1135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>75</v>
+<v>146</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>55</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -16059,107 +16383,107 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>18</a>
 <b>19</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>22</a>
 <b>23</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>26</a>
 <b>27</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>30</a>
 <b>31</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>34</a>
 <b>35</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>43</a>
 <b>44</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>51</a>
 <b>52</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>59</a>
 <b>60</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>80</a>
 <b>81</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>93</a>
 <b>94</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>332</a>
-<b>333</b>
-<v>2</v>
+<a>356</a>
+<b>357</b>
+<v>4</v>
 </b>
 <b>
-<a>341</a>
-<b>342</b>
-<v>2</v>
+<a>365</a>
+<b>366</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -16175,107 +16499,107 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>18</a>
 <b>19</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>22</a>
 <b>23</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>26</a>
 <b>27</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>30</a>
 <b>31</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>34</a>
 <b>35</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>38</a>
 <b>39</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>43</a>
 <b>44</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>51</a>
 <b>52</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>59</a>
 <b>60</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>80</a>
 <b>81</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>93</a>
 <b>94</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>332</a>
-<b>333</b>
-<v>2</v>
+<a>356</a>
+<b>357</b>
+<v>4</v>
 </b>
 <b>
-<a>341</a>
-<b>342</b>
-<v>2</v>
+<a>365</a>
+<b>366</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -16291,7 +16615,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3374</v>
+<v>6792</v>
 </b>
 </bs>
 </hist>
@@ -16307,7 +16631,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3374</v>
+<v>6792</v>
 </b>
 </bs>
 </hist>
@@ -16317,19 +16641,19 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>368399</cardinality>
+<cardinality>745834</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>368399</v>
+<v>745834</v>
 </e>
 <e>
 <k>type_id</k>
-<v>867</v>
+<v>1686</v>
 </e>
 <e>
 <k>target</k>
-<v>219716</v>
+<v>427238</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16343,7 +16667,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>368399</v>
+<v>745834</v>
 </b>
 </bs>
 </hist>
@@ -16359,7 +16683,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>368399</v>
+<v>745834</v>
 </b>
 </bs>
 </hist>
@@ -16375,67 +16699,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>115</v>
+<v>190</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>85</v>
+<v>194</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
-<b>9</b>
-<v>62</v>
+<b>10</b>
+<v>151</v>
 </b>
 <b>
-<a>9</a>
-<b>16</b>
-<v>67</v>
+<a>10</a>
+<b>18</b>
+<v>131</v>
 </b>
 <b>
-<a>16</a>
-<b>23</b>
-<v>65</v>
+<a>18</a>
+<b>28</b>
+<v>131</v>
 </b>
 <b>
-<a>23</a>
-<b>50</b>
-<v>65</v>
+<a>28</a>
+<b>54</b>
+<v>131</v>
 </b>
 <b>
-<a>50</a>
-<b>87</b>
-<v>65</v>
+<a>55</a>
+<b>119</b>
+<v>126</v>
 </b>
 <b>
-<a>90</a>
-<b>188</b>
-<v>65</v>
+<a>119</a>
+<b>232</b>
+<v>126</v>
 </b>
 <b>
-<a>194</a>
-<b>466</b>
-<v>65</v>
+<a>237</a>
+<b>608</b>
+<v>126</v>
 </b>
 <b>
-<a>498</a>
-<b>1735</b>
-<v>65</v>
+<a>616</a>
+<b>4825</b>
+<v>126</v>
 </b>
 <b>
-<a>1785</a>
-<b>41857</b>
-<v>27</v>
+<a>5142</a>
+<b>41859</b>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -16451,62 +16775,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>165</v>
+<v>316</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>67</v>
+<v>131</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>40</v>
+<v>77</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>72</v>
+<v>141</v>
 </b>
 <b>
 <a>9</a>
 <b>15</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>15</a>
-<b>26</b>
-<v>67</v>
+<b>25</b>
+<v>126</v>
 </b>
 <b>
-<a>26</a>
-<b>48</b>
-<v>65</v>
+<a>25</a>
+<b>47</b>
+<v>131</v>
 </b>
 <b>
-<a>48</a>
-<b>82</b>
-<v>67</v>
+<a>47</a>
+<b>81</b>
+<v>126</v>
 </b>
 <b>
-<a>82</a>
-<b>182</b>
-<v>65</v>
+<a>81</a>
+<b>176</b>
+<v>126</v>
 </b>
 <b>
-<a>183</a>
-<b>607</b>
-<v>65</v>
+<a>180</a>
+<b>563</b>
+<v>126</v>
 </b>
 <b>
-<a>607</a>
-<b>39377</b>
-<v>52</v>
+<a>596</a>
+<b>39379</b>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -16522,17 +16846,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188082</v>
+<v>365259</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24348</v>
+<v>47506</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>7284</v>
+<v>14472</v>
 </b>
 </bs>
 </hist>
@@ -16548,17 +16872,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202865</v>
+<v>394482</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>16660</v>
+<v>32385</v>
 </b>
 <b>
 <a>16</a>
 <b>20</b>
-<v>190</v>
+<v>370</v>
 </b>
 </bs>
 </hist>
@@ -16568,15 +16892,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>403061</cardinality>
+<cardinality>813924</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>368399</v>
+<v>745834</v>
 </e>
 <e>
 <k>loc</k>
-<v>36840</v>
+<v>72363</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16590,12 +16914,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333737</v>
+<v>677744</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34662</v>
+<v>68090</v>
 </b>
 </bs>
 </hist>
@@ -16611,12 +16935,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>34677</v>
+<v>68158</v>
 </b>
 <b>
 <a>4</a>
-<b>22087</b>
-<v>2163</v>
+<b>26599</b>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -16626,19 +16950,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>622003</cardinality>
+<cardinality>1252818</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>622003</v>
+<v>1252818</v>
 </e>
 <e>
 <k>type_id</k>
-<v>21696</v>
+<v>35202</v>
 </e>
 <e>
 <k>parent</k>
-<v>541633</v>
+<v>1030879</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16652,7 +16976,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>622003</v>
+<v>1252818</v>
 </b>
 </bs>
 </hist>
@@ -16668,7 +16992,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>622003</v>
+<v>1252818</v>
 </b>
 </bs>
 </hist>
@@ -16684,52 +17008,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5029</v>
+<v>5683</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4912</v>
+<v>7206</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1876</v>
+<v>3554</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1650</v>
+<v>3840</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1080</v>
+<v>1996</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>1622</v>
+<v>2859</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>1671</v>
+<v>2927</v>
 </b>
 <b>
 <a>12</a>
-<b>24</b>
-<v>1673</v>
+<b>22</b>
+<v>2761</v>
 </b>
 <b>
-<a>24</a>
-<b>119</b>
-<v>1633</v>
+<a>22</a>
+<b>67</b>
+<v>2654</v>
 </b>
 <b>
-<a>119</a>
-<b>44145</b>
-<v>547</v>
+<a>67</a>
+<b>80294</b>
+<v>1718</v>
 </b>
 </bs>
 </hist>
@@ -16745,47 +17069,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6457</v>
+<v>9878</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4662</v>
+<v>5861</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1635</v>
+<v>3391</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1239</v>
+<v>2829</v>
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>1984</v>
+<b>6</b>
+<v>1930</v>
 </b>
 <b>
-<a>7</a>
-<b>11</b>
-<v>1965</v>
+<a>6</a>
+<b>8</b>
+<v>2626</v>
 </b>
 <b>
-<a>11</a>
-<b>22</b>
-<v>1628</v>
+<a>8</a>
+<b>13</b>
+<v>2875</v>
 </b>
 <b>
-<a>22</a>
-<b>120</b>
-<v>1627</v>
+<a>13</a>
+<b>28</b>
+<v>2641</v>
 </b>
 <b>
-<a>120</a>
-<b>38647</b>
-<v>494</v>
+<a>28</a>
+<b>207</b>
+<v>2640</v>
+</b>
+<b>
+<a>207</a>
+<b>66416</b>
+<v>525</v>
 </b>
 </bs>
 </hist>
@@ -16801,17 +17130,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>480732</v>
+<v>873278</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55624</v>
+<v>141388</v>
 </b>
 <b>
 <a>3</a>
 <b>187</b>
-<v>5276</v>
+<v>16212</v>
 </b>
 </bs>
 </hist>
@@ -16827,12 +17156,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>532606</v>
+<v>1011551</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>9026</v>
+<v>19327</v>
 </b>
 </bs>
 </hist>
@@ -16842,15 +17171,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>626999</cardinality>
+<cardinality>1252818</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>626999</v>
+<v>1252818</v>
 </e>
 <e>
 <k>loc</k>
-<v>593108</v>
+<v>1163918</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16864,7 +17193,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>626999</v>
+<v>1252818</v>
 </b>
 </bs>
 </hist>
@@ -16880,12 +17209,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>572155</v>
+<v>1127479</v>
 </b>
 <b>
 <a>2</a>
-<b>187</b>
-<v>20953</v>
+<b>199</b>
+<v>36439</v>
 </b>
 </bs>
 </hist>
@@ -16895,15 +17224,15 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>25557</cardinality>
+<cardinality>50951</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>25557</v>
+<v>50951</v>
 </e>
 <e>
 <k>annotation</k>
-<v>7</v>
+<v>14</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16917,7 +17246,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>25557</v>
+<v>50951</v>
 </b>
 </bs>
 </hist>
@@ -16931,19 +17260,19 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1305</a>
-<b>1306</b>
-<v>2</v>
+<a>1306</a>
+<b>1307</b>
+<v>4</v>
 </b>
 <b>
-<a>2046</a>
-<b>2047</b>
-<v>2</v>
+<a>2047</a>
+<b>2048</b>
+<v>4</v>
 </b>
 <b>
-<a>6844</a>
-<b>6845</b>
-<v>2</v>
+<a>7103</a>
+<b>7104</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -16953,15 +17282,15 @@
 </relation>
 <relation>
 <name>nullability</name>
-<cardinality>997</cardinality>
+<cardinality>1997</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>997</v>
+<v>1997</v>
 </e>
 <e>
 <k>kind</k>
-<v>7</v>
+<v>14</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16975,7 +17304,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>997</v>
+<v>1997</v>
 </b>
 </bs>
 </hist>
@@ -16991,17 +17320,17 @@
 <b>
 <a>13</a>
 <b>14</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>120</a>
-<b>121</b>
-<v>2</v>
+<a>127</a>
+<b>128</b>
+<v>4</v>
 </b>
 <b>
-<a>265</a>
-<b>266</b>
-<v>2</v>
+<a>270</a>
+<b>271</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17011,19 +17340,19 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>3146</cardinality>
+<cardinality>6281</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>265</v>
+<v>521</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>parent</k>
-<v>990</v>
+<v>1983</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17037,22 +17366,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>172</v>
+<v>341</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>60</v>
+<v>116</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17</v>
+<v>34</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -17068,37 +17397,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>30</v>
+<v>53</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15</v>
+<v>38</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>22</v>
+<v>38</v>
 </b>
 <b>
 <a>8</a>
-<b>41</b>
-<v>20</v>
+<b>44</b>
+<v>43</v>
 </b>
 <b>
-<a>136</a>
-<b>201</b>
-<v>5</v>
+<a>138</a>
+<b>207</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -17114,37 +17443,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>39</a>
 <b>40</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>87</a>
-<b>88</b>
-<v>2</v>
+<a>88</a>
+<b>89</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17160,97 +17489,97 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>22</a>
 <b>23</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>44</a>
 <b>45</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>51</a>
-<b>52</b>
-<v>2</v>
+<a>52</a>
+<b>53</b>
+<v>4</v>
 </b>
 <b>
-<a>67</a>
-<b>68</b>
-<v>2</v>
+<a>69</a>
+<b>70</b>
+<v>4</v>
 </b>
 <b>
-<a>94</a>
-<b>95</b>
-<v>2</v>
+<a>97</a>
+<b>98</b>
+<v>4</v>
 </b>
 <b>
-<a>151</a>
-<b>152</b>
-<v>2</v>
+<a>157</a>
+<b>158</b>
+<v>4</v>
 </b>
 <b>
-<a>295</a>
-<b>296</b>
-<v>2</v>
+<a>305</a>
+<b>306</b>
+<v>4</v>
 </b>
 <b>
-<a>395</a>
-<b>396</b>
-<v>2</v>
+<a>407</a>
+<b>408</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17266,17 +17595,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>295</v>
+<v>594</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>616</v>
+<v>1227</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>77</v>
+<v>160</v>
 </b>
 </bs>
 </hist>
@@ -17292,37 +17621,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>250</v>
+<v>497</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>360</v>
+<v>721</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>142</v>
+<v>292</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>67</v>
+<v>136</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>67</v>
+<v>141</v>
 </b>
 <b>
 <a>8</a>
-<b>14</b>
-<v>75</v>
+<b>15</b>
+<v>155</v>
 </b>
 <b>
-<a>14</a>
+<a>15</a>
 <b>22</b>
-<v>25</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -17332,15 +17661,15 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>2271603</cardinality>
+<cardinality>4598536</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2238788</v>
+<v>4531334</v>
 </e>
 <e>
 <k>nullability</k>
-<v>601</v>
+<v>953</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17354,12 +17683,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2209099</v>
+<v>4470542</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>29689</v>
+<v>60792</v>
 </b>
 </bs>
 </hist>
@@ -17375,57 +17704,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>131</v>
+<v>159</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>81</v>
+<v>143</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>35</v>
+<v>59</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38</v>
+<v>65</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>48</v>
+<v>85</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>48</v>
+<v>68</v>
 </b>
 <b>
 <a>10</a>
-<b>13</b>
-<v>46</v>
+<b>14</b>
+<v>72</v>
 </b>
 <b>
-<a>13</a>
+<a>14</a>
 <b>23</b>
-<v>50</v>
+<v>75</v>
 </b>
 <b>
 <a>23</a>
-<b>61</b>
-<v>46</v>
+<b>41</b>
+<v>73</v>
 </b>
 <b>
-<a>63</a>
-<b>224</b>
-<v>46</v>
+<a>41</a>
+<b>123</b>
+<v>72</v>
 </b>
 <b>
-<a>278</a>
-<b>1814893</b>
-<v>32</v>
+<a>123</a>
+<b>4159</b>
+<v>72</v>
+</b>
+<b>
+<a>4585</a>
+<b>3676498</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -17435,11 +17769,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>1300115</cardinality>
+<cardinality>2971604</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1300115</v>
+<v>2971604</v>
 </e>
 <e>
 <k>state</k>
@@ -17457,7 +17791,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1300115</v>
+<v>2971604</v>
 </b>
 </bs>
 </hist>
@@ -17471,13 +17805,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>116006</a>
-<b>116007</b>
+<a>197310</a>
+<b>197311</b>
 <v>1</v>
 </b>
 <b>
-<a>1113915</a>
-<b>1113916</b>
+<a>2192990</a>
+<b>2192991</b>
 <v>1</v>
 </b>
 </bs>
@@ -17488,23 +17822,23 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>102354</cardinality>
+<cardinality>202784</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>102354</v>
+<v>202784</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>generic_id</k>
-<v>51560</v>
+<v>103755</v>
 </e>
 <e>
 <k>variance</k>
-<v>7</v>
+<v>14</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17518,7 +17852,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102354</v>
+<v>202784</v>
 </b>
 </bs>
 </hist>
@@ -17534,7 +17868,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102354</v>
+<v>202784</v>
 </b>
 </bs>
 </hist>
@@ -17550,7 +17884,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102354</v>
+<v>202784</v>
 </b>
 </bs>
 </hist>
@@ -17566,107 +17900,107 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>48</a>
 <b>49</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>170</a>
 <b>171</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>298</a>
 <b>299</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>429</a>
 <b>430</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>560</a>
 <b>561</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>691</a>
 <b>692</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>822</a>
 <b>823</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>954</a>
 <b>955</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1089</a>
 <b>1090</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1240</a>
 <b>1241</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1385</a>
 <b>1386</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1539</a>
 <b>1540</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1753</a>
-<b>1754</b>
-<v>2</v>
+<a>1757</a>
+<b>1758</b>
+<v>4</v>
 </b>
 <b>
-<a>2007</a>
-<b>2008</b>
-<v>2</v>
+<a>2015</a>
+<b>2016</b>
+<v>4</v>
 </b>
 <b>
-<a>2524</a>
-<b>2525</b>
-<v>2</v>
+<a>2536</a>
+<b>2537</b>
+<v>4</v>
 </b>
 <b>
-<a>4710</a>
-<b>4711</b>
-<v>2</v>
+<a>4744</a>
+<b>4745</b>
+<v>4</v>
 </b>
 <b>
-<a>20558</a>
-<b>20559</b>
-<v>2</v>
+<a>21279</a>
+<b>21280</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17682,107 +18016,107 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>48</a>
 <b>49</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>170</a>
 <b>171</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>298</a>
 <b>299</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>429</a>
 <b>430</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>560</a>
 <b>561</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>691</a>
 <b>692</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>822</a>
 <b>823</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>954</a>
 <b>955</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1089</a>
 <b>1090</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1240</a>
 <b>1241</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1385</a>
 <b>1386</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1539</a>
 <b>1540</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1753</a>
-<b>1754</b>
-<v>2</v>
+<a>1757</a>
+<b>1758</b>
+<v>4</v>
 </b>
 <b>
-<a>2007</a>
-<b>2008</b>
-<v>2</v>
+<a>2015</a>
+<b>2016</b>
+<v>4</v>
 </b>
 <b>
-<a>2524</a>
-<b>2525</b>
-<v>2</v>
+<a>2536</a>
+<b>2537</b>
+<v>4</v>
 </b>
 <b>
-<a>4712</a>
-<b>4713</b>
-<v>2</v>
+<a>4748</a>
+<b>4749</b>
+<v>4</v>
 </b>
 <b>
-<a>20568</a>
-<b>20569</b>
-<v>2</v>
+<a>21292</a>
+<b>21293</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17798,17 +18132,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>40</v>
+<v>77</v>
 </b>
 </bs>
 </hist>
@@ -17824,22 +18158,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39748</v>
+<v>80618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5484</v>
+<v>10779</v>
 </b>
 <b>
 <a>3</a>
-<b>10</b>
-<v>3935</v>
+<b>11</b>
+<v>8352</v>
 </b>
 <b>
-<a>10</a>
+<a>11</a>
 <b>22</b>
-<v>2391</v>
+<v>4005</v>
 </b>
 </bs>
 </hist>
@@ -17855,22 +18189,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39748</v>
+<v>80618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5484</v>
+<v>10779</v>
 </b>
 <b>
 <a>3</a>
-<b>10</b>
-<v>3935</v>
+<b>11</b>
+<v>8352</v>
 </b>
 <b>
-<a>10</a>
+<a>11</a>
 <b>22</b>
-<v>2391</v>
+<v>4005</v>
 </b>
 </bs>
 </hist>
@@ -17886,12 +18220,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51482</v>
+<v>103604</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>77</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -17907,17 +18241,17 @@
 <b>
 <a>68</a>
 <b>69</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>310</a>
 <b>311</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>40440</a>
-<b>40441</b>
-<v>2</v>
+<a>41219</a>
+<b>41220</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17933,17 +18267,17 @@
 <b>
 <a>16</a>
 <b>17</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>17</a>
 <b>18</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21</a>
 <b>22</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17959,17 +18293,17 @@
 <b>
 <a>65</a>
 <b>66</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>72</a>
 <b>73</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>20462</a>
-<b>20463</b>
-<v>2</v>
+<a>21186</a>
+<b>21187</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -17979,19 +18313,19 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>315219</cardinality>
+<cardinality>644081</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>136875</v>
+<v>273384</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>constructed_id</k>
-<v>201248</v>
+<v>413077</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18005,17 +18339,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119004</v>
+<v>234775</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17166</v>
+<v>37132</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>704</v>
+<v>1476</v>
 </b>
 </bs>
 </hist>
@@ -18031,27 +18365,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>88393</v>
+<v>174014</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27419</v>
+<v>56497</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>10305</v>
+<v>20578</v>
 </b>
 <b>
 <a>5</a>
-<b>25</b>
-<v>10278</v>
+<b>23</b>
+<v>20661</v>
 </b>
 <b>
-<a>25</a>
-<b>2394</b>
-<v>478</v>
+<a>23</a>
+<b>2800</b>
+<v>1632</v>
 </b>
 </bs>
 </hist>
@@ -18067,97 +18401,97 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>55</a>
 <b>56</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>167</a>
 <b>168</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>283</a>
 <b>284</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>402</a>
 <b>403</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>521</a>
 <b>522</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>640</a>
 <b>641</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>759</a>
 <b>760</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>883</a>
 <b>884</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1002</a>
 <b>1003</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1232</a>
 <b>1233</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1327</a>
 <b>1328</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1510</a>
-<b>1511</b>
-<v>2</v>
+<a>1515</a>
+<b>1516</b>
+<v>4</v>
 </b>
 <b>
-<a>1717</a>
-<b>1718</b>
-<v>2</v>
+<a>1729</a>
+<b>1730</b>
+<v>4</v>
 </b>
 <b>
-<a>1979</a>
-<b>1980</b>
-<v>2</v>
+<a>2010</a>
+<b>2011</b>
+<v>4</v>
 </b>
 <b>
-<a>3839</a>
-<b>3840</b>
-<v>2</v>
+<a>4190</a>
+<b>4191</b>
+<v>4</v>
 </b>
 <b>
-<a>13565</a>
-<b>13566</b>
-<v>2</v>
+<a>14311</a>
+<b>14312</b>
+<v>4</v>
 </b>
 <b>
-<a>32507</a>
-<b>32508</b>
-<v>2</v>
+<a>33697</a>
+<b>33698</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -18173,97 +18507,97 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>96</a>
 <b>97</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>227</a>
 <b>228</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>365</a>
 <b>366</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>503</a>
 <b>504</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>641</a>
 <b>642</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>779</a>
 <b>780</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>917</a>
 <b>918</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1061</a>
 <b>1062</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1201</a>
 <b>1202</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1456</a>
 <b>1457</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1641</a>
-<b>1642</b>
-<v>2</v>
+<a>1643</a>
+<b>1644</b>
+<v>4</v>
 </b>
 <b>
-<a>1859</a>
-<b>1860</b>
-<v>2</v>
+<a>1866</a>
+<b>1867</b>
+<v>4</v>
 </b>
 <b>
-<a>2240</a>
-<b>2241</b>
-<v>2</v>
+<a>2254</a>
+<b>2255</b>
+<v>4</v>
 </b>
 <b>
-<a>2987</a>
-<b>2988</b>
-<v>2</v>
+<a>3022</a>
+<b>3023</b>
+<v>4</v>
 </b>
 <b>
-<a>5285</a>
-<b>5286</b>
-<v>2</v>
+<a>5701</a>
+<b>5702</b>
+<v>4</v>
 </b>
 <b>
-<a>24196</a>
-<b>24197</b>
-<v>2</v>
+<a>25663</a>
+<b>25664</b>
+<v>4</v>
 </b>
 <b>
-<a>80280</a>
-<b>80281</b>
-<v>2</v>
+<a>84769</a>
+<b>84770</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -18279,17 +18613,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>141661</v>
+<v>290186</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>46887</v>
+<v>96275</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>12699</v>
+<v>26616</v>
 </b>
 </bs>
 </hist>
@@ -18305,17 +18639,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140593</v>
+<v>288022</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47406</v>
+<v>97274</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>13248</v>
+<v>27780</v>
 </b>
 </bs>
 </hist>
@@ -18325,15 +18659,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>201248</cardinality>
+<cardinality>413077</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>201248</v>
+<v>413077</v>
 </e>
 <e>
 <k>generic</k>
-<v>4256</v>
+<v>8581</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18347,7 +18681,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>201248</v>
+<v>413077</v>
 </b>
 </bs>
 </hist>
@@ -18363,47 +18697,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1737</v>
+<v>3445</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>551</v>
+<v>1154</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>293</v>
+<v>618</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>330</v>
+<v>652</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>350</v>
+<v>726</v>
 </b>
 <b>
 <a>11</a>
-<b>25</b>
-<v>328</v>
+<b>26</b>
+<v>648</v>
 </b>
 <b>
-<a>25</a>
-<b>61</b>
-<v>320</v>
+<a>26</a>
+<b>63</b>
+<v>657</v>
 </b>
 <b>
-<a>61</a>
-<b>2054</b>
-<v>320</v>
+<a>63</a>
+<b>2866</b>
+<v>648</v>
 </b>
 <b>
-<a>2323</a>
-<b>10856</b>
-<v>22</v>
+<a>2964</a>
+<b>11327</b>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -18413,15 +18747,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>273733</cardinality>
+<cardinality>594420</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273733</v>
+<v>594420</v>
 </e>
 <e>
 <k>param_id</k>
-<v>102321</v>
+<v>202696</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18435,7 +18769,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>273733</v>
+<v>594420</v>
 </b>
 </bs>
 </hist>
@@ -18451,17 +18785,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>86049</v>
+<v>167328</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9393</v>
+<v>19993</v>
 </b>
 <b>
 <a>3</a>
-<b>1740</b>
-<v>6878</v>
+<b>307</b>
+<v>15203</v>
+</b>
+<b>
+<a>311</a>
+<b>2109</b>
+<v>170</v>
 </b>
 </bs>
 </hist>
@@ -18507,11 +18846,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>40912</cardinality>
+<cardinality>106710</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>23697</v>
+<v>60470</v>
 </e>
 <e>
 <k>kind</k>
@@ -18529,12 +18868,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6482</v>
+<v>14230</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17215</v>
+<v>46240</v>
 </b>
 </bs>
 </hist>
@@ -18553,23 +18892,23 @@
 <v>1</v>
 </b>
 <b>
-<a>172</a>
-<b>173</b>
+<a>281</a>
+<b>282</b>
 <v>1</v>
 </b>
 <b>
-<a>2708</a>
-<b>2709</b>
+<a>5846</a>
+<b>5847</b>
 <v>1</v>
 </b>
 <b>
-<a>17170</a>
-<b>17171</b>
+<a>46183</a>
+<b>46184</b>
 <v>1</v>
 </b>
 <b>
-<a>20858</a>
-<b>20859</b>
+<a>54396</a>
+<b>54397</b>
 <v>1</v>
 </b>
 </bs>
@@ -18580,15 +18919,15 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>20140</cardinality>
+<cardinality>46398</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19736</v>
+<v>45693</v>
 </e>
 <e>
 <k>base_id</k>
-<v>787</v>
+<v>1286</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18602,12 +18941,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19370</v>
+<v>45034</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>366</v>
+<v>659</v>
 </b>
 </bs>
 </hist>
@@ -18628,48 +18967,58 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>181</v>
+<v>257</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>57</v>
+<v>73</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>87</v>
+<v>91</v>
 </b>
 <b>
 <a>5</a>
+<b>6</b>
+<v>58</v>
+</b>
+<b>
+<a>6</a>
 <b>7</b>
-<v>70</v>
+<v>138</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>53</v>
+<v>108</v>
 </b>
 <b>
 <a>10</a>
 <b>15</b>
-<v>63</v>
+<v>99</v>
 </b>
 <b>
 <a>15</a>
-<b>26</b>
+<b>21</b>
+<v>111</v>
+</b>
+<b>
+<a>21</a>
+<b>37</b>
+<v>97</v>
+</b>
+<b>
+<a>37</a>
+<b>106</b>
+<v>97</v>
+</b>
+<b>
+<a>108</a>
+<b>4906</b>
 <v>60</v>
 </b>
-<b>
-<a>26</a>
-<b>55</b>
-<v>61</v>
-</b>
-<b>
-<a>56</a>
-<b>3216</b>
-<v>58</v>
-</b>
 </bs>
 </hist>
 </val>
@@ -18678,19 +19027,19 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>13207</cardinality>
+<cardinality>31539</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13161</v>
+<v>31392</v>
 </e>
 <e>
 <k>base_id</k>
-<v>506</v>
+<v>911</v>
 </e>
 <e>
 <k>nullability</k>
-<v>11</v>
+<v>17</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18704,12 +19053,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13115</v>
+<v>31245</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>46</v>
+<v>147</v>
 </b>
 </bs>
 </hist>
@@ -18725,7 +19074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13161</v>
+<v>31392</v>
 </b>
 </bs>
 </hist>
@@ -18741,57 +19090,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99</v>
+<v>97</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>107</v>
+<v>150</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37</v>
+<v>48</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>31</v>
+<v>41</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>16</v>
+<v>52</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>41</v>
+<v>102</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>32</v>
+<b>9</b>
+<v>72</v>
 </b>
 <b>
-<a>10</a>
-<b>13</b>
-<v>39</v>
+<a>9</a>
+<b>12</b>
+<v>45</v>
 </b>
 <b>
-<a>13</a>
-<b>26</b>
-<v>38</v>
+<a>12</a>
+<b>16</b>
+<v>70</v>
 </b>
 <b>
-<a>26</a>
-<b>82</b>
-<v>40</v>
+<a>16</a>
+<b>22</b>
+<v>71</v>
 </b>
 <b>
-<a>84</a>
-<b>2385</b>
-<v>26</v>
+<a>22</a>
+<b>39</b>
+<v>71</v>
+</b>
+<b>
+<a>39</a>
+<b>186</b>
+<v>69</v>
+</b>
+<b>
+<a>190</a>
+<b>4327</b>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -18807,12 +19166,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>497</v>
+<v>889</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9</v>
+<v>22</v>
 </b>
 </bs>
 </hist>
@@ -18833,17 +19192,37 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>1</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1</v>
+<v>3</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
 </b>
 <b>
 <a>24</a>
@@ -18851,18 +19230,28 @@
 <v>1</v>
 </b>
 <b>
-<a>41</a>
-<b>42</b>
+<a>64</a>
+<b>65</b>
 <v>1</v>
 </b>
 <b>
-<a>132</a>
-<b>133</b>
+<a>72</a>
+<b>73</b>
 <v>1</v>
 </b>
 <b>
-<a>12930</a>
-<b>12931</b>
+<a>117</a>
+<b>118</b>
+<v>1</v>
+</b>
+<b>
+<a>386</a>
+<b>387</b>
+<v>1</v>
+</b>
+<b>
+<a>30639</a>
+<b>30640</b>
 <v>1</v>
 </b>
 </bs>
@@ -18879,12 +19268,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>6</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4</v>
+<v>3</v>
 </b>
 <b>
 <a>3</a>
@@ -18894,21 +19283,26 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>1</v>
-</b>
-<b>
-<a>6</a>
-<b>7</b>
-<v>1</v>
+<v>2</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
 <v>1</v>
 </b>
 <b>
-<a>482</a>
-<b>483</b>
+<a>43</a>
+<b>44</b>
+<v>1</v>
+</b>
+<b>
+<a>835</a>
+<b>836</b>
 <v>1</v>
 </b>
 </bs>
@@ -18919,15 +19313,15 @@
 </relation>
 <relation>
 <name>function_pointer_calling_conventions</name>
-<cardinality>9</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>9</v>
+<v>11</v>
 </e>
 <e>
 <k>kind</k>
-<v>2</v>
+<v>1</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18941,7 +19335,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9</v>
+<v>11</v>
 </b>
 </bs>
 </hist>
@@ -18955,13 +19349,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>1</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
+<a>9</a>
+<b>10</b>
 <v>1</v>
 </b>
 </bs>
@@ -19052,15 +19441,15 @@
 </relation>
 <relation>
 <name>modifiers</name>
-<cardinality>42</cardinality>
+<cardinality>82</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42</v>
+<v>82</v>
 </e>
 <e>
 <k>name</k>
-<v>42</v>
+<v>82</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19074,7 +19463,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42</v>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -19090,7 +19479,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42</v>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -19100,15 +19489,15 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>2748133</cardinality>
+<cardinality>5507492</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1841097</v>
+<v>3699060</v>
 </e>
 <e>
 <k>mod_id</k>
-<v>40</v>
+<v>82</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19122,17 +19511,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1002460</v>
+<v>2026176</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>771185</v>
+<v>1539180</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>67451</v>
+<v>133704</v>
 </b>
 </bs>
 </hist>
@@ -19146,84 +19535,89 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>5</a>
-<b>6</b>
-<v>2</v>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>4</v>
 </b>
 <b>
 <a>28</a>
 <b>29</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>149</a>
-<b>150</b>
-<v>2</v>
+<a>151</a>
+<b>152</b>
+<v>4</v>
 </b>
 <b>
 <a>360</a>
 <b>361</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>5658</a>
-<b>5659</b>
-<v>2</v>
+<a>6163</a>
+<b>6164</b>
+<v>4</v>
 </b>
 <b>
-<a>16373</a>
-<b>16374</b>
-<v>2</v>
+<a>16387</a>
+<b>16388</b>
+<v>4</v>
 </b>
 <b>
-<a>22977</a>
-<b>22978</b>
-<v>2</v>
+<a>23884</a>
+<b>23885</b>
+<v>4</v>
 </b>
 <b>
-<a>29954</a>
-<b>29955</b>
-<v>2</v>
+<a>30035</a>
+<b>30036</b>
+<v>4</v>
 </b>
 <b>
-<a>30538</a>
-<b>30539</b>
-<v>2</v>
+<a>30699</a>
+<b>30700</b>
+<v>4</v>
 </b>
 <b>
-<a>37974</a>
-<b>37975</b>
-<v>2</v>
+<a>38027</a>
+<b>38028</b>
+<v>4</v>
 </b>
 <b>
-<a>60421</a>
-<b>60422</b>
-<v>2</v>
+<a>62139</a>
+<b>62140</b>
+<v>4</v>
 </b>
 <b>
-<a>63249</a>
-<b>63250</b>
-<v>2</v>
+<a>63917</a>
+<b>63918</b>
+<v>4</v>
 </b>
 <b>
-<a>68508</a>
-<b>68509</b>
-<v>2</v>
+<a>68706</a>
+<b>68707</b>
+<v>4</v>
 </b>
 <b>
-<a>78672</a>
-<b>78673</b>
-<v>2</v>
+<a>83872</a>
+<b>83873</b>
+<v>4</v>
 </b>
 <b>
-<a>89979</a>
-<b>89980</b>
-<v>2</v>
+<a>96025</a>
+<b>96026</b>
+<v>4</v>
 </b>
 <b>
-<a>591411</a>
-<b>591412</b>
-<v>2</v>
+<a>609801</a>
+<b>609802</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -19233,26 +19627,26 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>64039</cardinality>
+<cardinality>136248</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>64039</v>
+<v>136248</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>exprorstmt_name</name>
-<cardinality>1469</cardinality>
+<cardinality>3753</cardinality>
 <columnsizes>
 <e>
 <k>parent_id</k>
-<v>1469</v>
+<v>3753</v>
 </e>
 <e>
 <k>name</k>
-<v>118</v>
+<v>374</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19266,7 +19660,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1469</v>
+<v>3753</v>
 </b>
 </bs>
 </hist>
@@ -19282,47 +19676,47 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>43</v>
+<v>110</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9</v>
+<v>55</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>50</v>
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>10</v>
+<b>6</b>
+<v>34</v>
 </b>
 <b>
-<a>7</a>
-<b>9</b>
-<v>9</v>
+<a>6</a>
+<b>8</b>
+<v>32</v>
 </b>
 <b>
-<a>10</a>
-<b>15</b>
-<v>9</v>
+<a>8</a>
+<b>12</b>
+<v>28</v>
 </b>
 <b>
-<a>16</a>
-<b>26</b>
-<v>7</v>
+<a>12</a>
+<b>23</b>
+<v>31</v>
 </b>
 <b>
-<a>26</a>
-<b>52</b>
-<v>10</v>
+<a>25</a>
+<b>214</b>
+<v>28</v>
 </b>
 <b>
-<a>54</a>
-<b>131</b>
-<v>5</v>
+<a>239</a>
+<b>240</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -19332,19 +19726,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>57075</cardinality>
+<cardinality>111985</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>57075</v>
+<v>111985</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>20621</v>
+<v>40616</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>41748</v>
+<v>81154</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19358,7 +19752,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57075</v>
+<v>111985</v>
 </b>
 </bs>
 </hist>
@@ -19374,7 +19768,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57075</v>
+<v>111985</v>
 </b>
 </bs>
 </hist>
@@ -19390,32 +19784,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11922</v>
+<v>23497</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3253</v>
+<v>6339</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1566</v>
+<v>3230</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1732</v>
+<v>3357</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>1581</v>
+<v>3094</v>
 </b>
 <b>
 <a>12</a>
 <b>262</b>
-<v>564</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -19431,32 +19825,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11940</v>
+<v>23531</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3296</v>
+<v>6422</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1524</v>
+<v>3147</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1742</v>
+<v>3386</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>1579</v>
+<v>3079</v>
 </b>
 <b>
 <a>12</a>
 <b>206</b>
-<v>538</v>
+<v>1047</v>
 </b>
 </bs>
 </hist>
@@ -19472,12 +19866,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40237</v>
+<v>78138</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>1511</v>
+<v>3016</v>
 </b>
 </bs>
 </hist>
@@ -19493,12 +19887,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40613</v>
+<v>78878</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>1135</v>
+<v>2275</v>
 </b>
 </bs>
 </hist>
@@ -19508,27 +19902,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>212542</cardinality>
+<cardinality>425801</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>212542</v>
+<v>425801</v>
 </e>
 <e>
 <k>name</k>
-<v>43400</v>
+<v>84400</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>58256</v>
+<v>118008</v>
 </e>
 <e>
 <k>type_id</k>
-<v>26015</v>
+<v>53037</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>171648</v>
+<v>334003</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19542,7 +19936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212542</v>
+<v>425801</v>
 </b>
 </bs>
 </hist>
@@ -19558,7 +19952,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212542</v>
+<v>425801</v>
 </b>
 </bs>
 </hist>
@@ -19574,7 +19968,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212542</v>
+<v>425801</v>
 </b>
 </bs>
 </hist>
@@ -19590,7 +19984,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212542</v>
+<v>425801</v>
 </b>
 </bs>
 </hist>
@@ -19606,32 +20000,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26111</v>
+<v>50776</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7204</v>
+<v>14000</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2970</v>
+<v>5754</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3414</v>
+<v>6651</v>
 </b>
 <b>
 <a>7</a>
-<b>50</b>
-<v>3276</v>
+<b>49</b>
+<v>6339</v>
 </b>
 <b>
-<a>50</a>
-<b>2493</b>
-<v>423</v>
+<a>49</a>
+<b>2886</b>
+<v>877</v>
 </b>
 </bs>
 </hist>
@@ -19647,32 +20041,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26111</v>
+<v>50776</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7239</v>
+<v>14068</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2963</v>
+<v>5740</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3431</v>
+<v>6685</v>
 </b>
 <b>
 <a>7</a>
-<b>52</b>
-<v>3256</v>
+<b>51</b>
+<v>6334</v>
 </b>
 <b>
-<a>52</a>
-<b>2224</b>
-<v>398</v>
+<a>51</a>
+<b>2578</b>
+<v>794</v>
 </b>
 </bs>
 </hist>
@@ -19688,17 +20082,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>37474</v>
+<v>72870</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3569</v>
+<v>6934</v>
 </b>
 <b>
 <a>3</a>
-<b>522</b>
-<v>2356</v>
+<b>773</b>
+<v>4595</v>
 </b>
 </bs>
 </hist>
@@ -19714,32 +20108,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26331</v>
+<v>51205</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7340</v>
+<v>14263</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2963</v>
+<v>5740</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3304</v>
+<v>6446</v>
 </b>
 <b>
 <a>7</a>
-<b>70</b>
-<v>3256</v>
+<b>68</b>
+<v>6330</v>
 </b>
 <b>
-<a>70</a>
+<a>68</a>
 <b>2018</b>
-<v>205</v>
+<v>414</v>
 </b>
 </bs>
 </hist>
@@ -19755,42 +20149,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19786</v>
+<v>40655</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14574</v>
+<v>30154</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5590</v>
+<v>10905</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4013</v>
+<v>7845</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3629</v>
+<v>7187</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4670</v>
+<v>9331</v>
 </b>
 <b>
 <a>8</a>
-<b>15</b>
-<v>4396</v>
+<b>16</b>
+<v>9570</v>
 </b>
 <b>
-<a>15</a>
+<a>16</a>
 <b>250</b>
-<v>1594</v>
+<v>2358</v>
 </b>
 </bs>
 </hist>
@@ -19806,42 +20200,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22107</v>
+<v>45440</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12293</v>
+<v>25446</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5587</v>
+<v>10900</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4023</v>
+<v>7918</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3637</v>
+<v>7148</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4647</v>
+<v>9287</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>4605</v>
+<v>9229</v>
 </b>
 <b>
 <a>15</a>
 <b>250</b>
-<v>1353</v>
+<v>2636</v>
 </b>
 </bs>
 </hist>
@@ -19857,31 +20251,144 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22884</v>
+<v>46722</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15963</v>
+<v>32902</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6963</v>
+<v>13897</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3873</v>
+<v>7548</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>4828</v>
+<v>9385</v>
 </b>
 <b>
 <a>7</a>
 <b>48</b>
+<v>7553</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>40655</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>30154</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10905</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7845</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7187</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9331</v>
+</b>
+<b>
+<a>8</a>
+<b>16</b>
+<v>9570</v>
+</b>
+<b>
+<a>16</a>
+<b>250</b>
+<v>2358</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>32030</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10959</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>4702</v>
+</b>
+<b>
+<a>5</a>
+<b>21</b>
+<v>3986</v>
+</b>
+<b>
+<a>21</a>
+<b>12516</b>
+<v>1359</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>44831</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4463</v>
+</b>
+<b>
+<a>3</a>
+<b>3289</b>
 <v>3742</v>
 </b>
 </bs>
@@ -19889,119 +20396,6 @@
 </val>
 </dep>
 <dep>
-<src>declaring_type_id</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>19786</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>14574</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5590</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>4013</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>3629</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>4670</v>
-</b>
-<b>
-<a>8</a>
-<b>15</b>
-<v>4396</v>
-</b>
-<b>
-<a>15</a>
-<b>250</b>
-<v>1594</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>15635</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>5319</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>2353</v>
-</b>
-<b>
-<a>5</a>
-<b>19</b>
-<v>1955</v>
-</b>
-<b>
-<a>19</a>
-<b>11856</b>
-<v>752</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>21932</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>2213</v>
-</b>
-<b>
-<a>3</a>
-<b>3289</b>
-<v>1870</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
 <src>type_id</src>
 <trg>declaring_type_id</trg>
 <val>
@@ -20011,27 +20405,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16244</v>
+<v>33209</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5169</v>
+<v>10671</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2243</v>
+<v>4492</v>
 </b>
 <b>
 <a>5</a>
-<b>30</b>
-<v>1952</v>
+<b>35</b>
+<v>3995</v>
 </b>
 <b>
-<a>30</a>
-<b>5894</b>
-<v>406</v>
+<a>35</a>
+<b>6176</b>
+<v>667</v>
 </b>
 </bs>
 </hist>
@@ -20047,27 +20441,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15707</v>
+<v>32171</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5392</v>
+<v>11086</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2356</v>
+<v>4741</v>
 </b>
 <b>
 <a>5</a>
-<b>21</b>
-<v>1975</v>
+<b>23</b>
+<v>4005</v>
 </b>
 <b>
-<a>21</a>
-<b>10599</b>
-<v>584</v>
+<a>23</a>
+<b>10636</b>
+<v>1033</v>
 </b>
 </bs>
 </hist>
@@ -20083,12 +20477,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>169043</v>
+<v>328770</v>
 </b>
 <b>
 <a>2</a>
-<b>585</b>
-<v>2604</v>
+<b>705</b>
+<v>5233</v>
 </b>
 </bs>
 </hist>
@@ -20104,7 +20498,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171648</v>
+<v>334003</v>
 </b>
 </bs>
 </hist>
@@ -20120,12 +20514,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>169043</v>
+<v>328770</v>
 </b>
 <b>
 <a>2</a>
-<b>585</b>
-<v>2604</v>
+<b>705</b>
+<v>5233</v>
 </b>
 </bs>
 </hist>
@@ -20141,12 +20535,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171048</v>
+<v>332771</v>
 </b>
 <b>
 <a>2</a>
-<b>438</b>
-<v>599</v>
+<b>690</b>
+<v>1232</v>
 </b>
 </bs>
 </hist>
@@ -20156,15 +20550,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>263937</cardinality>
+<cardinality>536773</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>212542</v>
+<v>425801</v>
 </e>
 <e>
 <k>loc</k>
-<v>24308</v>
+<v>52920</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20178,17 +20572,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171527</v>
+<v>340333</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32779</v>
+<v>64133</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>8234</v>
+<v>21333</v>
 </b>
 </bs>
 </hist>
@@ -20204,12 +20598,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22594</v>
+<v>49436</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>1714</v>
+<v>3484</v>
 </b>
 </bs>
 </hist>
@@ -20219,27 +20613,27 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>7590</cardinality>
+<cardinality>17050</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7590</v>
+<v>17050</v>
 </e>
 <e>
 <k>name</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>6071</v>
+<v>13556</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1817</v>
+<v>3971</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>2283</v>
+<v>4439</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20253,7 +20647,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7590</v>
+<v>17050</v>
 </b>
 </bs>
 </hist>
@@ -20269,7 +20663,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7590</v>
+<v>17050</v>
 </b>
 </bs>
 </hist>
@@ -20285,7 +20679,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7590</v>
+<v>17050</v>
 </b>
 </bs>
 </hist>
@@ -20301,7 +20695,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7590</v>
+<v>17050</v>
 </b>
 </bs>
 </hist>
@@ -20317,22 +20711,22 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>3017</a>
-<b>3018</b>
-<v>2</v>
+<a>3488</a>
+<b>3489</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20348,22 +20742,22 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>2415</a>
-<b>2416</b>
-<v>2</v>
+<a>2775</a>
+<b>2776</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20379,17 +20773,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>720</a>
-<b>721</b>
-<v>2</v>
+<a>810</a>
+<b>811</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20405,22 +20799,22 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>900</a>
 <b>901</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20436,17 +20830,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4770</v>
+<v>10511</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1160</v>
+<v>2748</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>140</v>
+<v>297</v>
 </b>
 </bs>
 </hist>
@@ -20462,12 +20856,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6066</v>
+<v>13546</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -20483,12 +20877,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5046</v>
+<v>11051</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1025</v>
+<v>2504</v>
 </b>
 </bs>
 </hist>
@@ -20504,17 +20898,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4770</v>
+<v>10511</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1160</v>
+<v>2748</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>140</v>
+<v>297</v>
 </b>
 </bs>
 </hist>
@@ -20530,27 +20924,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>461</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>423</v>
+<v>872</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>674</v>
+<v>1627</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>120</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
-<b>886</b>
-<v>137</v>
+<b>18</b>
+<v>302</v>
+</b>
+<b>
+<a>18</a>
+<b>1020</b>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -20566,12 +20965,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1814</v>
+<v>3966</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20587,27 +20986,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>541</v>
+<v>1033</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>376</v>
+<v>779</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>691</v>
+<v>1661</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>165</v>
+<b>6</b>
+<v>238</v>
 </b>
 <b>
-<a>7</a>
-<b>845</b>
-<v>42</v>
+<a>6</a>
+<b>978</b>
+<v>258</v>
 </b>
 </bs>
 </hist>
@@ -20623,27 +21022,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>461</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>423</v>
+<v>872</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>686</v>
+<v>1651</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>120</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>198</b>
-<v>125</v>
+<v>302</v>
 </b>
 </bs>
 </hist>
@@ -20659,12 +21058,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2118</v>
+<v>4103</v>
 </b>
 <b>
 <a>2</a>
-<b>384</b>
-<v>165</v>
+<b>452</b>
+<v>336</v>
 </b>
 </bs>
 </hist>
@@ -20680,7 +21079,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2283</v>
+<v>4439</v>
 </b>
 </bs>
 </hist>
@@ -20696,12 +21095,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2118</v>
+<v>4103</v>
 </b>
 <b>
 <a>2</a>
-<b>384</b>
-<v>165</v>
+<b>452</b>
+<v>336</v>
 </b>
 </bs>
 </hist>
@@ -20717,12 +21116,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2190</v>
+<v>4249</v>
 </b>
 <b>
 <a>2</a>
-<b>384</b>
-<v>92</v>
+<b>452</b>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -20732,15 +21131,15 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>12780</cardinality>
+<cardinality>23901</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>6439</v>
+<v>12715</v>
 </e>
 <e>
 <k>loc</k>
-<v>183</v>
+<v>222</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20754,27 +21153,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2232</v>
+<v>4499</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3081</v>
+<v>6699</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>283</v>
+<v>287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>774</v>
+<v>1116</v>
 </b>
 <b>
 <a>5</a>
-<b>11</b>
-<v>69</v>
+<b>13</b>
+<v>114</v>
 </b>
 </bs>
 </hist>
@@ -20790,17 +21189,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49</v>
+<v>77</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19</v>
+<v>18</v>
 </b>
 <b>
 <a>4</a>
@@ -20810,32 +21209,32 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>14</v>
+<v>18</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>14</v>
+<v>16</v>
 </b>
 <b>
 <a>13</a>
-<b>20</b>
-<v>14</v>
+<b>21</b>
+<v>18</v>
 </b>
 <b>
-<a>20</a>
-<b>35</b>
-<v>14</v>
+<a>23</a>
+<b>45</b>
+<v>17</v>
 </b>
 <b>
-<a>36</a>
-<b>112</b>
-<v>14</v>
+<a>47</a>
+<b>1551</b>
+<v>17</v>
 </b>
 <b>
-<a>124</a>
-<b>2196</b>
-<v>11</v>
+<a>2440</a>
+<b>5398</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20845,27 +21244,27 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>284483</cardinality>
+<cardinality>570207</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>284483</v>
+<v>570207</v>
 </e>
 <e>
 <k>kind</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>name</k>
-<v>62337</v>
+<v>121303</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>220132</v>
+<v>442851</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>226384</v>
+<v>440634</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20879,7 +21278,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>284483</v>
+<v>570207</v>
 </b>
 </bs>
 </hist>
@@ -20895,7 +21294,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>284483</v>
+<v>570207</v>
 </b>
 </bs>
 </hist>
@@ -20911,7 +21310,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>284483</v>
+<v>570207</v>
 </b>
 </bs>
 </hist>
@@ -20927,7 +21326,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>284483</v>
+<v>570207</v>
 </b>
 </bs>
 </hist>
@@ -20941,14 +21340,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>25718</a>
-<b>25719</b>
-<v>2</v>
+<a>26183</a>
+<b>26184</b>
+<v>4</v>
 </b>
 <b>
-<a>87765</a>
-<b>87766</b>
-<v>2</v>
+<a>90831</a>
+<b>90832</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20962,14 +21361,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>6501</a>
-<b>6502</b>
-<v>2</v>
+<a>6520</a>
+<b>6521</b>
+<v>4</v>
 </b>
 <b>
-<a>18366</a>
-<b>18367</b>
-<v>2</v>
+<a>18373</a>
+<b>18374</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -20983,14 +21382,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>25717</a>
-<b>25718</b>
-<v>2</v>
+<a>26182</a>
+<b>26183</b>
+<v>4</v>
 </b>
 <b>
-<a>87764</a>
-<b>87765</b>
-<v>2</v>
+<a>90830</a>
+<b>90831</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -21004,14 +21403,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>20971</a>
-<b>20972</b>
-<v>2</v>
+<a>21018</a>
+<b>21019</b>
+<v>4</v>
 </b>
 <b>
-<a>69336</a>
-<b>69337</b>
-<v>2</v>
+<a>69406</a>
+<b>69407</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -21027,27 +21426,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38650</v>
+<v>75229</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10267</v>
+<v>19959</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4103</v>
+<v>7933</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>5186</v>
+<v>10116</v>
 </b>
 <b>
 <a>8</a>
-<b>2204</b>
-<v>4128</v>
+<b>2558</b>
+<v>8064</v>
 </b>
 </bs>
 </hist>
@@ -21063,7 +21462,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62337</v>
+<v>121303</v>
 </b>
 </bs>
 </hist>
@@ -21079,27 +21478,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38655</v>
+<v>75238</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10262</v>
+<v>19949</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4103</v>
+<v>7933</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>5186</v>
+<v>10116</v>
 </b>
 <b>
 <a>8</a>
-<b>2204</b>
-<v>4128</v>
+<b>2558</b>
+<v>8064</v>
 </b>
 </bs>
 </hist>
@@ -21115,27 +21514,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38981</v>
+<v>75877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10611</v>
+<v>20627</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4020</v>
+<v>7767</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4933</v>
+<v>9658</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>3790</v>
+<v>7372</v>
 </b>
 </bs>
 </hist>
@@ -21151,17 +21550,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>155787</v>
+<v>315506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64342</v>
+<v>127340</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -21177,12 +21576,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>155787</v>
+<v>315506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64345</v>
+<v>127345</v>
 </b>
 </bs>
 </hist>
@@ -21198,12 +21597,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>155787</v>
+<v>315506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64345</v>
+<v>127345</v>
 </b>
 </bs>
 </hist>
@@ -21219,17 +21618,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>155787</v>
+<v>315506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64342</v>
+<v>127340</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -21245,12 +21644,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223033</v>
+<v>433909</v>
 </b>
 <b>
 <a>2</a>
-<b>585</b>
-<v>3351</v>
+<b>705</b>
+<v>6724</v>
 </b>
 </bs>
 </hist>
@@ -21266,7 +21665,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>226384</v>
+<v>440634</v>
 </b>
 </bs>
 </hist>
@@ -21282,7 +21681,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>226384</v>
+<v>440634</v>
 </b>
 </bs>
 </hist>
@@ -21298,12 +21697,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223033</v>
+<v>433909</v>
 </b>
 <b>
 <a>2</a>
-<b>585</b>
-<v>3351</v>
+<b>705</b>
+<v>6724</v>
 </b>
 </bs>
 </hist>
@@ -21313,26 +21712,26 @@
 </relation>
 <relation>
 <name>init_only_accessors</name>
-<cardinality>4</cardinality>
+<cardinality>11</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4</v>
+<v>11</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>367482</cardinality>
+<cardinality>750200</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>284483</v>
+<v>570207</v>
 </e>
 <e>
 <k>loc</k>
-<v>43067</v>
+<v>93259</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21346,17 +21745,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>219889</v>
+<v>434981</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50297</v>
+<v>98443</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>14296</v>
+<v>36781</v>
 </b>
 </bs>
 </hist>
@@ -21372,12 +21771,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41305</v>
+<v>89653</v>
 </b>
 <b>
 <a>2</a>
-<b>7862</b>
-<v>1762</v>
+<b>8548</b>
+<v>3606</v>
 </b>
 </bs>
 </hist>
@@ -21387,27 +21786,27 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>7838</cardinality>
+<cardinality>15237</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>name</k>
-<v>6685</v>
+<v>12996</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>631</v>
+<v>1227</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3276</v>
+<v>6368</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>7833</v>
+<v>15228</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21421,7 +21820,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -21437,7 +21836,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -21453,7 +21852,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -21469,7 +21868,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -21485,17 +21884,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6176</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>503</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
 <b>17</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21511,17 +21910,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6176</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>503</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
 <b>17</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21537,12 +21936,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6613</v>
+<v>12854</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>72</v>
+<v>141</v>
 </b>
 </bs>
 </hist>
@@ -21558,17 +21957,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6176</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>503</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
 <b>17</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21584,32 +21983,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>318</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117</v>
+<v>229</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>8</a>
 <b>23</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>58</a>
 <b>465</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -21625,32 +22024,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>318</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>8</a>
 <b>23</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>58</a>
 <b>465</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -21666,27 +22065,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396</v>
+<v>769</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>102</v>
+<v>199</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>5</a>
 <b>11</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>12</a>
 <b>181</b>
-<v>40</v>
+<v>77</v>
 </b>
 </bs>
 </hist>
@@ -21702,32 +22101,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>318</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117</v>
+<v>229</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>55</v>
+<v>107</v>
 </b>
 <b>
 <a>8</a>
 <b>23</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>58</a>
 <b>465</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -21743,22 +22142,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2271</v>
+<v>4414</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>599</v>
+<v>1164</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>265</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
 <b>318</b>
-<v>140</v>
+<v>272</v>
 </b>
 </bs>
 </hist>
@@ -21774,22 +22173,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2471</v>
+<v>4804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>471</v>
+<v>916</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>258</v>
+<v>501</v>
 </b>
 <b>
 <a>8</a>
 <b>242</b>
-<v>75</v>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -21805,17 +22204,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2960</v>
+<v>5754</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>268</v>
+<v>521</v>
 </b>
 <b>
 <a>4</a>
 <b>27</b>
-<v>47</v>
+<v>92</v>
 </b>
 </bs>
 </hist>
@@ -21831,22 +22230,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2271</v>
+<v>4414</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>599</v>
+<v>1164</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>265</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
 <b>318</b>
-<v>140</v>
+<v>272</v>
 </b>
 </bs>
 </hist>
@@ -21862,12 +22261,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7828</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21883,7 +22282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7833</v>
+<v>15228</v>
 </b>
 </bs>
 </hist>
@@ -21899,12 +22298,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7828</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21920,12 +22319,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7828</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -21935,15 +22334,15 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>8167</cardinality>
+<cardinality>15876</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>loc</k>
-<v>167</v>
+<v>326</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21957,12 +22356,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7510</v>
+<v>14599</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>328</v>
+<v>638</v>
 </b>
 </bs>
 </hist>
@@ -21978,57 +22377,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>16</a>
 <b>31</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>64</a>
 <b>2199</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -22038,27 +22437,27 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>15677</cardinality>
+<cardinality>30475</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15677</v>
+<v>30475</v>
 </e>
 <e>
 <k>kind</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>name</k>
-<v>13737</v>
+<v>26703</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>7838</v>
+<v>15237</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15667</v>
+<v>30456</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22072,7 +22471,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15677</v>
+<v>30475</v>
 </b>
 </bs>
 </hist>
@@ -22088,7 +22487,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15677</v>
+<v>30475</v>
 </b>
 </bs>
 </hist>
@@ -22104,7 +22503,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15677</v>
+<v>30475</v>
 </b>
 </bs>
 </hist>
@@ -22120,7 +22519,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15677</v>
+<v>30475</v>
 </b>
 </bs>
 </hist>
@@ -22136,7 +22535,7 @@
 <b>
 <a>3127</a>
 <b>3128</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -22152,7 +22551,7 @@
 <b>
 <a>2740</a>
 <b>2741</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -22168,7 +22567,7 @@
 <b>
 <a>3127</a>
 <b>3128</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -22184,7 +22583,7 @@
 <b>
 <a>3125</a>
 <b>3126</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -22200,12 +22599,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12714</v>
+<v>24715</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1022</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -22221,7 +22620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13737</v>
+<v>26703</v>
 </b>
 </bs>
 </hist>
@@ -22237,12 +22636,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12714</v>
+<v>24715</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1022</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -22258,12 +22657,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12714</v>
+<v>24715</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1022</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -22279,7 +22678,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -22295,7 +22694,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -22311,7 +22710,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -22327,7 +22726,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>7838</v>
+<v>15237</v>
 </b>
 </bs>
 </hist>
@@ -22343,12 +22742,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15657</v>
+<v>30436</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -22364,7 +22763,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15667</v>
+<v>30456</v>
 </b>
 </bs>
 </hist>
@@ -22380,7 +22779,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15667</v>
+<v>30456</v>
 </b>
 </bs>
 </hist>
@@ -22396,12 +22795,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15657</v>
+<v>30436</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -22411,15 +22810,15 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>16334</cardinality>
+<cardinality>31752</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15677</v>
+<v>30475</v>
 </e>
 <e>
 <k>loc</k>
-<v>167</v>
+<v>326</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22433,12 +22832,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15020</v>
+<v>29198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>656</v>
+<v>1276</v>
 </b>
 </bs>
 </hist>
@@ -22454,57 +22853,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>12</a>
 <b>15</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>24</a>
 <b>31</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>32</a>
 <b>61</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>128</a>
 <b>4397</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -22514,31 +22913,31 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>6201</cardinality>
+<cardinality>12416</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>6201</v>
+<v>12416</v>
 </e>
 <e>
 <k>name</k>
-<v>65</v>
+<v>126</v>
 </e>
 <e>
 <k>symbol</k>
-<v>60</v>
+<v>116</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>1448</v>
+<v>3026</v>
 </e>
 <e>
 <k>type_id</k>
-<v>809</v>
+<v>1622</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>5903</v>
+<v>11661</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22552,7 +22951,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6201</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -22568,7 +22967,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6201</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -22584,7 +22983,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6201</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -22600,7 +22999,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6201</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -22616,7 +23015,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6201</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -22632,375 +23031,80 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>5</v>
+<b>5</b>
+<v>9</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>7</v>
+<v>9</v>
 </b>
 <b>
-<a>10</a>
-<b>17</b>
-<v>5</v>
+<a>9</a>
+<b>11</b>
+<v>9</v>
 </b>
 <b>
-<a>26</a>
-<b>46</b>
-<v>5</v>
-</b>
-<b>
-<a>54</a>
-<b>55</b>
-<v>5</v>
-</b>
-<b>
-<a>57</a>
-<b>58</b>
-<v>5</v>
-</b>
-<b>
-<a>65</a>
-<b>73</b>
-<v>5</v>
-</b>
-<b>
-<a>80</a>
-<b>436</b>
-<v>5</v>
-</b>
-<b>
-<a>454</a>
-<b>500</b>
-<v>5</v>
-</b>
-<b>
-<a>506</a>
-<b>507</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>symbol</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>65</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>declaring_type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>10</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>2</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>7</v>
-</b>
-<b>
-<a>10</a>
-<b>15</b>
-<v>5</v>
-</b>
-<b>
-<a>26</a>
-<b>32</b>
-<v>5</v>
-</b>
-<b>
-<a>36</a>
-<b>50</b>
-<v>5</v>
-</b>
-<b>
-<a>50</a>
-<b>52</b>
-<v>5</v>
-</b>
-<b>
-<a>52</a>
-<b>53</b>
-<v>5</v>
-</b>
-<b>
-<a>63</a>
-<b>120</b>
-<v>5</v>
-</b>
-<b>
-<a>201</a>
-<b>444</b>
-<v>5</v>
-</b>
-<b>
-<a>451</a>
-<b>452</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>7</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>20</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>2</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>7</v>
-</b>
-<b>
-<a>10</a>
-<b>15</b>
-<v>5</v>
-</b>
-<b>
-<a>26</a>
-<b>32</b>
-<v>5</v>
-</b>
-<b>
-<a>37</a>
-<b>52</b>
-<v>5</v>
-</b>
-<b>
-<a>63</a>
-<b>155</b>
-<v>5</v>
-</b>
-<b>
-<a>181</a>
-<b>182</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>10</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>2</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>7</v>
-</b>
-<b>
-<a>10</a>
-<b>17</b>
-<v>5</v>
-</b>
-<b>
-<a>26</a>
-<b>46</b>
-<v>5</v>
-</b>
-<b>
-<a>53</a>
-<b>54</b>
-<v>5</v>
-</b>
-<b>
-<a>56</a>
-<b>57</b>
-<v>5</v>
-</b>
-<b>
-<a>65</a>
-<b>73</b>
-<v>5</v>
-</b>
-<b>
-<a>80</a>
-<b>415</b>
-<v>5</v>
-</b>
-<b>
-<a>416</a>
-<b>472</b>
-<v>5</v>
-</b>
-<b>
-<a>478</a>
-<b>479</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>symbol</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>10</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>7</v>
-</b>
-<b>
-<a>10</a>
-<b>17</b>
-<v>5</v>
+<a>17</a>
+<b>27</b>
+<v>9</v>
 </b>
 <b>
 <a>45</a>
 <b>46</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>54</a>
 <b>55</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>57</a>
 <b>58</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
-<a>72</a>
-<b>86</b>
-<v>5</v>
+<a>66</a>
+<b>74</b>
+<v>9</v>
 </b>
 <b>
-<a>91</a>
-<b>436</b>
-<v>5</v>
+<a>85</a>
+<b>437</b>
+<v>9</v>
 </b>
 <b>
-<a>454</a>
-<b>500</b>
-<v>5</v>
+<a>459</a>
+<b>532</b>
+<v>9</v>
 </b>
 <b>
-<a>506</a>
-<b>507</b>
-<v>2</v>
+<a>532</a>
+<b>533</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
 </val>
 </dep>
 <dep>
-<src>symbol</src>
-<trg>name</trg>
+<src>name</src>
+<trg>symbol</trg>
 <val>
 <hist>
 <budget>12</budget>
@@ -23008,19 +23112,14 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>5</v>
+<v>126</v>
 </b>
 </bs>
 </hist>
 </val>
 </dep>
 <dep>
-<src>symbol</src>
+<src>name</src>
 <trg>declaring_type_id</trg>
 <val>
 <hist>
@@ -23029,113 +23128,428 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>5</v>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>7</v>
+<v>9</v>
 </b>
 <b>
-<a>10</a>
-<b>15</b>
-<v>5</v>
+<a>9</a>
+<b>11</b>
+<v>9</v>
 </b>
 <b>
-<a>31</a>
-<b>37</b>
-<v>5</v>
-</b>
-<b>
-<a>49</a>
-<b>51</b>
-<v>5</v>
-</b>
-<b>
-<a>51</a>
-<b>52</b>
-<v>2</v>
-</b>
-<b>
-<a>52</a>
-<b>53</b>
-<v>5</v>
-</b>
-<b>
-<a>63</a>
-<b>120</b>
-<v>5</v>
-</b>
-<b>
-<a>201</a>
-<b>444</b>
-<v>5</v>
-</b>
-<b>
-<a>451</a>
-<b>452</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>symbol</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>7</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>20</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5</v>
-</b>
-<b>
-<a>8</a>
-<b>9</b>
-<v>7</v>
-</b>
-<b>
-<a>10</a>
-<b>15</b>
-<v>5</v>
+<a>15</a>
+<b>27</b>
+<v>9</v>
 </b>
 <b>
 <a>31</a>
 <b>38</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
-<a>51</a>
-<b>64</b>
-<v>5</v>
+<a>49</a>
+<b>51</b>
+<v>9</v>
 </b>
 <b>
-<a>154</a>
-<b>182</b>
-<v>5</v>
+<a>52</a>
+<b>53</b>
+<v>14</v>
+</b>
+<b>
+<a>68</a>
+<b>121</b>
+<v>9</v>
+</b>
+<b>
+<a>206</a>
+<b>476</b>
+<v>9</v>
+</b>
+<b>
+<a>477</a>
+<b>478</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>38</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
+</b>
+<b>
+<a>15</a>
+<b>27</b>
+<v>9</v>
+</b>
+<b>
+<a>31</a>
+<b>39</b>
+<v>9</v>
+</b>
+<b>
+<a>52</a>
+<b>69</b>
+<v>9</v>
+</b>
+<b>
+<a>155</a>
+<b>186</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>19</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
+</b>
+<b>
+<a>17</a>
+<b>27</b>
+<v>9</v>
+</b>
+<b>
+<a>45</a>
+<b>46</b>
+<v>4</v>
+</b>
+<b>
+<a>53</a>
+<b>54</b>
+<v>9</v>
+</b>
+<b>
+<a>56</a>
+<b>57</b>
+<v>9</v>
+</b>
+<b>
+<a>66</a>
+<b>74</b>
+<v>9</v>
+</b>
+<b>
+<a>85</a>
+<b>415</b>
+<v>9</v>
+</b>
+<b>
+<a>416</a>
+<b>489</b>
+<v>9</v>
+</b>
+<b>
+<a>489</a>
+<b>490</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>19</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
+</b>
+<b>
+<a>17</a>
+<b>46</b>
+<v>9</v>
+</b>
+<b>
+<a>54</a>
+<b>55</b>
+<v>9</v>
+</b>
+<b>
+<a>57</a>
+<b>58</b>
+<v>9</v>
+</b>
+<b>
+<a>73</a>
+<b>91</b>
+<v>9</v>
+</b>
+<b>
+<a>92</a>
+<b>437</b>
+<v>9</v>
+</b>
+<b>
+<a>459</a>
+<b>532</b>
+<v>9</v>
+</b>
+<b>
+<a>532</a>
+<b>533</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>107</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>declaring_type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>19</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
+</b>
+<b>
+<a>15</a>
+<b>32</b>
+<v>9</v>
+</b>
+<b>
+<a>37</a>
+<b>50</b>
+<v>9</v>
+</b>
+<b>
+<a>50</a>
+<b>51</b>
+<v>4</v>
+</b>
+<b>
+<a>52</a>
+<b>53</b>
+<v>14</v>
+</b>
+<b>
+<a>68</a>
+<b>121</b>
+<v>9</v>
+</b>
+<b>
+<a>206</a>
+<b>476</b>
+<v>9</v>
+</b>
+<b>
+<a>477</a>
+<b>478</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>38</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
+</b>
+<b>
+<a>15</a>
+<b>32</b>
+<v>9</v>
+</b>
+<b>
+<a>38</a>
+<b>53</b>
+<v>9</v>
+</b>
+<b>
+<a>68</a>
+<b>156</b>
+<v>9</v>
+</b>
+<b>
+<a>185</a>
+<b>186</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -23151,62 +23565,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10</v>
+<v>19</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>5</v>
+<b>5</b>
+<v>9</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>7</v>
+<v>9</v>
 </b>
 <b>
-<a>10</a>
-<b>17</b>
-<v>5</v>
+<a>9</a>
+<b>11</b>
+<v>9</v>
 </b>
 <b>
-<a>45</a>
+<a>17</a>
 <b>46</b>
-<v>2</v>
+<v>9</v>
 </b>
 <b>
 <a>53</a>
 <b>54</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>56</a>
 <b>57</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
-<a>72</a>
-<b>86</b>
-<v>5</v>
+<a>73</a>
+<b>91</b>
+<v>9</v>
 </b>
 <b>
-<a>91</a>
+<a>92</a>
 <b>415</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>416</a>
-<b>472</b>
-<v>5</v>
+<b>489</b>
+<v>9</v>
 </b>
 <b>
-<a>478</a>
-<b>479</b>
-<v>2</v>
+<a>489</a>
+<b>490</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -23222,42 +23636,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>200</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>742</v>
+<v>1569</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>115</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>22</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>7</a>
-<b>15</b>
-<v>112</v>
+<b>16</b>
+<v>229</v>
 </b>
 <b>
-<a>15</a>
+<a>16</a>
 <b>73</b>
-<v>62</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -23273,32 +23682,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>280</v>
+<v>628</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>726</v>
+<v>1539</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>142</v>
+<v>272</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>10</a>
 <b>24</b>
-<v>47</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -23314,32 +23723,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>280</v>
+<v>628</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>729</v>
+<v>1544</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>142</v>
+<v>272</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>115</v>
+<v>229</v>
 </b>
 <b>
 <a>9</a>
 <b>22</b>
-<v>57</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -23355,27 +23764,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>945</v>
+<v>2022</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>203</v>
+<v>419</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>150</v>
+<v>292</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>112</v>
+<b>6</b>
+<v>243</v>
 </b>
 <b>
-<a>5</a>
+<a>8</a>
 <b>39</b>
-<v>37</v>
+<v>48</v>
 </b>
 </bs>
 </hist>
@@ -23391,42 +23800,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>200</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>742</v>
+<v>1569</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>115</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>22</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>7</a>
-<b>15</b>
-<v>112</v>
+<b>16</b>
+<v>229</v>
 </b>
 <b>
-<a>15</a>
+<a>16</a>
 <b>73</b>
-<v>62</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -23442,32 +23846,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>383</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>190</v>
+<v>370</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>62</v>
+<v>121</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
-<a>18</a>
-<b>1167</b>
-<v>42</v>
+<a>19</a>
+<b>1227</b>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -23483,27 +23887,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>596</v>
+<v>1208</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>77</v>
+<v>151</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>60</v>
+<v>116</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>70</v>
+<v>131</v>
 </b>
 <b>
 <a>13</a>
 <b>18</b>
-<v>5</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -23519,27 +23923,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>596</v>
+<v>1208</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>82</v>
+<v>160</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>62</v>
+<v>121</v>
 </b>
 <b>
 <a>15</a>
 <b>16</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -23555,22 +23959,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>626</v>
+<v>1266</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62</v>
+<v>121</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>6</a>
-<b>463</b>
-<v>55</v>
+<b>501</b>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -23586,32 +23990,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>383</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>190</v>
+<v>370</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>62</v>
+<v>121</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>65</v>
+<v>126</v>
 </b>
 <b>
-<a>18</a>
-<b>1107</b>
-<v>42</v>
+<a>19</a>
+<b>1137</b>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -23627,12 +24031,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5828</v>
+<v>11514</v>
 </b>
 <b>
 <a>2</a>
-<b>21</b>
-<v>75</v>
+<b>26</b>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -23648,7 +24052,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5903</v>
+<v>11661</v>
 </b>
 </bs>
 </hist>
@@ -23664,7 +24068,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5903</v>
+<v>11661</v>
 </b>
 </bs>
 </hist>
@@ -23680,12 +24084,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5828</v>
+<v>11514</v>
 </b>
 <b>
 <a>2</a>
-<b>21</b>
-<v>75</v>
+<b>26</b>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -23701,12 +24105,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5873</v>
+<v>11602</v>
 </b>
 <b>
 <a>2</a>
-<b>21</b>
-<v>30</v>
+<b>22</b>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -23716,15 +24120,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>11639</cardinality>
+<cardinality>22767</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1989</v>
+<v>5765</v>
 </e>
 <e>
 <k>loc</k>
-<v>1713</v>
+<v>3231</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23738,47 +24142,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438</v>
+<v>859</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>221</v>
+<v>3222</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>182</v>
-</b>
-<b>
-<a>6</a>
-<b>7</b>
-<v>41</v>
-</b>
-<b>
-<a>7</a>
-<b>8</b>
-<v>257</v>
-</b>
-<b>
-<a>8</a>
 <b>9</b>
-<v>122</v>
+<v>395</v>
 </b>
 <b>
 <a>9</a>
-<b>10</b>
-<v>495</v>
+<b>11</b>
+<v>459</v>
 </b>
 <b>
-<a>10</a>
+<a>11</a>
 <b>12</b>
-<v>119</v>
+<v>595</v>
 </b>
 <b>
 <a>12</a>
-<b>13</b>
-<v>108</v>
+<b>14</b>
+<v>233</v>
 </b>
 </bs>
 </hist>
@@ -23794,22 +24183,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1403</v>
+<v>2831</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>115</v>
+<b>9</b>
+<v>242</v>
 </b>
 <b>
-<a>3</a>
-<b>15</b>
-<v>131</v>
-</b>
-<b>
-<a>21</a>
-<b>793</b>
-<v>63</v>
+<a>9</a>
+<b>2695</b>
+<v>156</v>
 </b>
 </bs>
 </hist>
@@ -23819,15 +24203,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>95257</cardinality>
+<cardinality>185441</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>95199</v>
+<v>185329</v>
 </e>
 <e>
 <k>value</k>
-<v>24531</v>
+<v>47877</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23841,12 +24225,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95141</v>
+<v>185217</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -23862,27 +24246,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16848</v>
+<v>32907</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3705</v>
+<v>7221</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1995</v>
+<v>3888</v>
 </b>
 <b>
 <a>4</a>
-<b>60</b>
-<v>1842</v>
+<b>61</b>
+<v>3591</v>
 </b>
 <b>
-<a>60</a>
+<a>61</a>
 <b>2421</b>
-<v>140</v>
+<v>268</v>
 </b>
 </bs>
 </hist>
@@ -23892,27 +24276,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>549172</cardinality>
+<cardinality>1118417</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549172</v>
+<v>1118417</v>
 </e>
 <e>
 <k>name</k>
-<v>68273</v>
+<v>133855</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>101140</v>
+<v>202701</v>
 </e>
 <e>
 <k>type_id</k>
-<v>54054</v>
+<v>112931</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>357745</v>
+<v>697128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23926,7 +24310,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549172</v>
+<v>1118417</v>
 </b>
 </bs>
 </hist>
@@ -23942,7 +24326,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549172</v>
+<v>1118417</v>
 </b>
 </bs>
 </hist>
@@ -23958,7 +24342,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549172</v>
+<v>1118417</v>
 </b>
 </bs>
 </hist>
@@ -23974,7 +24358,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549172</v>
+<v>1118417</v>
 </b>
 </bs>
 </hist>
@@ -23990,32 +24374,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35183</v>
+<v>69352</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12138</v>
+<v>23643</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5557</v>
+<v>10847</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5404</v>
+<v>10428</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>5429</v>
+<v>10574</v>
 </b>
 <b>
 <a>12</a>
-<b>5061</b>
-<v>4559</v>
+<b>5621</b>
+<v>9010</v>
 </b>
 </bs>
 </hist>
@@ -24031,32 +24415,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40500</v>
+<v>79726</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9934</v>
+<v>19365</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5820</v>
+<v>11329</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5698</v>
+<v>11051</v>
 </b>
 <b>
 <a>7</a>
-<b>32</b>
-<v>5131</v>
+<b>33</b>
+<v>10111</v>
 </b>
 <b>
-<a>32</a>
-<b>4959</b>
-<v>1188</v>
+<a>33</a>
+<b>5029</b>
+<v>2270</v>
 </b>
 </bs>
 </hist>
@@ -24072,22 +24456,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57652</v>
+<v>113111</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5432</v>
+<v>10598</v>
 </b>
 <b>
 <a>3</a>
-<b>126</b>
-<v>5121</v>
+<b>209</b>
+<v>10043</v>
 </b>
 <b>
-<a>137</a>
-<b>2143</b>
-<v>67</v>
+<a>222</a>
+<b>2703</b>
+<v>102</v>
 </b>
 </bs>
 </hist>
@@ -24103,32 +24487,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36040</v>
+<v>71091</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12589</v>
+<v>24511</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5607</v>
+<v>10920</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5512</v>
+<v>10725</v>
 </b>
 <b>
 <a>6</a>
-<b>12</b>
-<v>5149</v>
+<b>13</b>
+<v>10725</v>
 </b>
 <b>
-<a>12</a>
+<a>13</a>
 <b>4958</b>
-<v>3374</v>
+<v>5881</v>
 </b>
 </bs>
 </hist>
@@ -24144,42 +24528,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30224</v>
+<v>59976</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21964</v>
+<v>43023</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>15156</v>
+<v>31635</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7172</v>
+<v>14258</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7264</v>
+<v>14794</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>8104</v>
+<v>16105</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>7831</v>
+<v>15661</v>
 </b>
 <b>
 <a>23</a>
-<b>1055</b>
-<v>3421</v>
+<b>1309</b>
+<v>7246</v>
 </b>
 </bs>
 </hist>
@@ -24195,37 +24579,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32832</v>
+<v>65044</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22819</v>
+<v>44709</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16580</v>
+<v>34734</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9122</v>
+<v>18200</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>8951</v>
+<v>18166</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>7600</v>
+<v>15257</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>3233</v>
+<v>6588</v>
 </b>
 </bs>
 </hist>
@@ -24241,32 +24625,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49695</v>
+<v>98088</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23712</v>
+<v>49256</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11686</v>
+<v>22956</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5946</v>
+<v>11626</v>
 </b>
 <b>
 <a>5</a>
-<b>11</b>
-<v>7863</v>
+<b>10</b>
+<v>15213</v>
 </b>
 <b>
-<a>11</a>
-<b>595</b>
-<v>2236</v>
+<a>10</a>
+<b>738</b>
+<v>5560</v>
 </b>
 </bs>
 </hist>
@@ -24282,42 +24666,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30277</v>
+<v>60083</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21994</v>
+<v>43101</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>15158</v>
+<v>31635</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7184</v>
+<v>14292</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7267</v>
+<v>14813</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>8069</v>
+<v>16022</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>8069</v>
+<v>16119</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>3118</v>
+<v>6632</v>
 </b>
 </bs>
 </hist>
@@ -24333,27 +24717,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35802</v>
+<v>75472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6943</v>
+<v>14487</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4078</v>
+<v>8313</v>
 </b>
 <b>
 <a>4</a>
-<b>9</b>
-<v>4086</v>
+<b>10</b>
+<v>8829</v>
 </b>
 <b>
-<a>9</a>
-<b>59685</b>
-<v>3143</v>
+<a>10</a>
+<b>62315</b>
+<v>5828</v>
 </b>
 </bs>
 </hist>
@@ -24369,22 +24753,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43794</v>
+<v>91612</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4717</v>
+<v>9619</v>
 </b>
 <b>
 <a>3</a>
-<b>9</b>
-<v>4203</v>
+<b>8</b>
+<v>8669</v>
 </b>
 <b>
-<a>9</a>
-<b>7612</b>
-<v>1338</v>
+<a>8</a>
+<b>7691</b>
+<v>3030</v>
 </b>
 </bs>
 </hist>
@@ -24400,22 +24784,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41733</v>
+<v>87435</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6603</v>
+<v>13985</v>
 </b>
 <b>
 <a>3</a>
-<b>7</b>
-<v>4101</v>
+<b>8</b>
+<v>8805</v>
 </b>
 <b>
-<a>7</a>
-<b>19179</b>
-<v>1616</v>
+<a>8</a>
+<b>19729</b>
+<v>2704</v>
 </b>
 </bs>
 </hist>
@@ -24431,27 +24815,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35852</v>
+<v>75584</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6984</v>
+<v>14545</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4103</v>
+<v>8386</v>
 </b>
 <b>
 <a>4</a>
-<b>9</b>
-<v>4061</v>
+<b>10</b>
+<v>8766</v>
 </b>
 <b>
-<a>9</a>
-<b>44405</b>
-<v>3053</v>
+<a>10</a>
+<b>44512</b>
+<v>5647</v>
 </b>
 </bs>
 </hist>
@@ -24467,12 +24851,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>344231</v>
+<v>670220</v>
 </b>
 <b>
 <a>2</a>
-<b>1207</b>
-<v>13514</v>
+<b>1367</b>
+<v>26908</v>
 </b>
 </bs>
 </hist>
@@ -24488,7 +24872,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>357745</v>
+<v>697128</v>
 </b>
 </bs>
 </hist>
@@ -24504,12 +24888,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>345048</v>
+<v>672086</v>
 </b>
 <b>
 <a>2</a>
-<b>1207</b>
-<v>12697</v>
+<b>1367</b>
+<v>25042</v>
 </b>
 </bs>
 </hist>
@@ -24525,12 +24909,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>352528</v>
+<v>686759</v>
 </b>
 <b>
 <a>2</a>
-<b>1207</b>
-<v>5216</v>
+<b>1367</b>
+<v>10369</v>
 </b>
 </bs>
 </hist>
@@ -24540,15 +24924,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>622013</cardinality>
+<cardinality>1282232</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549172</v>
+<v>1118417</v>
 </e>
 <e>
 <k>loc</k>
-<v>15472</v>
+<v>40850</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24562,17 +24946,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488331</v>
+<v>987982</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>49469</v>
+<v>98283</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>11371</v>
+<v>32151</v>
 </b>
 </bs>
 </hist>
@@ -24588,17 +24972,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13409</v>
+<v>36235</v>
 </b>
 <b>
 <a>2</a>
-<b>37</b>
-<v>1160</v>
+<b>51</b>
+<v>3079</v>
 </b>
 <b>
-<a>37</a>
-<b>23908</b>
-<v>902</v>
+<a>51</a>
+<b>27732</b>
+<v>1534</v>
 </b>
 </bs>
 </hist>
@@ -24608,23 +24992,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>138720</cardinality>
+<cardinality>278115</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>138720</v>
+<v>278115</v>
 </e>
 <e>
 <k>name</k>
-<v>68664</v>
+<v>133529</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>107588</v>
+<v>212423</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>114690</v>
+<v>223357</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24638,7 +25022,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>138720</v>
+<v>278115</v>
 </b>
 </bs>
 </hist>
@@ -24654,7 +25038,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>138720</v>
+<v>278115</v>
 </b>
 </bs>
 </hist>
@@ -24670,7 +25054,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>138720</v>
+<v>278115</v>
 </b>
 </bs>
 </hist>
@@ -24686,22 +25070,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52686</v>
+<v>102235</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9766</v>
+<v>19180</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>5271</v>
+<v>10252</v>
 </b>
 <b>
 <a>8</a>
 <b>2183</b>
-<v>940</v>
+<v>1861</v>
 </b>
 </bs>
 </hist>
@@ -24717,17 +25101,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63031</v>
+<v>122540</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>5181</v>
+<v>10087</v>
 </b>
 <b>
 <a>11</a>
 <b>2183</b>
-<v>451</v>
+<v>901</v>
 </b>
 </bs>
 </hist>
@@ -24743,22 +25127,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53132</v>
+<v>103117</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9846</v>
+<v>19335</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>5179</v>
+<v>10091</v>
 </b>
 <b>
 <a>10</a>
 <b>2183</b>
-<v>506</v>
+<v>984</v>
 </b>
 </bs>
 </hist>
@@ -24774,17 +25158,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91484</v>
+<v>179739</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9914</v>
+<v>19759</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>6189</v>
+<v>12923</v>
 </b>
 </bs>
 </hist>
@@ -24800,7 +25184,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107588</v>
+<v>212423</v>
 </b>
 </bs>
 </hist>
@@ -24816,17 +25200,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91484</v>
+<v>179739</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9914</v>
+<v>19759</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>6189</v>
+<v>12923</v>
 </b>
 </bs>
 </hist>
@@ -24842,12 +25226,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113489</v>
+<v>220902</v>
 </b>
 <b>
 <a>2</a>
-<b>612</b>
-<v>1200</v>
+<b>780</b>
+<v>2455</v>
 </b>
 </bs>
 </hist>
@@ -24863,7 +25247,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114690</v>
+<v>223357</v>
 </b>
 </bs>
 </hist>
@@ -24879,12 +25263,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113489</v>
+<v>220902</v>
 </b>
 <b>
 <a>2</a>
-<b>612</b>
-<v>1200</v>
+<b>780</b>
+<v>2455</v>
 </b>
 </bs>
 </hist>
@@ -24894,15 +25278,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>159509</cardinality>
+<cardinality>321865</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>138720</v>
+<v>278115</v>
 </e>
 <e>
 <k>loc</k>
-<v>10914</v>
+<v>24783</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24916,17 +25300,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120137</v>
+<v>238776</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17760</v>
+<v>37658</v>
 </b>
 <b>
 <a>3</a>
 <b>87</b>
-<v>822</v>
+<v>1681</v>
 </b>
 </bs>
 </hist>
@@ -24942,22 +25326,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8122</v>
+<v>19009</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1484</v>
+<v>3182</v>
 </b>
 <b>
 <a>3</a>
-<b>38</b>
-<v>819</v>
+<b>59</b>
+<v>1866</v>
 </b>
 <b>
-<a>38</a>
-<b>3935</b>
-<v>488</v>
+<a>59</a>
+<b>4796</b>
+<v>726</v>
 </b>
 </bs>
 </hist>
@@ -24967,23 +25351,23 @@
 </relation>
 <relation>
 <name>destructors</name>
-<cardinality>225</cardinality>
+<cardinality>443</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>225</v>
+<v>443</v>
 </e>
 <e>
 <k>name</k>
-<v>213</v>
+<v>414</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>225</v>
+<v>443</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>220</v>
+<v>428</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24997,7 +25381,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25013,7 +25397,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25029,7 +25413,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25045,12 +25429,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203</v>
+<v>394</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -25066,12 +25450,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203</v>
+<v>394</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>10</v>
+<v>19</v>
 </b>
 </bs>
 </hist>
@@ -25087,12 +25471,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>205</v>
+<v>399</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -25108,7 +25492,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25124,7 +25508,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25140,7 +25524,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -25156,12 +25540,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>218</v>
+<v>419</v>
 </b>
 <b>
-<a>3</a>
+<a>2</a>
 <b>4</b>
-<v>2</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -25177,7 +25561,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>220</v>
+<v>428</v>
 </b>
 </bs>
 </hist>
@@ -25193,12 +25577,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>218</v>
+<v>419</v>
 </b>
 <b>
-<a>3</a>
+<a>2</a>
 <b>4</b>
-<v>2</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -25208,15 +25592,15 @@
 </relation>
 <relation>
 <name>destructor_location</name>
-<cardinality>494</cardinality>
+<cardinality>660</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>125</v>
+<v>165</v>
 </e>
 <e>
 <k>loc</k>
-<v>230</v>
+<v>329</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25230,42 +25614,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>34</v>
+<v>32</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17</v>
+<v>44</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14</v>
+<v>16</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17</v>
+<v>6</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>13</v>
+<v>29</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>9</v>
+<v>12</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>10</v>
+<v>12</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -25281,27 +25670,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175</v>
+<v>259</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12</v>
-</b>
-<b>
-<a>4</a>
-<b>9</b>
 <v>19</v>
 </b>
 <b>
-<a>9</a>
-<b>26</b>
-<v>8</v>
+<a>3</a>
+<b>5</b>
+<v>28</v>
+</b>
+<b>
+<a>5</a>
+<b>27</b>
+<v>21</v>
 </b>
 </bs>
 </hist>
@@ -25311,15 +25695,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>140510</cardinality>
+<cardinality>274061</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>140498</v>
+<v>274037</v>
 </e>
 <e>
 <k>base_id</k>
-<v>33661</v>
+<v>65434</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25333,12 +25717,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140485</v>
+<v>274012</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -25354,32 +25738,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20716</v>
+<v>40270</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5389</v>
+<v>10476</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2206</v>
+<v>4288</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>2752</v>
+<v>5340</v>
 </b>
 <b>
 <a>7</a>
-<b>216</b>
-<v>2526</v>
+<b>184</b>
+<v>4911</v>
 </b>
 <b>
-<a>217</a>
-<b>1317</b>
-<v>70</v>
+<a>215</a>
+<b>1329</b>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -25389,15 +25773,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>74568</cardinality>
+<cardinality>156832</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>74568</v>
+<v>156832</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>6111</v>
+<v>13288</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25411,7 +25795,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74568</v>
+<v>156832</v>
 </b>
 </bs>
 </hist>
@@ -25427,37 +25811,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3171</v>
+<v>6773</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1057</v>
+<v>2490</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>604</v>
+<v>1184</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>210</v>
+<v>458</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>491</v>
+<v>1208</v>
 </b>
 <b>
 <a>7</a>
-<b>41</b>
-<v>458</v>
+<b>58</b>
+<v>998</v>
 </b>
 <b>
-<a>42</a>
+<a>58</a>
 <b>7851</b>
-<v>117</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -25467,23 +25851,23 @@
 </relation>
 <relation>
 <name>local_functions</name>
-<cardinality>488</cardinality>
+<cardinality>1801</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>488</v>
+<v>1801</v>
 </e>
 <e>
 <k>name</k>
-<v>271</v>
+<v>1034</v>
 </e>
 <e>
 <k>return_type</k>
-<v>47</v>
+<v>184</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>488</v>
+<v>1792</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25497,7 +25881,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1801</v>
 </b>
 </bs>
 </hist>
@@ -25513,7 +25897,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1801</v>
 </b>
 </bs>
 </hist>
@@ -25529,7 +25913,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1801</v>
 </b>
 </bs>
 </hist>
@@ -25545,22 +25929,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227</v>
+<v>892</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18</v>
+<v>80</v>
 </b>
 <b>
 <a>3</a>
-<b>14</b>
-<v>22</v>
-</b>
-<b>
-<a>14</a>
-<b>38</b>
-<v>4</v>
+<b>137</b>
+<v>62</v>
 </b>
 </bs>
 </hist>
@@ -25576,12 +25955,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>269</v>
+<v>1026</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>2</v>
+<b>4</b>
+<v>8</v>
 </b>
 </bs>
 </hist>
@@ -25597,22 +25976,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227</v>
+<v>894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18</v>
+<v>82</v>
 </b>
 <b>
 <a>3</a>
-<b>14</b>
-<v>22</v>
-</b>
-<b>
-<a>14</a>
-<b>38</b>
-<v>4</v>
+<b>137</b>
+<v>58</v>
 </b>
 </bs>
 </hist>
@@ -25628,27 +26002,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>29</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>3</v>
+<b>7</b>
+<v>15</v>
 </b>
 <b>
-<a>4</a>
-<b>11</b>
-<v>4</v>
-</b>
-<b>
-<a>26</a>
-<b>336</b>
-<v>3</v>
+<a>7</a>
+<b>1134</b>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -25664,22 +26033,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33</v>
+<v>136</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>25</v>
 </b>
 <b>
 <a>3</a>
-<b>6</b>
-<v>4</v>
+<b>9</b>
+<v>14</v>
 </b>
 <b>
-<a>26</a>
-<b>136</b>
-<v>3</v>
+<a>9</a>
+<b>427</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -25695,27 +26064,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>30</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>3</v>
+<b>7</b>
+<v>14</v>
 </b>
 <b>
-<a>4</a>
-<b>11</b>
-<v>4</v>
-</b>
-<b>
-<a>26</a>
-<b>336</b>
-<v>3</v>
+<a>7</a>
+<b>1132</b>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -25731,7 +26095,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1788</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -25747,7 +26116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1792</v>
 </b>
 </bs>
 </hist>
@@ -25763,7 +26132,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1791</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -25773,15 +26147,15 @@
 </relation>
 <relation>
 <name>local_function_stmts</name>
-<cardinality>488</cardinality>
+<cardinality>1792</cardinality>
 <columnsizes>
 <e>
 <k>fn</k>
-<v>488</v>
+<v>1792</v>
 </e>
 <e>
 <k>stmt</k>
-<v>488</v>
+<v>1792</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25795,7 +26169,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1792</v>
 </b>
 </bs>
 </hist>
@@ -25811,7 +26185,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488</v>
+<v>1792</v>
 </b>
 </bs>
 </hist>
@@ -25821,31 +26195,31 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>283465</cardinality>
+<cardinality>556908</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>283465</v>
+<v>556908</v>
 </e>
 <e>
 <k>kind</k>
-<v>5</v>
+<v>9</v>
 </e>
 <e>
 <k>name</k>
-<v>111604</v>
+<v>218324</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>52465</v>
+<v>103969</v>
 </e>
 <e>
 <k>type_id</k>
-<v>45611</v>
+<v>89677</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>279953</v>
+<v>548254</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25859,7 +26233,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283465</v>
+<v>556908</v>
 </b>
 </bs>
 </hist>
@@ -25875,7 +26249,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283465</v>
+<v>556908</v>
 </b>
 </bs>
 </hist>
@@ -25891,7 +26265,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283465</v>
+<v>556908</v>
 </b>
 </bs>
 </hist>
@@ -25907,7 +26281,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283465</v>
+<v>556908</v>
 </b>
 </bs>
 </hist>
@@ -25923,7 +26297,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283465</v>
+<v>556908</v>
 </b>
 </bs>
 </hist>
@@ -25937,14 +26311,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>37974</a>
-<b>37975</b>
-<v>2</v>
+<a>38027</a>
+<b>38028</b>
+<v>4</v>
 </b>
 <b>
-<a>75103</a>
-<b>75104</b>
-<v>2</v>
+<a>76258</a>
+<b>76259</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -25958,14 +26332,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>17417</a>
-<b>17418</b>
-<v>2</v>
+<a>17662</a>
+<b>17663</b>
+<v>4</v>
 </b>
 <b>
-<a>29019</a>
-<b>29020</b>
-<v>2</v>
+<a>29062</a>
+<b>29063</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -25979,14 +26353,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3310</a>
-<b>3311</b>
-<v>2</v>
+<a>3335</a>
+<b>3336</b>
+<v>4</v>
 </b>
 <b>
-<a>17817</a>
-<b>17818</b>
-<v>2</v>
+<a>18225</a>
+<b>18226</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -26002,12 +26376,12 @@
 <b>
 <a>2463</a>
 <b>2464</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>16181</a>
-<b>16182</b>
-<v>2</v>
+<a>16391</a>
+<b>16392</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -26021,14 +26395,14 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>37962</a>
-<b>37963</b>
-<v>2</v>
+<a>38015</a>
+<b>38016</b>
+<v>4</v>
 </b>
 <b>
-<a>73714</a>
-<b>73715</b>
-<v>2</v>
+<a>74494</a>
+<b>74495</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -26044,22 +26418,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>90218</v>
+<v>176246</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11538</v>
+<v>22576</v>
 </b>
 <b>
 <a>3</a>
-<b>15</b>
-<v>8500</v>
+<b>14</b>
+<v>16573</v>
 </b>
 <b>
-<a>15</a>
+<a>14</a>
 <b>4800</b>
-<v>1346</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -26075,12 +26449,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106801</v>
+<v>208963</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4803</v>
+<v>9360</v>
 </b>
 </bs>
 </hist>
@@ -26096,22 +26470,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>90231</v>
+<v>176270</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11531</v>
+<v>22561</v>
 </b>
 <b>
 <a>3</a>
-<b>15</b>
-<v>8498</v>
+<b>14</b>
+<v>16563</v>
 </b>
 <b>
-<a>15</a>
+<a>14</a>
 <b>4800</b>
-<v>1343</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -26127,17 +26501,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96495</v>
+<v>188759</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9032</v>
+<v>17669</v>
 </b>
 <b>
 <a>3</a>
 <b>2459</b>
-<v>6076</v>
+<v>11894</v>
 </b>
 </bs>
 </hist>
@@ -26153,22 +26527,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>90406</v>
+<v>176645</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11536</v>
+<v>22581</v>
 </b>
 <b>
 <a>3</a>
-<b>16</b>
-<v>8412</v>
+<b>15</b>
+<v>16480</v>
 </b>
 <b>
-<a>16</a>
+<a>15</a>
 <b>4800</b>
-<v>1248</v>
+<v>2616</v>
 </b>
 </bs>
 </hist>
@@ -26184,42 +26558,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13760</v>
+<v>27332</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10719</v>
+<v>21226</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6297</v>
+<v>12850</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5139</v>
+<v>10106</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>4061</v>
+<v>7938</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4712</v>
+<v>9278</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>4143</v>
+<v>8152</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>3632</v>
+<v>7085</v>
 </b>
 </bs>
 </hist>
@@ -26235,12 +26609,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51969</v>
+<v>102878</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>496</v>
+<v>1091</v>
 </b>
 </bs>
 </hist>
@@ -26256,42 +26630,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13760</v>
+<v>27332</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10721</v>
+<v>21231</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6299</v>
+<v>12854</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5136</v>
+<v>10101</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>4061</v>
+<v>7938</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4715</v>
+<v>9283</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>4143</v>
+<v>8152</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>3627</v>
+<v>7075</v>
 </b>
 </bs>
 </hist>
@@ -26307,37 +26681,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22594</v>
+<v>44548</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10699</v>
+<v>21280</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4720</v>
+<v>9711</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3742</v>
+<v>7367</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3141</v>
+<v>6164</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>3675</v>
+<b>9</b>
+<v>9594</v>
 </b>
 <b>
-<a>8</a>
+<a>9</a>
 <b>132</b>
-<v>3893</v>
+<v>5301</v>
 </b>
 </bs>
 </hist>
@@ -26353,42 +26727,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13760</v>
+<v>27332</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10719</v>
+<v>21226</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6297</v>
+<v>12850</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5139</v>
+<v>10106</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>4061</v>
+<v>7938</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>4712</v>
+<v>9278</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>4143</v>
+<v>8152</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>3632</v>
+<v>7085</v>
 </b>
 </bs>
 </hist>
@@ -26404,161 +26778,161 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28425</v>
+<v>55907</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5530</v>
+<v>10915</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3193</v>
+<v>6213</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4046</v>
-</b>
-<b>
-<a>7</a>
-<b>26</b>
-<v>3421</v>
-</b>
-<b>
-<a>26</a>
-<b>9160</b>
-<v>995</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>44486</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1125</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>32473</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>4712</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>4020</v>
-</b>
-<b>
-<a>5</a>
-<b>17</b>
-<v>3436</v>
-</b>
-<b>
-<a>17</a>
-<b>5144</b>
-<v>967</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>declaring_type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>34857</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>5091</v>
-</b>
-<b>
-<a>3</a>
-<b>7</b>
-<v>3680</v>
-</b>
-<b>
-<a>7</a>
-<b>5706</b>
-<v>1982</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>28445</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>5693</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>3050</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>4033</v>
+<v>7977</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>3441</v>
+<v>6792</v>
 </b>
 <b>
 <a>27</a>
-<b>9081</b>
-<v>947</v>
+<b>9294</b>
+<v>1871</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>87479</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>63826</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9360</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>7899</v>
+</b>
+<b>
+<a>5</a>
+<b>18</b>
+<v>6841</v>
+</b>
+<b>
+<a>18</a>
+<b>5214</b>
+<v>1749</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>declaring_type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>68426</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10067</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>7246</v>
+</b>
+<b>
+<a>7</a>
+<b>5816</b>
+<v>3937</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>55951</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>11241</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5925</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>7952</v>
+</b>
+<b>
+<a>7</a>
+<b>27</b>
+<v>6749</v>
+</b>
+<b>
+<a>27</a>
+<b>9188</b>
+<v>1856</v>
 </b>
 </bs>
 </hist>
@@ -26574,12 +26948,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279539</v>
+<v>547279</v>
 </b>
 <b>
 <a>2</a>
-<b>210</b>
-<v>413</v>
+<b>234</b>
+<v>974</v>
 </b>
 </bs>
 </hist>
@@ -26595,7 +26969,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279953</v>
+<v>548254</v>
 </b>
 </bs>
 </hist>
@@ -26611,7 +26985,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279953</v>
+<v>548254</v>
 </b>
 </bs>
 </hist>
@@ -26627,12 +27001,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279539</v>
+<v>547279</v>
 </b>
 <b>
 <a>2</a>
-<b>210</b>
-<v>413</v>
+<b>234</b>
+<v>974</v>
 </b>
 </bs>
 </hist>
@@ -26648,12 +27022,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279717</v>
+<v>547737</v>
 </b>
 <b>
 <a>2</a>
 <b>138</b>
-<v>235</v>
+<v>516</v>
 </b>
 </bs>
 </hist>
@@ -26663,15 +27037,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>321998</cardinality>
+<cardinality>637702</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>279660</v>
+<v>549540</v>
 </e>
 <e>
 <k>loc</k>
-<v>24689</v>
+<v>52871</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26685,17 +27059,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>240001</v>
+<v>467396</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37935</v>
+<v>78133</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>1722</v>
+<v>4010</v>
 </b>
 </bs>
 </hist>
@@ -26711,12 +27085,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23072</v>
+<v>49363</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>1616</v>
+<v>3508</v>
 </b>
 </bs>
 </hist>
@@ -26726,11 +27100,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>72963</cardinality>
+<cardinality>163274</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>72963</v>
+<v>163274</v>
 </e>
 <e>
 <k>kind</k>
@@ -26738,7 +27112,7 @@
 </e>
 <e>
 <k>name</k>
-<v>9135</v>
+<v>22595</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -26746,11 +27120,11 @@
 </e>
 <e>
 <k>type_id</k>
-<v>3535</v>
+<v>7298</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>72963</v>
+<v>163274</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26764,7 +27138,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -26780,7 +27154,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -26796,7 +27170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -26812,7 +27186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -26828,7 +27202,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -26842,18 +27216,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3</a>
-<b>4</b>
+<a>18</a>
+<b>19</b>
 <v>1</v>
 </b>
 <b>
-<a>373</a>
-<b>374</b>
+<a>799</a>
+<b>800</b>
 <v>1</v>
 </b>
 <b>
-<a>72587</a>
-<b>72588</b>
+<a>162457</a>
+<b>162458</b>
 <v>1</v>
 </b>
 </bs>
@@ -26868,18 +27242,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>2</a>
-<b>3</b>
+<a>12</a>
+<b>13</b>
 <v>1</v>
 </b>
 <b>
-<a>115</a>
-<b>116</b>
+<a>293</a>
+<b>294</b>
 <v>1</v>
 </b>
 <b>
-<a>9057</a>
-<b>9058</b>
+<a>22382</a>
+<b>22383</b>
 <v>1</v>
 </b>
 </bs>
@@ -26915,18 +27289,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>2</a>
-<b>3</b>
+<a>10</a>
+<b>11</b>
 <v>1</v>
 </b>
 <b>
-<a>8</a>
-<b>9</b>
+<a>25</a>
+<b>26</b>
 <v>1</v>
 </b>
 <b>
-<a>3533</a>
-<b>3534</b>
+<a>7293</a>
+<b>7294</b>
 <v>1</v>
 </b>
 </bs>
@@ -26941,18 +27315,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3</a>
-<b>4</b>
+<a>18</a>
+<b>19</b>
 <v>1</v>
 </b>
 <b>
-<a>373</a>
-<b>374</b>
+<a>799</a>
+<b>800</b>
 <v>1</v>
 </b>
 <b>
-<a>72587</a>
-<b>72588</b>
+<a>162457</a>
+<b>162458</b>
 <v>1</v>
 </b>
 </bs>
@@ -26969,32 +27343,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5625</v>
+<v>14116</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1400</v>
+<v>3482</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>559</v>
+<v>1462</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>690</v>
+<b>8</b>
+<v>1876</v>
 </b>
 <b>
-<a>7</a>
-<b>46</b>
-<v>691</v>
-</b>
-<b>
-<a>46</a>
-<b>7564</b>
-<v>170</v>
+<a>8</a>
+<b>15750</b>
+<v>1659</v>
 </b>
 </bs>
 </hist>
@@ -27010,12 +27379,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9096</v>
+<v>22503</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39</v>
+<v>92</v>
 </b>
 </bs>
 </hist>
@@ -27031,12 +27400,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8300</v>
+<v>19935</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>835</v>
+<v>2660</v>
 </b>
 </bs>
 </hist>
@@ -27052,17 +27421,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7770</v>
+<v>19225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>727</v>
+<v>1909</v>
 </b>
 <b>
 <a>3</a>
-<b>494</b>
-<v>638</v>
+<b>678</b>
+<v>1461</v>
 </b>
 </bs>
 </hist>
@@ -27078,32 +27447,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5625</v>
+<v>14116</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1400</v>
+<v>3482</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>559</v>
+<v>1462</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>690</v>
+<b>8</b>
+<v>1876</v>
 </b>
 <b>
-<a>7</a>
-<b>46</b>
-<v>691</v>
-</b>
-<b>
-<a>46</a>
-<b>7564</b>
-<v>170</v>
+<a>8</a>
+<b>15750</b>
+<v>1659</v>
 </b>
 </bs>
 </hist>
@@ -27117,13 +27481,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>13942</a>
-<b>13943</b>
+<a>36626</a>
+<b>36627</b>
 <v>1</v>
 </b>
 <b>
-<a>59021</a>
-<b>59022</b>
+<a>126648</a>
+<b>126649</b>
 <v>1</v>
 </b>
 </bs>
@@ -27159,13 +27523,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>2512</a>
-<b>2513</b>
+<a>8549</a>
+<b>8550</b>
 <v>1</v>
 </b>
 <b>
-<a>7458</a>
-<b>7459</b>
+<a>16706</a>
+<b>16707</b>
 <v>1</v>
 </b>
 </bs>
@@ -27180,13 +27544,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1244</a>
-<b>1245</b>
+<a>2805</a>
+<b>2806</b>
 <v>1</v>
 </b>
 <b>
-<a>2982</a>
-<b>2983</b>
+<a>6179</a>
+<b>6180</b>
 <v>1</v>
 </b>
 </bs>
@@ -27201,13 +27565,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>13942</a>
-<b>13943</b>
+<a>36626</a>
+<b>36627</b>
 <v>1</v>
 </b>
 <b>
-<a>59021</a>
-<b>59022</b>
+<a>126648</a>
+<b>126649</b>
 <v>1</v>
 </b>
 </bs>
@@ -27224,37 +27588,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1585</v>
+<v>3308</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>519</v>
+<v>1138</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>460</v>
+<v>772</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>301</v>
+<v>624</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>279</v>
+<v>591</v>
 </b>
 <b>
 <a>11</a>
-<b>47</b>
-<v>267</v>
+<b>35</b>
+<v>548</v>
 </b>
 <b>
-<a>47</a>
-<b>17427</b>
-<v>124</v>
+<a>35</a>
+<b>37235</b>
+<v>317</v>
 </b>
 </bs>
 </hist>
@@ -27270,12 +27634,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3527</v>
+<v>7269</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>8</v>
+<b>4</b>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -27291,32 +27655,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1956</v>
+<v>4172</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>733</v>
+<v>1328</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>238</v>
+<v>522</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>310</v>
+<v>643</v>
 </b>
 <b>
 <a>7</a>
 <b>49</b>
-<v>266</v>
+<v>549</v>
 </b>
 <b>
-<a>51</a>
-<b>900</b>
-<v>32</v>
+<a>49</a>
+<b>1941</b>
+<v>84</v>
 </b>
 </bs>
 </hist>
@@ -27332,12 +27696,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2844</v>
+<v>5612</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>691</v>
+<v>1686</v>
 </b>
 </bs>
 </hist>
@@ -27353,37 +27717,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1585</v>
+<v>3308</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>519</v>
+<v>1138</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>460</v>
+<v>772</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>301</v>
+<v>624</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>279</v>
+<v>591</v>
 </b>
 <b>
 <a>11</a>
-<b>47</b>
-<v>267</v>
+<b>35</b>
+<v>548</v>
 </b>
 <b>
-<a>47</a>
-<b>17427</b>
-<v>124</v>
+<a>35</a>
+<b>37235</b>
+<v>317</v>
 </b>
 </bs>
 </hist>
@@ -27399,7 +27763,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27415,7 +27779,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27431,7 +27795,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27447,7 +27811,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27463,7 +27827,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27473,15 +27837,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>72963</cardinality>
+<cardinality>163274</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>72963</v>
+<v>163274</v>
 </e>
 <e>
 <k>loc</k>
-<v>72932</v>
+<v>163194</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27495,7 +27859,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72963</v>
+<v>163274</v>
 </b>
 </bs>
 </hist>
@@ -27511,12 +27875,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72901</v>
+<v>163114</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31</v>
+<v>80</v>
 </b>
 </bs>
 </hist>
@@ -27526,35 +27890,35 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>1189134</cardinality>
+<cardinality>2418845</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1189134</v>
+<v>2418845</v>
 </e>
 <e>
 <k>name</k>
-<v>41432</v>
+<v>80847</v>
 </e>
 <e>
 <k>type_id</k>
-<v>164897</v>
+<v>330734</v>
 </e>
 <e>
 <k>index</k>
-<v>102</v>
+<v>199</v>
 </e>
 <e>
 <k>mode</k>
-<v>15</v>
+<v>29</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>671887</v>
+<v>1370492</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>734670</v>
+<v>1435877</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27568,7 +27932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27584,7 +27948,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27600,7 +27964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27616,7 +27980,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27632,7 +27996,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27648,7 +28012,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189134</v>
+<v>2418845</v>
 </b>
 </bs>
 </hist>
@@ -27664,42 +28028,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15950</v>
+<v>31128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7116</v>
+<v>13858</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3622</v>
+<v>7060</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2469</v>
+<v>4838</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>3409</v>
+<v>6651</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>3534</v>
+<v>6895</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>3123</v>
+<v>6086</v>
 </b>
 <b>
 <a>41</a>
-<b>45301</b>
-<v>2206</v>
+<b>46351</b>
+<v>4327</v>
 </b>
 </bs>
 </hist>
@@ -27715,22 +28079,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32939</v>
+<v>64240</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4178</v>
+<v>8162</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>3153</v>
+<v>6174</v>
 </b>
 <b>
 <a>12</a>
-<b>6754</b>
-<v>1160</v>
+<b>6855</b>
+<v>2270</v>
 </b>
 </bs>
 </hist>
@@ -27746,22 +28110,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28201</v>
+<v>55030</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7467</v>
+<v>14570</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2820</v>
+<v>5516</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>2943</v>
+<v>5730</v>
 </b>
 </bs>
 </hist>
@@ -27777,12 +28141,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38848</v>
+<v>75813</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>2584</v>
+<v>5033</v>
 </b>
 </bs>
 </hist>
@@ -27798,42 +28162,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15950</v>
+<v>31128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7116</v>
+<v>13858</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3622</v>
+<v>7060</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2469</v>
+<v>4838</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>3409</v>
+<v>6651</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>3534</v>
+<v>6895</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>3123</v>
+<v>6086</v>
 </b>
 <b>
 <a>41</a>
-<b>45301</b>
-<v>2206</v>
+<b>46351</b>
+<v>4327</v>
 </b>
 </bs>
 </hist>
@@ -27849,42 +28213,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16151</v>
+<v>31518</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7222</v>
+<v>14087</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3639</v>
+<v>7075</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2519</v>
+<v>4955</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>3324</v>
+<v>6481</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>3544</v>
+<v>6909</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>3158</v>
+<v>6159</v>
 </b>
 <b>
 <a>43</a>
-<b>36702</b>
-<v>1872</v>
+<b>36753</b>
+<v>3659</v>
 </b>
 </bs>
 </hist>
@@ -27900,27 +28264,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114442</v>
+<v>227670</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19498</v>
+<v>38959</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14283</v>
+<v>30095</v>
 </b>
 <b>
 <a>6</a>
-<b>25</b>
-<v>12476</v>
+<b>24</b>
+<v>25071</v>
 </b>
 <b>
-<a>25</a>
-<b>47259</b>
-<v>4196</v>
+<a>24</a>
+<b>48953</b>
+<v>8937</v>
 </b>
 </bs>
 </hist>
@@ -27936,17 +28300,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144619</v>
+<v>289226</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>14880</v>
+<v>30504</v>
 </b>
 <b>
 <a>4</a>
-<b>2452</b>
-<v>5397</v>
+<b>2470</b>
+<v>11003</v>
 </b>
 </bs>
 </hist>
@@ -27962,17 +28326,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146130</v>
+<v>292291</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>12346</v>
+<v>25086</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>6420</v>
+<v>13356</v>
 </b>
 </bs>
 </hist>
@@ -27988,12 +28352,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>160670</v>
+<v>322021</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>4226</v>
+<v>8712</v>
 </b>
 </bs>
 </hist>
@@ -28009,27 +28373,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>115728</v>
+<v>230170</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18487</v>
+<v>37000</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14459</v>
+<v>30509</v>
 </b>
 <b>
 <a>6</a>
-<b>26</b>
-<v>12479</v>
+<b>25</b>
+<v>25032</v>
 </b>
 <b>
-<a>26</a>
-<b>38813</b>
-<v>3742</v>
+<a>25</a>
+<b>40410</b>
+<v>8020</v>
 </b>
 </bs>
 </hist>
@@ -28045,27 +28409,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>117385</v>
+<v>233362</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17404</v>
+<v>34919</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>12270</v>
+<v>25753</v>
 </b>
 <b>
 <a>5</a>
-<b>17</b>
-<v>12554</v>
+<b>16</b>
+<v>25315</v>
 </b>
 <b>
-<a>17</a>
-<b>33727</b>
-<v>5281</v>
+<a>16</a>
+<b>33991</b>
+<v>11383</v>
 </b>
 </bs>
 </hist>
@@ -28081,67 +28445,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>16</a>
 <b>26</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>30</a>
 <b>35</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>40</a>
 <b>48</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>52</a>
 <b>71</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>81</a>
 <b>266</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>431</a>
 <b>785</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>986</a>
 <b>1520</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>1960</a>
-<b>3510</b>
-<v>7</v>
+<b>3521</b>
+<v>14</v>
 </b>
 <b>
-<a>5391</a>
-<b>20664</b>
-<v>7</v>
+<a>5421</a>
+<b>21238</b>
+<v>14</v>
 </b>
 <b>
-<a>45851</a>
-<b>267875</b>
-<v>7</v>
+<a>47756</a>
+<b>281050</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -28157,72 +28521,72 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>12</a>
 <b>14</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>17</a>
 <b>20</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>20</a>
 <b>22</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>23</a>
 <b>27</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>29</a>
 <b>46</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>55</a>
 <b>66</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>86</a>
 <b>143</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>202</a>
 <b>435</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>630</a>
-<b>1616</b>
-<v>7</v>
+<b>1620</b>
+<v>14</v>
 </b>
 <b>
-<a>2706</a>
-<b>6807</b>
-<v>7</v>
+<a>2712</a>
+<b>6835</b>
+<v>14</v>
 </b>
 <b>
-<a>8049</a>
-<b>8050</b>
-<v>2</v>
+<a>8088</a>
+<b>8089</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28238,77 +28602,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>13</a>
 <b>14</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>14</a>
 <b>20</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>23</a>
 <b>40</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>161</a>
 <b>418</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>558</a>
 <b>841</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>1010</a>
 <b>1444</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>1705</a>
-<b>2786</b>
-<v>7</v>
+<b>2798</b>
+<v>14</v>
 </b>
 <b>
-<a>4142</a>
-<b>15101</b>
-<v>7</v>
+<a>4226</a>
+<b>15732</b>
+<v>14</v>
 </b>
 <b>
-<a>38776</a>
-<b>38777</b>
-<v>2</v>
+<a>40518</a>
+<b>40519</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28324,32 +28688,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28365,67 +28729,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>16</a>
 <b>26</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>30</a>
 <b>35</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>40</a>
 <b>48</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>52</a>
 <b>71</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>81</a>
 <b>266</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>431</a>
 <b>785</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>986</a>
 <b>1520</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>1960</a>
-<b>3510</b>
-<v>7</v>
+<b>3521</b>
+<v>14</v>
 </b>
 <b>
-<a>5391</a>
-<b>20664</b>
-<v>7</v>
+<a>5421</a>
+<b>21238</b>
+<v>14</v>
 </b>
 <b>
-<a>45851</a>
-<b>267875</b>
-<v>7</v>
+<a>47756</a>
+<b>281050</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -28441,67 +28805,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>16</a>
 <b>26</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>30</a>
 <b>35</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>40</a>
 <b>48</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>52</a>
 <b>70</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>79</a>
 <b>141</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>178</a>
 <b>266</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>334</a>
 <b>601</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>891</a>
-<b>2068</b>
-<v>7</v>
+<b>2069</b>
+<v>14</v>
 </b>
 <b>
-<a>3523</a>
-<b>13842</b>
-<v>7</v>
+<a>3526</a>
+<b>13874</b>
+<v>14</v>
 </b>
 <b>
-<a>29502</a>
-<b>167307</b>
-<v>7</v>
+<a>29619</a>
+<b>168470</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -28517,32 +28881,32 @@
 <b>
 <a>1253</a>
 <b>1254</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>2018</a>
-<b>2019</b>
-<v>2</v>
+<a>2019</a>
+<b>2020</b>
+<v>4</v>
 </b>
 <b>
-<a>2317</a>
-<b>2318</b>
-<v>2</v>
+<a>2345</a>
+<b>2346</b>
+<v>4</v>
 </b>
 <b>
-<a>6844</a>
-<b>6845</b>
-<v>2</v>
+<a>7103</a>
+<b>7104</b>
+<v>4</v>
 </b>
 <b>
-<a>10051</a>
-<b>10052</b>
-<v>2</v>
+<a>10553</a>
+<b>10554</b>
+<v>4</v>
 </b>
 <b>
-<a>451874</a>
-<b>451875</b>
-<v>2</v>
+<a>473106</a>
+<b>473107</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28558,32 +28922,32 @@
 <b>
 <a>110</a>
 <b>111</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>244</a>
 <b>245</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>282</a>
-<b>283</b>
-<v>2</v>
+<a>283</a>
+<b>284</b>
+<v>4</v>
 </b>
 <b>
 <a>524</a>
 <b>525</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1118</a>
-<b>1119</b>
-<v>2</v>
+<a>1119</a>
+<b>1120</b>
+<v>4</v>
 </b>
 <b>
-<a>15568</a>
-<b>15569</b>
-<v>2</v>
+<a>15632</a>
+<b>15633</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28599,32 +28963,32 @@
 <b>
 <a>227</a>
 <b>228</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>257</a>
-<b>258</b>
-<v>2</v>
+<a>258</a>
+<b>259</b>
+<v>4</v>
 </b>
 <b>
-<a>358</a>
-<b>359</b>
-<v>2</v>
+<a>370</a>
+<b>371</b>
+<v>4</v>
 </b>
 <b>
-<a>1180</a>
-<b>1181</b>
-<v>2</v>
+<a>1224</a>
+<b>1225</b>
+<v>4</v>
 </b>
 <b>
-<a>3107</a>
-<b>3108</b>
-<v>2</v>
+<a>3184</a>
+<b>3185</b>
+<v>4</v>
 </b>
 <b>
-<a>62478</a>
-<b>62479</b>
-<v>2</v>
+<a>64542</a>
+<b>64543</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28640,32 +29004,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>12</a>
 <b>13</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>22</a>
 <b>23</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>41</a>
 <b>42</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28681,32 +29045,32 @@
 <b>
 <a>1100</a>
 <b>1101</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1880</a>
-<b>1881</b>
-<v>2</v>
+<a>1881</a>
+<b>1882</b>
+<v>4</v>
 </b>
 <b>
-<a>2317</a>
-<b>2318</b>
-<v>2</v>
+<a>2345</a>
+<b>2346</b>
+<v>4</v>
 </b>
 <b>
-<a>5409</a>
-<b>5410</b>
-<v>2</v>
+<a>5653</a>
+<b>5654</b>
+<v>4</v>
 </b>
 <b>
-<a>10051</a>
-<b>10052</b>
-<v>2</v>
+<a>10553</a>
+<b>10554</b>
+<v>4</v>
 </b>
 <b>
-<a>261309</a>
-<b>261310</b>
-<v>2</v>
+<a>274248</a>
+<b>274249</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28722,32 +29086,32 @@
 <b>
 <a>1167</a>
 <b>1168</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1568</a>
 <b>1569</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>1959</a>
-<b>1960</b>
-<v>2</v>
+<a>1960</a>
+<b>1961</b>
+<v>4</v>
 </b>
 <b>
-<a>6113</a>
-<b>6114</b>
-<v>2</v>
+<a>6114</a>
+<b>6115</b>
+<v>4</v>
 </b>
 <b>
-<a>8393</a>
-<b>8394</b>
-<v>2</v>
+<a>8401</a>
+<b>8402</b>
+<v>4</v>
 </b>
 <b>
-<a>273867</a>
-<b>273868</b>
-<v>2</v>
+<a>275451</a>
+<b>275452</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -28763,27 +29127,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396310</v>
+<v>805128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160705</v>
+<v>332795</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>63147</v>
+<v>129250</v>
 </b>
 <b>
 <a>4</a>
-<b>15</b>
-<v>50643</v>
+<b>17</b>
+<v>102805</v>
 </b>
 <b>
-<a>15</a>
+<a>17</a>
 <b>42</b>
-<v>1080</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -28799,27 +29163,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396310</v>
+<v>805128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160705</v>
+<v>332795</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>63147</v>
+<v>129250</v>
 </b>
 <b>
 <a>4</a>
-<b>15</b>
-<v>50643</v>
+<b>17</b>
+<v>102805</v>
 </b>
 <b>
-<a>15</a>
+<a>17</a>
 <b>42</b>
-<v>1080</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -28835,22 +29199,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>420682</v>
+<v>854701</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>161091</v>
+<v>333092</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>55521</v>
+<v>113330</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>34591</v>
+<v>69366</v>
 </b>
 </bs>
 </hist>
@@ -28866,27 +29230,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396310</v>
+<v>805128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160705</v>
+<v>332795</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>63147</v>
+<v>129250</v>
 </b>
 <b>
 <a>4</a>
-<b>15</b>
-<v>50643</v>
+<b>17</b>
+<v>102805</v>
 </b>
 <b>
-<a>15</a>
+<a>17</a>
 <b>42</b>
-<v>1080</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -28902,12 +29266,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>637849</v>
+<v>1301953</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>34037</v>
+<v>68538</v>
 </b>
 </bs>
 </hist>
@@ -28923,27 +29287,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396310</v>
+<v>805128</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160705</v>
+<v>332795</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>63147</v>
+<v>129250</v>
 </b>
 <b>
 <a>4</a>
-<b>15</b>
-<v>50643</v>
+<b>17</b>
+<v>102805</v>
 </b>
 <b>
-<a>15</a>
+<a>17</a>
 <b>42</b>
-<v>1080</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -28959,12 +29323,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>709316</v>
+<v>1385573</v>
 </b>
 <b>
 <a>2</a>
-<b>10857</b>
-<v>25354</v>
+<b>11328</b>
+<v>50303</v>
 </b>
 </bs>
 </hist>
@@ -28980,7 +29344,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>734670</v>
+<v>1435877</v>
 </b>
 </bs>
 </hist>
@@ -28996,12 +29360,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>725656</v>
+<v>1417764</v>
 </b>
 <b>
 <a>2</a>
-<b>3610</b>
-<v>9014</v>
+<b>3718</b>
+<v>18112</v>
 </b>
 </bs>
 </hist>
@@ -29017,7 +29381,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>734670</v>
+<v>1435877</v>
 </b>
 </bs>
 </hist>
@@ -29033,7 +29397,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>734670</v>
+<v>1435877</v>
 </b>
 </bs>
 </hist>
@@ -29049,12 +29413,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>709316</v>
+<v>1385573</v>
 </b>
 <b>
 <a>2</a>
-<b>10857</b>
-<v>25354</v>
+<b>11328</b>
+<v>50303</v>
 </b>
 </bs>
 </hist>
@@ -29064,15 +29428,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>1316289</cardinality>
+<cardinality>2688643</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1187548</v>
+<v>2415152</v>
 </e>
 <e>
 <k>loc</k>
-<v>56062</v>
+<v>137603</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29086,17 +29450,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1063895</v>
+<v>2151860</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>120308</v>
+<v>256484</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>3344</v>
+<v>6807</v>
 </b>
 </bs>
 </hist>
@@ -29112,12 +29476,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54295</v>
+<v>133280</v>
 </b>
 <b>
 <a>2</a>
-<b>88836</b>
-<v>1767</v>
+<b>99581</b>
+<v>4322</v>
 </b>
 </bs>
 </hist>
@@ -29127,15 +29491,15 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>472277</cardinality>
+<cardinality>983184</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>472277</v>
+<v>983184</v>
 </e>
 <e>
 <k>kind</k>
-<v>32</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29149,7 +29513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>472277</v>
+<v>983184</v>
 </b>
 </bs>
 </hist>
@@ -29163,83 +29527,83 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>15</a>
-<b>36</b>
+<a>57</a>
+<b>85</b>
 <v>2</v>
 </b>
 <b>
-<a>48</a>
-<b>52</b>
+<a>97</a>
+<b>148</b>
 <v>2</v>
 </b>
 <b>
-<a>58</a>
-<b>110</b>
+<a>204</a>
+<b>266</b>
 <v>2</v>
 </b>
 <b>
-<a>139</a>
-<b>143</b>
+<a>283</a>
+<b>308</b>
 <v>2</v>
 </b>
 <b>
-<a>146</a>
-<b>218</b>
+<a>312</a>
+<b>593</b>
 <v>2</v>
 </b>
 <b>
-<a>366</a>
-<b>402</b>
+<a>790</a>
+<b>820</b>
 <v>2</v>
 </b>
 <b>
-<a>470</a>
-<b>471</b>
+<a>918</a>
+<b>926</b>
 <v>2</v>
 </b>
 <b>
-<a>490</a>
-<b>990</b>
+<a>1226</a>
+<b>1786</b>
 <v>2</v>
 </b>
 <b>
-<a>1105</a>
-<b>1370</b>
+<a>2200</a>
+<b>2468</b>
 <v>2</v>
 </b>
 <b>
-<a>1601</a>
-<b>1628</b>
+<a>2752</a>
+<b>3191</b>
 <v>2</v>
 </b>
 <b>
-<a>1877</a>
-<b>1904</b>
+<a>3456</a>
+<b>3580</b>
 <v>2</v>
 </b>
 <b>
-<a>2956</a>
-<b>5122</b>
+<a>5468</a>
+<b>8857</b>
 <v>2</v>
 </b>
 <b>
-<a>10374</a>
-<b>32130</b>
+<a>18283</a>
+<b>60466</b>
 <v>2</v>
 </b>
 <b>
-<a>37889</a>
-<b>48002</b>
+<a>62422</a>
+<b>75943</b>
 <v>2</v>
 </b>
 <b>
-<a>48236</a>
-<b>97276</b>
+<a>94725</a>
+<b>191608</b>
 <v>2</v>
 </b>
 <b>
-<a>151170</a>
-<b>151171</b>
+<a>246631</a>
+<b>246632</b>
 <v>1</v>
 </b>
 </bs>
@@ -29250,19 +29614,19 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>370789</cardinality>
+<cardinality>811572</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>370789</v>
+<v>811572</v>
 </e>
 <e>
 <k>index</k>
-<v>246</v>
+<v>448</v>
 </e>
 <e>
 <k>parent</k>
-<v>204384</v>
+<v>429988</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29276,7 +29640,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370789</v>
+<v>811572</v>
 </b>
 </bs>
 </hist>
@@ -29292,7 +29656,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>370789</v>
+<v>811572</v>
 </b>
 </bs>
 </hist>
@@ -29308,57 +29672,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35</v>
+<v>114</v>
 </b>
 <b>
 <a>2</a>
-<b>4</b>
-<v>14</v>
+<b>3</b>
+<v>44</v>
 </b>
 <b>
-<a>4</a>
+<a>3</a>
 <b>5</b>
-<v>45</v>
+<v>26</v>
 </b>
 <b>
 <a>5</a>
-<b>11</b>
-<v>19</v>
+<b>8</b>
+<v>33</v>
 </b>
 <b>
-<a>11</a>
-<b>16</b>
-<v>15</v>
+<a>8</a>
+<b>9</b>
+<v>9</v>
 </b>
 <b>
-<a>16</a>
-<b>21</b>
-<v>22</v>
+<a>9</a>
+<b>10</b>
+<v>42</v>
 </b>
 <b>
-<a>21</a>
-<b>34</b>
-<v>19</v>
+<a>10</a>
+<b>26</b>
+<v>36</v>
 </b>
 <b>
-<a>37</a>
-<b>72</b>
-<v>19</v>
+<a>26</a>
+<b>45</b>
+<v>34</v>
 </b>
 <b>
-<a>78</a>
-<b>210</b>
-<v>19</v>
+<a>45</a>
+<b>95</b>
+<v>34</v>
 </b>
 <b>
-<a>229</a>
-<b>947</b>
-<v>19</v>
+<a>98</a>
+<b>472</b>
+<v>34</v>
 </b>
 <b>
-<a>1063</a>
-<b>135963</b>
-<v>16</v>
+<a>510</a>
+<b>78794</b>
+<v>34</v>
+</b>
+<b>
+<a>196048</a>
+<b>233227</b>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -29374,57 +29743,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35</v>
+<v>114</v>
 </b>
 <b>
 <a>2</a>
-<b>4</b>
-<v>14</v>
+<b>3</b>
+<v>44</v>
 </b>
 <b>
-<a>4</a>
+<a>3</a>
 <b>5</b>
-<v>45</v>
+<v>26</v>
 </b>
 <b>
 <a>5</a>
-<b>11</b>
-<v>19</v>
+<b>8</b>
+<v>33</v>
 </b>
 <b>
-<a>11</a>
-<b>16</b>
-<v>15</v>
+<a>8</a>
+<b>9</b>
+<v>9</v>
 </b>
 <b>
-<a>16</a>
-<b>21</b>
-<v>22</v>
+<a>9</a>
+<b>10</b>
+<v>42</v>
 </b>
 <b>
-<a>21</a>
-<b>34</b>
-<v>19</v>
+<a>10</a>
+<b>26</b>
+<v>36</v>
 </b>
 <b>
-<a>37</a>
-<b>72</b>
-<v>19</v>
+<a>26</a>
+<b>45</b>
+<v>34</v>
 </b>
 <b>
-<a>78</a>
-<b>210</b>
-<v>19</v>
+<a>45</a>
+<b>95</b>
+<v>34</v>
 </b>
 <b>
-<a>229</a>
-<b>947</b>
-<v>19</v>
+<a>98</a>
+<b>472</b>
+<v>34</v>
 </b>
 <b>
-<a>1063</a>
-<b>135963</b>
-<v>16</v>
+<a>510</a>
+<b>78794</b>
+<v>34</v>
+</b>
+<b>
+<a>196048</a>
+<b>233227</b>
+<v>2</v>
 </b>
 </bs>
 </hist>
@@ -29440,22 +29814,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144057</v>
+<v>291140</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32560</v>
+<v>74405</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>16168</v>
+<v>37469</v>
 </b>
 <b>
 <a>5</a>
-<b>233</b>
-<v>11597</v>
+<b>361</b>
+<v>26972</v>
 </b>
 </bs>
 </hist>
@@ -29471,22 +29845,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144057</v>
+<v>291140</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32560</v>
+<v>74405</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>16168</v>
+<v>37469</v>
 </b>
 <b>
 <a>5</a>
-<b>233</b>
-<v>11597</v>
+<b>361</b>
+<v>26972</v>
 </b>
 </bs>
 </hist>
@@ -29496,11 +29870,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>101488</cardinality>
+<cardinality>171611</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>101488</v>
+<v>171611</v>
 </e>
 <e>
 <k>index</k>
@@ -29508,7 +29882,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>83071</v>
+<v>125773</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29522,7 +29896,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101488</v>
+<v>171611</v>
 </b>
 </bs>
 </hist>
@@ -29538,7 +29912,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101488</v>
+<v>171611</v>
 </b>
 </bs>
 </hist>
@@ -29552,8 +29926,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>96009</a>
-<b>96010</b>
+<a>138041</a>
+<b>138042</b>
 <v>1</v>
 </b>
 </bs>
@@ -29568,8 +29942,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>78586</a>
-<b>78587</b>
+<a>101170</a>
+<b>101171</b>
 <v>1</v>
 </b>
 </bs>
@@ -29586,17 +29960,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64837</v>
+<v>80585</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18049</v>
+<v>44547</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>183</v>
+<b>5</b>
+<v>641</v>
 </b>
 </bs>
 </hist>
@@ -29612,7 +29986,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83071</v>
+<v>125773</v>
 </b>
 </bs>
 </hist>
@@ -29622,15 +29996,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>472277</cardinality>
+<cardinality>983184</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>472277</v>
+<v>983184</v>
 </e>
 <e>
 <k>loc</k>
-<v>470073</v>
+<v>980298</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29644,7 +30018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>472277</v>
+<v>983184</v>
 </b>
 </bs>
 </hist>
@@ -29660,12 +30034,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>467869</v>
+<v>977413</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2203</v>
+<v>2885</v>
 </b>
 </bs>
 </hist>
@@ -29675,15 +30049,15 @@
 </relation>
 <relation>
 <name>catch_type</name>
-<cardinality>1719</cardinality>
+<cardinality>3421</cardinality>
 <columnsizes>
 <e>
 <k>catch_id</k>
-<v>1719</v>
+<v>3421</v>
 </e>
 <e>
 <k>type_id</k>
-<v>79</v>
+<v>129</v>
 </e>
 <e>
 <k>kind</k>
@@ -29701,7 +30075,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1719</v>
+<v>3421</v>
 </b>
 </bs>
 </hist>
@@ -29717,7 +30091,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1719</v>
+<v>3421</v>
 </b>
 </bs>
 </hist>
@@ -29733,52 +30107,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16</v>
+<v>32</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15</v>
+<v>22</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5</v>
+<v>12</v>
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>3</v>
+<b>8</b>
+<v>9</v>
 </b>
 <b>
-<a>7</a>
-<b>9</b>
-<v>6</v>
+<a>8</a>
+<b>13</b>
+<v>11</v>
 </b>
 <b>
-<a>10</a>
-<b>15</b>
-<v>6</v>
+<a>13</a>
+<b>24</b>
+<v>9</v>
 </b>
 <b>
-<a>15</a>
-<b>28</b>
-<v>6</v>
+<a>27</a>
+<b>47</b>
+<v>9</v>
 </b>
 <b>
-<a>29</a>
-<b>144</b>
-<v>6</v>
-</b>
-<b>
-<a>203</a>
-<b>316</b>
-<v>3</v>
+<a>48</a>
+<b>702</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -29794,7 +30163,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79</v>
+<v>129</v>
 </b>
 </bs>
 </hist>
@@ -29808,13 +30177,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>278</a>
-<b>279</b>
+<a>492</a>
+<b>493</b>
 <v>1</v>
 </b>
 <b>
-<a>1349</a>
-<b>1350</b>
+<a>2260</a>
+<b>2261</b>
 <v>1</v>
 </b>
 </bs>
@@ -29834,8 +30203,8 @@
 <v>1</v>
 </b>
 <b>
-<a>74</a>
-<b>75</b>
+<a>103</a>
+<b>104</b>
 <v>1</v>
 </b>
 </bs>
@@ -29845,20 +30214,244 @@
 </dependencies>
 </relation>
 <relation>
+<name>foreach_stmt_info</name>
+<cardinality>5340</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>5340</v>
+</e>
+<e>
+<k>kind</k>
+<v>9</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5340</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>13</a>
+<b>14</b>
+<v>4</v>
+</b>
+<b>
+<a>1083</a>
+<b>1084</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>foreach_stmt_desugar</name>
+<cardinality>26655</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>5340</v>
+</e>
+<e>
+<k>symbol</k>
+<v>5121</v>
+</e>
+<e>
+<k>kind</k>
+<v>24</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>48</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>5292</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>48</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>5292</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3099</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>857</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>370</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>414</v>
+</b>
+<b>
+<a>7</a>
+<b>1074</b>
+<v>380</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5121</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1086</a>
+<b>1087</b>
+<v>4</v>
+</b>
+<b>
+<a>1096</a>
+<b>1097</b>
+<v>19</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+<b>
+<a>85</a>
+<b>86</b>
+<v>4</v>
+</b>
+<b>
+<a>318</a>
+<b>319</b>
+<v>4</v>
+</b>
+<b>
+<a>320</a>
+<b>321</b>
+<v>4</v>
+</b>
+<b>
+<a>326</a>
+<b>327</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
 <name>expressions</name>
-<cardinality>1967906</cardinality>
+<cardinality>4251930</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1967906</v>
+<v>4251930</v>
 </e>
 <e>
 <k>kind</k>
-<v>112</v>
+<v>133</v>
 </e>
 <e>
 <k>type_id</k>
-<v>15377</v>
+<v>33352</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -29872,7 +30465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1967906</v>
+<v>4251930</v>
 </b>
 </bs>
 </hist>
@@ -29888,7 +30481,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1967906</v>
+<v>4251930</v>
 </b>
 </bs>
 </hist>
@@ -29902,74 +30495,64 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3</a>
-<b>17</b>
-<v>8</v>
+<a>1</a>
+<b>39</b>
+<v>11</v>
 </b>
 <b>
-<a>18</a>
-<b>61</b>
-<v>8</v>
+<a>43</a>
+<b>148</b>
+<v>11</v>
 </b>
 <b>
-<a>61</a>
-<b>134</b>
-<v>8</v>
+<a>174</a>
+<b>371</b>
+<v>11</v>
 </b>
 <b>
-<a>145</a>
-<b>243</b>
-<v>8</v>
+<a>409</a>
+<b>693</b>
+<v>11</v>
 </b>
 <b>
-<a>250</a>
-<b>457</b>
-<v>8</v>
+<a>696</a>
+<b>1145</b>
+<v>11</v>
 </b>
 <b>
-<a>532</a>
-<b>643</b>
-<v>8</v>
+<a>1194</a>
+<b>1938</b>
+<v>11</v>
 </b>
 <b>
-<a>661</a>
-<b>1291</b>
-<v>8</v>
+<a>1945</a>
+<b>3489</b>
+<v>11</v>
 </b>
 <b>
-<a>1313</a>
-<b>2180</b>
-<v>8</v>
+<a>3723</a>
+<b>7222</b>
+<v>11</v>
 </b>
 <b>
-<a>2252</a>
-<b>3767</b>
-<v>8</v>
+<a>7548</a>
+<b>12815</b>
+<v>11</v>
 </b>
 <b>
-<a>4681</a>
-<b>6580</b>
-<v>8</v>
+<a>13024</a>
+<b>36215</b>
+<v>11</v>
 </b>
 <b>
-<a>7133</a>
-<b>22007</b>
-<v>8</v>
+<a>37825</a>
+<b>155093</b>
+<v>11</v>
 </b>
 <b>
-<a>22297</a>
-<b>62473</b>
-<v>8</v>
-</b>
-<b>
-<a>72642</a>
-<b>169972</b>
-<v>8</v>
-</b>
-<b>
-<a>174284</a>
-<b>252450</b>
-<v>2</v>
+<a>212653</a>
+<b>415548</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -29985,57 +30568,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31</v>
+<v>37</v>
 </b>
 <b>
 <a>2</a>
-<b>4</b>
-<v>8</v>
-</b>
-<b>
-<a>5</a>
-<b>8</b>
-<v>9</v>
+<b>6</b>
+<v>11</v>
 </b>
 <b>
 <a>8</a>
-<b>16</b>
-<v>8</v>
+<b>10</b>
+<v>11</v>
 </b>
 <b>
-<a>16</a>
-<b>37</b>
-<v>8</v>
+<a>11</a>
+<b>25</b>
+<v>11</v>
 </b>
 <b>
-<a>38</a>
-<b>71</b>
-<v>8</v>
+<a>33</a>
+<b>70</b>
+<v>11</v>
 </b>
 <b>
-<a>77</a>
-<b>137</b>
-<v>8</v>
+<a>70</a>
+<b>174</b>
+<v>11</v>
 </b>
 <b>
-<a>137</a>
-<b>337</b>
-<v>8</v>
+<a>195</a>
+<b>312</b>
+<v>11</v>
 </b>
 <b>
-<a>384</a>
-<b>790</b>
-<v>8</v>
+<a>369</a>
+<b>870</b>
+<v>11</v>
 </b>
 <b>
-<a>1764</a>
-<b>3948</b>
-<v>8</v>
+<a>940</a>
+<b>7017</b>
+<v>11</v>
 </b>
 <b>
-<a>4410</a>
-<b>7388</b>
-<v>3</v>
+<a>7043</a>
+<b>10151</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -30051,67 +30629,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2149</v>
+<v>7043</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1894</v>
+<v>3515</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>786</v>
+<v>2357</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>984</v>
+<v>1974</v>
 </b>
 <b>
 <a>5</a>
-<b>6</b>
-<v>970</v>
+<b>7</b>
+<v>2942</v>
 </b>
 <b>
-<a>6</a>
-<b>8</b>
-<v>1167</v>
+<a>7</a>
+<b>11</b>
+<v>3052</v>
 </b>
 <b>
-<a>8</a>
-<b>12</b>
-<v>1337</v>
+<a>11</a>
+<b>17</b>
+<v>2563</v>
 </b>
 <b>
-<a>12</a>
-<b>19</b>
-<v>1299</v>
+<a>17</a>
+<b>28</b>
+<v>2625</v>
 </b>
 <b>
-<a>19</a>
-<b>30</b>
-<v>1215</v>
-</b>
-<b>
-<a>30</a>
+<a>28</a>
 <b>50</b>
-<v>1164</v>
+<v>2527</v>
 </b>
 <b>
 <a>50</a>
-<b>113</b>
-<v>1161</v>
+<b>129</b>
+<v>2502</v>
 </b>
 <b>
-<a>113</a>
-<b>1379</b>
-<v>1154</v>
-</b>
-<b>
-<a>1383</a>
-<b>318203</b>
-<v>93</v>
+<a>129</a>
+<b>637120</b>
+<v>2247</v>
 </b>
 </bs>
 </hist>
@@ -30127,42 +30695,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5687</v>
+<v>13058</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2551</v>
+<v>4827</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1979</v>
+<v>4690</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1305</v>
+<v>2597</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>933</v>
+<v>2036</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>1320</v>
+<v>2778</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>1227</v>
+<v>2526</v>
 </b>
 <b>
 <a>12</a>
 <b>57</b>
-<v>372</v>
+<v>837</v>
 </b>
 </bs>
 </hist>
@@ -30172,19 +30740,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>1745009</cardinality>
+<cardinality>3921412</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>1745009</v>
+<v>3921412</v>
 </e>
 <e>
 <k>index</k>
-<v>11825</v>
+<v>81483</v>
 </e>
 <e>
 <k>parent</k>
-<v>1152644</v>
+<v>2573231</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30198,7 +30766,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1745009</v>
+<v>3921412</v>
 </b>
 </bs>
 </hist>
@@ -30214,7 +30782,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1745009</v>
+<v>3921412</v>
 </b>
 </bs>
 </hist>
@@ -30230,47 +30798,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3162</v>
+<v>67574</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>439</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>1589</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>186</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>1234</v>
+<v>6326</v>
 </b>
 <b>
 <a>6</a>
-<b>7</b>
-<v>2909</v>
+<b>13</b>
+<v>6167</v>
 </b>
 <b>
-<a>8</a>
-<b>10</b>
-<v>1020</v>
-</b>
-<b>
-<a>10</a>
-<b>18</b>
-<v>895</v>
-</b>
-<b>
-<a>18</a>
-<b>837462</b>
-<v>387</v>
+<a>13</a>
+<b>1590334</b>
+<v>1414</v>
 </b>
 </bs>
 </hist>
@@ -30286,47 +30829,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3162</v>
+<v>67574</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>439</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>1589</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>186</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>1234</v>
+<v>6326</v>
 </b>
 <b>
 <a>6</a>
-<b>7</b>
-<v>2909</v>
+<b>13</b>
+<v>6167</v>
 </b>
 <b>
-<a>8</a>
-<b>10</b>
-<v>1020</v>
-</b>
-<b>
-<a>10</a>
-<b>18</b>
-<v>895</v>
-</b>
-<b>
-<a>18</a>
-<b>837462</b>
-<v>387</v>
+<a>13</a>
+<b>1590334</b>
+<v>1414</v>
 </b>
 </bs>
 </hist>
@@ -30342,17 +30860,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>726174</v>
+<v>1617293</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>372615</v>
+<v>828663</v>
 </b>
 <b>
 <a>3</a>
-<b>11185</b>
-<v>53853</v>
+<b>65537</b>
+<v>127274</v>
 </b>
 </bs>
 </hist>
@@ -30368,17 +30886,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>726174</v>
+<v>1617293</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>372615</v>
+<v>828663</v>
 </b>
 <b>
 <a>3</a>
-<b>11185</b>
-<v>53853</v>
+<b>65537</b>
+<v>127274</v>
 </b>
 </bs>
 </hist>
@@ -30388,19 +30906,19 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>239881</cardinality>
+<cardinality>500304</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>239881</v>
+<v>500304</v>
 </e>
 <e>
 <k>index</k>
-<v>22</v>
+<v>43</v>
 </e>
 <e>
 <k>parent</k>
-<v>204873</v>
+<v>432087</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -30414,7 +30932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>239881</v>
+<v>500304</v>
 </b>
 </bs>
 </hist>
@@ -30430,7 +30948,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>239881</v>
+<v>500304</v>
 </b>
 </bs>
 </hist>
@@ -30446,47 +30964,47 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>43</a>
 <b>44</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>113</a>
 <b>114</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>125</a>
-<b>126</b>
-<v>2</v>
+<a>166</a>
+<b>167</b>
+<v>4</v>
 </b>
 <b>
 <a>250</a>
 <b>251</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>884</a>
 <b>885</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>4456</a>
-<b>4457</b>
-<v>2</v>
+<a>4465</a>
+<b>4466</b>
+<v>4</v>
 </b>
 <b>
-<a>8335</a>
-<b>8336</b>
-<v>2</v>
+<a>8472</a>
+<b>8473</b>
+<v>4</v>
 </b>
 <b>
-<a>81483</a>
-<b>81484</b>
-<v>2</v>
+<a>88274</a>
+<b>88275</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -30502,47 +31020,47 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>43</a>
 <b>44</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>113</a>
 <b>114</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>125</a>
-<b>126</b>
-<v>2</v>
+<a>166</a>
+<b>167</b>
+<v>4</v>
 </b>
 <b>
 <a>250</a>
 <b>251</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>884</a>
 <b>885</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
-<a>4456</a>
-<b>4457</b>
-<v>2</v>
+<a>4465</a>
+<b>4466</b>
+<v>4</v>
 </b>
 <b>
-<a>8335</a>
-<b>8336</b>
-<v>2</v>
+<a>8472</a>
+<b>8473</b>
+<v>4</v>
 </b>
 <b>
-<a>81419</a>
-<b>81420</b>
-<v>2</v>
+<a>88210</a>
+<b>88211</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -30558,17 +31076,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>184342</v>
+<v>392055</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>18284</v>
+<v>35665</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>2246</v>
+<v>4366</v>
 </b>
 </bs>
 </hist>
@@ -30584,17 +31102,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>184435</v>
+<v>392236</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>18222</v>
+<v>35543</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>2216</v>
+<v>4307</v>
 </b>
 </bs>
 </hist>
@@ -30604,490 +31122,55 @@
 </relation>
 <relation>
 <name>implicitly_typed_array_creation</name>
-<cardinality>3866</cardinality>
+<cardinality>10813</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3866</v>
+<v>10813</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>1913</cardinality>
+<cardinality>4260</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1913</v>
+<v>4260</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>stackalloc_array_creation</name>
-<cardinality>170</cardinality>
+<cardinality>830</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>170</v>
+<v>830</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implicitly_typed_object_creation</name>
-<cardinality>405</cardinality>
+<cardinality>769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>405</v>
+<v>769</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>mutator_invocation_mode</name>
-<cardinality>2</cardinality>
+<cardinality>4</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2</v>
-</e>
-<e>
-<k>mode</k>
-<v>2</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>id</src>
-<trg>mode</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>mode</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>2</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>expr_compiler_generated</name>
-<cardinality>759849</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>759849</v>
-</e>
-</columnsizes>
-<dependencies/>
-</relation>
-<relation>
-<name>expr_value</name>
-<cardinality>719515</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>719515</v>
-</e>
-<e>
-<k>value</k>
-<v>52225</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>id</src>
-<trg>value</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>719515</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>value</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>36487</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>6531</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>4017</v>
-</b>
-<b>
-<a>5</a>
-<b>25</b>
-<v>3927</v>
-</b>
-<b>
-<a>25</a>
-<b>148925</b>
-<v>1263</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>expr_call</name>
-<cardinality>304738</cardinality>
-<columnsizes>
-<e>
-<k>caller_id</k>
-<v>304738</v>
-</e>
-<e>
-<k>target_id</k>
-<v>22603</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>caller_id</src>
-<trg>target_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>304738</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>target_id</src>
-<trg>caller_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>12775</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>3512</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>1884</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>1846</v>
-</b>
-<b>
-<a>7</a>
-<b>24</b>
-<v>1714</v>
-</b>
-<b>
-<a>24</a>
-<b>23696</b>
-<v>872</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>expr_access</name>
-<cardinality>603781</cardinality>
-<columnsizes>
-<e>
-<k>accesser_id</k>
-<v>603781</v>
-</e>
-<e>
-<k>target_id</k>
-<v>151428</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>accesser_id</src>
-<trg>target_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>603781</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>target_id</src>
-<trg>accesser_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>49895</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>33117</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>23450</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>14681</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>8746</v>
-</b>
-<b>
-<a>6</a>
-<b>10</b>
-<v>12743</v>
-</b>
-<b>
-<a>10</a>
-<b>4570</b>
-<v>8794</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>expr_location</name>
-<cardinality>1970785</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>1970785</v>
-</e>
-<e>
-<k>loc</k>
-<v>1481488</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>id</src>
-<trg>loc</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>1970785</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>loc</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>1266804</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>207105</v>
-</b>
-<b>
-<a>3</a>
-<b>62488</b>
-<v>7578</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>dynamic_member_name</name>
-<cardinality>6116</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>6116</v>
-</e>
-<e>
-<k>name</k>
-<v>629</v>
-</e>
-</columnsizes>
-<dependencies>
-<dep>
-<src>id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>6116</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>172</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>107</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>82</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>50</v>
-</b>
-<b>
-<a>5</a>
-<b>7</b>
-<v>47</v>
-</b>
-<b>
-<a>7</a>
-<b>11</b>
-<v>50</v>
-</b>
-<b>
-<a>11</a>
-<b>18</b>
-<v>50</v>
-</b>
-<b>
-<a>18</a>
-<b>47</b>
-<v>50</v>
-</b>
-<b>
-<a>70</a>
-<b>303</b>
-<v>17</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-</dependencies>
-</relation>
-<relation>
-<name>conditional_access</name>
-<cardinality>1323</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>1323</v>
-</e>
-</columnsizes>
-<dependencies/>
-</relation>
-<relation>
-<name>expr_argument</name>
-<cardinality>409033</cardinality>
-<columnsizes>
-<e>
-<k>id</k>
-<v>409033</v>
+<v>4</v>
 </e>
 <e>
 <k>mode</k>
@@ -31105,7 +31188,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409033</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -31119,24 +31202,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>93</a>
-<b>94</b>
-<v>1</v>
-</b>
-<b>
-<a>764</a>
-<b>765</b>
-<v>1</v>
-</b>
-<b>
-<a>1980</a>
-<b>1981</b>
-<v>1</v>
-</b>
-<b>
-<a>406196</a>
-<b>406197</b>
-<v>1</v>
+<a>1</a>
+<b>2</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -31145,16 +31213,304 @@
 </dependencies>
 </relation>
 <relation>
-<name>expr_argument_name</name>
-<cardinality>27657</cardinality>
+<name>expr_compiler_generated</name>
+<cardinality>1630407</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>27657</v>
+<v>1630407</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>expr_value</name>
+<cardinality>1400486</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1400486</v>
+</e>
+<e>
+<k>value</k>
+<v>102877</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1400486</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>72300</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14948</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>7874</v>
+</b>
+<b>
+<a>6</a>
+<b>2062</b>
+<v>7716</v>
+</b>
+<b>
+<a>2136</a>
+<b>272893</b>
+<v>39</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>expr_call</name>
+<cardinality>677225</cardinality>
+<columnsizes>
+<e>
+<k>caller_id</k>
+<v>677225</v>
+</e>
+<e>
+<k>target_id</k>
+<v>53764</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>caller_id</src>
+<trg>target_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>677225</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>target_id</src>
+<trg>caller_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>28793</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10041</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4350</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>4656</v>
+</b>
+<b>
+<a>7</a>
+<b>24</b>
+<v>4068</v>
+</b>
+<b>
+<a>24</a>
+<b>43831</b>
+<v>1856</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>expr_access</name>
+<cardinality>1375810</cardinality>
+<columnsizes>
+<e>
+<k>accesser_id</k>
+<v>1375810</v>
+</e>
+<e>
+<k>target_id</k>
+<v>338367</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>accesser_id</src>
+<trg>target_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1375810</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>target_id</src>
+<trg>accesser_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>110149</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>71074</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>54625</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>33065</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>19830</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>25660</v>
+</b>
+<b>
+<a>9</a>
+<b>7782</b>
+<v>23961</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>expr_location</name>
+<cardinality>4251930</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>4251930</v>
+</e>
+<e>
+<k>loc</k>
+<v>3327013</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>loc</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4251930</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>loc</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2816403</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>493589</v>
+</b>
+<b>
+<a>3</a>
+<b>105362</b>
+<v>17019</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>dynamic_member_name</name>
+<cardinality>13634</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>13634</v>
 </e>
 <e>
 <k>name</k>
-<v>1049</v>
+<v>1408</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31168,7 +31524,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27657</v>
+<v>13634</v>
 </b>
 </bs>
 </hist>
@@ -31184,47 +31540,204 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>344</v>
+<v>409</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>172</v>
+<v>248</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>101</v>
+<v>160</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>71</v>
+<v>112</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>116</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>121</v>
+</b>
+<b>
+<a>11</a>
+<b>19</b>
+<v>107</v>
+</b>
+<b>
+<a>20</a>
+<b>97</b>
+<v>107</v>
+</b>
+<b>
+<a>122</a>
+<b>304</b>
+<v>24</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>conditional_access</name>
+<cardinality>3074</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>3074</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>expr_argument</name>
+<cardinality>897972</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>897972</v>
+</e>
+<e>
+<k>mode</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>mode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>897972</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>mode</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>213</a>
+<b>214</b>
+<v>1</v>
+</b>
+<b>
+<a>4293</a>
+<b>4294</b>
+<v>1</v>
+</b>
+<b>
+<a>5670</a>
+<b>5671</b>
+<v>1</v>
+</b>
+<b>
+<a>887796</a>
+<b>887797</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>expr_argument_name</name>
+<cardinality>60805</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>60805</v>
+</e>
+<e>
+<k>name</k>
+<v>2738</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>60805</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>895</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>486</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>281</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>195</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>96</v>
+<v>251</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>89</v>
+<v>232</v>
 </b>
 <b>
 <a>13</a>
-<b>26</b>
-<v>81</v>
+<b>28</b>
+<v>207</v>
 </b>
 <b>
-<a>26</a>
-<b>187</b>
-<v>79</v>
-</b>
-<b>
-<a>212</a>
-<b>4751</b>
-<v>16</v>
+<a>28</a>
+<b>11230</b>
+<v>191</v>
 </b>
 </bs>
 </hist>
@@ -31282,11 +31795,11 @@
 </relation>
 <relation>
 <name>xmlDTDs</name>
-<cardinality>5</cardinality>
+<cardinality>6</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5</v>
+<v>6</v>
 </e>
 <e>
 <k>root</k>
@@ -31302,7 +31815,7 @@
 </e>
 <e>
 <k>fileid</k>
-<v>5</v>
+<v>6</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -31316,7 +31829,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31332,7 +31845,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31348,7 +31861,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31364,7 +31877,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31582,7 +32095,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31598,7 +32111,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31614,7 +32127,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -31630,7 +32143,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -35693,11 +36206,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>94236</cardinality>
+<cardinality>419798</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>94236</v>
+<v>419798</v>
 </e>
 <e>
 <k>kind</k>
@@ -35705,11 +36218,11 @@
 </e>
 <e>
 <k>text</k>
-<v>52841</v>
+<v>201313</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>53561</v>
+<v>203984</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35723,7 +36236,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94236</v>
+<v>419798</v>
 </b>
 </bs>
 </hist>
@@ -35739,7 +36252,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94236</v>
+<v>419798</v>
 </b>
 </bs>
 </hist>
@@ -35755,7 +36268,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94236</v>
+<v>419798</v>
 </b>
 </bs>
 </hist>
@@ -35769,18 +36282,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>604</a>
-<b>605</b>
+<a>18162</a>
+<b>18163</b>
 <v>1</v>
 </b>
 <b>
-<a>7127</a>
-<b>7128</b>
+<a>152161</a>
+<b>152162</b>
 <v>1</v>
 </b>
 <b>
-<a>81418</a>
-<b>81419</b>
+<a>167355</a>
+<b>167356</b>
 <v>1</v>
 </b>
 </bs>
@@ -35795,18 +36308,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>156</a>
-<b>157</b>
+<a>12037</a>
+<b>12038</b>
 <v>1</v>
 </b>
 <b>
-<a>4531</a>
-<b>4532</b>
+<a>60681</a>
+<b>60682</b>
 <v>1</v>
 </b>
 <b>
-<a>45654</a>
-<b>45655</b>
+<a>90120</a>
+<b>90121</b>
 <v>1</v>
 </b>
 </bs>
@@ -35821,18 +36334,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>157</a>
-<b>158</b>
+<a>12704</a>
+<b>12705</b>
 <v>1</v>
 </b>
 <b>
-<a>4678</a>
-<b>4679</b>
+<a>60920</a>
+<b>60921</b>
 <v>1</v>
 </b>
 <b>
-<a>45835</a>
-<b>45836</b>
+<a>90457</a>
+<b>90458</b>
 <v>1</v>
 </b>
 </bs>
@@ -35849,17 +36362,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44757</v>
+<v>164921</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5919</v>
+<v>24003</v>
 </b>
 <b>
 <a>3</a>
-<b>6105</b>
-<v>2164</v>
+<b>24462</b>
+<v>12388</v>
 </b>
 </bs>
 </hist>
@@ -35875,12 +36388,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52470</v>
+<v>200201</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>371</v>
+<v>1112</v>
 </b>
 </bs>
 </hist>
@@ -35896,12 +36409,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52264</v>
+<v>199190</v>
 </b>
 <b>
 <a>2</a>
-<b>35</b>
-<v>577</v>
+<b>51</b>
+<v>2123</v>
 </b>
 </bs>
 </hist>
@@ -35917,17 +36430,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45738</v>
+<v>168317</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5679</v>
+<v>23527</v>
 </b>
 <b>
 <a>3</a>
-<b>5512</b>
-<v>2143</v>
+<b>24457</b>
+<v>12139</v>
 </b>
 </bs>
 </hist>
@@ -35943,7 +36456,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53561</v>
+<v>203984</v>
 </b>
 </bs>
 </hist>
@@ -35959,7 +36472,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53561</v>
+<v>203984</v>
 </b>
 </bs>
 </hist>
@@ -35969,15 +36482,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>94236</cardinality>
+<cardinality>419798</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>94236</v>
+<v>419798</v>
 </e>
 <e>
 <k>loc</k>
-<v>94236</v>
+<v>419798</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35991,7 +36504,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94236</v>
+<v>419798</v>
 </b>
 </bs>
 </hist>
@@ -36007,7 +36520,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94236</v>
+<v>419798</v>
 </b>
 </bs>
 </hist>
@@ -36017,26 +36530,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>42325</cardinality>
+<cardinality>147875</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42325</v>
+<v>147875</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>42325</cardinality>
+<cardinality>147875</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42325</v>
+<v>147875</v>
 </e>
 <e>
 <k>loc</k>
-<v>42325</v>
+<v>147875</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36050,7 +36563,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42325</v>
+<v>147875</v>
 </b>
 </bs>
 </hist>
@@ -36066,7 +36579,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42325</v>
+<v>147875</v>
 </b>
 </bs>
 </hist>
@@ -36076,15 +36589,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>133597</cardinality>
+<cardinality>512195</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42288</v>
+<v>147815</v>
 </e>
 <e>
 <k>entity</k>
-<v>65144</v>
+<v>221080</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -36102,22 +36615,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9049</v>
+<v>18487</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10673</v>
+<v>29786</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22336</v>
+<v>99241</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>228</v>
+<v>299</v>
 </b>
 </bs>
 </hist>
@@ -36133,22 +36646,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7568</v>
+<v>13264</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1533</v>
+<v>5345</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10676</v>
+<v>29742</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>22509</v>
+<v>99462</v>
 </b>
 </bs>
 </hist>
@@ -36164,17 +36677,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50257</v>
+<v>161756</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10921</v>
+<v>43244</v>
 </b>
 <b>
 <a>3</a>
-<b>525</b>
-<v>3965</v>
+<b>9897</b>
+<v>16079</v>
 </b>
 </bs>
 </hist>
@@ -36190,22 +36703,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32218</v>
+<v>96499</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25063</v>
+<v>94921</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7689</v>
+<v>28762</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>173</v>
+<v>897</v>
 </b>
 </bs>
 </hist>
@@ -36219,23 +36732,23 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>23541</a>
-<b>23542</b>
+<a>84124</a>
+<b>84125</b>
 <v>1</v>
 </b>
 <b>
-<a>32035</a>
-<b>32036</b>
+<a>104686</a>
+<b>104687</b>
 <v>1</v>
 </b>
 <b>
-<a>32822</a>
-<b>32823</b>
+<a>108160</a>
+<b>108161</b>
 <v>1</v>
 </b>
 <b>
-<a>37140</a>
-<b>37141</b>
+<a>114096</a>
+<b>114097</b>
 <v>1</v>
 </b>
 </bs>
@@ -36250,23 +36763,23 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>15869</a>
-<b>15870</b>
+<a>35989</a>
+<b>35990</b>
 <v>1</v>
 </b>
 <b>
-<a>21711</a>
-<b>21712</b>
+<a>77579</a>
+<b>77580</b>
 <v>1</v>
 </b>
 <b>
-<a>29111</a>
-<b>29112</b>
+<a>86538</a>
+<b>86539</b>
 <v>1</v>
 </b>
 <b>
-<a>33686</a>
-<b>33687</b>
+<a>102518</a>
+<b>102519</b>
 <v>1</v>
 </b>
 </bs>
@@ -36277,19 +36790,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>132682</cardinality>
+<cardinality>556149</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42325</v>
+<v>147875</v>
 </e>
 <e>
 <k>commentline</k>
-<v>94161</v>
+<v>419710</v>
 </e>
 <e>
 <k>index</k>
-<v>1200</v>
+<v>5094</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36303,22 +36816,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26814</v>
+<v>79021</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9030</v>
+<v>20347</v>
 </b>
 <b>
 <a>3</a>
+<b>4</b>
+<v>19380</v>
+</b>
+<b>
+<a>4</a>
 <b>5</b>
-<v>3555</v>
+<v>9154</v>
 </b>
 <b>
 <a>5</a>
-<b>1136</b>
-<v>2923</v>
+<b>8</b>
+<v>11718</v>
+</b>
+<b>
+<a>8</a>
+<b>4098</b>
+<v>8253</v>
 </b>
 </bs>
 </hist>
@@ -36334,27 +36857,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2277</v>
+<v>4382</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24975</v>
+<v>75573</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8866</v>
+<v>22223</v>
 </b>
 <b>
 <a>4</a>
+<b>5</b>
+<v>17490</v>
+</b>
+<b>
+<a>5</a>
 <b>6</b>
-<v>3376</v>
+<v>8805</v>
 </b>
 <b>
 <a>6</a>
-<b>1137</b>
-<v>2828</v>
+<b>9</b>
+<v>11429</v>
+</b>
+<b>
+<a>9</a>
+<b>4099</b>
+<v>7970</v>
 </b>
 </bs>
 </hist>
@@ -36370,7 +36903,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94161</v>
+<v>419701</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
 </b>
 </bs>
 </hist>
@@ -36386,12 +36924,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55641</v>
+<v>283280</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38520</v>
+<v>136430</v>
 </b>
 </bs>
 </hist>
@@ -36407,47 +36945,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>286</v>
+<v>2273</v>
 </b>
 <b>
 <a>2</a>
-<b>6</b>
-<v>71</v>
+<b>3</b>
+<v>1408</v>
 </b>
 <b>
-<a>6</a>
+<a>3</a>
 <b>7</b>
-<v>300</v>
+<v>406</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>77</v>
-</b>
-<b>
-<a>10</a>
-<b>11</b>
-<v>145</v>
+<v>448</v>
 </b>
 <b>
 <a>11</a>
-<b>15</b>
-<v>64</v>
+<b>28</b>
+<v>387</v>
 </b>
 <b>
-<a>15</a>
-<b>17</b>
-<v>101</v>
-</b>
-<b>
-<a>17</a>
-<b>40</b>
-<v>99</v>
-</b>
-<b>
-<a>40</a>
-<b>40041</b>
-<v>53</v>
+<a>28</a>
+<b>118949</b>
+<v>169</v>
 </b>
 </bs>
 </hist>
@@ -36463,47 +36986,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>286</v>
+<v>2273</v>
 </b>
 <b>
 <a>2</a>
-<b>6</b>
-<v>71</v>
+<b>3</b>
+<v>1408</v>
 </b>
 <b>
-<a>6</a>
+<a>3</a>
 <b>7</b>
-<v>300</v>
+<v>406</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>77</v>
-</b>
-<b>
-<a>10</a>
-<b>11</b>
-<v>145</v>
+<v>448</v>
 </b>
 <b>
 <a>11</a>
-<b>15</b>
-<v>64</v>
+<b>28</b>
+<v>387</v>
 </b>
 <b>
-<a>15</a>
-<b>17</b>
-<v>101</v>
-</b>
-<b>
-<a>17</a>
-<b>40</b>
-<v>99</v>
-</b>
-<b>
-<a>40</a>
-<b>40041</b>
-<v>53</v>
+<a>28</a>
+<b>118942</b>
+<v>169</v>
 </b>
 </bs>
 </hist>
@@ -36975,7 +37483,7 @@
 </e>
 <e>
 <k>name</k>
-<v>1</v>
+<v>2</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37003,8 +37511,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3</a>
-<b>4</b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
 <v>1</v>
 </b>
 </bs>
@@ -37302,7 +37815,7 @@
 </e>
 <e>
 <k>name</k>
-<v>6</v>
+<v>3</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37330,19 +37843,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>4</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
-</b>
-<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -37363,23 +37866,23 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>16552562</cardinality>
+<cardinality>32176157</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16552562</v>
+<v>32176157</v>
 </e>
 <e>
 <k>opcode</k>
-<v>496</v>
+<v>964</v>
 </e>
 <e>
 <k>index</k>
-<v>171041</v>
+<v>332483</v>
 </e>
 <e>
 <k>impl</k>
-<v>888189</v>
+<v>1726531</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37393,7 +37896,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16552562</v>
+<v>32176157</v>
 </b>
 </bs>
 </hist>
@@ -37409,7 +37912,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16552562</v>
+<v>32176157</v>
 </b>
 </bs>
 </hist>
@@ -37425,7 +37928,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16552562</v>
+<v>32176157</v>
 </b>
 </bs>
 </hist>
@@ -37441,72 +37944,72 @@
 <b>
 <a>1</a>
 <b>7</b>
-<v>40</v>
+<v>77</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>46</a>
 <b>106</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>128</a>
 <b>302</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>304</a>
 <b>953</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>1002</a>
 <b>1752</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>1791</a>
 <b>2952</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>3194</a>
 <b>4898</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>5191</a>
 <b>11577</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>11669</a>
 <b>19719</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>19906</a>
 <b>53412</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>54233</a>
 <b>104298</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>104740</a>
 <b>420483</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>562153</a>
 <b>815024</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -37522,67 +38025,67 @@
 <b>
 <a>1</a>
 <b>7</b>
-<v>42</v>
+<v>82</v>
 </b>
 <b>
 <a>10</a>
 <b>31</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>32</a>
 <b>68</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>75</a>
 <b>148</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>150</a>
 <b>214</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>214</a>
 <b>313</b>
-<v>40</v>
+<v>77</v>
 </b>
 <b>
 <a>323</a>
 <b>468</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>486</a>
 <b>699</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>714</a>
 <b>872</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>879</a>
 <b>1176</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>1185</a>
 <b>1360</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>1382</a>
 <b>2349</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>2641</a>
 <b>31606</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -37598,72 +38101,72 @@
 <b>
 <a>1</a>
 <b>6</b>
-<v>40</v>
+<v>77</v>
 </b>
 <b>
 <a>7</a>
 <b>22</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>26</a>
 <b>58</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>62</a>
 <b>191</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>192</a>
 <b>422</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>434</a>
 <b>696</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>703</a>
 <b>993</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>1012</a>
 <b>2698</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>2754</a>
 <b>5088</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>5150</a>
 <b>9841</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>10112</a>
 <b>16999</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>18955</a>
 <b>42845</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>44005</a>
 <b>171634</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>243198</a>
 <b>301111</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -37679,22 +38182,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133975</v>
+<v>260431</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>15742</v>
+<v>30602</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>13115</v>
+<v>25495</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>8207</v>
+<v>15954</v>
 </b>
 </bs>
 </hist>
@@ -37710,27 +38213,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>134281</v>
+<v>261026</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9097</v>
+<v>17684</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>14782</v>
+<v>28735</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>12829</v>
+<v>24939</v>
 </b>
 <b>
 <a>160</a>
 <b>169</b>
-<v>50</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -37746,22 +38249,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133975</v>
+<v>260431</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>15742</v>
+<v>30602</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>13115</v>
+<v>25495</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>8207</v>
+<v>15954</v>
 </b>
 </bs>
 </hist>
@@ -37777,57 +38280,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43222</v>
+<v>84019</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>129568</v>
+<v>251864</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>170983</v>
+<v>332371</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>100772</v>
+<v>195888</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>55082</v>
+<v>107074</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>81281</v>
+<v>158001</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>77684</v>
+<v>151008</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>68857</v>
+<v>133851</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>67649</v>
+<v>131502</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>66634</v>
+<v>129528</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>26452</v>
+<v>51419</v>
 </b>
 </bs>
 </hist>
@@ -37843,57 +38346,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43222</v>
+<v>84019</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>129716</v>
+<v>252152</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>174054</v>
+<v>338340</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>123195</v>
+<v>239477</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>68133</v>
+<v>132442</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>49557</v>
+<v>96333</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>76029</v>
+<v>147792</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>66293</v>
+<v>128866</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>69868</v>
+<v>135814</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>67955</v>
+<v>132096</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>20162</v>
+<v>39193</v>
 </b>
 </bs>
 </hist>
@@ -37909,57 +38412,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43222</v>
+<v>84019</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>129568</v>
+<v>251864</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>170983</v>
+<v>332371</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>100772</v>
+<v>195888</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>55082</v>
+<v>107074</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>81281</v>
+<v>158001</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>77684</v>
+<v>151008</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>68857</v>
+<v>133851</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>67649</v>
+<v>131502</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>66634</v>
+<v>129528</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>26452</v>
+<v>51419</v>
 </b>
 </bs>
 </hist>
@@ -37969,15 +38472,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>1031096</cardinality>
+<cardinality>2004325</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1031096</v>
+<v>2004325</v>
 </e>
 <e>
 <k>target</k>
-<v>825801</v>
+<v>1605257</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37991,7 +38494,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1031096</v>
+<v>2004325</v>
 </b>
 </bs>
 </hist>
@@ -38007,17 +38510,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>715866</v>
+<v>1391557</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73951</v>
+<v>143752</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>35983</v>
+<v>69946</v>
 </b>
 </bs>
 </hist>
@@ -38027,15 +38530,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>6137610</cardinality>
+<cardinality>11930764</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>6137610</v>
+<v>11930764</v>
 </e>
 <e>
 <k>target</k>
-<v>1371444</v>
+<v>2665920</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38049,7 +38552,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6137610</v>
+<v>11930764</v>
 </b>
 </bs>
 </hist>
@@ -38065,37 +38568,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>486346</v>
+<v>945397</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>380856</v>
+<v>740337</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>138477</v>
+<v>269183</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>96310</v>
+<v>187215</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>116673</v>
+<v>226798</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>104758</v>
+<v>203637</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>48023</v>
+<v>93351</v>
 </b>
 </bs>
 </hist>
@@ -38105,15 +38608,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>969669</cardinality>
+<cardinality>1884918</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>969669</v>
+<v>1884918</v>
 </e>
 <e>
 <k>value</k>
-<v>254691</v>
+<v>495090</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38127,7 +38630,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>969669</v>
+<v>1884918</v>
 </b>
 </bs>
 </hist>
@@ -38143,27 +38646,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>172094</v>
+<v>334530</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40663</v>
+<v>79044</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>20952</v>
+<v>40728</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>19172</v>
+<v>37268</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>1809</v>
+<v>3518</v>
 </b>
 </bs>
 </hist>
@@ -38173,19 +38676,19 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>100055</cardinality>
+<cardinality>194495</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>12275</v>
+<v>23862</v>
 </e>
 <e>
 <k>index</k>
-<v>1296</v>
+<v>2519</v>
 </e>
 <e>
 <k>target</k>
-<v>67220</v>
+<v>130669</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38199,47 +38702,47 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>3612</v>
+<v>7021</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2363</v>
+<v>4595</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1662</v>
+<v>3230</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>867</v>
+<v>1686</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>742</v>
+<v>1442</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>1110</v>
+<v>2158</v>
 </b>
 <b>
 <a>11</a>
 <b>17</b>
-<v>950</v>
+<v>1846</v>
 </b>
 <b>
 <a>17</a>
 <b>128</b>
-<v>922</v>
+<v>1793</v>
 </b>
 <b>
 <a>141</a>
 <b>518</b>
-<v>45</v>
+<v>87</v>
 </b>
 </bs>
 </hist>
@@ -38255,42 +38758,42 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>543</v>
+<v>1057</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4244</v>
+<v>8249</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2825</v>
+<v>5491</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1323</v>
+<v>2572</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>947</v>
+<v>1841</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>874</v>
+<v>1700</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>925</v>
+<v>1798</v>
 </b>
 <b>
 <a>14</a>
 <b>204</b>
-<v>591</v>
+<v>1150</v>
 </b>
 </bs>
 </hist>
@@ -38306,52 +38809,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>508</v>
+<v>989</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>185</v>
+<v>360</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>11</a>
 <b>18</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>18</a>
 <b>24</b>
-<v>97</v>
+<v>190</v>
 </b>
 <b>
 <a>25</a>
 <b>47</b>
-<v>102</v>
+<v>199</v>
 </b>
 <b>
 <a>47</a>
 <b>225</b>
-<v>97</v>
+<v>190</v>
 </b>
 <b>
 <a>238</a>
 <b>4898</b>
-<v>55</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -38367,52 +38870,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20</v>
+<v>38</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>501</v>
+<v>974</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>160</v>
+<v>311</v>
 </b>
 <b>
 <a>5</a>
 <b>11</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>11</a>
 <b>18</b>
-<v>107</v>
+<v>209</v>
 </b>
 <b>
 <a>18</a>
 <b>24</b>
-<v>105</v>
+<v>204</v>
 </b>
 <b>
 <a>24</a>
 <b>47</b>
-<v>100</v>
+<v>194</v>
 </b>
 <b>
 <a>47</a>
 <b>271</b>
-<v>97</v>
+<v>190</v>
 </b>
 <b>
 <a>289</a>
 <b>4830</b>
-<v>47</v>
+<v>92</v>
 </b>
 </bs>
 </hist>
@@ -38428,12 +38931,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66381</v>
+<v>129036</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>839</v>
+<v>1632</v>
 </b>
 </bs>
 </hist>
@@ -38449,17 +38952,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60843</v>
+<v>118272</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5146</v>
+<v>10004</v>
 </b>
 <b>
 <a>7</a>
 <b>253</b>
-<v>1230</v>
+<v>2392</v>
 </b>
 </bs>
 </hist>
@@ -38537,15 +39040,15 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>142744</cardinality>
+<cardinality>277477</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>131230</v>
+<v>255095</v>
 </e>
 <e>
 <k>loc</k>
-<v>1757</v>
+<v>3415</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38559,12 +39062,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119716</v>
+<v>232714</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11513</v>
+<v>22381</v>
 </b>
 </bs>
 </hist>
@@ -38580,67 +39083,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>112</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>152</v>
+<v>297</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>140</v>
+<v>272</v>
 </b>
 <b>
 <a>13</a>
 <b>17</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>17</a>
 <b>23</b>
-<v>145</v>
+<v>282</v>
 </b>
 <b>
 <a>23</a>
 <b>32</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>32</a>
 <b>43</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>43</a>
 <b>66</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>66</a>
 <b>110</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>112</a>
 <b>238</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>239</a>
 <b>2419</b>
-<v>125</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -38650,15 +39153,15 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>969646</cardinality>
+<cardinality>1884874</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>924658</v>
+<v>1797423</v>
 </e>
 <e>
 <k>loc</k>
-<v>1609</v>
+<v>3128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38672,12 +39175,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>879671</v>
+<v>1709973</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44987</v>
+<v>87450</v>
 </b>
 </bs>
 </hist>
@@ -38693,67 +39196,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>11</a>
 <b>23</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>23</a>
 <b>38</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>38</a>
 <b>53</b>
-<v>130</v>
+<v>253</v>
 </b>
 <b>
 <a>53</a>
 <b>79</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>80</a>
 <b>107</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>107</a>
 <b>138</b>
-<v>127</v>
+<v>248</v>
 </b>
 <b>
 <a>140</a>
 <b>204</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>204</a>
 <b>278</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>281</a>
 <b>385</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>388</a>
 <b>734</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>735</a>
 <b>1631</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>1646</a>
 <b>33686</b>
-<v>105</v>
+<v>204</v>
 </b>
 </bs>
 </hist>
@@ -38763,27 +39266,27 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>409055</cardinality>
+<cardinality>795153</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>409055</v>
+<v>795153</v>
 </e>
 <e>
 <k>name</k>
-<v>92151</v>
+<v>179130</v>
 </e>
 <e>
 <k>kind</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>parent</k>
-<v>79995</v>
+<v>155501</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>239129</v>
+<v>464838</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38797,7 +39300,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409055</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -38813,7 +39316,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409055</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -38829,7 +39332,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409055</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -38845,7 +39348,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409055</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -38861,22 +39364,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70838</v>
+<v>137700</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11566</v>
+<v>22483</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7292</v>
+<v>14175</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>2454</v>
+<v>4770</v>
 </b>
 </bs>
 </hist>
@@ -38892,7 +39395,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>92151</v>
+<v>179130</v>
 </b>
 </bs>
 </hist>
@@ -38908,17 +39411,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83582</v>
+<v>162474</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>7021</v>
+<v>13649</v>
 </b>
 <b>
 <a>4</a>
 <b>21324</b>
-<v>1546</v>
+<v>3006</v>
 </b>
 </bs>
 </hist>
@@ -38934,17 +39437,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75192</v>
+<v>146165</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11579</v>
+<v>22508</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>5379</v>
+<v>10457</v>
 </b>
 </bs>
 </hist>
@@ -38960,22 +39463,22 @@
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2909</a>
 <b>2910</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>37932</a>
 <b>37933</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>122212</a>
 <b>122213</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -38991,22 +39494,22 @@
 <b>
 <a>21</a>
 <b>22</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>101</a>
 <b>102</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1188</a>
 <b>1189</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>35450</a>
 <b>35451</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -39022,22 +39525,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>31</a>
 <b>32</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11217</a>
 <b>11218</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21323</a>
 <b>21324</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -39053,22 +39556,22 @@
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2464</a>
 <b>2465</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>37932</a>
 <b>37933</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>54872</a>
 <b>54873</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -39084,27 +39587,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52382</v>
+<v>101825</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13790</v>
+<v>26806</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>6866</v>
+<v>13347</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>6021</v>
+<v>11704</v>
 </b>
 <b>
 <a>33</a>
 <b>26079</b>
-<v>935</v>
+<v>1817</v>
 </b>
 </bs>
 </hist>
@@ -39120,27 +39623,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52678</v>
+<v>102400</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14005</v>
+<v>27225</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>6813</v>
+<v>13244</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>6013</v>
+<v>11690</v>
 </b>
 <b>
 <a>38</a>
 <b>1426</b>
-<v>483</v>
+<v>940</v>
 </b>
 </bs>
 </hist>
@@ -39156,12 +39659,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78348</v>
+<v>152300</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1646</v>
+<v>3201</v>
 </b>
 </bs>
 </hist>
@@ -39177,27 +39680,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52625</v>
+<v>102298</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14015</v>
+<v>27244</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>6765</v>
+<v>13152</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>6003</v>
+<v>11670</v>
 </b>
 <b>
 <a>38</a>
 <b>3476</b>
-<v>584</v>
+<v>1135</v>
 </b>
 </bs>
 </hist>
@@ -39213,12 +39716,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225344</v>
+<v>438042</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>13785</v>
+<v>26796</v>
 </b>
 </bs>
 </hist>
@@ -39234,7 +39737,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>239129</v>
+<v>464838</v>
 </b>
 </bs>
 </hist>
@@ -39250,7 +39753,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>239129</v>
+<v>464838</v>
 </b>
 </bs>
 </hist>
@@ -39266,12 +39769,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234845</v>
+<v>456510</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>4284</v>
+<v>8327</v>
 </b>
 </bs>
 </hist>
@@ -39281,15 +39784,15 @@
 </relation>
 <relation>
 <name>cil_pointer_type</name>
-<cardinality>308</cardinality>
+<cardinality>599</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>308</v>
+<v>599</v>
 </e>
 <e>
 <k>pointee</k>
-<v>308</v>
+<v>599</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39303,7 +39806,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>308</v>
+<v>599</v>
 </b>
 </bs>
 </hist>
@@ -39319,7 +39822,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>308</v>
+<v>599</v>
 </b>
 </bs>
 </hist>
@@ -39329,19 +39832,19 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>7292</cardinality>
+<cardinality>14175</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7292</v>
+<v>14175</v>
 </e>
 <e>
 <k>element_type</k>
-<v>7252</v>
+<v>14097</v>
 </e>
 <e>
 <k>rank</k>
-<v>7</v>
+<v>14</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39355,7 +39858,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7292</v>
+<v>14175</v>
 </b>
 </bs>
 </hist>
@@ -39371,7 +39874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7292</v>
+<v>14175</v>
 </b>
 </bs>
 </hist>
@@ -39387,12 +39890,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7214</v>
+<v>14024</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -39408,12 +39911,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7214</v>
+<v>14024</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>37</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -39429,17 +39932,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2892</a>
 <b>2893</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -39455,17 +39958,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2892</a>
 <b>2893</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -39528,23 +40031,23 @@
 </relation>
 <relation>
 <name>cil_method</name>
-<cardinality>1189816</cardinality>
+<cardinality>2312858</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1189816</v>
+<v>2312858</v>
 </e>
 <e>
 <k>name</k>
-<v>226266</v>
+<v>439835</v>
 </e>
 <e>
 <k>parent</k>
-<v>195528</v>
+<v>380082</v>
 </e>
 <e>
 <k>return_type</k>
-<v>110065</v>
+<v>213953</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39558,7 +40061,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189816</v>
+<v>2312858</v>
 </b>
 </bs>
 </hist>
@@ -39574,7 +40077,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189816</v>
+<v>2312858</v>
 </b>
 </bs>
 </hist>
@@ -39590,7 +40093,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1189816</v>
+<v>2312858</v>
 </b>
 </bs>
 </hist>
@@ -39606,27 +40109,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>139407</v>
+<v>270991</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40949</v>
+<v>79600</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12877</v>
+<v>25032</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>17229</v>
+<v>33492</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>15803</v>
+<v>30719</v>
 </b>
 </bs>
 </hist>
@@ -39642,27 +40145,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146614</v>
+<v>285001</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39384</v>
+<v>76559</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20508</v>
+<v>39865</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>17056</v>
+<v>33155</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>2702</v>
+<v>5253</v>
 </b>
 </bs>
 </hist>
@@ -39678,17 +40181,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>197578</v>
+<v>384068</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>20693</v>
+<v>40226</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>7994</v>
+<v>15539</v>
 </b>
 </bs>
 </hist>
@@ -39704,42 +40207,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55538</v>
+<v>107960</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43468</v>
+<v>84497</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25692</v>
+<v>49943</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14695</v>
+<v>28565</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15878</v>
+<v>30865</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16931</v>
+<v>32912</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>14893</v>
+<v>28950</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>8430</v>
+<v>16387</v>
 </b>
 </bs>
 </hist>
@@ -39755,42 +40258,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>58825</v>
+<v>114349</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44576</v>
+<v>86651</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25978</v>
+<v>50498</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14873</v>
+<v>28911</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>16908</v>
+<v>32868</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>15437</v>
+<v>30007</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>14757</v>
+<v>28687</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>4171</v>
+<v>8108</v>
 </b>
 </bs>
 </hist>
@@ -39806,32 +40309,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83409</v>
+<v>162138</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48191</v>
+<v>93678</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>23862</v>
+<v>46385</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11982</v>
+<v>23292</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>14604</v>
+<v>28389</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>13476</v>
+<v>26197</v>
 </b>
 </bs>
 </hist>
@@ -39847,27 +40350,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67877</v>
+<v>131945</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19668</v>
+<v>38233</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>9691</v>
+<v>18838</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>8520</v>
+<v>16563</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>4306</v>
+<v>8371</v>
 </b>
 </bs>
 </hist>
@@ -39883,22 +40386,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78972</v>
+<v>153513</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15607</v>
+<v>30339</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>9846</v>
+<v>19141</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>5637</v>
+<v>10959</v>
 </b>
 </bs>
 </hist>
@@ -39914,22 +40417,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74781</v>
+<v>145365</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18202</v>
+<v>35382</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>9027</v>
+<v>17547</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>8054</v>
+<v>15656</v>
 </b>
 </bs>
 </hist>
@@ -39939,15 +40442,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>1083735</cardinality>
+<cardinality>2106648</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1083735</v>
+<v>2106648</v>
 </e>
 <e>
 <k>source</k>
-<v>958949</v>
+<v>1864081</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39961,7 +40464,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1083735</v>
+<v>2106648</v>
 </b>
 </bs>
 </hist>
@@ -39977,12 +40480,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>904975</v>
+<v>1759161</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>53974</v>
+<v>104920</v>
 </b>
 </bs>
 </hist>
@@ -39992,19 +40495,19 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>888189</cardinality>
+<cardinality>1726531</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>888189</v>
+<v>1726531</v>
 </e>
 <e>
 <k>method</k>
-<v>843532</v>
+<v>1639724</v>
 </e>
 <e>
 <k>location</k>
-<v>1591</v>
+<v>3094</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40018,7 +40521,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>888189</v>
+<v>1726531</v>
 </b>
 </bs>
 </hist>
@@ -40034,7 +40537,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>888189</v>
+<v>1726531</v>
 </b>
 </bs>
 </hist>
@@ -40050,12 +40553,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>798875</v>
+<v>1552916</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44656</v>
+<v>86807</v>
 </b>
 </bs>
 </hist>
@@ -40071,12 +40574,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>798875</v>
+<v>1552916</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44656</v>
+<v>86807</v>
 </b>
 </bs>
 </hist>
@@ -40092,67 +40595,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>140</v>
+<v>272</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
 <b>50</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>50</a>
 <b>74</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>74</a>
 <b>104</b>
-<v>127</v>
+<v>248</v>
 </b>
 <b>
 <a>104</a>
 <b>133</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
 <b>192</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>192</a>
 <b>271</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>271</a>
 <b>365</b>
-<v>127</v>
+<v>248</v>
 </b>
 <b>
 <a>372</a>
 <b>654</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>682</a>
 <b>1597</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>97</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -40168,67 +40671,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>140</v>
+<v>272</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
 <b>50</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>50</a>
 <b>74</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>74</a>
 <b>104</b>
-<v>127</v>
+<v>248</v>
 </b>
 <b>
 <a>104</a>
 <b>133</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
 <b>192</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>192</a>
 <b>271</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>271</a>
 <b>365</b>
-<v>127</v>
+<v>248</v>
 </b>
 <b>
 <a>372</a>
 <b>654</b>
-<v>120</v>
+<v>233</v>
 </b>
 <b>
 <a>682</a>
 <b>1597</b>
-<v>122</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>97</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -40238,15 +40741,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>55097</cardinality>
+<cardinality>107103</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>54706</v>
+<v>106343</v>
 </e>
 <e>
 <k>decl</k>
-<v>9119</v>
+<v>17727</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40260,12 +40763,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54315</v>
+<v>105582</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>391</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -40281,27 +40784,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5936</v>
+<v>11539</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1391</v>
+<v>2704</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>812</v>
+<v>1578</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>684</v>
+<v>1330</v>
 </b>
 <b>
 <a>18</a>
 <b>2180</b>
-<v>295</v>
+<v>575</v>
 </b>
 </bs>
 </hist>
@@ -40311,23 +40814,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>518960</cardinality>
+<cardinality>1008794</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>518960</v>
+<v>1008794</v>
 </e>
 <e>
 <k>parent</k>
-<v>103509</v>
+<v>201210</v>
 </e>
 <e>
 <k>name</k>
-<v>185701</v>
+<v>360980</v>
 </e>
 <e>
 <k>field_type</k>
-<v>85352</v>
+<v>165915</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40341,7 +40844,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>518960</v>
+<v>1008794</v>
 </b>
 </bs>
 </hist>
@@ -40357,7 +40860,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>518960</v>
+<v>1008794</v>
 </b>
 </bs>
 </hist>
@@ -40373,7 +40876,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>518960</v>
+<v>1008794</v>
 </b>
 </bs>
 </hist>
@@ -40389,47 +40892,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31195</v>
+<v>60639</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21115</v>
+<v>41045</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11471</v>
+<v>22298</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7966</v>
+<v>15486</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6026</v>
+<v>11714</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>8721</v>
+<v>16953</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>9187</v>
+<v>17859</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>7766</v>
+<v>15096</v>
 </b>
 <b>
 <a>237</a>
 <b>4205</b>
-<v>60</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -40445,47 +40948,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31195</v>
+<v>60639</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21115</v>
+<v>41045</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11471</v>
+<v>22298</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7966</v>
+<v>15486</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6026</v>
+<v>11714</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>8721</v>
+<v>16953</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>9187</v>
+<v>17859</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>7766</v>
+<v>15096</v>
 </b>
 <b>
 <a>237</a>
 <b>4205</b>
-<v>60</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -40501,37 +41004,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36231</v>
+<v>70429</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30751</v>
+<v>59776</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10508</v>
+<v>20427</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5898</v>
+<v>11466</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>8072</v>
+<v>15691</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>8262</v>
+<v>16061</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>3785</v>
+<v>7358</v>
 </b>
 </bs>
 </hist>
@@ -40547,22 +41050,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>134749</v>
+<v>261937</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28485</v>
+<v>55371</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>15474</v>
+<v>30080</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>6991</v>
+<v>13590</v>
 </b>
 </bs>
 </hist>
@@ -40578,22 +41081,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>134749</v>
+<v>261937</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28485</v>
+<v>55371</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>15474</v>
+<v>30080</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>6991</v>
+<v>13590</v>
 </b>
 </bs>
 </hist>
@@ -40609,17 +41112,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>157161</v>
+<v>305501</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17525</v>
+<v>34067</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>11015</v>
+<v>21411</v>
 </b>
 </bs>
 </hist>
@@ -40635,32 +41138,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42515</v>
+<v>82645</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22521</v>
+<v>43778</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4610</v>
+<v>8961</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7851</v>
+<v>15262</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>6452</v>
+<v>12543</v>
 </b>
 <b>
 <a>31</a>
 <b>21103</b>
-<v>1401</v>
+<v>2723</v>
 </b>
 </bs>
 </hist>
@@ -40676,22 +41179,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49760</v>
+<v>96728</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22894</v>
+<v>44504</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7322</v>
+<v>14233</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>5374</v>
+<v>10447</v>
 </b>
 </bs>
 </hist>
@@ -40707,27 +41210,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61655</v>
+<v>119850</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9242</v>
+<v>17966</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6813</v>
+<v>13244</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>6414</v>
+<v>12469</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>1225</v>
+<v>2382</v>
 </b>
 </bs>
 </hist>
@@ -40737,23 +41240,23 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>2339980</cardinality>
+<cardinality>4548636</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2339980</v>
+<v>4548636</v>
 </e>
 <e>
 <k>parameterizable</k>
-<v>1142723</v>
+<v>2221314</v>
 </e>
 <e>
 <k>index</k>
-<v>102</v>
+<v>199</v>
 </e>
 <e>
 <k>param_type</k>
-<v>284357</v>
+<v>552756</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40767,7 +41270,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2339980</v>
+<v>4548636</v>
 </b>
 </bs>
 </hist>
@@ -40783,7 +41286,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2339980</v>
+<v>4548636</v>
 </b>
 </bs>
 </hist>
@@ -40799,7 +41302,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2339980</v>
+<v>4548636</v>
 </b>
 </bs>
 </hist>
@@ -40815,27 +41318,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>463488</v>
+<v>900965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>405252</v>
+<v>787761</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>167073</v>
+<v>324769</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>90027</v>
+<v>175003</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>16881</v>
+<v>32814</v>
 </b>
 </bs>
 </hist>
@@ -40851,27 +41354,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>463488</v>
+<v>900965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>405252</v>
+<v>787761</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>167073</v>
+<v>324769</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>90027</v>
+<v>175003</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>16881</v>
+<v>32814</v>
 </b>
 </bs>
 </hist>
@@ -40887,22 +41390,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>488208</v>
+<v>949018</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>410659</v>
+<v>798272</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>161084</v>
+<v>313128</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>82770</v>
+<v>160896</v>
 </b>
 </bs>
 </hist>
@@ -40918,67 +41421,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>18</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>20</a>
 <b>35</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>44</a>
 <b>53</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>61</a>
 <b>78</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>87</a>
 <b>122</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>150</a>
 <b>293</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>378</a>
 <b>632</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>810</a>
 <b>2528</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3263</a>
 <b>6735</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>11503</a>
 <b>42648</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>109294</a>
 <b>455844</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -40994,67 +41497,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>18</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>20</a>
 <b>35</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>44</a>
 <b>53</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>61</a>
 <b>78</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>87</a>
 <b>122</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>150</a>
 <b>293</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>378</a>
 <b>632</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>810</a>
 <b>2528</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3263</a>
 <b>6735</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>11503</a>
 <b>42648</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>109294</a>
 <b>455844</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -41070,72 +41573,72 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>11</a>
 <b>16</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>16</a>
 <b>18</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>19</a>
 <b>21</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>22</a>
 <b>28</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>34</a>
 <b>88</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>129</a>
 <b>233</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>290</a>
 <b>447</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>554</a>
 <b>928</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>1321</a>
 <b>3323</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>6167</a>
 <b>43422</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>83818</a>
 <b>83819</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -41151,42 +41654,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95417</v>
+<v>185480</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70539</v>
+<v>137120</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>23168</v>
+<v>45036</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>19788</v>
+<v>38467</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>22569</v>
+<v>43871</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>22007</v>
+<v>42779</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>21553</v>
+<v>41897</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>9312</v>
+<v>18103</v>
 </b>
 </bs>
 </hist>
@@ -41202,42 +41705,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97067</v>
+<v>188686</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>69870</v>
+<v>135819</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>23381</v>
+<v>45450</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>19162</v>
+<v>37249</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>22799</v>
+<v>44319</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>22037</v>
+<v>42838</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>21471</v>
+<v>41737</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>8568</v>
+<v>16655</v>
 </b>
 </bs>
 </hist>
@@ -41253,22 +41756,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>198441</v>
+<v>385745</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56524</v>
+<v>109875</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22884</v>
+<v>44485</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>6507</v>
+<v>12650</v>
 </b>
 </bs>
 </hist>
@@ -41278,37 +41781,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>16650</cardinality>
+<cardinality>32366</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16650</v>
+<v>32366</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>23687</cardinality>
+<cardinality>46044</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>23687</v>
+<v>46044</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>54944</cardinality>
+<cardinality>106806</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>54944</v>
+<v>106806</v>
 </e>
 <e>
 <k>method</k>
-<v>54944</v>
+<v>106806</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41322,7 +41825,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54944</v>
+<v>106806</v>
 </b>
 </bs>
 </hist>
@@ -41338,7 +41841,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54944</v>
+<v>106806</v>
 </b>
 </bs>
 </hist>
@@ -41348,19 +41851,19 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>2113</cardinality>
+<cardinality>4107</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2113</v>
+<v>4107</v>
 </e>
 <e>
 <k>modifier</k>
-<v>27</v>
+<v>53</v>
 </e>
 <e>
 <k>kind</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41374,7 +41877,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2113</v>
+<v>4107</v>
 </b>
 </bs>
 </hist>
@@ -41390,7 +41893,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2113</v>
+<v>4107</v>
 </b>
 </bs>
 </hist>
@@ -41406,57 +41909,57 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>10</a>
 <b>11</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>19</a>
 <b>20</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>25</a>
 <b>26</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>29</a>
 <b>30</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>51</a>
 <b>52</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>68</a>
 <b>69</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>87</a>
 <b>88</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>94</a>
 <b>95</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>444</a>
 <b>445</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -41472,7 +41975,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27</v>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -41488,7 +41991,7 @@
 <b>
 <a>843</a>
 <b>844</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -41504,7 +42007,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -41514,15 +42017,15 @@
 </relation>
 <relation>
 <name>cil_type_annotation</name>
-<cardinality>100907</cardinality>
+<cardinality>196152</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>100907</v>
+<v>196152</v>
 </e>
 <e>
 <k>annotation</k>
-<v>2</v>
+<v>4</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41536,7 +42039,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100907</v>
+<v>196152</v>
 </b>
 </bs>
 </hist>
@@ -41552,7 +42055,7 @@
 <b>
 <a>40253</a>
 <b>40254</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -41562,15 +42065,15 @@
 </relation>
 <relation>
 <name>cil_getter</name>
-<cardinality>195244</cardinality>
+<cardinality>379532</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>195244</v>
+<v>379532</v>
 </e>
 <e>
 <k>method</k>
-<v>195244</v>
+<v>379532</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41584,7 +42087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195244</v>
+<v>379532</v>
 </b>
 </bs>
 </hist>
@@ -41600,7 +42103,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195244</v>
+<v>379532</v>
 </b>
 </bs>
 </hist>
@@ -41610,15 +42113,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>10741</cardinality>
+<cardinality>20880</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>10741</v>
+<v>20880</v>
 </e>
 <e>
 <k>method</k>
-<v>10741</v>
+<v>20880</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41632,7 +42135,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10741</v>
+<v>20880</v>
 </b>
 </bs>
 </hist>
@@ -41648,7 +42151,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10741</v>
+<v>20880</v>
 </b>
 </bs>
 </hist>
@@ -41658,15 +42161,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>10741</cardinality>
+<cardinality>20880</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>10741</v>
+<v>20880</v>
 </e>
 <e>
 <k>method</k>
-<v>10741</v>
+<v>20880</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41680,7 +42183,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10741</v>
+<v>20880</v>
 </b>
 </bs>
 </hist>
@@ -41696,7 +42199,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10741</v>
+<v>20880</v>
 </b>
 </bs>
 </hist>
@@ -41754,23 +42257,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>195525</cardinality>
+<cardinality>380077</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>195525</v>
+<v>380077</v>
 </e>
 <e>
 <k>parent</k>
-<v>48198</v>
+<v>93692</v>
 </e>
 <e>
 <k>name</k>
-<v>54674</v>
+<v>106279</v>
 </e>
 <e>
 <k>property_type</k>
-<v>25642</v>
+<v>49845</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41784,7 +42287,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195525</v>
+<v>380077</v>
 </b>
 </bs>
 </hist>
@@ -41800,7 +42303,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195525</v>
+<v>380077</v>
 </b>
 </bs>
 </hist>
@@ -41816,7 +42319,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195525</v>
+<v>380077</v>
 </b>
 </bs>
 </hist>
@@ -41832,42 +42335,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14855</v>
+<v>28877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11463</v>
+<v>22284</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5873</v>
+<v>11417</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4349</v>
+<v>8454</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2953</v>
+<v>5740</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>4457</v>
+<v>8664</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>3652</v>
+<v>7099</v>
 </b>
 <b>
 <a>25</a>
 <b>1883</b>
-<v>594</v>
+<v>1154</v>
 </b>
 </bs>
 </hist>
@@ -41883,42 +42386,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17297</v>
+<v>33623</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9154</v>
+<v>17796</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5820</v>
+<v>11315</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4354</v>
+<v>8464</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2943</v>
+<v>5720</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>3409</v>
+<v>6627</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>3712</v>
+<v>7216</v>
 </b>
 <b>
 <a>15</a>
 <b>1883</b>
-<v>1506</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -41934,32 +42437,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18041</v>
+<v>35070</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13256</v>
+<v>25768</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6933</v>
+<v>13478</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4168</v>
+<v>8103</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>3990</v>
+<v>7757</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>1807</v>
+<v>3513</v>
 </b>
 </bs>
 </hist>
@@ -41975,27 +42478,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32232</v>
+<v>62656</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11030</v>
+<v>21441</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3334</v>
+<v>6481</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4507</v>
+<v>8761</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>3569</v>
+<v>6939</v>
 </b>
 </bs>
 </hist>
@@ -42011,27 +42514,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32232</v>
+<v>62656</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11067</v>
+<v>21514</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3321</v>
+<v>6456</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4514</v>
+<v>8776</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>3537</v>
+<v>6875</v>
 </b>
 </bs>
 </hist>
@@ -42047,17 +42550,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>46012</v>
+<v>89443</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5645</v>
+<v>10973</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>3015</v>
+<v>5862</v>
 </b>
 </bs>
 </hist>
@@ -42073,27 +42576,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16169</v>
+<v>31430</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3868</v>
+<v>7519</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1636</v>
+<v>3182</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>2246</v>
+<v>4366</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>1722</v>
+<v>3347</v>
 </b>
 </bs>
 </hist>
@@ -42109,27 +42612,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17089</v>
+<v>33219</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3617</v>
+<v>7031</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1566</v>
+<v>3045</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>1987</v>
+<v>3864</v>
 </b>
 <b>
 <a>8</a>
 <b>5858</b>
-<v>1381</v>
+<v>2685</v>
 </b>
 </bs>
 </hist>
@@ -42145,22 +42648,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20548</v>
+<v>39943</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2732</v>
+<v>5311</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>1955</v>
+<v>3800</v>
 </b>
 <b>
 <a>12</a>
 <b>6253</b>
-<v>406</v>
+<v>789</v>
 </b>
 </bs>
 </hist>
@@ -42170,23 +42673,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>10726</cardinality>
+<cardinality>20851</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10726</v>
+<v>20851</v>
 </e>
 <e>
 <k>parent</k>
-<v>3324</v>
+<v>6461</v>
 </e>
 <e>
 <k>name</k>
-<v>6723</v>
+<v>13069</v>
 </e>
 <e>
 <k>event_type</k>
-<v>3497</v>
+<v>6797</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42200,7 +42703,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10726</v>
+<v>20851</v>
 </b>
 </bs>
 </hist>
@@ -42216,7 +42719,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10726</v>
+<v>20851</v>
 </b>
 </bs>
 </hist>
@@ -42232,7 +42735,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10726</v>
+<v>20851</v>
 </b>
 </bs>
 </hist>
@@ -42248,17 +42751,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2955</v>
+<v>5745</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>253</v>
+<v>492</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>115</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -42274,17 +42777,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2955</v>
+<v>5745</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>253</v>
+<v>492</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>115</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -42300,17 +42803,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3045</v>
+<v>5920</v>
 </b>
 <b>
 <a>2</a>
 <b>20</b>
-<v>250</v>
+<v>487</v>
 </b>
 <b>
 <a>30</a>
 <b>181</b>
-<v>27</v>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -42326,17 +42829,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5998</v>
+<v>11661</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>496</v>
+<v>964</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>228</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -42352,17 +42855,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5998</v>
+<v>11661</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>496</v>
+<v>964</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>228</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -42378,12 +42881,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6417</v>
+<v>12474</v>
 </b>
 <b>
 <a>2</a>
 <b>566</b>
-<v>305</v>
+<v>594</v>
 </b>
 </bs>
 </hist>
@@ -42399,27 +42902,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>486</v>
+<v>945</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2323</v>
+<v>4517</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>300</v>
+<v>584</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>295</v>
+<v>575</v>
 </b>
 <b>
 <a>8</a>
 <b>318</b>
-<v>90</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -42435,17 +42938,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>731</v>
+<v>1422</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2617</v>
+<v>5087</v>
 </b>
 <b>
 <a>3</a>
 <b>32</b>
-<v>147</v>
+<v>287</v>
 </b>
 </bs>
 </hist>
@@ -42461,27 +42964,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>674</v>
+<v>1310</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2236</v>
+<v>4346</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>255</v>
+<v>497</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>273</v>
+<v>531</v>
 </b>
 <b>
 <a>10</a>
 <b>243</b>
-<v>57</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -42491,23 +42994,23 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>592197</cardinality>
+<cardinality>1151159</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>592197</v>
+<v>1151159</v>
 </e>
 <e>
 <k>impl</k>
-<v>179424</v>
+<v>348778</v>
 </e>
 <e>
 <k>index</k>
-<v>355</v>
+<v>691</v>
 </e>
 <e>
 <k>var_type</k>
-<v>79371</v>
+<v>154288</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42521,7 +43024,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>592197</v>
+<v>1151159</v>
 </b>
 </bs>
 </hist>
@@ -42537,7 +43040,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>592197</v>
+<v>1151159</v>
 </b>
 </bs>
 </hist>
@@ -42553,7 +43056,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>592197</v>
+<v>1151159</v>
 </b>
 </bs>
 </hist>
@@ -42569,37 +43072,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71998</v>
+<v>139956</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31924</v>
+<v>62057</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25381</v>
+<v>49338</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12080</v>
+<v>23482</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>16404</v>
+<v>31888</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>14850</v>
+<v>28867</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>6783</v>
+<v>13186</v>
 </b>
 </bs>
 </hist>
@@ -42615,37 +43118,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71998</v>
+<v>139956</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31924</v>
+<v>62057</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25381</v>
+<v>49338</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12080</v>
+<v>23482</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>16404</v>
+<v>31888</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>14850</v>
+<v>28867</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>6783</v>
+<v>13186</v>
 </b>
 </bs>
 </hist>
@@ -42661,32 +43164,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>86641</v>
+<v>168419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36085</v>
+<v>70146</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19523</v>
+<v>37950</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10623</v>
+<v>20651</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>14238</v>
+<v>27678</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>12311</v>
+<v>23931</v>
 </b>
 </bs>
 </hist>
@@ -42702,62 +43205,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35</v>
+<v>68</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>13</a>
 <b>19</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>21</a>
 <b>51</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>56</a>
 <b>167</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>182</a>
 <b>829</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>1008</a>
 <b>8631</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>11398</a>
 <b>71575</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -42773,62 +43276,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35</v>
+<v>68</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45</v>
+<v>87</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>25</v>
+<v>48</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>32</v>
+<v>63</v>
 </b>
 <b>
 <a>13</a>
 <b>19</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>21</a>
 <b>51</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>56</a>
 <b>167</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>182</a>
 <b>829</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>1008</a>
 <b>8631</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>11398</a>
 <b>71575</b>
-<v>15</v>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -42844,67 +43347,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>37</v>
+<v>73</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>92</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>30</v>
+<v>58</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>24</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>30</v>
+<v>58</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>30</v>
+<v>58</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>22</v>
+<v>43</v>
 </b>
 <b>
 <a>11</a>
 <b>18</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>19</a>
 <b>42</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>52</a>
 <b>110</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>143</a>
 <b>539</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>599</a>
 <b>4919</b>
-<v>27</v>
+<v>53</v>
 </b>
 <b>
 <a>7226</a>
 <b>19498</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -42920,37 +43423,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>41836</v>
+<v>81325</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14018</v>
+<v>27249</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4309</v>
+<v>8376</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>6084</v>
+<v>11826</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>6580</v>
+<v>12791</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>5956</v>
+<v>11578</v>
 </b>
 <b>
 <a>76</a>
 <b>35712</b>
-<v>586</v>
+<v>1140</v>
 </b>
 </bs>
 </hist>
@@ -42966,32 +43469,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43909</v>
+<v>85355</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15943</v>
+<v>30992</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4314</v>
+<v>8386</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>6021</v>
+<v>11704</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>6186</v>
+<v>12026</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>2995</v>
+<v>5823</v>
 </b>
 </bs>
 </hist>
@@ -43007,27 +43510,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49725</v>
+<v>96660</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14757</v>
+<v>28687</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7086</v>
+<v>13775</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>6104</v>
+<v>11865</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>1697</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -43090,35 +43593,35 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>52214</cardinality>
+<cardinality>101499</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>52214</v>
+<v>101499</v>
 </e>
 <e>
 <k>impl</k>
-<v>36760</v>
+<v>71457</v>
 </e>
 <e>
 <k>index</k>
-<v>40</v>
+<v>77</v>
 </e>
 <e>
 <k>kind</k>
-<v>10</v>
+<v>19</v>
 </e>
 <e>
 <k>try_start</k>
-<v>50239</v>
+<v>97659</v>
 </e>
 <e>
 <k>try_end</k>
-<v>51380</v>
+<v>99876</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>52214</v>
+<v>101499</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43132,7 +43635,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43148,7 +43651,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43164,7 +43667,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43180,7 +43683,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43196,7 +43699,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43212,7 +43715,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -43228,22 +43731,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27677</v>
+<v>53802</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5740</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2792</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>548</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -43259,22 +43762,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27677</v>
+<v>53802</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5740</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2792</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>548</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -43290,17 +43793,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31839</v>
+<v>61891</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4805</v>
+<v>9341</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>115</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -43316,22 +43819,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28206</v>
+<v>54830</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5582</v>
+<v>10852</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>2845</v>
+<v>5530</v>
 </b>
 <b>
 <a>7</a>
 <b>15</b>
-<v>125</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -43347,22 +43850,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27961</v>
+<v>54353</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5695</v>
+<v>11071</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>2842</v>
+<v>5525</v>
 </b>
 <b>
 <a>6</a>
 <b>16</b>
-<v>260</v>
+<v>506</v>
 </b>
 </bs>
 </hist>
@@ -43378,22 +43881,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27677</v>
+<v>53802</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5740</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2792</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>548</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -43409,77 +43912,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>66</a>
 <b>67</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>219</a>
 <b>220</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>685</a>
 <b>686</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1333</a>
 <b>1334</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3623</a>
 <b>3624</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14664</a>
 <b>14665</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43495,77 +43998,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>66</a>
 <b>67</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>219</a>
 <b>220</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>685</a>
 <b>686</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1333</a>
 <b>1334</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3623</a>
 <b>3624</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14664</a>
 <b>14665</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43581,22 +44084,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15</v>
+<v>29</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -43612,77 +44115,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>66</a>
 <b>67</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>219</a>
 <b>220</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>685</a>
 <b>686</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1333</a>
 <b>1334</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3623</a>
 <b>3624</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14664</a>
 <b>14665</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43698,77 +44201,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>66</a>
 <b>67</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>219</a>
 <b>220</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>685</a>
 <b>686</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1333</a>
 <b>1334</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3623</a>
 <b>3624</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14664</a>
 <b>14665</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43784,77 +44287,77 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>9</a>
 <b>10</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>20</a>
 <b>21</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>40</a>
 <b>41</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>66</a>
 <b>67</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>123</a>
 <b>124</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>219</a>
 <b>220</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>685</a>
 <b>686</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1333</a>
 <b>1334</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3623</a>
 <b>3624</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14664</a>
 <b>14665</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43870,22 +44373,22 @@
 <b>
 <a>166</a>
 <b>167</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>302</a>
 <b>303</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8994</a>
 <b>8995</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11367</a>
 <b>11368</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43901,22 +44404,22 @@
 <b>
 <a>148</a>
 <b>149</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>302</a>
 <b>303</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>7560</a>
 <b>7561</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8663</a>
 <b>8664</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43932,22 +44435,22 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>16</a>
 <b>17</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43963,22 +44466,22 @@
 <b>
 <a>159</a>
 <b>160</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>302</a>
 <b>303</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8695</a>
 <b>8696</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11363</a>
 <b>11364</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -43994,22 +44497,22 @@
 <b>
 <a>159</a>
 <b>160</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>302</a>
 <b>303</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8704</a>
 <b>8705</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11367</a>
 <b>11368</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -44025,22 +44528,22 @@
 <b>
 <a>166</a>
 <b>167</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>302</a>
 <b>303</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>8994</a>
 <b>8995</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>11367</a>
 <b>11368</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -44056,12 +44559,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>48542</v>
+<v>94360</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>1697</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -44077,7 +44580,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50239</v>
+<v>97659</v>
 </b>
 </bs>
 </hist>
@@ -44093,12 +44596,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>48542</v>
+<v>94360</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>1697</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -44114,12 +44617,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49076</v>
+<v>95398</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1163</v>
+<v>2261</v>
 </b>
 </bs>
 </hist>
@@ -44135,12 +44638,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49098</v>
+<v>95442</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1140</v>
+<v>2217</v>
 </b>
 </bs>
 </hist>
@@ -44156,12 +44659,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>48542</v>
+<v>94360</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>1697</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -44177,12 +44680,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50748</v>
+<v>98648</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>631</v>
+<v>1227</v>
 </b>
 </bs>
 </hist>
@@ -44198,7 +44701,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51380</v>
+<v>99876</v>
 </b>
 </bs>
 </hist>
@@ -44214,12 +44717,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50748</v>
+<v>98648</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>631</v>
+<v>1227</v>
 </b>
 </bs>
 </hist>
@@ -44235,12 +44738,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51289</v>
+<v>99701</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>90</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -44256,7 +44759,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51380</v>
+<v>99876</v>
 </b>
 </bs>
 </hist>
@@ -44272,12 +44775,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50748</v>
+<v>98648</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>631</v>
+<v>1227</v>
 </b>
 </bs>
 </hist>
@@ -44293,7 +44796,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44309,7 +44812,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44325,7 +44828,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44341,7 +44844,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44357,7 +44860,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44373,7 +44876,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52214</v>
+<v>101499</v>
 </b>
 </bs>
 </hist>
@@ -44383,15 +44886,15 @@
 </relation>
 <relation>
 <name>cil_handler_filter</name>
-<cardinality>416</cardinality>
+<cardinality>808</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>416</v>
+<v>808</v>
 </e>
 <e>
 <k>filter_start</k>
-<v>416</v>
+<v>808</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44405,7 +44908,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>416</v>
+<v>808</v>
 </b>
 </bs>
 </hist>
@@ -44421,7 +44924,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>416</v>
+<v>808</v>
 </b>
 </bs>
 </hist>
@@ -44431,15 +44934,15 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>22546</cardinality>
+<cardinality>43827</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22546</v>
+<v>43827</v>
 </e>
 <e>
 <k>catch_type</k>
-<v>649</v>
+<v>1262</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44453,7 +44956,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22546</v>
+<v>43827</v>
 </b>
 </bs>
 </hist>
@@ -44469,42 +44972,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>225</v>
+<v>438</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>77</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>52</v>
+<v>102</v>
 </b>
 <b>
 <a>16</a>
 <b>2589</b>
-<v>50</v>
+<v>97</v>
 </b>
 <b>
 <a>3495</a>
 <b>3496</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -44514,15 +45017,15 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>888189</cardinality>
+<cardinality>1726531</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>888189</v>
+<v>1726531</v>
 </e>
 <e>
 <k>size</k>
-<v>82</v>
+<v>160</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44536,7 +45039,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>888189</v>
+<v>1726531</v>
 </b>
 </bs>
 </hist>
@@ -44552,62 +45055,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>14</a>
 <b>19</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>54</a>
 <b>75</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>99</a>
 <b>326</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>814</a>
 <b>2665</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>3004</a>
 <b>5050</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>8726</a>
 <b>20803</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>23498</a>
 <b>270374</b>
-<v>5</v>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -44617,110 +45120,110 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>982987</cardinality>
+<cardinality>1910808</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>982987</v>
+<v>1910808</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>477765</cardinality>
+<cardinality>928717</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>477765</v>
+<v>928717</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>935332</cardinality>
+<cardinality>1818172</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>935332</v>
+<v>1818172</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>23052</cardinality>
+<cardinality>41683</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>23052</v>
+<v>41683</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>408907</cardinality>
+<cardinality>794866</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>408907</v>
+<v>794866</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>183415</cardinality>
+<cardinality>356536</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>183415</v>
+<v>356536</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>348562</cardinality>
+<cardinality>677563</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>348562</v>
+<v>677563</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>84971</cardinality>
+<cardinality>165174</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>84971</v>
+<v>165174</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>122717</cardinality>
+<cardinality>238547</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>122717</v>
+<v>238547</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>8513</cardinality>
+<cardinality>16548</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8513</v>
+<v>16548</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -44749,37 +45252,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>417180</cardinality>
+<cardinality>810947</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>417180</v>
+<v>810947</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>217219</cardinality>
+<cardinality>422248</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>217219</v>
+<v>422248</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>121182</cardinality>
+<cardinality>235564</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>121182</v>
+<v>235564</v>
 </e>
 <e>
 <k>base</k>
-<v>11012</v>
+<v>21407</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44793,7 +45296,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121182</v>
+<v>235564</v>
 </b>
 </bs>
 </hist>
@@ -44809,32 +45312,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6334</v>
+<v>12314</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1985</v>
+<v>3859</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>829</v>
+<v>1612</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>972</v>
+<v>1890</v>
 </b>
 <b>
 <a>7</a>
 <b>84</b>
-<v>827</v>
+<v>1608</v>
 </b>
 <b>
 <a>86</a>
 <b>23834</b>
-<v>62</v>
+<v>121</v>
 </b>
 </bs>
 </hist>
@@ -44844,15 +45347,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>64405</cardinality>
+<cardinality>125196</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>35286</v>
+<v>68592</v>
 </e>
 <e>
 <k>base</k>
-<v>16046</v>
+<v>31191</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44866,27 +45369,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24534</v>
+<v>47691</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4173</v>
+<v>8113</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>3221</v>
+<v>6261</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>2765</v>
+<v>5374</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>591</v>
+<v>1150</v>
 </b>
 </bs>
 </hist>
@@ -44902,27 +45405,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11561</v>
+<v>22474</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1764</v>
+<v>3430</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1296</v>
+<v>2519</v>
 </b>
 <b>
 <a>5</a>
 <b>30</b>
-<v>1205</v>
+<v>2343</v>
 </b>
 <b>
 <a>30</a>
 <b>2180</b>
-<v>218</v>
+<v>423</v>
 </b>
 </bs>
 </hist>
@@ -44932,15 +45435,15 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>7237</cardinality>
+<cardinality>14068</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7237</v>
+<v>14068</v>
 </e>
 <e>
 <k>underlying</k>
-<v>20</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44954,7 +45457,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7237</v>
+<v>14068</v>
 </b>
 </bs>
 </hist>
@@ -44970,42 +45473,42 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>25</a>
 <b>26</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>31</a>
 <b>32</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>41</a>
 <b>42</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>173</a>
 <b>174</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>291</a>
 <b>292</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2315</a>
 <b>2316</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -45015,19 +45518,19 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>95089</cardinality>
+<cardinality>184841</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>53453</v>
+<v>103906</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>param</k>
-<v>95089</v>
+<v>184841</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -45041,22 +45544,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38572</v>
+<v>74980</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9774</v>
+<v>18999</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>4196</v>
+<v>8157</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>909</v>
+<v>1768</v>
 </b>
 </bs>
 </hist>
@@ -45072,22 +45575,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>38572</v>
+<v>74980</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9774</v>
+<v>18999</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>4196</v>
+<v>8157</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>909</v>
+<v>1768</v>
 </b>
 </bs>
 </hist>
@@ -45103,107 +45606,107 @@
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21</a>
 <b>22</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>65</a>
 <b>66</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>132</a>
 <b>133</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>207</a>
 <b>208</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>285</a>
 <b>286</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>363</a>
 <b>364</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>441</a>
 <b>442</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>519</a>
 <b>520</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>598</a>
 <b>599</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>680</a>
 <b>681</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>791</a>
 <b>792</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>891</a>
 <b>892</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1012</a>
 <b>1013</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1173</a>
 <b>1174</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1409</a>
 <b>1410</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2037</a>
 <b>2038</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>5936</a>
 <b>5937</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21323</a>
 <b>21324</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -45219,107 +45722,107 @@
 <b>
 <a>8</a>
 <b>9</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14</a>
 <b>15</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21</a>
 <b>22</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>27</a>
 <b>28</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>65</a>
 <b>66</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>132</a>
 <b>133</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>207</a>
 <b>208</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>285</a>
 <b>286</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>363</a>
 <b>364</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>441</a>
 <b>442</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>519</a>
 <b>520</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>598</a>
 <b>599</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>680</a>
 <b>681</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>791</a>
 <b>792</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>891</a>
 <b>892</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1012</a>
 <b>1013</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1173</a>
 <b>1174</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1409</a>
 <b>1410</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2037</a>
 <b>2038</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>5936</a>
 <b>5937</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>21323</a>
 <b>21324</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -45335,7 +45838,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95089</v>
+<v>184841</v>
 </b>
 </bs>
 </hist>
@@ -45351,7 +45854,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95089</v>
+<v>184841</v>
 </b>
 </bs>
 </hist>
@@ -45361,19 +45864,19 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>379309</cardinality>
+<cardinality>737330</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>247697</v>
+<v>481494</v>
 </e>
 <e>
 <k>index</k>
-<v>52</v>
+<v>102</v>
 </e>
 <e>
 <k>t</k>
-<v>129781</v>
+<v>252279</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -45387,17 +45890,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>172996</v>
+<v>336284</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>60392</v>
+<v>117395</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>14309</v>
+<v>27814</v>
 </b>
 </bs>
 </hist>
@@ -45413,17 +45916,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175521</v>
+<v>341191</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59304</v>
+<v>115280</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>12872</v>
+<v>25022</v>
 </b>
 </bs>
 </hist>
@@ -45439,97 +45942,97 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5</v>
+<v>9</v>
 </b>
 <b>
 <a>84</a>
 <b>85</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>205</a>
 <b>206</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>343</a>
 <b>344</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>482</a>
 <b>483</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>621</a>
 <b>622</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>760</a>
 <b>761</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>899</a>
 <b>900</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1044</a>
 <b>1045</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1189</a>
 <b>1190</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1601</a>
 <b>1602</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1810</a>
 <b>1811</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2091</a>
 <b>2092</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2513</a>
 <b>2514</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>3338</a>
 <b>3339</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>5708</a>
 <b>5709</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>29799</a>
 <b>29800</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>98809</a>
 <b>98810</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -45545,97 +46048,97 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7</v>
+<v>14</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>49</a>
 <b>50</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>116</a>
 <b>117</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>185</a>
 <b>186</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>254</a>
 <b>255</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>322</a>
 <b>323</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>390</a>
 <b>391</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>457</a>
 <b>458</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>531</a>
 <b>532</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>602</a>
 <b>603</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>925</a>
 <b>926</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>927</a>
 <b>928</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1083</a>
 <b>1084</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1307</a>
 <b>1308</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>1645</a>
 <b>1646</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>2968</a>
 <b>2969</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>14488</a>
 <b>14489</b>
-<v>2</v>
+<v>4</v>
 </b>
 <b>
 <a>39680</a>
 <b>39681</b>
-<v>2</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -45651,27 +46154,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51623</v>
+<v>100349</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37437</v>
+<v>72773</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21864</v>
+<v>42502</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10345</v>
+<v>20110</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>8510</v>
+<v>16543</v>
 </b>
 </bs>
 </hist>
@@ -45687,17 +46190,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98187</v>
+<v>190864</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28552</v>
+<v>55503</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>3040</v>
+<v>5910</v>
 </b>
 </bs>
 </hist>
@@ -45798,19 +46301,19 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>168950</cardinality>
+<cardinality>328419</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>168950</v>
+<v>328419</v>
 </e>
 <e>
 <k>element</k>
-<v>127933</v>
+<v>248687</v>
 </e>
 <e>
 <k>constructor</k>
-<v>1737</v>
+<v>3376</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -45824,7 +46327,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168950</v>
+<v>328419</v>
 </b>
 </bs>
 </hist>
@@ -45840,7 +46343,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168950</v>
+<v>328419</v>
 </b>
 </bs>
 </hist>
@@ -45856,17 +46359,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101559</v>
+<v>197419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18883</v>
+<v>36708</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>7490</v>
+<v>14560</v>
 </b>
 </bs>
 </hist>
@@ -45882,17 +46385,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>109719</v>
+<v>213280</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>15950</v>
+<v>31006</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>2263</v>
+<v>4400</v>
 </b>
 </bs>
 </hist>
@@ -45908,57 +46411,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>285</v>
+<v>555</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>205</v>
+<v>399</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>162</v>
+<v>316</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>157</v>
+<v>306</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>19</a>
 <b>33</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>33</a>
 <b>64</b>
-<v>130</v>
+<v>253</v>
 </b>
 <b>
 <a>64</a>
 <b>179</b>
-<v>130</v>
+<v>253</v>
 </b>
 <b>
 <a>187</a>
 <b>15289</b>
-<v>110</v>
+<v>214</v>
 </b>
 </bs>
 </hist>
@@ -45974,57 +46477,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>308</v>
+<v>599</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>198</v>
+<v>384</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>145</v>
+<v>282</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>162</v>
+<v>316</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>125</v>
+<v>243</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>145</v>
+<v>282</v>
 </b>
 <b>
 <a>10</a>
 <b>17</b>
-<v>130</v>
+<v>253</v>
 </b>
 <b>
 <a>17</a>
 <b>31</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>31</a>
 <b>50</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>50</a>
 <b>151</b>
-<v>130</v>
+<v>253</v>
 </b>
 <b>
 <a>152</a>
 <b>15028</b>
-<v>122</v>
+<v>238</v>
 </b>
 </bs>
 </hist>
@@ -46034,19 +46537,19 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>7973</cardinality>
+<cardinality>10944</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>4938</v>
+<v>7981</v>
 </e>
 <e>
 <k>param</k>
-<v>25</v>
+<v>155</v>
 </e>
 <e>
 <k>value</k>
-<v>128</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -46060,17 +46563,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1911</v>
+<v>5092</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3020</v>
+<v>2816</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -46086,17 +46589,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3839</v>
+<v>6563</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1095</v>
+<v>1403</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -46112,62 +46615,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3</v>
+<v>34</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>2</v>
+<b>4</b>
+<v>9</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>9</v>
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>2</v>
+<b>6</b>
+<v>14</v>
 </b>
 <b>
 <a>7</a>
-<b>9</b>
-<v>2</v>
+<b>8</b>
+<v>4</v>
 </b>
 <b>
-<a>11</a>
-<b>14</b>
-<v>2</v>
+<a>8</a>
+<b>9</b>
+<v>14</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9</v>
 </b>
 <b>
 <a>14</a>
-<b>19</b>
-<v>2</v>
+<b>30</b>
+<v>9</v>
 </b>
 <b>
-<a>19</a>
-<b>20</b>
-<v>1</v>
+<a>32</a>
+<b>43</b>
+<v>9</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
-<v>2</v>
+<a>46</a>
+<b>47</b>
+<v>9</v>
 </b>
 <b>
-<a>26</a>
-<b>39</b>
-<v>2</v>
+<a>47</a>
+<b>48</b>
+<v>9</v>
 </b>
 <b>
-<a>55</a>
-<b>61</b>
-<v>2</v>
+<a>96</a>
+<b>308</b>
+<v>9</v>
 </b>
 <b>
-<a>347</a>
-<b>348</b>
-<v>2</v>
-</b>
-<b>
-<a>2859</a>
-<b>3660</b>
-<v>2</v>
+<a>725</a>
+<b>731</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -46183,42 +46691,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8</v>
+<v>77</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5</v>
+<v>19</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>19</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>2</v>
-</b>
-<b>
-<a>6</a>
-<b>7</b>
-<v>1</v>
-</b>
-<b>
-<a>7</a>
 <b>8</b>
-<v>2</v>
+<v>9</v>
 </b>
 <b>
-<a>9</a>
-<b>11</b>
-<v>2</v>
+<a>10</a>
+<b>14</b>
+<v>9</v>
 </b>
 <b>
 <a>26</a>
-<b>39</b>
-<v>2</v>
+<b>45</b>
+<v>9</v>
+</b>
+<b>
+<a>47</a>
+<b>56</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -46234,32 +46737,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71</v>
+<v>721</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>6</v>
+<b>5</b>
+<v>82</v>
 </b>
 <b>
-<a>4</a>
-<b>7</b>
-<v>11</v>
-</b>
-<b>
-<a>8</a>
-<b>301</b>
-<v>10</v>
-</b>
-<b>
-<a>347</a>
-<b>3871</b>
-<v>3</v>
+<a>5</a>
+<b>866</b>
+<v>53</v>
 </b>
 </bs>
 </hist>
@@ -46275,12 +46768,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120</v>
+<v>1067</v>
 </b>
 <b>
 <a>2</a>
-<b>7</b>
-<v>8</v>
+<b>10</b>
+<v>29</v>
 </b>
 </bs>
 </hist>
@@ -46290,19 +46783,19 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>58735</cardinality>
+<cardinality>103190</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>57269</v>
+<v>97064</v>
 </e>
 <e>
 <k>index</k>
-<v>5</v>
+<v>29</v>
 </e>
 <e>
 <k>value</k>
-<v>4430</v>
+<v>17269</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -46316,12 +46809,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55901</v>
+<v>92381</v>
 </b>
 <b>
 <a>2</a>
-<b>6</b>
-<v>1368</v>
+<b>7</b>
+<v>4682</v>
 </b>
 </bs>
 </hist>
@@ -46337,12 +46830,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55905</v>
+<v>92391</v>
 </b>
 <b>
 <a>2</a>
-<b>5</b>
-<v>1364</v>
+<b>7</b>
+<v>4673</v>
 </b>
 </bs>
 </hist>
@@ -46356,29 +46849,34 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>20</a>
-<b>21</b>
-<v>1</v>
+<a>14</a>
+<b>15</b>
+<v>4</v>
 </b>
 <b>
-<a>21</a>
-<b>22</b>
-<v>1</v>
+<a>24</a>
+<b>25</b>
+<v>4</v>
 </b>
 <b>
-<a>57</a>
-<b>58</b>
-<v>1</v>
+<a>117</a>
+<b>118</b>
+<v>4</v>
 </b>
 <b>
-<a>1368</a>
-<b>1369</b>
-<v>1</v>
+<a>141</a>
+<b>142</b>
+<v>4</v>
 </b>
 <b>
-<a>57269</a>
-<b>57270</b>
-<v>1</v>
+<a>961</a>
+<b>962</b>
+<v>4</v>
+</b>
+<b>
+<a>19919</a>
+<b>19920</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -46392,24 +46890,29 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>3</a>
-<b>4</b>
-<v>2</v>
+<a>4</a>
+<b>5</b>
+<v>4</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1</v>
+<v>9</v>
 </b>
 <b>
-<a>110</a>
-<b>111</b>
-<v>1</v>
+<a>25</a>
+<b>26</b>
+<v>4</v>
 </b>
 <b>
-<a>4331</a>
-<b>4332</b>
-<v>1</v>
+<a>433</a>
+<b>434</b>
+<v>4</v>
+</b>
+<b>
+<a>3150</a>
+<b>3151</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -46425,27 +46928,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2894</v>
+<v>12304</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>723</v>
+<v>2529</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>215</v>
+<b>6</b>
+<v>1447</v>
 </b>
 <b>
-<a>4</a>
-<b>9</b>
-<v>382</v>
-</b>
-<b>
-<a>9</a>
-<b>17524</b>
-<v>216</v>
+<a>6</a>
+<b>5556</b>
+<v>989</v>
 </b>
 </bs>
 </hist>
@@ -46461,12 +46959,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4414</v>
+<v>16943</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>16</v>
+<v>326</v>
 </b>
 </bs>
 </hist>
@@ -46476,19 +46974,19 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>3178070</cardinality>
+<cardinality>6178058</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>2925983</v>
+<v>5688031</v>
 </e>
 <e>
 <k>location</k>
-<v>1757</v>
+<v>3415</v>
 </e>
 <e>
 <k>handle</k>
-<v>141034</v>
+<v>274153</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -46502,17 +47000,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2683251</v>
+<v>5216190</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>238091</v>
+<v>462821</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>4640</v>
+<v>9019</v>
 </b>
 </bs>
 </hist>
@@ -46528,12 +47026,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2802586</v>
+<v>5448164</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>123396</v>
+<v>239867</v>
 </b>
 </bs>
 </hist>
@@ -46549,72 +47047,72 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>36</a>
 <b>79</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>79</a>
 <b>130</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>130</a>
 <b>200</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>200</a>
 <b>288</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>288</a>
 <b>400</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>403</a>
 <b>527</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>528</a>
 <b>744</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>747</a>
 <b>1109</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>1116</a>
 <b>1915</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>1920</a>
 <b>4051</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>4053</a>
 <b>50922</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>67370</a>
 <b>92454</b>
-<v>7</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -46630,67 +47128,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>147</v>
+<v>287</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>145</v>
+<v>282</v>
 </b>
 <b>
 <a>20</a>
 <b>46</b>
-<v>137</v>
+<v>268</v>
 </b>
 <b>
 <a>46</a>
 <b>76</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>77</a>
 <b>119</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>119</a>
 <b>176</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>176</a>
 <b>253</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>255</a>
 <b>332</b>
-<v>135</v>
+<v>263</v>
 </b>
 <b>
 <a>338</a>
 <b>481</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>483</a>
 <b>683</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>685</a>
 <b>1273</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>1295</a>
 <b>2685</b>
-<v>132</v>
+<v>258</v>
 </b>
 <b>
 <a>2710</a>
 <b>55264</b>
-<v>125</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -46706,62 +47204,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9741</v>
+<v>18936</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23163</v>
+<v>45026</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>12303</v>
+<v>23916</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9009</v>
+<v>17513</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>15504</v>
+<v>30139</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>9761</v>
+<v>18975</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>11363</v>
+<v>22089</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>10822</v>
+<v>21036</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>11042</v>
+<v>21465</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>10869</v>
+<v>21129</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>10583</v>
+<v>20573</v>
 </b>
 <b>
 <a>83</a>
-<b>1061</b>
-<v>6868</v>
+<b>1062</b>
+<v>13351</v>
 </b>
 </bs>
 </hist>
@@ -46777,52 +47275,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32363</v>
+<v>62910</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10852</v>
+<v>21095</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>24173</v>
+<v>46990</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9741</v>
+<v>18936</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>9979</v>
+<v>19399</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>11350</v>
+<v>22064</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>11982</v>
+<v>23292</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>11315</v>
+<v>21996</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>10729</v>
+<v>20856</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>8545</v>
+<v>16611</v>
 </b>
 </bs>
 </hist>
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.expected b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.expected
new file mode 100644
index 00000000000..f890a844778
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.expected	
@@ -0,0 +1 @@
+| test.cs:31:9:31:74 | call to method InitiateSystemShutdownExW | Call to an external method 'InitiateSystemShutdownExW'. |
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref
new file mode 100644
index 00000000000..1215c001b40
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.expected b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.expected
new file mode 100644
index 00000000000..490a71b0c0c
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.expected	
@@ -0,0 +1,23 @@
+edges
+| test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:36:70:48 | access to local variable lastWriteTime |
+| test.cs:70:13:70:71 | call to method CompareTo : Int32 | test.cs:70:13:70:76 | ... >= ... |
+| test.cs:70:36:70:48 | access to local variable lastWriteTime | test.cs:70:36:70:70 | call to method AddHours |
+| test.cs:70:36:70:48 | access to local variable lastWriteTime | test.cs:70:36:70:70 | call to method AddHours : DateTime |
+| test.cs:70:36:70:48 | access to local variable lastWriteTime : DateTime | test.cs:70:36:70:70 | call to method AddHours |
+| test.cs:70:36:70:48 | access to local variable lastWriteTime : DateTime | test.cs:70:36:70:70 | call to method AddHours : DateTime |
+| test.cs:70:36:70:70 | call to method AddHours | test.cs:70:13:70:71 | call to method CompareTo |
+| test.cs:70:36:70:70 | call to method AddHours | test.cs:70:13:70:71 | call to method CompareTo : Int32 |
+| test.cs:70:36:70:70 | call to method AddHours : DateTime | test.cs:70:13:70:71 | call to method CompareTo |
+| test.cs:70:36:70:70 | call to method AddHours : DateTime | test.cs:70:13:70:71 | call to method CompareTo : Int32 |
+#select
+| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:71 | call to method CompareTo | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
+| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:71 | call to method CompareTo : Int32 | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
+| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:76 | ... >= ... | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
+| test.cs:70:9:73:9 | if (...) ... | test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | test.cs:70:13:70:76 | ... >= ... : Boolean | Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger. | test.cs:70:13:70:71 | call to method CompareTo | call to method CompareTo | test.cs:70:36:70:70 | call to method AddHours | an offset | test.cs:68:34:68:76 | call to method GetLastWriteTime | last modification time of a file |
+nodes
+| test.cs:68:34:68:76 | call to method GetLastWriteTime : DateTime | semmle.label | call to method GetLastWriteTime : DateTime |
+| test.cs:70:13:70:71 | call to method CompareTo | semmle.label | call to method CompareTo |
+| test.cs:70:13:70:71 | call to method CompareTo : Int32 | semmle.label | call to method CompareTo : Int32 |
+| test.cs:70:13:70:76 | ... >= ... | semmle.label | ... >= ... |
+| test.cs:70:36:70:48 | access to local variable lastWriteTime | semmle.label | access to local variable lastWriteTime |
+| test.cs:70:36:70:70 | call to method AddHours | semmle.label | call to method AddHours |
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref
new file mode 100644
index 00000000000..f76817aa089
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/backdoor/PotentialTimeBomb.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.expected b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.expected
new file mode 100644
index 00000000000..58e3dda0964
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.expected	
@@ -0,0 +1,3 @@
+edges
+nodes
+#select
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref
new file mode 100644
index 00000000000..d1d0d520d61
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/backdoor/test.cs b/csharp/ql/test/experimental/Security Features/backdoor/test.cs
new file mode 100644
index 00000000000..aea05818423
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/backdoor/test.cs	
@@ -0,0 +1,76 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace System.IO
+{
+    public class File
+    {
+        public static DateTime GetLastWriteTime(string s)
+        {
+            return new DateTime(DateTime.MaxValue.Ticks);
+        }
+    }
+}
+
+namespace System.Diagnostics
+{
+    public class Process
+    {
+        public static string GetCurrentProcess() { return "test"; }
+    }
+}
+
+class External {
+    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    public static extern bool InitiateSystemShutdownExW([In] string lpMachineName, [In] string lpMessage, [In] uint dwTimeout, [MarshalAs(UnmanagedType.Bool)][In] bool bForceAppsClosed, [MarshalAs(UnmanagedType.Bool)][In] bool bRebootAfterShutdown, [In] uint dwReason);
+
+    void TestDangerousNativeFunctionCall()
+    {
+        InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // BUG : DangerousNativeFunctionCall
+    }
+
+    ulong GetFvnHash(string s)
+    {
+        ulong num = 14695981039346656037UL; /* FNV base offset */
+        try
+        {
+            foreach (byte b in Encoding.UTF8.GetBytes(s))
+            {
+                num ^= (ulong)b;
+                num *= 1099511628211UL; /* FNV prime */
+            }
+        }
+        catch
+        {
+        }
+        // regular FVN
+        return num; 
+    }
+
+    void IndirectTestProcessNameToHashTaintFlow( string s)
+    {
+        GetFvnHash(s); // BUG : ProcessNameToHashTaintFlow
+    }
+
+    void TestProcessNameToHashTaintFlow()
+    {
+        GetFvnHash( System.Diagnostics.Process.GetCurrentProcess() ); // BUG : ProcessNameToHashTaintFlow
+
+        string proc = System.Diagnostics.Process.GetCurrentProcess();
+
+        IndirectTestProcessNameToHashTaintFlow( proc );
+    }
+
+    void TestTimeBomb() 
+    {
+        DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile");
+        int num = new Random().Next(288, 336);
+        if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // BUG : Potential time bomb
+        {
+            // Some code here
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.expected
new file mode 100644
index 00000000000..da578042bc3
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.expected	
@@ -0,0 +1 @@
+| test.cs:40:16:40:36 | 6605813339339102567 | The variable $@ seems to be used as part of a FNV-like hash calculation, that is modified by an additional $@ expression using literal $@. | test.cs:26:9:26:11 | num | num | test.cs:40:10:40:36 | ... ^ ... | xor | test.cs:40:16:40:36 | 6605813339339102567 | 6605813339339102567 |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qlref
new file mode 100644
index 00000000000..af0428b3391
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.expected
new file mode 100644
index 00000000000..fa8afc54079
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.expected	
@@ -0,0 +1 @@
+| test.cs:43:7:43:15 | JobEngine | The enum $@ may be related to Solorigate. It matches 19 of the values used for commands in the enum. | test.cs:43:7:43:15 | JobEngine | JobEngine |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref
new file mode 100644
index 00000000000..11d2fef0441
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.expected
new file mode 100644
index 00000000000..3603cf8a20a
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.expected	
@@ -0,0 +1,248 @@
+| test.cs:10:15:10:36 | 14695981039346656037 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:10:15:10:36 | 14695981039346656037 | 14695981039346656037 |
+| test.cs:15:11:15:25 | 1099511628211 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:15:11:15:25 | 1099511628211 | 1099511628211 |
+| test.cs:26:15:26:36 | 14695981039346656037 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:26:15:26:36 | 14695981039346656037 | 14695981039346656037 |
+| test.cs:32:12:32:26 | 1099511628211 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:32:12:32:26 | 1099511628211 | 1099511628211 |
+| test.cs:40:16:40:36 | 6605813339339102567 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:40:16:40:36 | 6605813339339102567 | 6605813339339102567 |
+| test.cs:173:5:173:24 | 10063651499895178962 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:173:5:173:24 | 10063651499895178962 | 10063651499895178962 |
+| test.cs:173:27:173:46 | 10235971842993272939 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:173:27:173:46 | 10235971842993272939 | 10235971842993272939 |
+| test.cs:173:49:173:68 | 10296494671777307979 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:173:49:173:68 | 10296494671777307979 | 10296494671777307979 |
+| test.cs:174:5:174:24 | 10336842116636872171 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:174:5:174:24 | 10336842116636872171 | 10336842116636872171 |
+| test.cs:174:27:174:46 | 10374841591685794123 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:174:27:174:46 | 10374841591685794123 | 10374841591685794123 |
+| test.cs:174:49:174:68 | 10393903804869831898 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:174:49:174:68 | 10393903804869831898 | 10393903804869831898 |
+| test.cs:175:5:175:24 | 10463926208560207521 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:175:5:175:24 | 10463926208560207521 | 10463926208560207521 |
+| test.cs:175:27:175:46 | 10484659978517092504 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:175:27:175:46 | 10484659978517092504 | 10484659978517092504 |
+| test.cs:175:49:175:68 | 10501212300031893463 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:175:49:175:68 | 10501212300031893463 | 10501212300031893463 |
+| test.cs:176:5:176:24 | 10545868833523019926 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:176:5:176:24 | 10545868833523019926 | 10545868833523019926 |
+| test.cs:176:27:176:46 | 10657751674541025650 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:176:27:176:46 | 10657751674541025650 | 10657751674541025650 |
+| test.cs:176:49:176:66 | 106672141413120087 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:176:49:176:66 | 106672141413120087 | 106672141413120087 |
+| test.cs:176:69:176:88 | 10734127004244879770 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:176:69:176:88 | 10734127004244879770 | 10734127004244879770 |
+| test.cs:177:5:177:24 | 10829648878147112121 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:177:5:177:24 | 10829648878147112121 | 10829648878147112121 |
+| test.cs:177:27:177:39 | 1099511628211 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:177:27:177:39 | 1099511628211 | 1099511628211 |
+| test.cs:177:42:177:61 | 11073283311104541690 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:177:42:177:61 | 11073283311104541690 | 11073283311104541690 |
+| test.cs:177:64:177:82 | 1109067043404435916 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:177:64:177:82 | 1109067043404435916 | 1109067043404435916 |
+| test.cs:178:5:178:24 | 11109294216876344399 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:178:5:178:24 | 11109294216876344399 | 11109294216876344399 |
+| test.cs:178:27:178:46 | 11266044540366291518 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:178:27:178:46 | 11266044540366291518 | 11266044540366291518 |
+| test.cs:178:49:178:68 | 11385275378891906608 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:178:49:178:68 | 11385275378891906608 | 11385275378891906608 |
+| test.cs:179:5:179:24 | 11771945869106552231 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:179:5:179:24 | 11771945869106552231 | 11771945869106552231 |
+| test.cs:179:27:179:46 | 11801746708619571308 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:179:27:179:46 | 11801746708619571308 | 11801746708619571308 |
+| test.cs:179:49:179:68 | 11818825521849580123 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:179:49:179:68 | 11818825521849580123 | 11818825521849580123 |
+| test.cs:180:5:180:24 | 11913842725949116895 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:180:5:180:24 | 11913842725949116895 | 11913842725949116895 |
+| test.cs:180:27:180:46 | 12027963942392743532 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:180:27:180:46 | 12027963942392743532 | 12027963942392743532 |
+| test.cs:180:49:180:68 | 12094027092655598256 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:180:49:180:68 | 12094027092655598256 | 12094027092655598256 |
+| test.cs:181:5:181:24 | 12343334044036541897 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:181:5:181:24 | 12343334044036541897 | 12343334044036541897 |
+| test.cs:181:27:181:46 | 12445177985737237804 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:181:27:181:46 | 12445177985737237804 | 12445177985737237804 |
+| test.cs:181:49:181:68 | 12445232961318634374 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:181:49:181:68 | 12445232961318634374 | 12445232961318634374 |
+| test.cs:182:5:182:24 | 12574535824074203265 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:182:5:182:24 | 12574535824074203265 | 12574535824074203265 |
+| test.cs:182:27:182:46 | 12679195163651834776 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:182:27:182:46 | 12679195163651834776 | 12679195163651834776 |
+| test.cs:182:49:182:68 | 12709986806548166638 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:182:49:182:68 | 12709986806548166638 | 12709986806548166638 |
+| test.cs:183:5:183:24 | 12718416789200275332 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:183:5:183:24 | 12718416789200275332 | 12718416789200275332 |
+| test.cs:183:27:183:46 | 12785322942775634499 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:183:27:183:46 | 12785322942775634499 | 12785322942775634499 |
+| test.cs:183:49:183:68 | 12790084614253405985 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:183:49:183:68 | 12790084614253405985 | 12790084614253405985 |
+| test.cs:184:5:184:24 | 12969190449276002545 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:184:5:184:24 | 12969190449276002545 | 12969190449276002545 |
+| test.cs:184:27:184:46 | 13014156621614176974 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:184:27:184:46 | 13014156621614176974 | 13014156621614176974 |
+| test.cs:184:49:184:68 | 13029357933491444455 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:184:49:184:68 | 13029357933491444455 | 13029357933491444455 |
+| test.cs:185:5:185:24 | 13135068273077306806 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:185:5:185:24 | 13135068273077306806 | 13135068273077306806 |
+| test.cs:185:27:185:46 | 13260224381505715848 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:185:27:185:46 | 13260224381505715848 | 13260224381505715848 |
+| test.cs:185:49:185:68 | 13316211011159594063 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:185:49:185:68 | 13316211011159594063 | 13316211011159594063 |
+| test.cs:186:5:186:24 | 13464308873961738403 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:186:5:186:24 | 13464308873961738403 | 13464308873961738403 |
+| test.cs:186:27:186:46 | 13544031715334011032 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:186:27:186:46 | 13544031715334011032 | 13544031715334011032 |
+| test.cs:186:49:186:68 | 13581776705111912829 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:186:49:186:68 | 13581776705111912829 | 13581776705111912829 |
+| test.cs:187:5:187:24 | 13599785766252827703 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:187:5:187:24 | 13599785766252827703 | 13599785766252827703 |
+| test.cs:187:27:187:46 | 13611051401579634621 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:187:27:187:46 | 13611051401579634621 | 13611051401579634621 |
+| test.cs:187:49:187:68 | 13611814135072561278 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:187:49:187:68 | 13611814135072561278 | 13611814135072561278 |
+| test.cs:188:5:188:24 | 13655261125244647696 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:188:5:188:24 | 13655261125244647696 | 13655261125244647696 |
+| test.cs:188:27:188:45 | 1367627386496056834 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:188:27:188:45 | 1367627386496056834 | 1367627386496056834 |
+| test.cs:188:48:188:66 | 1368907909245890092 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:188:48:188:66 | 1368907909245890092 | 1368907909245890092 |
+| test.cs:188:69:188:88 | 13693525876560827283 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:188:69:188:88 | 13693525876560827283 | 13693525876560827283 |
+| test.cs:189:5:189:24 | 13783346438774742614 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:189:5:189:24 | 13783346438774742614 | 13783346438774742614 |
+| test.cs:189:27:189:46 | 13799353263187722717 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:189:27:189:46 | 13799353263187722717 | 13799353263187722717 |
+| test.cs:189:49:189:68 | 13825071784440082496 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:189:49:189:68 | 13825071784440082496 | 13825071784440082496 |
+| test.cs:190:5:190:24 | 13852439084267373191 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:190:5:190:24 | 13852439084267373191 | 13852439084267373191 |
+| test.cs:190:27:190:46 | 13876356431472225791 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:190:27:190:46 | 13876356431472225791 | 13876356431472225791 |
+| test.cs:190:49:190:68 | 14055243717250701608 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:190:49:190:68 | 14055243717250701608 | 14055243717250701608 |
+| test.cs:191:5:191:24 | 14079676299181301772 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:191:5:191:24 | 14079676299181301772 | 14079676299181301772 |
+| test.cs:191:27:191:46 | 14095938998438966337 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:191:27:191:46 | 14095938998438966337 | 14095938998438966337 |
+| test.cs:191:49:191:68 | 14111374107076822891 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:191:49:191:68 | 14111374107076822891 | 14111374107076822891 |
+| test.cs:192:5:192:24 | 14193859431895170587 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:192:5:192:24 | 14193859431895170587 | 14193859431895170587 |
+| test.cs:192:27:192:46 | 14226582801651130532 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:192:27:192:46 | 14226582801651130532 | 14226582801651130532 |
+| test.cs:192:49:192:68 | 14243671177281069512 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:192:49:192:68 | 14243671177281069512 | 14243671177281069512 |
+| test.cs:193:5:193:24 | 14256853800858727521 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:193:5:193:24 | 14256853800858727521 | 14256853800858727521 |
+| test.cs:193:27:193:46 | 14480775929210717493 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:193:27:193:46 | 14480775929210717493 | 14480775929210717493 |
+| test.cs:193:49:193:68 | 14482658293117931546 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:193:49:193:68 | 14482658293117931546 | 14482658293117931546 |
+| test.cs:194:5:194:24 | 14513577387099045298 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:194:5:194:24 | 14513577387099045298 | 14513577387099045298 |
+| test.cs:194:27:194:46 | 14630721578341374856 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:194:27:194:46 | 14630721578341374856 | 14630721578341374856 |
+| test.cs:194:49:194:68 | 14695981039346656037 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:194:49:194:68 | 14695981039346656037 | 14695981039346656037 |
+| test.cs:195:5:195:24 | 14710585101020280896 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:195:5:195:24 | 14710585101020280896 | 14710585101020280896 |
+| test.cs:195:27:195:45 | 1475579823244607677 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:195:27:195:45 | 1475579823244607677 | 1475579823244607677 |
+| test.cs:195:48:195:67 | 14868920869169964081 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:195:48:195:67 | 14868920869169964081 | 14868920869169964081 |
+| test.cs:195:70:195:89 | 14968320160131875803 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:195:70:195:89 | 14968320160131875803 | 14968320160131875803 |
+| test.cs:196:5:196:24 | 14971809093655817917 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:196:5:196:24 | 14971809093655817917 | 14971809093655817917 |
+| test.cs:196:27:196:46 | 15039834196857999838 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:196:27:196:46 | 15039834196857999838 | 15039834196857999838 |
+| test.cs:196:49:196:68 | 15092207615430402812 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:196:49:196:68 | 15092207615430402812 | 15092207615430402812 |
+| test.cs:197:5:197:24 | 15114163911481793350 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:197:5:197:24 | 15114163911481793350 | 15114163911481793350 |
+| test.cs:197:27:197:46 | 15194901817027173566 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:197:27:197:46 | 15194901817027173566 | 15194901817027173566 |
+| test.cs:197:49:197:68 | 15267980678929160412 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:197:49:197:68 | 15267980678929160412 | 15267980678929160412 |
+| test.cs:198:5:198:24 | 15457732070353984570 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:198:5:198:24 | 15457732070353984570 | 15457732070353984570 |
+| test.cs:198:27:198:46 | 15514036435533858158 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:198:27:198:46 | 15514036435533858158 | 15514036435533858158 |
+| test.cs:198:49:198:68 | 15535773470978271326 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:198:49:198:68 | 15535773470978271326 | 15535773470978271326 |
+| test.cs:199:5:199:24 | 15587050164583443069 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:199:5:199:24 | 15587050164583443069 | 15587050164583443069 |
+| test.cs:199:27:199:44 | 155978580751494388 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:199:27:199:44 | 155978580751494388 | 155978580751494388 |
+| test.cs:199:47:199:66 | 15695338751700748390 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:199:47:199:66 | 15695338751700748390 | 15695338751700748390 |
+| test.cs:199:69:199:88 | 15997665423159927228 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:199:69:199:88 | 15997665423159927228 | 15997665423159927228 |
+| test.cs:200:5:200:24 | 16066522799090129502 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:200:5:200:24 | 16066522799090129502 | 16066522799090129502 |
+| test.cs:200:27:200:46 | 16066651430762394116 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:200:27:200:46 | 16066651430762394116 | 16066651430762394116 |
+| test.cs:200:49:200:68 | 16112751343173365533 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:200:49:200:68 | 16112751343173365533 | 16112751343173365533 |
+| test.cs:201:5:201:24 | 16130138450758310172 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:201:5:201:24 | 16130138450758310172 | 16130138450758310172 |
+| test.cs:201:27:201:45 | 1614465773938842903 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:201:27:201:45 | 1614465773938842903 | 1614465773938842903 |
+| test.cs:201:48:201:67 | 16292685861617888592 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:201:48:201:67 | 16292685861617888592 | 16292685861617888592 |
+| test.cs:201:70:201:89 | 16335643316870329598 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:201:70:201:89 | 16335643316870329598 | 16335643316870329598 |
+| test.cs:202:5:202:24 | 16423314183614230717 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:202:5:202:24 | 16423314183614230717 | 16423314183614230717 |
+| test.cs:202:27:202:46 | 16570804352575357627 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:202:27:202:46 | 16570804352575357627 | 16570804352575357627 |
+| test.cs:202:49:202:67 | 1682585410644922036 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:202:49:202:67 | 1682585410644922036 | 1682585410644922036 |
+| test.cs:202:70:202:89 | 16858955978146406642 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:202:70:202:89 | 16858955978146406642 | 16858955978146406642 |
+| test.cs:203:5:203:24 | 16990567851129491937 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:203:5:203:24 | 16990567851129491937 | 16990567851129491937 |
+| test.cs:203:27:203:46 | 17017923349298346219 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:203:27:203:46 | 17017923349298346219 | 17017923349298346219 |
+| test.cs:203:49:203:68 | 17097380490166623672 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:203:49:203:68 | 17097380490166623672 | 17097380490166623672 |
+| test.cs:204:5:204:24 | 17109238199226571972 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:204:5:204:24 | 17109238199226571972 | 17109238199226571972 |
+| test.cs:204:27:204:46 | 17204844226884380288 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:204:27:204:46 | 17204844226884380288 | 17204844226884380288 |
+| test.cs:204:49:204:68 | 17291806236368054941 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:204:49:204:68 | 17291806236368054941 | 17291806236368054941 |
+| test.cs:205:5:205:24 | 17351543633914244545 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:205:5:205:24 | 17351543633914244545 | 17351543633914244545 |
+| test.cs:205:27:205:46 | 17439059603042731363 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:205:27:205:46 | 17439059603042731363 | 17439059603042731363 |
+| test.cs:205:49:205:68 | 17574002783607647274 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:205:49:205:68 | 17574002783607647274 | 17574002783607647274 |
+| test.cs:206:5:206:24 | 17624147599670377042 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:206:5:206:24 | 17624147599670377042 | 17624147599670377042 |
+| test.cs:206:27:206:46 | 17633734304611248415 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:206:27:206:46 | 17633734304611248415 | 17633734304611248415 |
+| test.cs:206:49:206:68 | 17683972236092287897 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:206:49:206:68 | 17683972236092287897 | 17683972236092287897 |
+| test.cs:207:5:207:24 | 17849680105131524334 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:207:5:207:24 | 17849680105131524334 | 17849680105131524334 |
+| test.cs:207:27:207:46 | 17939405613729073960 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:207:27:207:46 | 17939405613729073960 | 17939405613729073960 |
+| test.cs:207:49:207:68 | 17956969551821596225 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:207:49:207:68 | 17956969551821596225 | 17956969551821596225 |
+| test.cs:208:5:208:24 | 17978774977754553159 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:208:5:208:24 | 17978774977754553159 | 17978774977754553159 |
+| test.cs:208:27:208:46 | 17984632978012874803 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:208:27:208:46 | 17984632978012874803 | 17984632978012874803 |
+| test.cs:208:49:208:68 | 17997967489723066537 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:208:49:208:68 | 17997967489723066537 | 17997967489723066537 |
+| test.cs:209:5:209:24 | 18147627057830191163 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:209:5:209:24 | 18147627057830191163 | 18147627057830191163 |
+| test.cs:209:27:209:46 | 18150909006539876521 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:209:27:209:46 | 18150909006539876521 | 18150909006539876521 |
+| test.cs:209:49:209:68 | 18159703063075866524 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:209:49:209:68 | 18159703063075866524 | 18159703063075866524 |
+| test.cs:210:5:210:24 | 18246404330670877335 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:210:5:210:24 | 18246404330670877335 | 18246404330670877335 |
+| test.cs:210:27:210:46 | 18294908219222222902 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:210:27:210:46 | 18294908219222222902 | 18294908219222222902 |
+| test.cs:210:49:210:68 | 18392881921099771407 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:210:49:210:68 | 18392881921099771407 | 18392881921099771407 |
+| test.cs:211:5:211:24 | 18446744073709551613 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:211:5:211:24 | 18446744073709551613 | 18446744073709551613 |
+| test.cs:211:27:211:44 | 191060519014405309 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:211:27:211:44 | 191060519014405309 | 191060519014405309 |
+| test.cs:211:47:211:65 | 2032008861530788751 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:211:47:211:65 | 2032008861530788751 | 2032008861530788751 |
+| test.cs:211:68:211:86 | 2128122064571842954 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:211:68:211:86 | 2128122064571842954 | 2128122064571842954 |
+| test.cs:212:5:212:14 | 2147483647 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:212:5:212:14 | 2147483647 | 2147483647 |
+| test.cs:212:17:212:26 | 2147745794 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:212:17:212:26 | 2147745794 | 2147745794 |
+| test.cs:212:29:212:47 | 2380224015317016190 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:212:29:212:47 | 2380224015317016190 | 2380224015317016190 |
+| test.cs:212:50:212:68 | 2478231962306073784 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:212:50:212:68 | 2478231962306073784 | 2478231962306073784 |
+| test.cs:213:5:213:23 | 2532538262737333146 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:213:5:213:23 | 2532538262737333146 | 2532538262737333146 |
+| test.cs:213:26:213:44 | 2589926981877829912 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:213:26:213:44 | 2589926981877829912 | 2589926981877829912 |
+| test.cs:213:47:213:65 | 2597124982561782591 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:213:47:213:65 | 2597124982561782591 | 2597124982561782591 |
+| test.cs:213:68:213:86 | 2600364143812063535 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:213:68:213:86 | 2600364143812063535 | 2600364143812063535 |
+| test.cs:214:5:214:23 | 2717025511528702475 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:214:5:214:23 | 2717025511528702475 | 2717025511528702475 |
+| test.cs:214:26:214:44 | 2734787258623754862 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:214:26:214:44 | 2734787258623754862 | 2734787258623754862 |
+| test.cs:214:47:214:63 | 27407921587843457 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:214:47:214:63 | 27407921587843457 | 27407921587843457 |
+| test.cs:214:66:214:84 | 2760663353550280147 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:214:66:214:84 | 2760663353550280147 | 2760663353550280147 |
+| test.cs:215:5:215:23 | 2797129108883749491 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:215:5:215:23 | 2797129108883749491 | 2797129108883749491 |
+| test.cs:215:26:215:44 | 2810460305047003196 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:215:26:215:44 | 2810460305047003196 | 2810460305047003196 |
+| test.cs:215:47:215:64 | 292198192373389586 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:215:47:215:64 | 292198192373389586 | 292198192373389586 |
+| test.cs:215:67:215:85 | 2934149816356927366 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:215:67:215:85 | 2934149816356927366 | 2934149816356927366 |
+| test.cs:216:5:216:23 | 3045986759481489935 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:216:5:216:23 | 3045986759481489935 | 3045986759481489935 |
+| test.cs:216:26:216:44 | 3178468437029279937 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:216:26:216:44 | 3178468437029279937 | 3178468437029279937 |
+| test.cs:216:47:216:65 | 3200333496547938354 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:216:47:216:65 | 3200333496547938354 | 3200333496547938354 |
+| test.cs:216:68:216:86 | 3320026265773918739 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:216:68:216:86 | 3320026265773918739 | 3320026265773918739 |
+| test.cs:217:5:217:23 | 3320767229281015341 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:217:5:217:23 | 3320767229281015341 | 3320767229281015341 |
+| test.cs:217:26:217:44 | 3341747963119755850 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:217:26:217:44 | 3341747963119755850 | 3341747963119755850 |
+| test.cs:217:47:217:65 | 3407972863931386250 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:217:47:217:65 | 3407972863931386250 | 3407972863931386250 |
+| test.cs:217:68:217:86 | 3413052607651207697 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:217:68:217:86 | 3413052607651207697 | 3413052607651207697 |
+| test.cs:218:5:218:23 | 3413886037471417852 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:218:5:218:23 | 3413886037471417852 | 3413886037471417852 |
+| test.cs:218:26:218:44 | 3421197789791424393 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:218:26:218:44 | 3421197789791424393 | 3421197789791424393 |
+| test.cs:218:47:218:65 | 3421213182954201407 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:218:47:218:65 | 3421213182954201407 | 3421213182954201407 |
+| test.cs:218:68:218:86 | 3425260965299690882 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:218:68:218:86 | 3425260965299690882 | 3425260965299690882 |
+| test.cs:219:5:219:23 | 3538022140597504361 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:219:5:219:23 | 3538022140597504361 | 3538022140597504361 |
+| test.cs:219:26:219:44 | 3575761800716667678 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:219:26:219:44 | 3575761800716667678 | 3575761800716667678 |
+| test.cs:219:47:219:65 | 3588624367609827560 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:219:47:219:65 | 3588624367609827560 | 3588624367609827560 |
+| test.cs:219:68:219:86 | 3626142665768487764 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:219:68:219:86 | 3626142665768487764 | 3626142665768487764 |
+| test.cs:220:5:220:23 | 3642525650883269872 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:220:5:220:23 | 3642525650883269872 | 3642525650883269872 |
+| test.cs:220:26:220:44 | 3656637464651387014 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:220:26:220:44 | 3656637464651387014 | 3656637464651387014 |
+| test.cs:220:47:220:65 | 3660705254426876796 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:220:47:220:65 | 3660705254426876796 | 3660705254426876796 |
+| test.cs:220:68:220:86 | 3769837838875367802 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:220:68:220:86 | 3769837838875367802 | 3769837838875367802 |
+| test.cs:221:5:221:23 | 3778500091710709090 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:221:5:221:23 | 3778500091710709090 | 3778500091710709090 |
+| test.cs:221:26:221:44 | 3796405623695665524 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:221:26:221:44 | 3796405623695665524 | 3796405623695665524 |
+| test.cs:221:47:221:65 | 3869935012404164040 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:221:47:221:65 | 3869935012404164040 | 3869935012404164040 |
+| test.cs:221:68:221:86 | 3890769468012566366 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:221:68:221:86 | 3890769468012566366 | 3890769468012566366 |
+| test.cs:222:5:222:23 | 3890794756780010537 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:222:5:222:23 | 3890794756780010537 | 3890794756780010537 |
+| test.cs:222:26:222:43 | 397780960855462669 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:222:26:222:43 | 397780960855462669 | 397780960855462669 |
+| test.cs:222:46:222:64 | 4030236413975199654 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:222:46:222:64 | 4030236413975199654 | 4030236413975199654 |
+| test.cs:222:67:222:85 | 4088976323439621041 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:222:67:222:85 | 4088976323439621041 | 4088976323439621041 |
+| test.cs:223:5:223:23 | 4454255944391929578 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:223:5:223:23 | 4454255944391929578 | 4454255944391929578 |
+| test.cs:223:26:223:44 | 4501656691368064027 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:223:26:223:44 | 4501656691368064027 | 4501656691368064027 |
+| test.cs:223:47:223:65 | 4578480846255629462 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:223:47:223:65 | 4578480846255629462 | 4578480846255629462 |
+| test.cs:223:68:223:86 | 4821863173800309721 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:223:68:223:86 | 4821863173800309721 | 4821863173800309721 |
+| test.cs:224:5:224:23 | 4931721628717906635 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:224:5:224:23 | 4931721628717906635 | 4931721628717906635 |
+| test.cs:224:26:224:43 | 506634811745884560 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:224:26:224:43 | 506634811745884560 | 506634811745884560 |
+| test.cs:224:46:224:64 | 5132256620104998637 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:224:46:224:64 | 5132256620104998637 | 5132256620104998637 |
+| test.cs:224:67:224:85 | 5183687599225757871 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:224:67:224:85 | 5183687599225757871 | 5183687599225757871 |
+| test.cs:225:5:225:22 | 521157249538507889 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:225:5:225:22 | 521157249538507889 | 521157249538507889 |
+| test.cs:225:25:225:43 | 5219431737322569038 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:225:25:225:43 | 5219431737322569038 | 5219431737322569038 |
+| test.cs:225:46:225:63 | 541172992193764396 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:225:46:225:63 | 541172992193764396 | 541172992193764396 |
+| test.cs:225:66:225:84 | 5415426428750045503 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:225:66:225:84 | 5415426428750045503 | 5415426428750045503 |
+| test.cs:226:5:226:23 | 5449730069165757263 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:226:5:226:23 | 5449730069165757263 | 5449730069165757263 |
+| test.cs:226:26:226:44 | 5587557070429522647 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:226:26:226:44 | 5587557070429522647 | 5587557070429522647 |
+| test.cs:226:47:226:65 | 5614586596107908838 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:226:47:226:65 | 5614586596107908838 | 5614586596107908838 |
+| test.cs:226:68:226:85 | 576626207276463000 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:226:68:226:85 | 576626207276463000 | 576626207276463000 |
+| test.cs:227:5:227:23 | 5942282052525294911 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:227:5:227:23 | 5942282052525294911 | 5942282052525294911 |
+| test.cs:227:26:227:44 | 5945487981219695001 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:227:26:227:44 | 5945487981219695001 | 5945487981219695001 |
+| test.cs:227:47:227:65 | 5984963105389676759 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:227:47:227:65 | 5984963105389676759 | 5984963105389676759 |
+| test.cs:227:68:227:85 | 607197993339007484 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:227:68:227:85 | 607197993339007484 | 607197993339007484 |
+| test.cs:228:5:228:23 | 6088115528707848728 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:228:5:228:23 | 6088115528707848728 | 6088115528707848728 |
+| test.cs:228:26:228:44 | 6116246686670134098 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:228:26:228:44 | 6116246686670134098 | 6116246686670134098 |
+| test.cs:228:47:228:65 | 6180361713414290679 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:228:47:228:65 | 6180361713414290679 | 6180361713414290679 |
+| test.cs:228:68:228:86 | 6195833633417633900 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:228:68:228:86 | 6195833633417633900 | 6195833633417633900 |
+| test.cs:229:5:229:23 | 6274014997237900919 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:229:5:229:23 | 6274014997237900919 | 6274014997237900919 |
+| test.cs:229:26:229:43 | 640589622539783622 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:229:26:229:43 | 640589622539783622 | 640589622539783622 |
+| test.cs:229:46:229:64 | 6461429591783621719 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:229:46:229:64 | 6461429591783621719 | 6461429591783621719 |
+| test.cs:229:67:229:85 | 6491986958834001955 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:229:67:229:85 | 6491986958834001955 | 6491986958834001955 |
+| test.cs:230:5:230:23 | 6508141243778577344 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:230:5:230:23 | 6508141243778577344 | 6508141243778577344 |
+| test.cs:230:26:230:44 | 6605813339339102567 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:230:26:230:44 | 6605813339339102567 | 6605813339339102567 |
+| test.cs:230:47:230:64 | 682250828679635420 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:230:47:230:64 | 682250828679635420 | 682250828679635420 |
+| test.cs:230:67:230:85 | 6827032273910657891 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:230:67:230:85 | 6827032273910657891 | 6827032273910657891 |
+| test.cs:231:5:231:23 | 6943102301517884811 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:231:5:231:23 | 6943102301517884811 | 6943102301517884811 |
+| test.cs:231:26:231:43 | 700598796416086955 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:231:26:231:43 | 700598796416086955 | 700598796416086955 |
+| test.cs:231:46:231:64 | 7080175711202577138 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:231:46:231:64 | 7080175711202577138 | 7080175711202577138 |
+| test.cs:231:67:231:85 | 7175363135479931834 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:231:67:231:85 | 7175363135479931834 | 7175363135479931834 |
+| test.cs:232:5:232:23 | 7315838824213522000 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:232:5:232:23 | 7315838824213522000 | 7315838824213522000 |
+| test.cs:232:26:232:44 | 7412338704062093516 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:232:26:232:44 | 7412338704062093516 | 7412338704062093516 |
+| test.cs:232:47:232:65 | 7516148236133302073 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:232:47:232:65 | 7516148236133302073 | 7516148236133302073 |
+| test.cs:232:68:232:86 | 7574774749059321801 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:232:68:232:86 | 7574774749059321801 | 7574774749059321801 |
+| test.cs:233:5:233:23 | 7701683279824397773 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:233:5:233:23 | 7701683279824397773 | 7701683279824397773 |
+| test.cs:233:26:233:44 | 7775177810774851294 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:233:26:233:44 | 7775177810774851294 | 7775177810774851294 |
+| test.cs:233:47:233:65 | 7810436520414958497 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:233:47:233:65 | 7810436520414958497 | 7810436520414958497 |
+| test.cs:233:68:233:86 | 7878537243757499832 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:233:68:233:86 | 7878537243757499832 | 7878537243757499832 |
+| test.cs:234:5:234:21 | 79089792725215063 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:234:5:234:21 | 79089792725215063 | 79089792725215063 |
+| test.cs:234:24:234:42 | 7982848972385914508 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:234:24:234:42 | 7982848972385914508 | 7982848972385914508 |
+| test.cs:234:45:234:63 | 8052533790968282297 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:234:45:234:63 | 8052533790968282297 | 8052533790968282297 |
+| test.cs:234:66:234:84 | 8129411991672431889 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:234:66:234:84 | 8129411991672431889 | 8129411991672431889 |
+| test.cs:235:5:235:23 | 8146185202538899243 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:235:5:235:23 | 8146185202538899243 | 8146185202538899243 |
+| test.cs:235:26:235:43 | 835151375515278827 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:235:26:235:43 | 835151375515278827 | 835151375515278827 |
+| test.cs:235:46:235:64 | 8381292265993977266 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:235:46:235:64 | 8381292265993977266 | 8381292265993977266 |
+| test.cs:235:67:235:85 | 8408095252303317471 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:235:67:235:85 | 8408095252303317471 | 8408095252303317471 |
+| test.cs:236:5:236:23 | 8473756179280619170 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:236:5:236:23 | 8473756179280619170 | 8473756179280619170 |
+| test.cs:236:26:236:44 | 8478833628889826985 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:236:26:236:44 | 8478833628889826985 | 8478833628889826985 |
+| test.cs:236:47:236:65 | 8612208440357175863 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:236:47:236:65 | 8612208440357175863 | 8612208440357175863 |
+| test.cs:236:68:236:86 | 8697424601205169055 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:236:68:236:86 | 8697424601205169055 | 8697424601205169055 |
+| test.cs:237:5:237:23 | 8698326794961817906 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:237:5:237:23 | 8698326794961817906 | 8698326794961817906 |
+| test.cs:237:26:237:44 | 8709004393777297355 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:237:26:237:44 | 8709004393777297355 | 8709004393777297355 |
+| test.cs:237:47:237:65 | 8727477769544302060 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:237:47:237:65 | 8727477769544302060 | 8727477769544302060 |
+| test.cs:237:68:237:86 | 8760312338504300643 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:237:68:237:86 | 8760312338504300643 | 8760312338504300643 |
+| test.cs:238:5:238:23 | 8799118153397725683 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:238:5:238:23 | 8799118153397725683 | 8799118153397725683 |
+| test.cs:238:26:238:44 | 8873858923435176895 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:238:26:238:44 | 8873858923435176895 | 8873858923435176895 |
+| test.cs:238:47:238:65 | 8994091295115840290 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:238:47:238:65 | 8994091295115840290 | 8994091295115840290 |
+| test.cs:238:68:238:86 | 9007106680104765185 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:238:68:238:86 | 9007106680104765185 | 9007106680104765185 |
+| test.cs:239:5:239:23 | 9061219083560670602 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:239:5:239:23 | 9061219083560670602 | 9061219083560670602 |
+| test.cs:239:26:239:44 | 9149947745824492274 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:239:26:239:44 | 9149947745824492274 | 9149947745824492274 |
+| test.cs:239:47:239:64 | 917638920165491138 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:239:47:239:64 | 917638920165491138 | 917638920165491138 |
+| test.cs:239:67:239:85 | 9234894663364701749 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:239:67:239:85 | 9234894663364701749 | 9234894663364701749 |
+| test.cs:240:5:240:23 | 9333057603143916814 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:240:5:240:23 | 9333057603143916814 | 9333057603143916814 |
+| test.cs:240:26:240:44 | 9384605490088500348 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:240:26:240:44 | 9384605490088500348 | 9384605490088500348 |
+| test.cs:240:47:240:65 | 9531326785919727076 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:240:47:240:65 | 9531326785919727076 | 9531326785919727076 |
+| test.cs:240:68:240:86 | 9555688264681862794 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:240:68:240:86 | 9555688264681862794 | 9555688264681862794 |
+| test.cs:241:5:241:23 | 9559632696372799208 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:241:5:241:23 | 9559632696372799208 | 9559632696372799208 |
+| test.cs:241:26:241:44 | 9903758755917170407 | The Hash literal $@ may be related to the Solorigate campaign. Total count = 243 is above the threshold 5. | test.cs:241:26:241:44 | 9903758755917170407 | 9903758755917170407 |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qlref
new file mode 100644
index 00000000000..0b468dcce55
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.expected
new file mode 100644
index 00000000000..043068419d7
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.expected	
@@ -0,0 +1,140 @@
+| test.cs:247:4:247:35 | "(?i)([^a-z]\|^)(test)([^a-z]\|$)" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:247:4:247:35 | "(?i)([^a-z]\|^)(test)([^a-z]\|$)" | (?i)([^a-z]\|^)(test)([^a-z]\|$) |
+| test.cs:247:38:247:55 | "(?i)(solarwinds)" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:247:38:247:55 | "(?i)(solarwinds)" | (?i)(solarwinds) |
+| test.cs:247:58:247:96 | "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:247:58:247:96 | "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n" | [{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n |
+| test.cs:248:4:248:18 | "[{0,5}] {1}\n" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:248:4:248:18 | "[{0,5}] {1}\n" | [{0,5}] {1}\n |
+| test.cs:248:21:248:37 | "[E] {0} {1} {2}" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:248:21:248:37 | "[E] {0} {1} {2}" | [E] {0} {1} {2} |
+| test.cs:249:4:249:62 | "\\"\\{[0-9a-f-]{36}\\}\\"\|\\"[0-9a-f]{32}\\"\|\\"[0-9a-f]{16}\\"" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:249:4:249:62 | "\\"\\{[0-9a-f-]{36}\\}\\"\|\\"[0-9a-f]{32}\\"\|\\"[0-9a-f]{16}\\"" | "\\{[0-9a-f-]{36}\\}"\|"[0-9a-f]{32}"\|"[0-9a-f]{16}" |
+| test.cs:249:65:249:79 | ".CortexPlugin" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:249:65:249:79 | ".CortexPlugin" | .CortexPlugin |
+| test.cs:249:82:249:89 | ".Orion" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:249:82:249:89 | ".Orion" | .Orion |
+| test.cs:250:4:250:36 | "\\"EventName\\":\\"EventManager\\"," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:250:4:250:36 | "\\"EventName\\":\\"EventManager\\"," | "EventName":"EventManager", |
+| test.cs:250:39:250:64 | "\\"EventType\\":\\"Orion\\"," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:250:39:250:64 | "\\"EventType\\":\\"Orion\\"," | "EventType":"Orion", |
+| test.cs:251:4:251:56 | "\\OrionImprovement\\SolarWinds.OrionImprovement.exe" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:251:4:251:56 | "\\OrionImprovement\\SolarWinds.OrionImprovement.exe" | \\OrionImprovement\\SolarWinds.OrionImprovement.exe |
+| test.cs:252:4:252:44 | "0123456789abcdefghijklmnopqrstuvwxyz-_." | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:252:4:252:44 | "0123456789abcdefghijklmnopqrstuvwxyz-_." | 0123456789abcdefghijklmnopqrstuvwxyz-_. |
+| test.cs:252:47:252:70 | "\\"sessionId\\":\\"{0}\\"," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:252:47:252:70 | "\\"sessionId\\":\\"{0}\\"," | "sessionId":"{0}", |
+| test.cs:252:73:252:85 | "\\"steps\\":[" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:252:73:252:85 | "\\"steps\\":[" | "steps":[ |
+| test.cs:253:4:253:24 | "\\"Succeeded\\":true," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:253:4:253:24 | "\\"Succeeded\\":true," | "Succeeded":true, |
+| test.cs:253:27:253:62 | "\\"Timestamp\\":\\"\\/Date({0})\\/\\"," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:253:27:253:62 | "\\"Timestamp\\":\\"\\/Date({0})\\/\\"," | "Timestamp":"\\/Date({0})\\/", |
+| test.cs:253:65:253:85 | "\\"userId\\":\\"{0}\\"," | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:253:65:253:85 | "\\"userId\\":\\"{0}\\"," | "userId":"{0}", |
+| test.cs:254:4:254:23 | "{0} {1} HTTP/{2}\n" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:4:254:23 | "{0} {1} HTTP/{2}\n" | {0} {1} HTTP/{2}\n |
+| test.cs:254:26:254:32 | "10140" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:26:254:32 | "10140" | 10140 |
+| test.cs:254:35:254:48 | "144.86.226.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:35:254:48 | "144.86.226.0" | 144.86.226.0 |
+| test.cs:254:51:254:65 | "154.118.140.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:51:254:65 | "154.118.140.0" | 154.118.140.0 |
+| test.cs:254:68:254:79 | "172.16.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:68:254:79 | "172.16.0.0" | 172.16.0.0 |
+| test.cs:254:82:254:93 | "18.130.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:254:82:254:93 | "18.130.0.0" | 18.130.0.0 |
+| test.cs:255:4:255:15 | "184.72.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:4:255:15 | "184.72.0.0" | 184.72.0.0 |
+| test.cs:255:18:255:30 | "192.168.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:18:255:30 | "192.168.0.0" | 192.168.0.0 |
+| test.cs:255:33:255:47 | "199.201.117.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:33:255:47 | "199.201.117.0" | 199.201.117.0 |
+| test.cs:255:50:255:61 | "20.140.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:50:255:61 | "20.140.0.0" | 20.140.0.0 |
+| test.cs:255:64:255:70 | "20100" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:64:255:70 | "20100" | 20100 |
+| test.cs:255:73:255:79 | "20220" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:73:255:79 | "20220" | 20220 |
+| test.cs:255:82:255:94 | "217.163.7.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:255:82:255:94 | "217.163.7.0" | 217.163.7.0 |
+| test.cs:256:4:256:14 | "224.0.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:4:256:14 | "224.0.0.0" | 224.0.0.0 |
+| test.cs:256:17:256:27 | "240.0.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:17:256:27 | "240.0.0.0" | 240.0.0.0 |
+| test.cs:256:30:256:42 | "255.240.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:30:256:42 | "255.240.0.0" | 255.240.0.0 |
+| test.cs:256:45:256:57 | "255.254.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:45:256:57 | "255.254.0.0" | 255.254.0.0 |
+| test.cs:256:60:256:74 | "255.255.248.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:60:256:74 | "255.255.248.0" | 255.255.248.0 |
+| test.cs:256:77:256:87 | "3.0.0.382" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:256:77:256:87 | "3.0.0.382" | 3.0.0.382 |
+| test.cs:257:4:257:16 | "41.84.159.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:4:257:16 | "41.84.159.0" | 41.84.159.0 |
+| test.cs:257:19:257:25 | "43140" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:19:257:25 | "43140" | 43140 |
+| test.cs:257:28:257:33 | "4320" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:28:257:33 | "4320" | 4320 |
+| test.cs:257:36:257:42 | "43260" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:36:257:42 | "43260" | 43260 |
+| test.cs:257:45:257:52 | "524287" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:45:257:52 | "524287" | 524287 |
+| test.cs:257:55:257:92 | "583da945-62af-10e8-4902-a8f205c72b2e" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:257:55:257:92 | "583da945-62af-10e8-4902-a8f205c72b2e" | 583da945-62af-10e8-4902-a8f205c72b2e |
+| test.cs:258:4:258:10 | "65280" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:4:258:10 | "65280" | 65280 |
+| test.cs:258:13:258:25 | "71.152.53.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:13:258:25 | "71.152.53.0" | 71.152.53.0 |
+| test.cs:258:28:258:40 | "74.114.24.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:28:258:40 | "74.114.24.0" | 74.114.24.0 |
+| test.cs:258:43:258:54 | "8.18.144.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:43:258:54 | "8.18.144.0" | 8.18.144.0 |
+| test.cs:258:57:258:69 | "87.238.80.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:57:258:69 | "87.238.80.0" | 87.238.80.0 |
+| test.cs:258:72:258:84 | "96.31.172.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:72:258:84 | "96.31.172.0" | 96.31.172.0 |
+| test.cs:258:87:258:94 | "983040" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:258:87:258:94 | "983040" | 983040 |
+| test.cs:259:4:259:14 | "99.79.0.0" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:4:259:14 | "99.79.0.0" | 99.79.0.0 |
+| test.cs:259:17:259:31 | "Administrator" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:17:259:31 | "Administrator" | Administrator |
+| test.cs:259:34:259:47 | "advapi32.dll" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:34:259:47 | "advapi32.dll" | advapi32.dll |
+| test.cs:259:50:259:57 | "Apollo" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:50:259:57 | "Apollo" | Apollo |
+| test.cs:259:60:259:72 | "appsync-api" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:60:259:72 | "appsync-api" | appsync-api |
+| test.cs:259:75:259:90 | "avsvmcloud.com" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:259:75:259:90 | "avsvmcloud.com" | avsvmcloud.com |
+| test.cs:260:4:260:23 | "api.solarwinds.com" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:4:260:23 | "api.solarwinds.com" | api.solarwinds.com |
+| test.cs:260:26:260:32 | "-root" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:26:260:32 | "-root" | -root |
+| test.cs:260:35:260:41 | "-cert" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:35:260:41 | "-cert" | -cert |
+| test.cs:260:44:260:58 | "-universal_ca" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:44:260:58 | "-universal_ca" | -universal_ca |
+| test.cs:260:61:260:65 | "-ca" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:61:260:65 | "-ca" | -ca |
+| test.cs:260:68:260:80 | "-primary_ca" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:68:260:80 | "-primary_ca" | -primary_ca |
+| test.cs:260:83:260:94 | "-timestamp" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:260:83:260:94 | "-timestamp" | -timestamp |
+| test.cs:261:4:261:12 | "-global" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:4:261:12 | "-global" | -global |
+| test.cs:261:15:261:25 | "-secureca" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:15:261:25 | "-secureca" | -secureca |
+| test.cs:261:28:261:44 | "CloudMonitoring" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:28:261:44 | "CloudMonitoring" | CloudMonitoring |
+| test.cs:261:47:261:58 | "MACAddress" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:47:261:58 | "MACAddress" | MACAddress |
+| test.cs:261:61:261:73 | "DHCPEnabled" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:61:261:73 | "DHCPEnabled" | DHCPEnabled |
+| test.cs:261:76:261:87 | "DHCPServer" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:261:76:261:87 | "DHCPServer" | DHCPServer |
+| test.cs:262:4:262:16 | "DNSHostName" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:262:4:262:16 | "DNSHostName" | DNSHostName |
+| test.cs:262:19:262:46 | "DNSDomainSuffixSearchOrder" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:262:19:262:46 | "DNSDomainSuffixSearchOrder" | DNSDomainSuffixSearchOrder |
+| test.cs:262:49:262:70 | "DNSServerSearchOrder" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:262:49:262:70 | "DNSServerSearchOrder" | DNSServerSearchOrder |
+| test.cs:262:73:262:83 | "IPAddress" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:262:73:262:83 | "IPAddress" | IPAddress |
+| test.cs:262:86:262:95 | "IPSubnet" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:262:86:262:95 | "IPSubnet" | IPSubnet |
+| test.cs:263:4:263:21 | "DefaultIPGateway" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:263:4:263:21 | "DefaultIPGateway" | DefaultIPGateway |
+| test.cs:263:24:263:39 | "OSArchitecture" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:263:24:263:39 | "OSArchitecture" | OSArchitecture |
+| test.cs:263:42:263:54 | "InstallDate" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:263:42:263:54 | "InstallDate" | InstallDate |
+| test.cs:263:57:263:70 | "Organization" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:263:57:263:70 | "Organization" | Organization |
+| test.cs:263:73:263:88 | "RegisteredUser" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:263:73:263:88 | "RegisteredUser" | RegisteredUser |
+| test.cs:264:4:264:11 | "fc00::" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:4:264:11 | "fc00::" | fc00:: |
+| test.cs:264:14:264:21 | "fe00::" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:14:264:21 | "fe00::" | fe00:: |
+| test.cs:264:24:264:31 | "fec0::" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:24:264:31 | "fec0::" | fec0:: |
+| test.cs:264:34:264:41 | "ffc0::" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:34:264:41 | "ffc0::" | ffc0:: |
+| test.cs:264:44:264:51 | "ff00::" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:44:264:51 | "ff00::" | ff00:: |
+| test.cs:264:54:264:59 | "HKCC" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:54:264:59 | "HKCC" | HKCC |
+| test.cs:264:62:264:67 | "HKCR" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:62:264:67 | "HKCR" | HKCR |
+| test.cs:264:70:264:75 | "HKCU" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:70:264:75 | "HKCU" | HKCU |
+| test.cs:264:78:264:83 | "HKDD" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:264:78:264:83 | "HKDD" | HKDD |
+| test.cs:265:4:265:22 | "HKEY_CLASSES_ROOT" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:265:4:265:22 | "HKEY_CLASSES_ROOT" | HKEY_CLASSES_ROOT |
+| test.cs:265:25:265:45 | "HKEY_CURRENT_CONFIG" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:265:25:265:45 | "HKEY_CURRENT_CONFIG" | HKEY_CURRENT_CONFIG |
+| test.cs:265:48:265:66 | "HKEY_CURRENT_USER" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:265:48:265:66 | "HKEY_CURRENT_USER" | HKEY_CURRENT_USER |
+| test.cs:265:69:265:83 | "HKEY_DYN_DATA" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:265:69:265:83 | "HKEY_DYN_DATA" | HKEY_DYN_DATA |
+| test.cs:266:4:266:23 | "HKEY_LOCAL_MACHINE" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:266:4:266:23 | "HKEY_LOCAL_MACHINE" | HKEY_LOCAL_MACHINE |
+| test.cs:266:26:266:80 | "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:266:26:266:80 | "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" | HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography |
+| test.cs:267:4:267:25 | "HKEY_PERFOMANCE_DATA" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:4:267:25 | "HKEY_PERFOMANCE_DATA" | HKEY_PERFOMANCE_DATA |
+| test.cs:267:28:267:39 | "HKEY_USERS" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:28:267:39 | "HKEY_USERS" | HKEY_USERS |
+| test.cs:267:42:267:47 | "HKLM" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:42:267:47 | "HKLM" | HKLM |
+| test.cs:267:50:267:55 | "HKPD" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:50:267:55 | "HKPD" | HKPD |
+| test.cs:267:58:267:62 | "HKU" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:58:267:62 | "HKU" | HKU |
+| test.cs:267:65:267:79 | "If-None-Match" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:267:65:267:79 | "If-None-Match" | If-None-Match |
+| test.cs:268:4:268:25 | "Microsoft-CryptoAPI/" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:4:268:25 | "Microsoft-CryptoAPI/" | Microsoft-CryptoAPI/ |
+| test.cs:268:28:268:34 | "Nodes" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:28:268:34 | "Nodes" | Nodes |
+| test.cs:268:37:268:45 | "Volumes" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:37:268:45 | "Volumes" | Volumes |
+| test.cs:268:48:268:59 | "Interfaces" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:48:268:59 | "Interfaces" | Interfaces |
+| test.cs:268:62:268:73 | "Components" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:62:268:73 | "Components" | Components |
+| test.cs:268:76:268:85 | "opensans" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:268:76:268:85 | "opensans" | opensans |
+| test.cs:269:4:269:17 | "Organization" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:269:4:269:17 | "Organization" | Organization |
+| test.cs:269:20:269:35 | "OSArchitecture" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:269:20:269:35 | "OSArchitecture" | OSArchitecture |
+| test.cs:269:38:269:54 | "ParentProcessID" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:269:38:269:54 | "ParentProcessID" | ParentProcessID |
+| test.cs:269:57:269:66 | "PathName" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:269:57:269:66 | "PathName" | PathName |
+| test.cs:269:69:269:91 | "ReportWatcherPostpone" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:269:69:269:91 | "ReportWatcherPostpone" | ReportWatcherPostpone |
+| test.cs:270:4:270:23 | "ReportWatcherRetry" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:270:4:270:23 | "ReportWatcherRetry" | ReportWatcherRetry |
+| test.cs:270:26:270:33 | "S-1-5-" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:270:26:270:33 | "S-1-5-" | S-1-5- |
+| test.cs:270:36:270:55 | "SeRestorePrivilege" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:270:36:270:55 | "SeRestorePrivilege" | SeRestorePrivilege |
+| test.cs:270:58:270:78 | "SeShutdownPrivilege" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:270:58:270:78 | "SeShutdownPrivilege" | SeShutdownPrivilege |
+| test.cs:271:4:271:29 | "SeTakeOwnershipPrivilege" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:271:4:271:29 | "SeTakeOwnershipPrivilege" | SeTakeOwnershipPrivilege |
+| test.cs:271:32:271:43 | "SolarWinds" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:271:32:271:43 | "SolarWinds" | SolarWinds |
+| test.cs:271:46:271:80 | "SolarWindsOrionImprovementClient/" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:271:46:271:80 | "SolarWindsOrionImprovementClient/" | SolarWindsOrionImprovementClient/ |
+| test.cs:272:4:272:18 | "SourceCodePro" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:4:272:18 | "SourceCodePro" | SourceCodePro |
+| test.cs:272:21:272:35 | "SourceHanSans" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:21:272:35 | "SourceHanSans" | SourceHanSans |
+| test.cs:272:38:272:53 | "SourceHanSerif" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:38:272:53 | "SourceHanSerif" | SourceHanSerif |
+| test.cs:272:56:272:71 | "SourceSerifPro" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:56:272:71 | "SourceSerifPro" | SourceSerifPro |
+| test.cs:272:74:272:80 | "Start" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:74:272:80 | "Start" | Start |
+| test.cs:272:83:272:95 | "swip/Events" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:272:83:272:95 | "swip/Events" | swip/Events |
+| test.cs:273:4:273:14 | "swip/upd/" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:273:4:273:14 | "swip/upd/" | swip/upd/ |
+| test.cs:273:17:273:34 | "swip/Upload.ashx" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:273:17:273:34 | "swip/Upload.ashx" | swip/Upload.ashx |
+| test.cs:273:37:273:44 | "SYSTEM" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:273:37:273:44 | "SYSTEM" | SYSTEM |
+| test.cs:273:47:273:83 | "SYSTEM\\CurrentControlSet\\services" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:273:47:273:83 | "SYSTEM\\CurrentControlSet\\services" | SYSTEM\\CurrentControlSet\\services |
+| test.cs:273:86:273:96 | "us-east-1" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:273:86:273:96 | "us-east-1" | us-east-1 |
+| test.cs:274:4:274:14 | "us-east-2" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:274:4:274:14 | "us-east-2" | us-east-2 |
+| test.cs:274:17:274:27 | "us-west-2" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:274:17:274:27 | "us-west-2" | us-west-2 |
+| test.cs:274:30:274:62 | "fonts/woff/{0}-{1}-{2}{3}.woff2" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:274:30:274:62 | "fonts/woff/{0}-{1}-{2}{3}.woff2" | fonts/woff/{0}-{1}-{2}{3}.woff2 |
+| test.cs:275:4:275:44 | "fonts/woff/{0}-{1}-{2}-webfont{3}.woff2" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:275:4:275:44 | "fonts/woff/{0}-{1}-{2}-webfont{3}.woff2" | fonts/woff/{0}-{1}-{2}-webfont{3}.woff2 |
+| test.cs:275:47:275:80 | "ph2eifo3n5utg1j8d94qrvbmk0sal76c" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:275:47:275:80 | "ph2eifo3n5utg1j8d94qrvbmk0sal76c" | ph2eifo3n5utg1j8d94qrvbmk0sal76c |
+| test.cs:276:4:276:26 | "pki/crl/{0}{1}{2}.crl" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:276:4:276:26 | "pki/crl/{0}{1}{2}.crl" | pki/crl/{0}{1}{2}.crl |
+| test.cs:276:29:276:65 | "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:276:29:276:65 | "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj" | rq3gsalt6u1iyfzop572d49bnx8cvmkewhj |
+| test.cs:277:4:277:73 | "Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:277:4:277:73 | "Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true" | Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true |
+| test.cs:278:4:278:40 | "Select * From Win32_OperatingSystem" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:278:4:278:40 | "Select * From Win32_OperatingSystem" | Select * From Win32_OperatingSystem |
+| test.cs:278:43:278:71 | "Select * From Win32_Process" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:278:43:278:71 | "Select * From Win32_Process" | Select * From Win32_Process |
+| test.cs:279:4:279:37 | "Select * From Win32_SystemDriver" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:279:4:279:37 | "Select * From Win32_SystemDriver" | Select * From Win32_SystemDriver |
+| test.cs:279:40:279:72 | "Select * From Win32_UserAccount" | The literal $@ may be related to the Solorigate campaign. Total count = 138 is above the threshold 30. | test.cs:279:40:279:72 | "Select * From Win32_UserAccount" | Select * From Win32_UserAccount |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref
new file mode 100644
index 00000000000..e3c8a3b7f87
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.expected
new file mode 100644
index 00000000000..625fe686581
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.expected	
@@ -0,0 +1,104 @@
+| test.cs:66:7:66:11 | Abort | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:66:7:66:11 | Abort | Abort |
+| test.cs:67:7:67:28 | AddFileExecutionEngine | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:67:7:67:28 | AddFileExecutionEngine | AddFileExecutionEngine |
+| test.cs:68:7:68:32 | AddRegistryExecutionEngine | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:68:7:68:32 | AddRegistryExecutionEngine | AddRegistryExecutionEngine |
+| test.cs:69:7:69:27 | AdjustTokenPrivileges | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:69:7:69:27 | AdjustTokenPrivileges | AdjustTokenPrivileges |
+| test.cs:70:7:70:18 | Base64Decode | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:70:7:70:18 | Base64Decode | Base64Decode |
+| test.cs:71:7:71:18 | Base64Encode | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:71:7:71:18 | Base64Encode | Base64Encode |
+| test.cs:72:7:72:26 | ByteArrayToHexString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:72:7:72:26 | ByteArrayToHexString | ByteArrayToHexString |
+| test.cs:73:7:73:27 | CheckServerConnection | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:73:7:73:27 | CheckServerConnection | CheckServerConnection |
+| test.cs:74:7:74:11 | Close | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:74:7:74:11 | Close | Close |
+| test.cs:75:7:75:17 | CloseHandle | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:75:7:75:17 | CloseHandle | CloseHandle |
+| test.cs:76:7:76:30 | CollectSystemDescription | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:76:7:76:30 | CollectSystemDescription | CollectSystemDescription |
+| test.cs:77:7:77:14 | Compress | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:77:7:77:14 | Compress | Compress |
+| test.cs:78:7:78:24 | CreateSecureString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:78:7:78:24 | CreateSecureString | CreateSecureString |
+| test.cs:79:7:79:18 | CreateString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:79:7:79:18 | CreateString | CreateString |
+| test.cs:80:7:80:25 | CreateUploadRequest | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:80:7:80:25 | CreateUploadRequest | CreateUploadRequest |
+| test.cs:81:7:81:29 | CreateUploadRequestImpl | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:81:7:81:29 | CreateUploadRequestImpl | CreateUploadRequestImpl |
+| test.cs:82:7:82:16 | Decompress | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:82:7:82:16 | Decompress | Decompress |
+| test.cs:83:7:83:18 | DecryptShort | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:83:7:83:18 | DecryptShort | DecryptShort |
+| test.cs:84:7:84:13 | Deflate | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:84:7:84:13 | Deflate | Deflate |
+| test.cs:85:7:85:14 | DelayMin | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:85:7:85:14 | DelayMin | DelayMin |
+| test.cs:86:7:86:13 | DelayMs | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:86:7:86:13 | DelayMs | DelayMs |
+| test.cs:87:7:87:16 | DeleteFile | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:87:7:87:16 | DeleteFile | DeleteFile |
+| test.cs:88:7:88:25 | DeleteRegistryValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:88:7:88:25 | DeleteRegistryValue | DeleteRegistryValue |
+| test.cs:89:7:89:17 | DeleteValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:89:7:89:17 | DeleteValue | DeleteValue |
+| test.cs:90:7:90:19 | ExecuteEngine | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:90:7:90:19 | ExecuteEngine | ExecuteEngine |
+| test.cs:91:7:91:16 | FileExists | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:91:7:91:16 | FileExists | FileExists |
+| test.cs:92:7:92:18 | GetAddresses | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:92:7:92:18 | GetAddresses | GetAddresses |
+| test.cs:93:7:93:22 | GetAddressFamily | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:93:7:93:22 | GetAddressFamily | GetAddressFamily |
+| test.cs:94:7:94:22 | GetArgumentIndex | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:94:7:94:22 | GetArgumentIndex | GetArgumentIndex |
+| test.cs:95:7:95:16 | GetBaseUri | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:95:7:95:16 | GetBaseUri | GetBaseUri |
+| test.cs:96:7:96:20 | GetBaseUriImpl | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:96:7:96:20 | GetBaseUriImpl | GetBaseUriImpl |
+| test.cs:97:7:97:14 | GetCache | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:97:7:97:14 | GetCache | GetCache |
+| test.cs:98:7:98:23 | GetCurrentProcess | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:98:7:98:23 | GetCurrentProcess | GetCurrentProcess |
+| test.cs:99:7:99:22 | GetCurrentString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:99:7:99:22 | GetCurrentString | GetCurrentString |
+| test.cs:100:7:100:22 | GetDescriptionId | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:100:7:100:22 | GetDescriptionId | GetDescriptionId |
+| test.cs:101:7:101:17 | GetFileHash | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:101:7:101:17 | GetFileHash | GetFileHash |
+| test.cs:102:7:102:26 | GetFileSystemEntries | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:102:7:102:26 | GetFileSystemEntries | GetFileSystemEntries |
+| test.cs:103:7:103:13 | GetHash | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:103:7:103:13 | GetHash | GetHash |
+| test.cs:104:7:104:13 | GetHive | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:104:7:104:13 | GetHive | GetHive |
+| test.cs:105:7:105:17 | GetIntArray | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:105:7:105:17 | GetIntArray | GetIntArray |
+| test.cs:106:7:106:20 | GetIPHostEntry | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:106:7:106:20 | GetIPHostEntry | GetIPHostEntry |
+| test.cs:107:7:107:33 | GetManagementObjectProperty | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:107:7:107:33 | GetManagementObjectProperty | GetManagementObjectProperty |
+| test.cs:108:7:108:36 | GetNetworkAdapterConfiguration | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:108:7:108:36 | GetNetworkAdapterConfiguration | GetNetworkAdapterConfiguration |
+| test.cs:109:7:109:21 | GetNewOwnerName | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:109:7:109:21 | GetNewOwnerName | GetNewOwnerName |
+| test.cs:110:7:110:19 | GetNextString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:110:7:110:19 | GetNextString | GetNextString |
+| test.cs:111:7:111:21 | GetNextStringEx | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:111:7:111:21 | GetNextStringEx | GetNextStringEx |
+| test.cs:112:7:112:23 | GetOrCreateUserID | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:112:7:112:23 | GetOrCreateUserID | GetOrCreateUserID |
+| test.cs:113:7:113:35 | GetOrionImprovementCustomerId | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:113:7:113:35 | GetOrionImprovementCustomerId | GetOrionImprovementCustomerId |
+| test.cs:114:7:114:18 | GetOSVersion | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:114:7:114:18 | GetOSVersion | GetOSVersion |
+| test.cs:115:7:115:23 | GetPreviousString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:115:7:115:23 | GetPreviousString | GetPreviousString |
+| test.cs:116:7:116:29 | GetProcessByDescription | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:116:7:116:29 | GetProcessByDescription | GetProcessByDescription |
+| test.cs:117:7:117:36 | GetRegistrySubKeyAndValueNames | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:117:7:117:36 | GetRegistrySubKeyAndValueNames | GetRegistrySubKeyAndValueNames |
+| test.cs:118:7:118:15 | GetStatus | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:118:7:118:15 | GetStatus | GetStatus |
+| test.cs:119:7:119:19 | GetStringHash | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:119:7:119:19 | GetStringHash | GetStringHash |
+| test.cs:120:7:120:28 | GetSubKeyAndValueNames | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:120:7:120:28 | GetSubKeyAndValueNames | GetSubKeyAndValueNames |
+| test.cs:121:7:121:18 | GetUserAgent | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:121:7:121:18 | GetUserAgent | GetUserAgent |
+| test.cs:122:7:122:14 | GetValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:122:7:122:14 | GetValue | GetValue |
+| test.cs:123:7:123:17 | GetWebProxy | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:123:7:123:17 | GetWebProxy | GetWebProxy |
+| test.cs:124:7:124:26 | HexStringToByteArray | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:124:7:124:26 | HexStringToByteArray | HexStringToByteArray |
+| test.cs:125:7:125:13 | Inflate | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:125:7:125:13 | Inflate | Inflate |
+| test.cs:126:7:126:16 | Initialize | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:126:7:126:16 | Initialize | Initialize |
+| test.cs:127:7:127:31 | InitiateSystemShutdownExW | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:127:7:127:31 | InitiateSystemShutdownExW | InitiateSystemShutdownExW |
+| test.cs:128:7:128:25 | IsNullOrInvalidName | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:128:7:128:25 | IsNullOrInvalidName | IsNullOrInvalidName |
+| test.cs:129:7:129:20 | IsSynchronized | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:129:7:129:20 | IsSynchronized | IsSynchronized |
+| test.cs:130:7:130:14 | KillTask | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:130:7:130:14 | KillTask | KillTask |
+| test.cs:131:7:131:27 | LookupPrivilegeValueW | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:131:7:131:27 | LookupPrivilegeValueW | LookupPrivilegeValueW |
+| test.cs:132:7:132:22 | OpenProcessToken | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:132:7:132:22 | OpenProcessToken | OpenProcessToken |
+| test.cs:133:7:133:26 | ParseServiceResponse | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:133:7:133:26 | ParseServiceResponse | ParseServiceResponse |
+| test.cs:134:7:134:11 | Quote | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:134:7:134:11 | Quote | Quote |
+| test.cs:135:7:135:16 | ReadConfig | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:135:7:135:16 | ReadConfig | ReadConfig |
+| test.cs:136:7:136:20 | ReadDeviceInfo | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:136:7:136:20 | ReadDeviceInfo | ReadDeviceInfo |
+| test.cs:137:7:137:23 | ReadRegistryValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:137:7:137:23 | ReadRegistryValue | ReadRegistryValue |
+| test.cs:138:7:138:22 | ReadReportStatus | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:138:7:138:22 | ReadReportStatus | ReadReportStatus |
+| test.cs:139:7:139:23 | ReadServiceStatus | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:139:7:139:23 | ReadServiceStatus | ReadServiceStatus |
+| test.cs:140:7:140:20 | RebootComputer | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:140:7:140:20 | RebootComputer | RebootComputer |
+| test.cs:141:7:141:13 | RunTask | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:141:7:141:13 | RunTask | RunTask |
+| test.cs:142:7:142:22 | SearchAssemblies | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:142:7:142:22 | SearchAssemblies | SearchAssemblies |
+| test.cs:143:7:143:26 | SearchConfigurations | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:143:7:143:26 | SearchConfigurations | SearchConfigurations |
+| test.cs:144:7:144:20 | SearchServices | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:144:7:144:20 | SearchServices | SearchServices |
+| test.cs:145:7:145:22 | SetAutomaticMode | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:145:7:145:22 | SetAutomaticMode | SetAutomaticMode |
+| test.cs:146:7:146:17 | SetKeyOwner | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:146:7:146:17 | SetKeyOwner | SetKeyOwner |
+| test.cs:147:7:147:31 | SetKeyOwnerWithPrivileges | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:147:7:147:31 | SetKeyOwnerWithPrivileges | SetKeyOwnerWithPrivileges |
+| test.cs:148:7:148:23 | SetKeyPermissions | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:148:7:148:23 | SetKeyPermissions | SetKeyPermissions |
+| test.cs:149:7:149:19 | SetManualMode | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:149:7:149:19 | SetManualMode | SetManualMode |
+| test.cs:150:7:150:25 | SetProcessPrivilege | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:150:7:150:25 | SetProcessPrivilege | SetProcessPrivilege |
+| test.cs:151:7:151:22 | SetRegistryValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:151:7:151:22 | SetRegistryValue | SetRegistryValue |
+| test.cs:152:7:152:13 | SetTime | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:152:7:152:13 | SetTime | SetTime |
+| test.cs:153:7:153:14 | SetValue | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:153:7:153:14 | SetValue | SetValue |
+| test.cs:154:7:154:17 | SplitString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:154:7:154:17 | SplitString | SplitString |
+| test.cs:155:7:155:14 | ToString | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:155:7:155:14 | ToString | ToString |
+| test.cs:156:7:156:16 | TrackEvent | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:156:7:156:16 | TrackEvent | TrackEvent |
+| test.cs:157:7:157:20 | TrackProcesses | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:157:7:157:20 | TrackProcesses | TrackProcesses |
+| test.cs:158:7:158:13 | Unquote | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:158:7:158:13 | Unquote | Unquote |
+| test.cs:159:7:159:11 | Unzip | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:159:7:159:11 | Unzip | Unzip |
+| test.cs:160:7:160:12 | Update | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:160:7:160:12 | Update | Update |
+| test.cs:161:7:161:18 | UpdateBuffer | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:161:7:161:18 | UpdateBuffer | UpdateBuffer |
+| test.cs:162:7:162:24 | UpdateNotification | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:162:7:162:24 | UpdateNotification | UpdateNotification |
+| test.cs:163:7:163:29 | UploadSystemDescription | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:163:7:163:29 | UploadSystemDescription | UploadSystemDescription |
+| test.cs:164:7:164:11 | Valid | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:164:7:164:11 | Valid | Valid |
+| test.cs:165:7:165:17 | WriteConfig | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:165:7:165:17 | WriteConfig | WriteConfig |
+| test.cs:166:7:166:15 | WriteFile | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:166:7:166:15 | WriteFile | WriteFile |
+| test.cs:167:7:167:23 | WriteReportStatus | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:167:7:167:23 | WriteReportStatus | WriteReportStatus |
+| test.cs:168:7:168:24 | WriteServiceStatus | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:168:7:168:24 | WriteServiceStatus | WriteServiceStatus |
+| test.cs:169:7:169:9 | Zip | The method $@ may be related to Solorigate. Total count = 104 is above the threshold 50. | test.cs:169:7:169:9 | Zip | Zip |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref
new file mode 100644
index 00000000000..7483e8f5902
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/NumberOfKnownMethodNamesAboveThreshold.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.expected b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.expected
new file mode 100644
index 00000000000..9125049047e
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.expected	
@@ -0,0 +1,3 @@
+| test.cs:35:3:38:3 | catch {...} | Empty Swallow Everything Exception. |
+| test.cs:289:3:290:4 | catch {...} | Empty Swallow Everything Exception. |
+| test.cs:295:3:298:3 | catch (...) {...} | Empty Swallow Everything Exception. |
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qlref b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qlref
new file mode 100644
index 00000000000..783fb3f06a0
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/campaign/Solorigate/SwallowEverythingExceptionHandler.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/campaign/Solorigate/test.cs b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/test.cs
new file mode 100644
index 00000000000..1ee9403a5f1
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/campaign/Solorigate/test.cs	
@@ -0,0 +1,309 @@
+using System;
+using System.Text;
+
+
+class FalsePositiveCases
+{
+	// regular FVN
+	ulong GetRegularFvnHash(string s)
+	{
+		ulong num = 14695981039346656037UL; /* FNV base offset */
+
+		foreach (byte b in Encoding.UTF8.GetBytes(s))
+		{
+			num ^= (ulong)b;
+			num *= 1099511628211UL; /* FNV prime */
+		}
+
+		return num;
+	}
+}
+
+class TestCases
+{
+	ulong GetRegularFvnHash(string s)
+	{
+		ulong num = 14695981039346656037UL;
+		try
+		{
+			foreach (byte b in Encoding.UTF8.GetBytes(s))
+			{
+				num ^= (ulong)b;
+				num *= 1099511628211UL;
+			}
+		}
+		catch // BUG : SwallowEverythingExceptionHandler
+		{
+
+		}
+
+		return num ^ 6605813339339102567UL; // BUG (ModifiedFnvFunctionDetection.ql)
+	}
+
+	enum JobEngine
+	{
+		Idle,
+		Exit,
+		SetTime,
+		CollectSystemDescription,
+		UploadSystemDescription,
+		RunTask,
+		GetProcessByDescription,
+		KillTask,
+		GetFileSystemEntries,
+		WriteFile,
+		FileExists,
+		DeleteFile,
+		GetFileHash,
+		ReadRegistryValue,
+		SetRegistryValue,
+		DeleteRegistryValue,
+		GetRegistrySubKeyAndValueNames,
+		Reboot,
+		None
+	}
+
+	void Abort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void AddFileExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void AddRegistryExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void AdjustTokenPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Base64Decode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Base64Encode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ByteArrayToHexString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CheckServerConnection() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Close() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CloseHandle() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CollectSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Compress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CreateSecureString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CreateString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CreateUploadRequest() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void CreateUploadRequestImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Decompress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DecryptShort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Deflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DelayMin() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DelayMs() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DeleteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DeleteRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void DeleteValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ExecuteEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void FileExists() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetAddresses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetAddressFamily() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetArgumentIndex() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetBaseUri() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetBaseUriImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetCache() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetCurrentProcess() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetCurrentString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetDescriptionId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetFileHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetFileSystemEntries() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetHive() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetIntArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetIPHostEntry() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetManagementObjectProperty() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetNetworkAdapterConfiguration() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetNewOwnerName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetNextString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetNextStringEx() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetOrCreateUserID() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetOrionImprovementCustomerId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetOSVersion() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetPreviousString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetProcessByDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetRegistrySubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetStringHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetSubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetUserAgent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void GetWebProxy() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void HexStringToByteArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Inflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Initialize() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void InitiateSystemShutdownExW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void IsNullOrInvalidName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void IsSynchronized() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void KillTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void LookupPrivilegeValueW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void OpenProcessToken() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ParseServiceResponse() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Quote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ReadConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ReadDeviceInfo() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ReadRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ReadReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ReadServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void RebootComputer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void RunTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SearchAssemblies() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SearchConfigurations() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SearchServices() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetAutomaticMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetKeyOwner() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetKeyOwnerWithPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetKeyPermissions() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetManualMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetProcessPrivilege() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetTime() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void SplitString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void ToString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void TrackEvent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void TrackProcesses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Unquote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Unzip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Update() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void UpdateBuffer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void UpdateNotification() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void UploadSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Valid() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void WriteConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void WriteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void WriteReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void WriteServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+	void Zip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
+
+	void Hashes() {
+		ulong[] hashes = { // BUG : NumberOfKnownHashesAboveThreshold
+		  10063651499895178962, 10235971842993272939, 10296494671777307979,
+		  10336842116636872171, 10374841591685794123, 10393903804869831898,
+		  10463926208560207521, 10484659978517092504, 10501212300031893463,
+		  10545868833523019926, 10657751674541025650, 106672141413120087, 10734127004244879770,
+		  10829648878147112121, 1099511628211, 11073283311104541690, 1109067043404435916,
+		  11109294216876344399, 11266044540366291518, 11385275378891906608,
+		  11771945869106552231, 11801746708619571308, 11818825521849580123,
+		  11913842725949116895, 12027963942392743532, 12094027092655598256,
+		  12343334044036541897, 12445177985737237804, 12445232961318634374,
+		  12574535824074203265, 12679195163651834776, 12709986806548166638,
+		  12718416789200275332, 12785322942775634499, 12790084614253405985,
+		  12969190449276002545, 13014156621614176974, 13029357933491444455,
+		  13135068273077306806, 13260224381505715848, 13316211011159594063,
+		  13464308873961738403, 13544031715334011032, 13581776705111912829,
+		  13599785766252827703, 13611051401579634621, 13611814135072561278,
+		  13655261125244647696, 1367627386496056834, 1368907909245890092, 13693525876560827283,
+		  13783346438774742614, 13799353263187722717, 13825071784440082496,
+		  13852439084267373191, 13876356431472225791, 14055243717250701608,
+		  14079676299181301772, 14095938998438966337, 14111374107076822891,
+		  14193859431895170587, 14226582801651130532, 14243671177281069512,
+		  14256853800858727521, 14480775929210717493, 14482658293117931546,
+		  14513577387099045298, 14630721578341374856, 14695981039346656037,
+		  14710585101020280896, 1475579823244607677, 14868920869169964081, 14968320160131875803,
+		  14971809093655817917, 15039834196857999838, 15092207615430402812,
+		  15114163911481793350, 15194901817027173566, 15267980678929160412,
+		  15457732070353984570, 15514036435533858158, 15535773470978271326,
+		  15587050164583443069, 155978580751494388, 15695338751700748390, 15997665423159927228,
+		  16066522799090129502, 16066651430762394116, 16112751343173365533,
+		  16130138450758310172, 1614465773938842903, 16292685861617888592, 16335643316870329598,
+		  16423314183614230717, 16570804352575357627, 1682585410644922036, 16858955978146406642,
+		  16990567851129491937, 17017923349298346219, 17097380490166623672,
+		  17109238199226571972, 17204844226884380288, 17291806236368054941,
+		  17351543633914244545, 17439059603042731363, 17574002783607647274,
+		  17624147599670377042, 17633734304611248415, 17683972236092287897,
+		  17849680105131524334, 17939405613729073960, 17956969551821596225,
+		  17978774977754553159, 17984632978012874803, 17997967489723066537,
+		  18147627057830191163, 18150909006539876521, 18159703063075866524,
+		  18246404330670877335, 18294908219222222902, 18392881921099771407,
+		  18446744073709551613, 191060519014405309, 2032008861530788751, 2128122064571842954,
+		  2147483647, 2147745794, 2380224015317016190, 2478231962306073784,
+		  2532538262737333146, 2589926981877829912, 2597124982561782591, 2600364143812063535,
+		  2717025511528702475, 2734787258623754862, 27407921587843457, 2760663353550280147,
+		  2797129108883749491, 2810460305047003196, 292198192373389586, 2934149816356927366,
+		  3045986759481489935, 3178468437029279937, 3200333496547938354, 3320026265773918739,
+		  3320767229281015341, 3341747963119755850, 3407972863931386250, 3413052607651207697,
+		  3413886037471417852, 3421197789791424393, 3421213182954201407, 3425260965299690882,
+		  3538022140597504361, 3575761800716667678, 3588624367609827560, 3626142665768487764,
+		  3642525650883269872, 3656637464651387014, 3660705254426876796, 3769837838875367802,
+		  3778500091710709090, 3796405623695665524, 3869935012404164040, 3890769468012566366,
+		  3890794756780010537, 397780960855462669, 4030236413975199654, 4088976323439621041,
+		  4454255944391929578, 4501656691368064027, 4578480846255629462, 4821863173800309721,
+		  4931721628717906635, 506634811745884560, 5132256620104998637, 5183687599225757871,
+		  521157249538507889, 5219431737322569038, 541172992193764396, 5415426428750045503,
+		  5449730069165757263, 5587557070429522647, 5614586596107908838, 576626207276463000,
+		  5942282052525294911, 5945487981219695001, 5984963105389676759, 607197993339007484,
+		  6088115528707848728, 6116246686670134098, 6180361713414290679, 6195833633417633900,
+		  6274014997237900919, 640589622539783622, 6461429591783621719, 6491986958834001955,
+		  6508141243778577344, 6605813339339102567, 682250828679635420, 6827032273910657891,
+		  6943102301517884811, 700598796416086955, 7080175711202577138, 7175363135479931834,
+		  7315838824213522000, 7412338704062093516, 7516148236133302073, 7574774749059321801,
+		  7701683279824397773, 7775177810774851294, 7810436520414958497, 7878537243757499832,
+		  79089792725215063, 7982848972385914508, 8052533790968282297, 8129411991672431889,
+		  8146185202538899243, 835151375515278827, 8381292265993977266, 8408095252303317471,
+		  8473756179280619170, 8478833628889826985, 8612208440357175863, 8697424601205169055,
+		  8698326794961817906, 8709004393777297355, 8727477769544302060, 8760312338504300643,
+		  8799118153397725683, 8873858923435176895, 8994091295115840290, 9007106680104765185,
+		  9061219083560670602, 9149947745824492274, 917638920165491138, 9234894663364701749,
+		  9333057603143916814, 9384605490088500348, 9531326785919727076, 9555688264681862794,
+		  9559632696372799208, 9903758755917170407
+		};
+	}
+
+	void Literals() {
+		string[] literals = { // BUG : NumberOfKnownLiteralsAboveThreshold
+			"(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n",
+			"[{0,5}] {1}\n", "[E] {0} {1} {2}",
+			"\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion",
+			"\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",",
+			"\\OrionImprovement\\SolarWinds.OrionImprovement.exe",
+			"0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[",
+			"\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",",
+			"{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0",
+			"184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0",
+			"224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382",
+			"41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e",
+			"65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040",
+			"99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com",
+			"api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp",
+			"-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer",
+			"DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet",
+			"DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser",
+			"fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD",
+			"HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA",
+			"HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography",
+			"HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match",
+			"Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans",
+			"Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone",
+			"ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege",
+			"SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/",
+			"SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events",
+			"swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1",
+			"us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2",
+			"fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c",
+			"pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj",
+			"Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true",
+			"Select * From Win32_OperatingSystem", "Select * From Win32_Process",
+			"Select * From Win32_SystemDriver", "Select * From Win32_UserAccount"
+		};
+				
+	}
+
+	void SwallowExceptionTest()
+	{
+		try{
+			Literals();
+		}
+		catch // BUG : SwallowEverythingExceptionHandler
+		{}
+
+		try{
+			Literals();
+		}
+		catch( Exception e) // BUG : SwallowEverythingExceptionHandler
+		{
+			// 
+		}
+
+		try{
+			Literals();
+		}
+		catch( Exception e)
+		{
+			// NOT A BUG
+			throw;
+		}
+	}
+}
diff --git a/csharp/ql/test/library-tests/csharp9/ForeachExtension.cs b/csharp/ql/test/library-tests/csharp9/ForeachExtension.cs
new file mode 100644
index 00000000000..6e2af21e323
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/ForeachExtension.cs
@@ -0,0 +1,48 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+static class Extensions
+{
+    public static IEnumerator<T> GetEnumerator<T>(this IEnumerator<T> enumerator) => enumerator;
+    public static IAsyncEnumerator<T> GetAsyncEnumerator<T>(this IAsyncEnumerator<T> enumerator) => enumerator;
+    public static IEnumerator<int> GetEnumerator(this int count)
+    {
+        for (int i = 0; i < count; i++)
+        {
+            yield return i;
+        }
+    }
+}
+
+class Program
+{
+    async Task Main()
+    {
+        IEnumerator<int> enumerator1 = Enumerable.Range(0, 10).GetEnumerator();
+        foreach (var item in enumerator1)
+        {
+        }
+
+        IAsyncEnumerator<int> enumerator2 = GetAsyncEnumerator();
+        await foreach (var item in enumerator2)
+        {
+        }
+
+        foreach (var item in 42)
+        {
+        }
+
+        foreach (var i in new int[] { 1, 2, 3 }) // not extension
+        {
+        }
+    }
+
+    static async IAsyncEnumerator<int> GetAsyncEnumerator()
+    {
+        yield return 0;
+        await Task.Delay(1);
+        yield return 1;
+    }
+}
diff --git a/csharp/ql/test/library-tests/csharp9/GlobalStmt.cs b/csharp/ql/test/library-tests/csharp9/GlobalStmt.cs
new file mode 100644
index 00000000000..6b8958d7fbd
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/GlobalStmt.cs
@@ -0,0 +1,25 @@
+/*
+  Global statements are not allowed in 'library' target.
+
+  semmle-extractor-options: --standalone
+*/
+
+using System;
+
+[assembly: Attr] // not a global stmt
+
+Console.WriteLine("1");
+Console.WriteLine("2");
+M();
+
+void M()
+{
+}
+
+public class Attr : Attribute
+{
+  void M1()
+  {
+    Console.WriteLine("3");
+  }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/csharp9/LocalFunctions.expected b/csharp/ql/test/library-tests/csharp9/LocalFunctions.expected
index fd746b2a58b..c57ece05e59 100644
--- a/csharp/ql/test/library-tests/csharp9/LocalFunctions.expected
+++ b/csharp/ql/test/library-tests/csharp9/LocalFunctions.expected
@@ -1,6 +1,7 @@
 noBody
 | LocalFunction.cs:16:9:16:41 | localExtern |
 localFunctionModifier
+| GlobalStmt.cs:15:1:17:1 | M | private |
 | LambdaModifier.cs:8:9:8:36 | m | private |
 | LocalFunction.cs:9:9:12:9 | mul | async |
 | LocalFunction.cs:9:9:12:9 | mul | private |
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index ea3540ce4ce..56299fbdc68 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -166,6 +166,109 @@ Discard.cs:
 #   10|             4: [BlockStmt] {...}
 #   10|               0: [ReturnStmt] return ...;
 #   10|                 0: [IntLiteral] 0
+ForeachExtension.cs:
+#    6| [Class] Extensions
+#    8|   4: [ExtensionMethod] GetEnumerator
+#    8|     -1: [TypeMention] IEnumerator<T>
+#    8|       1: [TypeMention] T
+#-----|     1: (Type parameters)
+#    8|       0: [TypeParameter] T
+#-----|     2: (Parameters)
+#    8|       0: [Parameter] enumerator
+#    8|         -1: [TypeMention] IEnumerator<T>
+#    8|           1: [TypeMention] T
+#    8|     4: [ParameterAccess] access to parameter enumerator
+#    9|   6: [ExtensionMethod] GetAsyncEnumerator
+#    9|     -1: [TypeMention] IAsyncEnumerator<T>
+#    9|       1: [TypeMention] T
+#-----|     1: (Type parameters)
+#    9|       0: [TypeParameter] T
+#-----|     2: (Parameters)
+#    9|       0: [Parameter] enumerator
+#    9|         -1: [TypeMention] IAsyncEnumerator<T>
+#    9|           1: [TypeMention] T
+#    9|     4: [ParameterAccess] access to parameter enumerator
+#   10|   8: [ExtensionMethod] GetEnumerator
+#   10|     -1: [TypeMention] IEnumerator<Int32>
+#   10|       1: [TypeMention] int
+#-----|     2: (Parameters)
+#   10|       0: [Parameter] count
+#   10|         -1: [TypeMention] int
+#   11|     4: [BlockStmt] {...}
+#   12|       0: [ForStmt] for (...;...;...) ...
+#   12|         -1: [LocalVariableDeclAndInitExpr] Int32 i = ...
+#   12|           -1: [TypeMention] int
+#   12|           0: [LocalVariableAccess] access to local variable i
+#   12|           1: [IntLiteral] 0
+#   12|         0: [LTExpr] ... < ...
+#   12|           0: [LocalVariableAccess] access to local variable i
+#   12|           1: [ParameterAccess] access to parameter count
+#   12|         1: [PostIncrExpr] ...++
+#   12|           0: [LocalVariableAccess] access to local variable i
+#   13|         2: [BlockStmt] {...}
+#   14|           0: [YieldReturnStmt] yield return ...;
+#   14|             0: [LocalVariableAccess] access to local variable i
+#   19| [Class] Program
+#   21|   5: [Method] Main
+#   21|     -1: [TypeMention] Task
+#   22|     4: [BlockStmt] {...}
+#   23|       0: [LocalVariableDeclStmt] ... ...;
+#   23|         0: [LocalVariableDeclAndInitExpr] IEnumerator<Int32> enumerator1 = ...
+#   23|           -1: [TypeMention] IEnumerator<Int32>
+#   23|             1: [TypeMention] int
+#   23|           0: [LocalVariableAccess] access to local variable enumerator1
+#   23|           1: [MethodCall] call to method GetEnumerator
+#   23|             -1: [MethodCall] call to method Range
+#   23|               -1: [TypeAccess] access to type Enumerable
+#   23|                 0: [TypeMention] Enumerable
+#   23|               0: [IntLiteral] 0
+#   23|               1: [IntLiteral] 10
+#   24|       1: [ForeachStmt] foreach (... ... in ...) ...
+#   24|         0: [LocalVariableDeclExpr] Int32 item
+#   24|           0: [TypeMention] int
+#   24|         1: [LocalVariableAccess] access to local variable enumerator1
+#   25|         2: [BlockStmt] {...}
+#   28|       2: [LocalVariableDeclStmt] ... ...;
+#   28|         0: [LocalVariableDeclAndInitExpr] IAsyncEnumerator<Int32> enumerator2 = ...
+#   28|           -1: [TypeMention] IAsyncEnumerator<Int32>
+#   28|             1: [TypeMention] int
+#   28|           0: [LocalVariableAccess] access to local variable enumerator2
+#   28|           1: [MethodCall] call to method GetAsyncEnumerator
+#   29|       3: [ForeachStmt] foreach (... ... in ...) ...
+#   29|         0: [LocalVariableDeclExpr] Int32 item
+#   29|           0: [TypeMention] int
+#   29|         1: [LocalVariableAccess] access to local variable enumerator2
+#   30|         2: [BlockStmt] {...}
+#   33|       4: [ForeachStmt] foreach (... ... in ...) ...
+#   33|         0: [LocalVariableDeclExpr] Int32 item
+#   33|           0: [TypeMention] int
+#   33|         1: [IntLiteral] 42
+#   34|         2: [BlockStmt] {...}
+#   37|       5: [ForeachStmt] foreach (... ... in ...) ...
+#   37|         0: [LocalVariableDeclExpr] Int32 i
+#   37|           0: [TypeMention] int
+#   37|         1: [ArrayCreation] array creation of type Int32[]
+#   37|           -2: [TypeMention] Int32[]
+#   37|             1: [TypeMention] int
+#   37|           -1: [ArrayInitializer] { ..., ... }
+#   37|             0: [IntLiteral] 1
+#   37|             1: [IntLiteral] 2
+#   37|             2: [IntLiteral] 3
+#   38|         2: [BlockStmt] {...}
+#   42|   6: [Method] GetAsyncEnumerator
+#   42|     -1: [TypeMention] IAsyncEnumerator<Int32>
+#   42|       1: [TypeMention] int
+#   43|     4: [BlockStmt] {...}
+#   44|       0: [YieldReturnStmt] yield return ...;
+#   44|         0: [IntLiteral] 0
+#   45|       1: [ExprStmt] ...;
+#   45|         0: [AwaitExpr] await ...
+#   45|           0: [MethodCall] call to method Delay
+#   45|             -1: [TypeAccess] access to type Task
+#   45|               0: [TypeMention] Task
+#   45|             0: [IntLiteral] 1
+#   46|       2: [YieldReturnStmt] yield return ...;
+#   46|         0: [IntLiteral] 1
 FunctionPointer.cs:
 #    5| [Class] FnPointer
 #    7|   5: [Class] Program
@@ -286,6 +389,39 @@ FunctionPointer.cs:
 #   50|     14: [Class] B
 #-----|       3: (Base types)
 #   50|         0: [TypeMention] A
+GlobalStmt.cs:
+#    7| [Class] <Program>$
+#    7|   4: [Method] <Main>$
+#-----|     2: (Parameters)
+#    1|       0: [Parameter] args
+#    7|     4: [BlockStmt] {...}
+#   11|       0: [ExprStmt] ...;
+#   11|         0: [MethodCall] call to method WriteLine
+#   11|           -1: [TypeAccess] access to type Console
+#   11|             0: [TypeMention] Console
+#   11|           0: [StringLiteral] "1"
+#   12|       1: [ExprStmt] ...;
+#   12|         0: [MethodCall] call to method WriteLine
+#   12|           -1: [TypeAccess] access to type Console
+#   12|             0: [TypeMention] Console
+#   12|           0: [StringLiteral] "2"
+#   13|       2: [ExprStmt] ...;
+#   13|         0: [LocalFunctionCall] call to local function M
+#   13|           -1: [LocalFunctionAccess] access to local function M
+#   15|       3: [LocalFunctionStmt] M(...)
+#   15|         0: [LocalFunction] M
+#   16|           4: [BlockStmt] {...}
+#   19| [Class] Attr
+#-----|   3: (Base types)
+#   19|     0: [TypeMention] Attribute
+#   21|   5: [Method] M1
+#   21|     -1: [TypeMention] Void
+#   22|     4: [BlockStmt] {...}
+#   23|       0: [ExprStmt] ...;
+#   23|         0: [MethodCall] call to method WriteLine
+#   23|           -1: [TypeAccess] access to type Console
+#   23|             0: [TypeMention] Console
+#   23|           0: [StringLiteral] "3"
 InitOnlyProperty.cs:
 #    3| [Class] Base
 #    5|   5: [Property] Prop0
@@ -884,61 +1020,158 @@ Record.cs:
 #   50|           0: [MethodCall] call to method ToString
 #   50|             -1: [LocalVariableAccess] access to local variable s
 #   50|           1: [StringLiteral] " is a dog"
-#   54| [Class] Record1
-#   56|   5: [Method] M1
-#   56|     -1: [TypeMention] Void
-#   57|     4: [BlockStmt] {...}
-#   58|       0: [LocalVariableDeclStmt] ... ...;
-#   58|         0: [LocalVariableDeclAndInitExpr] Person person = ...
-#   58|           -1: [TypeMention] Person
-#   58|           0: [LocalVariableAccess] access to local variable person
-#   58|           1: [ObjectCreation] object creation of type Person
-#   58|             -1: [TypeMention] Person
-#   58|             0: [StringLiteral] "Bill"
-#   58|             1: [StringLiteral] "Wagner"
-#   59|       1: [LocalVariableDeclStmt] ... ...;
-#   59|         0: [LocalVariableDeclAndInitExpr] Student student = ...
-#   59|           -1: [TypeMention] Student
-#   59|           0: [LocalVariableAccess] access to local variable student
-#   59|           1: [ObjectCreation] object creation of type Student
-#   59|             -1: [TypeMention] Student
-#   59|             0: [StringLiteral] "Bill"
-#   59|             1: [StringLiteral] "Wagner"
-#   59|             2: [IntLiteral] 11
-#   61|       2: [ExprStmt] ...;
-#   61|         0: [MethodCall] call to method WriteLine
-#   61|           -1: [TypeAccess] access to type Console
-#   61|             0: [TypeMention] Console
-#   61|           0: [OperatorCall] call to operator ==
-#   61|             0: [LocalVariableAccess] access to local variable student
-#   61|             1: [LocalVariableAccess] access to local variable person
-#   64|   6: [Method] M2
-#   64|     -1: [TypeMention] Void
-#   65|     4: [BlockStmt] {...}
-#   66|       0: [LocalVariableDeclStmt] ... ...;
-#   66|         0: [LocalVariableDeclAndInitExpr] Person1 person = ...
-#   66|           -1: [TypeMention] Person1
-#   66|           0: [LocalVariableAccess] access to local variable person
-#   66|           1: [ObjectCreation] object creation of type Person1
-#   66|             -1: [TypeMention] Person1
-#   66|             0: [StringLiteral] "Bill"
-#   66|             1: [StringLiteral] "Wagner"
-#   68|       1: [ExprStmt] ...;
-#   68|         0: [AssignExpr] ... = ...
-#   68|           0: [TupleExpr] (..., ...)
-#   68|             0: [LocalVariableDeclExpr] String first
-#   68|             1: [LocalVariableDeclExpr] String last
-#   68|           1: [LocalVariableAccess] access to local variable person
-#   69|       2: [ExprStmt] ...;
-#   69|         0: [MethodCall] call to method WriteLine
-#   69|           -1: [TypeAccess] access to type Console
-#   69|             0: [TypeMention] Console
-#   69|           0: [LocalVariableAccess] access to local variable first
-#   70|       3: [ExprStmt] ...;
-#   70|         0: [MethodCall] call to method WriteLine
-#   70|           -1: [TypeAccess] access to type Console
-#   70|             0: [TypeMention] Console
-#   70|           0: [LocalVariableAccess] access to local variable last
+#   54| [Record] R1
+#   54|   12: [NEOperator] !=
+#-----|     2: (Parameters)
+#   54|       0: [Parameter] r1
+#   54|       1: [Parameter] r2
+#   54|   13: [EQOperator] ==
+#-----|     2: (Parameters)
+#   54|       0: [Parameter] r1
+#   54|       1: [Parameter] r2
+#   54|   14: [Property] EqualityContract
+#   54|     3: [Getter] get_EqualityContract
+#   54|   15: [InstanceConstructor] R1
+#-----|     2: (Parameters)
+#   54|       0: [Parameter] A
+#   54|         -1: [TypeMention] string
+#   54|   16: [Property] A
+#   54|     3: [Getter] get_A
+#   54|     4: [Setter] set_A
+#-----|       2: (Parameters)
+#   54|         0: [Parameter] value
+#   56| [Record] R2
+#   56|   13: [NEOperator] !=
+#-----|     2: (Parameters)
+#   56|       0: [Parameter] r1
+#   56|       1: [Parameter] r2
+#   56|   14: [EQOperator] ==
+#-----|     2: (Parameters)
+#   56|       0: [Parameter] r1
+#   56|       1: [Parameter] r2
+#   56|   15: [Property] EqualityContract
+#   56|     3: [Getter] get_EqualityContract
+#   56|   16: [InstanceConstructor] R2
+#-----|     2: (Parameters)
+#   56|       0: [Parameter] A
+#   56|         -1: [TypeMention] string
+#   56|       1: [Parameter] B
+#   56|         -1: [TypeMention] string
+#   56|   17: [Property] B
+#   56|     3: [Getter] get_B
+#   56|     4: [Setter] set_B
+#-----|       2: (Parameters)
+#   56|         0: [Parameter] value
+#   58| [Class] Record1
+#   60|   5: [Method] M1
+#   60|     -1: [TypeMention] Void
+#   61|     4: [BlockStmt] {...}
+#   62|       0: [LocalVariableDeclStmt] ... ...;
+#   62|         0: [LocalVariableDeclAndInitExpr] Person person = ...
+#   62|           -1: [TypeMention] Person
+#   62|           0: [LocalVariableAccess] access to local variable person
+#   62|           1: [ObjectCreation] object creation of type Person
+#   62|             -1: [TypeMention] Person
+#   62|             0: [StringLiteral] "Bill"
+#   62|             1: [StringLiteral] "Wagner"
+#   63|       1: [LocalVariableDeclStmt] ... ...;
+#   63|         0: [LocalVariableDeclAndInitExpr] Student student = ...
+#   63|           -1: [TypeMention] Student
+#   63|           0: [LocalVariableAccess] access to local variable student
+#   63|           1: [ObjectCreation] object creation of type Student
+#   63|             -1: [TypeMention] Student
+#   63|             0: [StringLiteral] "Bill"
+#   63|             1: [StringLiteral] "Wagner"
+#   63|             2: [IntLiteral] 11
+#   65|       2: [ExprStmt] ...;
+#   65|         0: [MethodCall] call to method WriteLine
+#   65|           -1: [TypeAccess] access to type Console
+#   65|             0: [TypeMention] Console
+#   65|           0: [OperatorCall] call to operator ==
+#   65|             0: [LocalVariableAccess] access to local variable student
+#   65|             1: [LocalVariableAccess] access to local variable person
+#   68|   6: [Method] M2
+#   68|     -1: [TypeMention] Void
+#   69|     4: [BlockStmt] {...}
+#   70|       0: [LocalVariableDeclStmt] ... ...;
+#   70|         0: [LocalVariableDeclAndInitExpr] Person1 p1 = ...
+#   70|           -1: [TypeMention] Person1
+#   70|           0: [LocalVariableAccess] access to local variable p1
+#   70|           1: [ObjectCreation] object creation of type Teacher1
+#   70|             -1: [TypeMention] Teacher1
+#   70|             0: [StringLiteral] "Bill"
+#   70|             1: [StringLiteral] "Wagner"
+#   70|             2: [StringLiteral] "Math"
+#   72|       1: [ExprStmt] ...;
+#   72|         0: [AssignExpr] ... = ...
+#   72|           0: [TupleExpr] (..., ...)
+#   72|             0: [LocalVariableDeclExpr] String first
+#   72|             1: [LocalVariableDeclExpr] String last
+#   72|           1: [LocalVariableAccess] access to local variable p1
+#   73|       2: [ExprStmt] ...;
+#   73|         0: [MethodCall] call to method WriteLine
+#   73|           -1: [TypeAccess] access to type Console
+#   73|             0: [TypeMention] Console
+#   73|           0: [LocalVariableAccess] access to local variable first
+#   75|       3: [LocalVariableDeclStmt] ... ...;
+#   75|         0: [LocalVariableDeclAndInitExpr] Person1 p2 = ...
+#   75|           -1: [TypeMention] Person1
+#   75|           0: [LocalVariableAccess] access to local variable p2
+#   75|           1: [WithExpr] ... with { ... }
+#   75|             0: [LocalVariableAccess] access to local variable p1
+#   75|             1: [ObjectInitializer] { ..., ... }
+#   75|               0: [MemberInitializer] ... = ...
+#   75|                 0: [PropertyCall] access to property FirstName
+#   75|                 1: [StringLiteral] "Paul"
+#   76|       4: [LocalVariableDeclStmt] ... ...;
+#   76|         0: [LocalVariableDeclAndInitExpr] Teacher1 p3 = ...
+#   76|           -1: [TypeMention] Teacher1
+#   76|           0: [LocalVariableAccess] access to local variable p3
+#   76|           1: [WithExpr] ... with { ... }
+#   76|             0: [CastExpr] (...) ...
+#   76|               0: [TypeAccess] access to type Teacher1
+#   76|                 0: [TypeMention] Teacher1
+#   76|               1: [LocalVariableAccess] access to local variable p1
+#   76|             1: [ObjectInitializer] { ..., ... }
+#   76|               0: [MemberInitializer] ... = ...
+#   76|                 0: [PropertyCall] access to property FirstName
+#   76|                 1: [StringLiteral] "Paul"
+#   76|               1: [MemberInitializer] ... = ...
+#   76|                 0: [PropertyCall] access to property Subject
+#   76|                 1: [StringLiteral] "Literature"
+#   77|       5: [LocalVariableDeclStmt] ... ...;
+#   77|         0: [LocalVariableDeclAndInitExpr] Person1 clone = ...
+#   77|           -1: [TypeMention] Person1
+#   77|           0: [LocalVariableAccess] access to local variable clone
+#   77|           1: [WithExpr] ... with { ... }
+#   77|             0: [LocalVariableAccess] access to local variable p1
+#   77|             1: [ObjectInitializer] { ..., ... }
+#   80|   7: [Method] M3
+#   80|     -1: [TypeMention] Void
+#   81|     4: [BlockStmt] {...}
+#   82|       0: [LocalVariableDeclStmt] ... ...;
+#   82|         0: [LocalVariableDeclAndInitExpr] R2 a = ...
+#   82|           -1: [TypeMention] R2
+#   82|           0: [LocalVariableAccess] access to local variable a
+#   82|           1: [ObjectCreation] object creation of type R2
+#   82|             -1: [TypeMention] R2
+#   82|             0: [StringLiteral] "A"
+#   82|             1: [StringLiteral] "B"
+#   83|       1: [LocalVariableDeclStmt] ... ...;
+#   83|         0: [LocalVariableDeclAndInitExpr] R1 b = ...
+#   83|           -1: [TypeMention] R1
+#   83|           0: [LocalVariableAccess] access to local variable b
+#   83|           1: [LocalVariableAccess] access to local variable a
+#   84|       2: [LocalVariableDeclStmt] ... ...;
+#   84|         0: [LocalVariableDeclAndInitExpr] R1 c = ...
+#   84|           -1: [TypeMention] R1
+#   84|           0: [LocalVariableAccess] access to local variable c
+#   84|           1: [WithExpr] ... with { ... }
+#   84|             0: [LocalVariableAccess] access to local variable b
+#   84|             1: [ObjectInitializer] { ..., ... }
+#   84|               0: [MemberInitializer] ... = ...
+#   84|                 0: [PropertyCall] access to property A
+#   84|                 1: [StringLiteral] "C"
 RelationalPattern.cs:
 #    3| [Class] RelationalPattern
 #    5|   5: [Method] M1
diff --git a/csharp/ql/test/library-tests/csharp9/Record.cs b/csharp/ql/test/library-tests/csharp9/Record.cs
index 45d1506c055..8859cc74716 100644
--- a/csharp/ql/test/library-tests/csharp9/Record.cs
+++ b/csharp/ql/test/library-tests/csharp9/Record.cs
@@ -51,6 +51,10 @@ public record Dog(string Name) : Pet(Name)
     }
 }
 
+public abstract record R1(string A) { }
+
+public record R2(string A, string B) : R1(A) { }
+
 public class Record1
 {
     public void M1()
@@ -63,10 +67,20 @@ public class Record1
 
     public void M2()
     {
-        var person = new Person1("Bill", "Wagner");
+        Person1 p1 = new Teacher1("Bill", "Wagner", "Math");
 
-        var (first, last) = person;
+        var (first, last) = p1;
         Console.WriteLine(first);
-        Console.WriteLine(last);
+
+        var p2 = p1 with { FirstName = "Paul" };
+        var p3 = (Teacher1)p1 with { FirstName = "Paul", Subject = "Literature" };
+        var clone = p1 with { };
+    }
+
+    public void M3()
+    {
+        R2 a = new R2("A", "B");
+        R1 b = a;
+        R1 c = b with { A = "C" };
     }
 }
diff --git a/csharp/ql/test/library-tests/csharp9/foreach.expected b/csharp/ql/test/library-tests/csharp9/foreach.expected
new file mode 100644
index 00000000000..39694665cb0
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/foreach.expected
@@ -0,0 +1,4 @@
+| ForeachExtension.cs:24:9:26:9 | foreach (... ... in ...) ... | Int32 | sync | Extensions | ForeachExtension.cs:8:34:8:49 | System.Collections.Generic.IEnumerator<Int32> | - | System.Collections.IEnumerator | - |
+| ForeachExtension.cs:29:9:31:9 | foreach (... ... in ...) ... | Int32 | async | Extensions | ForeachExtension.cs:9:39:9:59 | System.Collections.Generic.IAsyncEnumerator<Int32> | - | System.Collections.Generic.IAsyncEnumerator<Int32> | - |
+| ForeachExtension.cs:33:9:35:9 | foreach (... ... in ...) ... | Int32 | sync | Extensions | ForeachExtension.cs:10:36:10:48 | System.Collections.Generic.IEnumerator<Int32> | - | System.Collections.IEnumerator | - |
+| ForeachExtension.cs:37:9:39:9 | foreach (... ... in ...) ... | Int32 | sync | System.Collections.IEnumerable | - | System.Collections.IEnumerator | - | System.Collections.IEnumerator | - |
diff --git a/csharp/ql/test/library-tests/csharp9/foreach.ql b/csharp/ql/test/library-tests/csharp9/foreach.ql
new file mode 100644
index 00000000000..38d431d762f
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/foreach.ql
@@ -0,0 +1,15 @@
+import csharp
+
+private string getLocation(Member m) {
+  if m.fromSource() then result = m.getALocation().(SourceLocation).toString() else result = "-"
+}
+
+private string getIsAsync(ForeachStmt f) {
+  if f.isAsync() then result = "async" else result = "sync"
+}
+
+from ForeachStmt f
+select f, f.getElementType().toString(), getIsAsync(f),
+  f.getGetEnumerator().getDeclaringType().getQualifiedName(), getLocation(f.getGetEnumerator()),
+  f.getCurrent().getDeclaringType().getQualifiedName(), getLocation(f.getCurrent()),
+  f.getMoveNext().getDeclaringType().getQualifiedName(), getLocation(f.getMoveNext())
diff --git a/csharp/ql/test/library-tests/csharp9/globalStmt.expected b/csharp/ql/test/library-tests/csharp9/globalStmt.expected
new file mode 100644
index 00000000000..dc7ccea6ad1
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/globalStmt.expected
@@ -0,0 +1,10 @@
+global_stmt
+| GlobalStmt.cs:11:1:11:23 | ...; |
+| GlobalStmt.cs:12:1:12:23 | ...; |
+| GlobalStmt.cs:13:1:13:4 | ...; |
+| GlobalStmt.cs:15:1:17:1 | M(...) |
+globalBlock
+| GlobalStmt.cs:7:1:25:1 | {...} | GlobalStmt.cs:7:1:25:1 | <Main>$ | GlobalStmt.cs:1:1:1:0 | args | GlobalStmt.cs:7:1:25:1 | <Program>$ |
+methods
+| GlobalStmt.cs:7:1:25:1 | <Main>$ | entry |
+| GlobalStmt.cs:21:8:21:9 | M1 | non-entry |
diff --git a/csharp/ql/test/library-tests/csharp9/globalStmt.ql b/csharp/ql/test/library-tests/csharp9/globalStmt.ql
new file mode 100644
index 00000000000..ff0ca8f661a
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/globalStmt.ql
@@ -0,0 +1,16 @@
+import csharp
+private import semmle.code.csharp.commons.Util
+
+query predicate global_stmt(Stmt stmt) { stmt.isGlobal() }
+
+query predicate globalBlock(BlockStmt block, Method m, Parameter p, Type t) {
+  block.isGlobalStatementContainer() and
+  block.getEnclosingCallable() = m and
+  m.getDeclaringType() = t and
+  m.getAParameter() = p
+}
+
+query predicate methods(Method m, string entry) {
+  m.getFile().getStem() = "GlobalStmt" and
+  if m instanceof MainMethod then entry = "entry" else entry = "non-entry"
+}
diff --git a/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected b/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
index ca27ad80532..dfb3e11d7ed 100644
--- a/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
+++ b/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
@@ -10,4 +10,6 @@
 | Record.cs:29:66:29:72 | set_Subject | init |
 | Record.cs:32:70:32:74 | set_Level | init |
 | Record.cs:35:26:35:29 | set_Name | init |
+| Record.cs:54:34:54:34 | set_A | init |
+| Record.cs:56:35:56:35 | set_B | init |
 | UnaryPattern.cs:5:26:5:28 | set_P1 | set |
diff --git a/csharp/ql/test/library-tests/csharp9/record.expected b/csharp/ql/test/library-tests/csharp9/record.expected
index 69d7abddb31..9b6b5c00571 100644
--- a/csharp/ql/test/library-tests/csharp9/record.expected
+++ b/csharp/ql/test/library-tests/csharp9/record.expected
@@ -1,12 +1,14 @@
-types
-| Record.cs:4:1:10:1 | Person | IEquatable<Person> |
-| Record.cs:12:1:18:1 | Teacher | IEquatable<Teacher> |
-| Record.cs:20:1:25:1 | Student | IEquatable<Student> |
-| Record.cs:27:1:27:57 | Person1 | IEquatable<Person1> |
-| Record.cs:29:1:30:35 | Teacher1 | IEquatable<Teacher1> |
-| Record.cs:32:1:33:35 | Student1 | IEquatable<Student1> |
-| Record.cs:35:1:39:1 | Pet | IEquatable<Pet> |
-| Record.cs:41:1:52:1 | Dog | IEquatable<Dog> |
+records
+| Record.cs:4:1:10:1 | Person | IEquatable<Person> | Record.cs:4:1:10:1 | <Clone>$ |
+| Record.cs:12:1:18:1 | Teacher | IEquatable<Teacher> | Record.cs:12:1:18:1 | <Clone>$ |
+| Record.cs:20:1:25:1 | Student | IEquatable<Student> | Record.cs:20:1:25:1 | <Clone>$ |
+| Record.cs:27:1:27:57 | Person1 | IEquatable<Person1> | Record.cs:27:1:27:57 | <Clone>$ |
+| Record.cs:29:1:30:35 | Teacher1 | IEquatable<Teacher1> | Record.cs:29:1:30:35 | <Clone>$ |
+| Record.cs:32:1:33:35 | Student1 | IEquatable<Student1> | Record.cs:32:1:33:35 | <Clone>$ |
+| Record.cs:35:1:39:1 | Pet | IEquatable<Pet> | Record.cs:35:1:39:1 | <Clone>$ |
+| Record.cs:41:1:52:1 | Dog | IEquatable<Dog> | Record.cs:41:1:52:1 | <Clone>$ |
+| Record.cs:54:1:54:39 | R1 | IEquatable<R1> | Record.cs:54:1:54:39 | <Clone>$ |
+| Record.cs:56:1:56:48 | R2 | IEquatable<R2> | Record.cs:56:1:56:48 | <Clone>$ |
 members
 | Record.cs:4:1:10:1 | Person | Person.!=(Person, Person) | Record.cs:4:15:4:20 |
 | Record.cs:4:1:10:1 | Person | Person.<Clone>$() | no location |
@@ -198,3 +200,48 @@ members
 | Record.cs:41:1:52:1 | Dog | System.Object.Object() | no location |
 | Record.cs:41:1:52:1 | Dog | System.Object.ReferenceEquals(object, object) | no location |
 | Record.cs:41:1:52:1 | Dog | System.Object.~Object() | no location |
+| Record.cs:54:1:54:39 | R1 | R1.!=(R1, R1) | Record.cs:54:24:54:25 |
+| Record.cs:54:1:54:39 | R1 | R1.<Clone>$() | no location |
+| Record.cs:54:1:54:39 | R1 | R1.==(R1, R1) | Record.cs:54:24:54:25 |
+| Record.cs:54:1:54:39 | R1 | R1.A | Record.cs:54:34:54:34 |
+| Record.cs:54:1:54:39 | R1 | R1.Deconstruct(out string) | no location |
+| Record.cs:54:1:54:39 | R1 | R1.EqualityContract | Record.cs:54:24:54:25 |
+| Record.cs:54:1:54:39 | R1 | R1.Equals(R1) | no location |
+| Record.cs:54:1:54:39 | R1 | R1.Equals(object) | no location |
+| Record.cs:54:1:54:39 | R1 | R1.GetHashCode() | no location |
+| Record.cs:54:1:54:39 | R1 | R1.PrintMembers(StringBuilder) | no location |
+| Record.cs:54:1:54:39 | R1 | R1.R1(R1) | no location |
+| Record.cs:54:1:54:39 | R1 | R1.R1(string) | Record.cs:54:24:54:25 |
+| Record.cs:54:1:54:39 | R1 | R1.ToString() | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.Equals(object, object) | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.GetType() | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.MemberwiseClone() | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.Object() | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.ReferenceEquals(object, object) | no location |
+| Record.cs:54:1:54:39 | R1 | System.Object.~Object() | no location |
+| Record.cs:56:1:56:48 | R2 | R1.!=(R1, R1) | Record.cs:54:24:54:25 |
+| Record.cs:56:1:56:48 | R2 | R1.==(R1, R1) | Record.cs:54:24:54:25 |
+| Record.cs:56:1:56:48 | R2 | R1.A | Record.cs:54:34:54:34 |
+| Record.cs:56:1:56:48 | R2 | R1.Deconstruct(out string) | no location |
+| Record.cs:56:1:56:48 | R2 | R1.R1(R1) | no location |
+| Record.cs:56:1:56:48 | R2 | R1.R1(string) | Record.cs:54:24:54:25 |
+| Record.cs:56:1:56:48 | R2 | R2.!=(R2, R2) | Record.cs:56:15:56:16 |
+| Record.cs:56:1:56:48 | R2 | R2.<Clone>$() | no location |
+| Record.cs:56:1:56:48 | R2 | R2.==(R2, R2) | Record.cs:56:15:56:16 |
+| Record.cs:56:1:56:48 | R2 | R2.B | Record.cs:56:35:56:35 |
+| Record.cs:56:1:56:48 | R2 | R2.Deconstruct(out string, out string) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.EqualityContract | Record.cs:56:15:56:16 |
+| Record.cs:56:1:56:48 | R2 | R2.Equals(R1) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.Equals(R2) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.Equals(object) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.GetHashCode() | no location |
+| Record.cs:56:1:56:48 | R2 | R2.PrintMembers(StringBuilder) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.R2(R2) | no location |
+| Record.cs:56:1:56:48 | R2 | R2.R2(string, string) | Record.cs:56:15:56:16 |
+| Record.cs:56:1:56:48 | R2 | R2.ToString() | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.Equals(object, object) | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.GetType() | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.MemberwiseClone() | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.Object() | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.ReferenceEquals(object, object) | no location |
+| Record.cs:56:1:56:48 | R2 | System.Object.~Object() | no location |
diff --git a/csharp/ql/test/library-tests/csharp9/record.ql b/csharp/ql/test/library-tests/csharp9/record.ql
index 3c97ee1aa84..dc228c3fdd7 100644
--- a/csharp/ql/test/library-tests/csharp9/record.ql
+++ b/csharp/ql/test/library-tests/csharp9/record.ql
@@ -1,6 +1,8 @@
 import csharp
 
-query predicate types(Record t, string i) { t.getABaseInterface().toStringWithTypes() = i }
+query predicate records(Record t, string i, RecordCloneMethod clone) {
+  t.getABaseInterface().toStringWithTypes() = i and clone = t.getCloneMethod()
+}
 
 private string getMemberName(Member m) {
   result = m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes()
diff --git a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
index cd42090259a..cfec2a5ca11 100644
--- a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
+++ b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
@@ -10,8 +10,6 @@ valueType
 | TypeParameterNullability.cs:19:29:19:29 | T |
 | TypeParameterNullability.cs:24:29:24:29 | T |
 valueOrRefType
-| FunctionPointer.cs:22:24:22:24 | T |
-| FunctionPointer.cs:34:24:34:24 | T |
 | TypeParameterNullability.cs:5:28:5:28 | T |
 | TypeParameterNullability.cs:9:28:9:28 | T |
 | TypeParameterNullability.cs:15:29:15:29 | T |
diff --git a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.ql b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.ql
index 58d3bfb8fb9..d8a966e2ff2 100644
--- a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.ql
+++ b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.ql
@@ -1,17 +1,17 @@
 import csharp
 
 query predicate refType(TypeParameter tp) {
-  tp.fromSource() and
+  tp.getFile().getStem() = "TypeParameterNullability" and
   tp.isRefType()
 }
 
 query predicate valueType(TypeParameter tp) {
-  tp.fromSource() and
+  tp.getFile().getStem() = "TypeParameterNullability" and
   tp.isValueType()
 }
 
 query predicate valueOrRefType(TypeParameter tp) {
-  tp.fromSource() and
+  tp.getFile().getStem() = "TypeParameterNullability" and
   not tp.isRefType() and
   not tp.isValueType()
 }
diff --git a/csharp/ql/test/library-tests/csharp9/withExpr.expected b/csharp/ql/test/library-tests/csharp9/withExpr.expected
new file mode 100644
index 00000000000..2d32e7c8bfd
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/withExpr.expected
@@ -0,0 +1,17 @@
+withExpr
+| Record.cs:75:18:75:47 | ... with { ... } | Person1 | Record.cs:75:18:75:19 | access to local variable p1 | Record.cs:75:26:75:47 | { ..., ... } | Person1.<Clone>$() |
+| Record.cs:76:18:76:81 | ... with { ... } | Teacher1 | Record.cs:76:18:76:29 | (...) ... | Record.cs:76:36:76:81 | { ..., ... } | Teacher1.<Clone>$() |
+| Record.cs:77:21:77:31 | ... with { ... } | Person1 | Record.cs:77:21:77:22 | access to local variable p1 | Record.cs:77:29:77:31 | { ..., ... } | Person1.<Clone>$() |
+| Record.cs:84:16:84:33 | ... with { ... } | R1 | Record.cs:84:16:84:16 | access to local variable b | Record.cs:84:23:84:33 | { ..., ... } | R1.<Clone>$() |
+withTarget
+| Record.cs:75:18:75:47 | ... with { ... } | Record.cs:27:1:27:57 | <Clone>$ | Record.cs:27:1:27:57 | Person1 |
+| Record.cs:76:18:76:81 | ... with { ... } | Record.cs:29:1:30:35 | <Clone>$ | Record.cs:29:1:30:35 | Teacher1 |
+| Record.cs:77:21:77:31 | ... with { ... } | Record.cs:27:1:27:57 | <Clone>$ | Record.cs:27:1:27:57 | Person1 |
+| Record.cs:84:16:84:33 | ... with { ... } | Record.cs:54:1:54:39 | <Clone>$ | Record.cs:54:1:54:39 | R1 |
+cloneOverrides
+| Person1.<Clone>$() | Student1.<Clone>$() |
+| Person1.<Clone>$() | Teacher1.<Clone>$() |
+| Person.<Clone>$() | Student.<Clone>$() |
+| Person.<Clone>$() | Teacher.<Clone>$() |
+| Pet.<Clone>$() | Dog.<Clone>$() |
+| R1.<Clone>$() | R2.<Clone>$() |
diff --git a/csharp/ql/test/library-tests/csharp9/withExpr.ql b/csharp/ql/test/library-tests/csharp9/withExpr.ql
new file mode 100644
index 00000000000..d55a430dae6
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/withExpr.ql
@@ -0,0 +1,26 @@
+import csharp
+
+private string getSignature(Method m) {
+  result = m.getDeclaringType().getQualifiedName() + "." + m.toStringWithTypes()
+}
+
+query predicate withExpr(WithExpr with, string type, Expr expr, ObjectInitializer init, string clone) {
+  type = with.getType().toStringWithTypes() and
+  expr = with.getExpr() and
+  init = with.getInitializer() and
+  clone = getSignature(with.getCloneMethod())
+}
+
+query predicate withTarget(WithExpr with, RecordCloneMethod clone, Constructor ctor) {
+  with.getCloneMethod() = clone and
+  clone.getConstructor() = ctor
+}
+
+query predicate cloneOverrides(string b, string o) {
+  exists(RecordCloneMethod base, RecordCloneMethod overrider |
+    base.getDeclaringType().fromSource() and
+    base.(Virtualizable).getAnOverrider() = overrider and
+    b = getSignature(base) and
+    o = getSignature(overrider)
+  )
+}
diff --git a/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected b/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
index 8f1a95d58c7..e776b086467 100644
--- a/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
@@ -238,6 +238,18 @@ edges
 | I.cs:37:23:37:23 | i [Field1] : Object | I.cs:39:9:39:9 | access to parameter i [Field1] : Object |
 | I.cs:39:9:39:9 | access to parameter i [Field1] : Object | I.cs:40:14:40:14 | access to parameter i [Field1] : Object |
 | I.cs:40:14:40:14 | access to parameter i [Field1] : Object | I.cs:40:14:40:21 | access to field Field1 |
+| J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:13:29:13:29 | access to local variable o : Object |
+| J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:21:36:21:36 | access to local variable o : Object |
+| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object |
+| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object |
+| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object |
+| J.cs:13:29:13:29 | access to local variable o : Object | J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object |
+| J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object | J.cs:14:14:14:21 | access to property Prop1 |
+| J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object | J.cs:18:14:18:21 | access to property Prop1 |
+| J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object | J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object |
+| J.cs:21:36:21:36 | access to local variable o : Object | J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object |
+| J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object | J.cs:22:14:22:21 | access to property Prop1 |
+| J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object | J.cs:23:14:23:21 | access to property Prop2 |
 nodes
 | A.cs:5:17:5:23 | object creation of type C : C | semmle.label | object creation of type C : C |
 | A.cs:6:17:6:25 | call to method Make [c] : C | semmle.label | call to method Make [c] : C |
@@ -513,6 +525,19 @@ nodes
 | I.cs:39:9:39:9 | access to parameter i [Field1] : Object | semmle.label | access to parameter i [Field1] : Object |
 | I.cs:40:14:40:14 | access to parameter i [Field1] : Object | semmle.label | access to parameter i [Field1] : Object |
 | I.cs:40:14:40:21 | access to field Field1 | semmle.label | access to field Field1 |
+| J.cs:12:17:12:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | semmle.label | object creation of type Record [Prop1] : Object |
+| J.cs:13:29:13:29 | access to local variable o : Object | semmle.label | access to local variable o : Object |
+| J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object | semmle.label | access to local variable r1 [Prop1] : Object |
+| J.cs:14:14:14:21 | access to property Prop1 | semmle.label | access to property Prop1 |
+| J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object | semmle.label | access to local variable r2 [Prop1] : Object |
+| J.cs:18:14:18:21 | access to property Prop1 | semmle.label | access to property Prop1 |
+| J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object | semmle.label | ... with { ... } [Prop2] : Object |
+| J.cs:21:36:21:36 | access to local variable o : Object | semmle.label | access to local variable o : Object |
+| J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object | semmle.label | access to local variable r3 [Prop1] : Object |
+| J.cs:22:14:22:21 | access to property Prop1 | semmle.label | access to property Prop1 |
+| J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object | semmle.label | access to local variable r3 [Prop2] : Object |
+| J.cs:23:14:23:21 | access to property Prop2 | semmle.label | access to property Prop2 |
 #select
 | A.cs:7:14:7:16 | access to field c | A.cs:5:17:5:23 | object creation of type C : C | A.cs:7:14:7:16 | access to field c | $@ | A.cs:5:17:5:23 | object creation of type C : C | object creation of type C : C |
 | A.cs:14:14:14:20 | call to method Get | A.cs:13:15:13:22 | object creation of type C1 : C1 | A.cs:14:14:14:20 | call to method Get | $@ | A.cs:13:15:13:22 | object creation of type C1 : C1 | object creation of type C1 : C1 |
@@ -566,3 +591,7 @@ nodes
 | I.cs:23:14:23:21 | access to field Field1 | I.cs:7:18:7:29 | object creation of type Object : Object | I.cs:23:14:23:21 | access to field Field1 | $@ | I.cs:7:18:7:29 | object creation of type Object : Object | object creation of type Object : Object |
 | I.cs:27:14:27:21 | access to field Field1 | I.cs:7:18:7:29 | object creation of type Object : Object | I.cs:27:14:27:21 | access to field Field1 | $@ | I.cs:7:18:7:29 | object creation of type Object : Object | object creation of type Object : Object |
 | I.cs:40:14:40:21 | access to field Field1 | I.cs:31:13:31:24 | object creation of type Object : Object | I.cs:40:14:40:21 | access to field Field1 | $@ | I.cs:31:13:31:24 | object creation of type Object : Object | object creation of type Object : Object |
+| J.cs:14:14:14:21 | access to property Prop1 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:14:14:14:21 | access to property Prop1 | $@ | J.cs:12:17:12:28 | object creation of type Object : Object | object creation of type Object : Object |
+| J.cs:18:14:18:21 | access to property Prop1 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:18:14:18:21 | access to property Prop1 | $@ | J.cs:12:17:12:28 | object creation of type Object : Object | object creation of type Object : Object |
+| J.cs:22:14:22:21 | access to property Prop1 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:22:14:22:21 | access to property Prop1 | $@ | J.cs:12:17:12:28 | object creation of type Object : Object | object creation of type Object : Object |
+| J.cs:23:14:23:21 | access to property Prop2 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:23:14:23:21 | access to property Prop2 | $@ | J.cs:12:17:12:28 | object creation of type Object : Object | object creation of type Object : Object |
diff --git a/csharp/ql/test/library-tests/dataflow/fields/J.cs b/csharp/ql/test/library-tests/dataflow/fields/J.cs
new file mode 100644
index 00000000000..4244a514281
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/fields/J.cs
@@ -0,0 +1,31 @@
+namespace System.Runtime.CompilerServices
+{
+    internal static class IsExternalInit { }
+}
+
+public record Record(object Prop1, object Prop2) { }
+
+public class J
+{
+    private void M1()
+    {
+        var o = new object();
+        var r1 = new Record(o, null);
+        Sink(r1.Prop1); // flow
+        Sink(r1.Prop2); // no flow
+
+        var r2 = r1 with { };
+        Sink(r2.Prop1); // flow
+        Sink(r2.Prop2); // no flow
+
+        var r3 = r1 with { Prop2 = o };
+        Sink(r3.Prop1); // flow
+        Sink(r3.Prop2); // flow
+
+        var r4 = r1 with { Prop1 = null };
+        Sink(r4.Prop1); // no flow
+        Sink(r4.Prop2); // no flow
+    }
+
+    public static void Sink(object o) { }
+}
diff --git a/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/old.dbscheme b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/old.dbscheme
new file mode 100644
index 00000000000..16936565fbe
--- /dev/null
+++ b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/old.dbscheme
@@ -0,0 +1,2082 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref
+)
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/semmlecode.csharp.dbscheme b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..9258e9b38d8
--- /dev/null
+++ b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/semmlecode.csharp.dbscheme
@@ -0,0 +1,2083 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref
+)
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/upgrade.properties b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/upgrade.properties
new file mode 100644
index 00000000000..61e314aa1e0
--- /dev/null
+++ b/csharp/upgrades/16936565fbeffa1492ef636112694d29f7c578d0/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add 'with_expr' to 'expr' types.
+compatibility: backwards
diff --git a/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/old.dbscheme b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/old.dbscheme
new file mode 100644
index 00000000000..68db341c2ed
--- /dev/null
+++ b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/old.dbscheme
@@ -0,0 +1,2070 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref
+)
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/semmlecode.csharp.dbscheme b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..16936565fbe
--- /dev/null
+++ b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/semmlecode.csharp.dbscheme
@@ -0,0 +1,2082 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref
+)
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/upgrade.properties b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/upgrade.properties
new file mode 100644
index 00000000000..0b0c3a88460
--- /dev/null
+++ b/csharp/upgrades/68db341c2ed1693c2ae6e20ad533c84138cb275a/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add 'foreach_stmt_info' and 'foreach_stmt_desugar' relations.
+compatibility: backwards
\ No newline at end of file
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
index 57a39cef5b4..02678c27f84 100644
--- a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
@@ -26,6 +26,12 @@ features for query files (extension ``.ql``) and library files (extension ``.qll
 
 You can also use the VS Code **Format Document** command to format your code according to the `CodeQL style guide <https://github.com/github/codeql/blob/main/docs/ql-style-guide.md>`__.
 
+Data and telemetry
+-------------------
+
+If you specifically opt in to permit GitHub to do so, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
+For more information, see ":doc:`About telemetry in CodeQL for Visual Studio Code <about-telemetry-in-codeql-for-visual-studio-code>`."
+
 Further reading
 -------------------
 
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
new file mode 100644
index 00000000000..6b6dd1c03e0
--- /dev/null
+++ b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
@@ -0,0 +1,63 @@
+:tocdepth: 1
+
+.. _about-telemetry-in-codeql-for-visual-studio-code:
+
+About telemetry in CodeQL for Visual Studio Code
+=================================================
+
+If you specifically opt in to permit GitHub to do so, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
+
+This data will not be shared with any parties outside of GitHub. IP addresses and installation IDs will be retained for a maximum of 30 days. Anonymous data will be retained for a maximum of 180 days.
+
+Why we collect data
+--------------------------------------
+
+GitHub collects aggregated, anonymous usage data and metrics to help us improve CodeQL for VS Code. IP addresses and installation IDs are collected only to ensure that anonymous data is not duplicated during aggregation.
+
+What data is collected
+--------------------------------------
+
+If you opt in, GitHub collects the following information related to the usage of the extension. The data collected are:
+
+- The identifiers of any CodeQL-related VS Code commands that are run.
+- For each command: the timestamp, time taken, and whether or not the command completed successfully.
+- VS Code and extension version.
+- Randomly generated GUID that uniquely identifies a CodeQL extension installation. (Discarded before aggregation.)
+- IP address of the client sending the telemetry data. (Discarded before aggregation.)
+- Whether or not the ``codeQL.canary`` setting is enabled and set to ``true``.
+
+How long data is retained
+--------------------------
+
+IP address and GUIDs will be retained for a maximum of 30 days. Anonymous, aggregated data that includes command identifiers, run times, and timestamps will be retained for a maximum of 180 days.
+
+Access to the data
+-------------------
+
+IP address and GUIDs will only be available to the core developers of CodeQL. Aggregated data will be available to GitHub employees.
+
+What data is **NOT** collected
+--------------------------------
+
+We only collect the minimal amount of data we need to answer the questions about how our users are experiencing this product. To that end, we do not collect the following information:
+
+- No GitHub user ID
+- No CodeQL database names or contents
+- No contents of CodeQL queries
+- No filesystem paths
+
+Disabling telemetry reporting
+------------------------------
+
+Telemetry collection is *disabled* by default.
+
+When telemetry collection is disabled, no data will be sent to GitHub servers.
+
+You can disable telemetry collection by setting ``codeQL.telemetry.enableTelemetry`` to ``false`` in your settings. For more information about CodeQL settings, see ":doc:`Customizing settings <customizing-settings>`." 
+
+Additionally, telemetry collection will be disabled if the global ``telemetry.enableTelemetry`` setting is set to ``false``. For more information about global telemetry collection, see "`Microsoft's documentation <https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting>`__."
+
+Further reading
+----------------
+
+For more information, see GitHub's "`Privacy Statement <https://docs.github.com/github/site-policy/github-privacy-statement>`__" and "`Terms of Service <https://docs.github.com/github/site-policy/github-terms-of-service>`__."
diff --git a/docs/codeql/codeql-for-visual-studio-code/index.rst b/docs/codeql/codeql-for-visual-studio-code/index.rst
index 3163dd2d029..a6020c23b75 100644
--- a/docs/codeql/codeql-for-visual-studio-code/index.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/index.rst
@@ -39,6 +39,8 @@ The CodeQL extension for Visual Studio Code adds rich language support for CodeQ
   <troubleshooting-codeql-for-visual-studio-code>`: You can use the detailed 
   information written to the extension's log files if you need to troubleshoot problems.
 
+- :doc:`About telemetry in CodeQL for Visual Studio Code <about-telemetry-in-codeql-for-visual-studio-code>`: If you specifically opt in to permit GitHub to do so, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
+
 .. toctree::
    :hidden:
    :titlesonly:
@@ -51,3 +53,4 @@ The CodeQL extension for Visual Studio Code adds rich language support for CodeQ
    testing-codeql-queries-in-visual-studio-code
    customizing-settings
    troubleshooting-codeql-for-visual-studio-code
+   about-telemetry-in-codeql-for-visual-studio-code
diff --git a/docs/codeql/ql-language-reference/ql-language-specification.rst b/docs/codeql/ql-language-reference/ql-language-specification.rst
index df1da36a1ba..0fe54210504 100644
--- a/docs/codeql/ql-language-reference/ql-language-specification.rst
+++ b/docs/codeql/ql-language-reference/ql-language-specification.rst
@@ -374,7 +374,7 @@ A *variable declaration list* provides a sequence of variables and a type for ea
 
 ::
 
-   var_decls ::= var_decl ("," var_decl)*
+   var_decls ::= (var_decl ("," var_decl)*)?
    var_decl ::= type simpleId
 
 A valid variable declaration list must not include two declarations with the same variable name. Moreover, if the declaration has a typing environment that applies, it must not use a variable name that is already present in that typing environment.
@@ -820,7 +820,7 @@ The head of the predicate gives a name, an optional *result type*, and a sequenc
 
 ::
 
-   head ::= ("predicate" | type) predicateName "(" (var_decls)? ")"
+   head ::= ("predicate" | type) predicateName "(" var_decls ")"
 
 The body of a predicate is of one of three forms:
 
@@ -1209,7 +1209,7 @@ An aggregation can be written in one of two forms:
 
 ::
 
-   aggregation ::= aggid ("[" expr "]")? "(" (var_decls)? ("|" (formula)? ("|" as_exprs ("order" "by" aggorderbys)?)?)? ")"
+   aggregation ::= aggid ("[" expr "]")? "(" var_decls ("|" (formula)? ("|" as_exprs ("order" "by" aggorderbys)?)?)? ")"
                |   aggid ("[" expr "]")? "(" as_exprs ("order" "by" aggorderbys)? ")"
                |   "unique" "(" var_decls "|" (formula)? ("|" as_exprs)? ")"
 
@@ -2046,7 +2046,7 @@ The complete grammar for QL is as follows:
                   |   "language" "[" "monotonicAggregates" "]"
                   |   "bindingset" "[" (variable ( "," variable)*)? "]"
 
-   head ::= ("predicate" | type) predicateName "(" (var_decls)? ")"
+   head ::= ("predicate" | type) predicateName "(" var_decls ")"
 
    optbody ::= ";"
            |  "{" formula "}" 
@@ -2070,7 +2070,7 @@ The complete grammar for QL is as follows:
          |  qldoc? annotations "class" classname "=" type ";"
          |  qldoc? annotations "module" modulename "=" moduleId ";"
          
-   var_decls ::= var_decl ("," var_decl)*
+   var_decls ::= (var_decl ("," var_decl)*)?
 
    var_decl ::= type simpleId
 
@@ -2157,7 +2157,7 @@ The complete grammar for QL is as follows:
 
    postfix_cast ::= primary "." "(" type ")"
 
-   aggregation ::= aggid ("[" expr "]")? "(" (var_decls)? ("|" (formula)? ("|" as_exprs ("order" "by" aggorderbys)?)?)? ")"
+   aggregation ::= aggid ("[" expr "]")? "(" var_decls ("|" (formula)? ("|" as_exprs ("order" "by" aggorderbys)?)?)? ")"
                |   aggid ("[" expr "]")? "(" as_exprs ("order" "by" aggorderbys)? ")"
                |   "unique" "(" var_decls "|" (formula)? ("|" as_exprs)? ")"
  
diff --git a/docs/codeql/query-help/codeql-cwe-coverage.md b/docs/codeql/query-help/codeql-cwe-coverage.md
new file mode 100644
index 00000000000..245318a5258
--- /dev/null
+++ b/docs/codeql/query-help/codeql-cwe-coverage.md
@@ -0,0 +1,25 @@
+# CodeQL CWE coverage
+
+An overview of the coverage of MITRE's Common Weakness Enumeration (CWE) for the latest release of CodeQL.
+
+## About CWEs
+
+The CWE categorization contains several types of entity, collectively known as CWEs. The CWEs that we consider in this report are only those of the types:
+
+- Weakness Class
+- Weakness Base
+- Weakness Variant
+- Compound Element
+
+Other types of CWE do not correspond directly to weaknesses, so are omitted.
+
+The CWE categorization includes relationships between entities, in particular a parent-child relationship.
+These relationships are associated with Views (another kind of CWE entity). For the purposes of coverage claims, we use the "[Research View](https://cwe.mitre.org/data/definitions/1000.html)."
+
+Every security query is associated with one or more CWEs, which are the most precise CWEs that are covered by that query.
+Overall coverage is claimed for the most-precise CWEs, as well as for any of their ancestors in the View.
+
+## Overview
+
+<!-- autogenerated CWE coverage table will be added below -->
+
diff --git a/docs/codeql/query-help/conf.py b/docs/codeql/query-help/conf.py
index 0016a489f07..f3d4090f952 100644
--- a/docs/codeql/query-help/conf.py
+++ b/docs/codeql/query-help/conf.py
@@ -23,7 +23,10 @@ master_doc = 'index'
 project = u'CodeQL query help'
 
 # Add md parser to process query help markdown files 
-extensions =['recommonmark']
+extensions = [
+    'recommonmark',
+    'sphinx_markdown_tables',
+]
 
 source_suffix = {
     '.rst': 'restructuredtext',
diff --git a/docs/codeql/query-help/index.rst b/docs/codeql/query-help/index.rst
index 5c523650d70..10e4b0dff20 100644
--- a/docs/codeql/query-help/index.rst
+++ b/docs/codeql/query-help/index.rst
@@ -20,6 +20,9 @@ View the query help for the queries included in the ``code-scanning``, ``securit
    - A link to the query in the `CodeQL repository <https://github.com/github/codeql>`__.
    - A description of the potential vulnerability that the query identifies and a recommendation for how to avoid introducing the problem to your code.
 
+
+For a full list of the CWEs covered by these queries, see ":doc:`CodeQL CWE coverage <codeql-cwe-coverage>`." 
+
 .. toctree::
    :hidden:
    :titlesonly:
@@ -30,4 +33,5 @@ View the query help for the queries included in the ``code-scanning``, ``securit
    java
    javascript
    python
+   codeql-cwe-coverage
    
diff --git a/docs/codeql/support/reusables/frameworks.rst b/docs/codeql/support/reusables/frameworks.rst
index 4427407fe9d..4dd155e2302 100644
--- a/docs/codeql/support/reusables/frameworks.rst
+++ b/docs/codeql/support/reusables/frameworks.rst
@@ -27,40 +27,47 @@ Go built-in support
    :widths: auto
 
    Name, Category
-   Chi, Web framework
-   Echo, Web framework
-   Gin, Web framework
-   glog, Logging library
-   go-restful, Web application framework
-   go-sh, Utility library
-   Gokogiri, XPath library
-   golang.org/x/crypto/ssh, Network communicator
-   golang.org/x/net/websocket, Network communicator
-   Gorilla websocket, Network communicator
-   GORM, Database
-   GoWebsocket, Network communicator
-   goxpath, XPath library
-   https://github.com/antchfx/htmlquery, XPath library
-   https://github.com/antchfx/jsonquery, XPath library
-   https://github.com/antchfx/xmlquery, XPath library
-   https://github.com/antchfx/xpath, XPath library
-   https://github.com/go-xmlpath/xmlpath, XPath library
-   json-iterator, Serialization
-   klog, Logging library
-   Logrus, Logging library
-   Macaron, Web framework
-   mongo, Database
-   mux, HTTP request router and dispatcher
-   nhooyr.io/websocket, Network communicator
-   pg, Database
-   proto, Serialization
-   Revel, Web framework
-   Spew, Logging library
-   sqlx, Database
-   SendGrid, Email library
-   Squirrel, Database
-   ws, Network communicator
-   xpathparser, XPath library
+   `beego <https://beego.me/>`_, Web/logging/database framework
+   `Chi <https://github.com/go-chi/chi>`_, Web framework
+   Couchbase (`gocb <https://github.com/couchbase/gocb>`_ and `go-couchbase <http://www.github.com/couchbase/go-couchbase>`_), Database
+   `Echo <https://echo.labstack.com/>`_, Web framework
+   `Gin <https://github.com/gin-gonic/gin>`_, Web framework
+   `glog <https://github.com/golang/glog>`_, Logging library
+   `go-pg <https://pg.uptrace.dev/>`_, Database
+   `go-restful <https://github.com/emicklei/go-restful>`_, Web application framework
+   `go-sh <https://github.com/codeskyblue/go-sh>`_, Utility library
+   `go-spew <https://github.com/davecgh/go-spew>`_, Logging library
+   `GoKit <https://github.com/go-kit/kit>`_, Microservice toolkit
+   `Gokogiri <https://github.com/jbowtie/gokogiri>`_, XPath library
+   `golang.org/x/crypto/ssh <https://pkg.go.dev/golang.org/x/crypto/ssh>`_, Network communicator
+   `golang.org/x/net/websocket <https://pkg.go.dev/golang.org/x/net/websocket>`_, Network communicator
+   `goproxy <https://github.com/elazarl/goproxy>`_, HTTP proxy library
+   `Gorilla mux <http://www.gorillatoolkit.org/pkg/mux>`_, HTTP request router and dispatcher
+   `Gorilla websocket <https://github.com/gorilla/websocket>`_, Network communicator
+   `GORM <https://gorm.io/>`_, Database
+   `GoWebsocket <https://github.com/sacOO7/gowebsocket>`_, Network communicator
+   `goxpath <https://github.com/ChrisTrenkamp/goxpath>`_, XPath library
+   `htmlquery <https://github.com/antchfx/htmlquery>`_, XPath library
+   `json-iterator <https://github.com/json-iterator/go>`_, Serialization
+   `jsonpatch <https://github.com/evanphx/json-patch>`_, Serialization
+   `jsonquery <https://github.com/antchfx/jsonquery>`_, XPath library
+   `klog <https://github.com/kubernetes/klog>`_, Logging library
+   `Logrus <https://github.com/sirupsen/logrus>`_, Logging library
+   `Macaron <https://gopkg.in/macaron.v1>`_, Web framework
+   `mongo <https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo>`_, Database
+   `nhooyr.io/websocket <http://nhooyr.io/websocket>`_, Network communicator
+   `protobuf <https://pkg.go.dev/google.golang.org/protobuf>`_, Serialization
+   `Revel <http://revel.github.io/>`_, Web framework
+   `sqlx <http://jmoiron.github.io/sqlx/>`_, Database
+   `SendGrid <https://github.com/sendgrid/sendgrid-go>`_, Email library
+   `Squirrel <https://github.com/Masterminds/squirrel>`_, Database
+   `ws <https://github.com/gobwas/ws>`_, Network communicator
+   `xmlpath <https://gopkg.in/xmlpath.v2>`_, XPath library
+   `xmlquery <https://github.com/antchfx/xmlquery>`_, XPath library
+   `xpath <https://github.com/antchfx/xpath>`_, XPath library
+   `xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_, XPath library
+   `yaml <https://gopkg.in/yaml.v3>`_, Serialization
+   `zap <https://go.uber.org/zap>`_, Logging library
 
 Java built-in support
 ==================================
@@ -93,7 +100,8 @@ JavaScript and TypeScript built-in support
    :widths: auto
 
    Name, Category
-   angularjs, HTML framework
+   angular (modern version), HTML framework
+   angular.js (legacy version), HTML framework
    axios, Network communicator
    browser, Runtime environment
    electron, Runtime environment
@@ -122,19 +130,20 @@ JavaScript and TypeScript built-in support
 Python built-in support
 ====================================
 
-.. csv-table:: 
+.. csv-table::
    :header-rows: 1
    :class: fullWidthTable
    :widths: auto
 
    Name, Category
-   Bottle, Web framework
-   CherryPy, Web framework
-   Django, Web application framework
-   Falcon, Web API framework
-   Flask, Microframework
-   Pyramid, Web application framework
-   Tornado, Web application framework and asynchronous networking library
-   Turbogears, Web framework
-   Twisted, Networking engine
-   WebOb, WSGI request library
+   Django, Web framework
+   Flask, Web framework
+   Tornado, Web framework
+   PyYAML, Serialization
+   dill, Serialization
+   fabric, Utility library
+   invoke, Utility library
+   mysql-connector-python, Database
+   MySQLdb, Database
+   psycopg2, Database
+   sqlite3, Database
diff --git a/docs/ql-style-guide.md b/docs/ql-style-guide.md
index fba407ae8dd..bea84aff36e 100644
--- a/docs/ql-style-guide.md
+++ b/docs/ql-style-guide.md
@@ -173,6 +173,7 @@ private predicate foo(Expr e, Expr p) {
 1. Use [camelCase](https://en.wikipedia.org/wiki/Camel_case) for:
    - Predicate names
    - Variable names
+1. Acronyms *should* use normal PascalCase/camelCase. However, two-letter acronyms should have both letters capitalized.
 1. Newtype predicate names *should* begin with `T`.
 1. Predicates that have a result *should* be named `get...`
 1. Predicates that can return multiple results *should* be named `getA...` or `getAn...`
@@ -183,6 +184,7 @@ private predicate foo(Expr e, Expr p) {
 1. Use names as they are used in the target-language specification.
 1. Use American English.
 
+
 ### Examples
 
 ```ql
@@ -209,6 +211,9 @@ class Type extends ... {
 
   /** ... */
   Type getATypeParameter() { ... }
+  
+  /** Gets the SSA variable ... */
+  predicate getSsaVariable() { ... }
 }
 ```
 
diff --git a/docs/supported-queries.md b/docs/supported-queries.md
index dc02a1e547c..55530c2fa12 100644
--- a/docs/supported-queries.md
+++ b/docs/supported-queries.md
@@ -20,14 +20,15 @@ The process must begin with the first step and must conclude with the final step
 
    Query help files explain the purpose of your query to other users. Write your query help in a `.qhelp` file and save it in the same directory as your query. For more information on writing query help, see the [Query help style guide](query-help-style-guide.md).
 
-   - Note, in particular, that almost all queries need to have a pair of "before" and "after" examples demonstrating the kind of problem the query identifies and how to fix it. Make sure that the examples are actually consistent with what the query does, for example by including them in your unit tests.
+   - Note, in particular, that almost all queries need to have a pair of "before" and "after" examples demonstrating the kind of problem the query identifies and how to fix it. Make sure that the examples are actually consistent with what the query does, for example by including them in your unit tests. Examples must be original, not copied from third-party sources.
    - At the time of writing, there is no way of previewing help locally. Once you've opened a PR, a preview will be created as part of the CI checks. A GitHub employee will review this and let you know of any problems.
 
 3. **Write unit tests**
 
    Add one or more unit tests for the query (and for any library changes you make) to the `ql/<language>/ql/test/experimental` directory. Tests for library changes go into the `library-tests` subdirectory, and tests for queries go into `query-tests` with their relative path mirroring the query's location under `ql/<language>/ql/src/experimental`.
 
-   See the section on [Testing custom queries](https://help.semmle.com/codeql/codeql-cli/procedures/test-queries.html) in the [CodeQL documentation](https://help.semmle.com/codeql/) for more information.
+ 	- See the section on [Testing custom queries](https://help.semmle.com/codeql/codeql-cli/procedures/test-queries.html) in the [CodeQL documentation](https://help.semmle.com/codeql/) for more information.
+	- See [C/C++ CodeQL tests](/cpp/ql/test/README.md) for more information about contributing tests for C/C++ queries in particular.
 
 4. **Test for correctness on real-world code**
 
diff --git a/java/change-notes/2021-02-09-commons-string-utils.md b/java/change-notes/2021-02-09-commons-string-utils.md
new file mode 100644
index 00000000000..0e2a4037fb2
--- /dev/null
+++ b/java/change-notes/2021-02-09-commons-string-utils.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for the Apache Commons Lang StringUtils library.
diff --git a/java/change-notes/2021-02-15-commons-array-utils.md b/java/change-notes/2021-02-15-commons-array-utils.md
new file mode 100644
index 00000000000..a689a08e98c
--- /dev/null
+++ b/java/change-notes/2021-02-15-commons-array-utils.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for the Apache Commons Lang ArrayUtils library.
diff --git a/java/change-notes/2021-02-15-snakeyaml-fn-fix.md b/java/change-notes/2021-02-15-snakeyaml-fn-fix.md
new file mode 100644
index 00000000000..ed08bdfe8c6
--- /dev/null
+++ b/java/change-notes/2021-02-15-snakeyaml-fn-fix.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* The query "Unsafe Deserialization" (`java/unsafe-deserialization`) has been
+  improved to report those cases where SnakeYaml `Constructor` is used to fix
+  the unmarshaled object graph root's type but injection is still possible in
+  nested nodes of the object graph.
diff --git a/java/ql/src/Language Abuse/MissedTernaryOpportunity.ql b/java/ql/src/Language Abuse/MissedTernaryOpportunity.ql
index 17485f02248..64f9e1e8907 100644
--- a/java/ql/src/Language Abuse/MissedTernaryOpportunity.ql	
+++ b/java/ql/src/Language Abuse/MissedTernaryOpportunity.ql	
@@ -14,7 +14,7 @@
 import java
 
 predicate complicatedBranch(Stmt branch) {
-  exists(ConditionalExpr ce | ce.getParent*() = branch) or
+  any(ConditionalExpr ce).getParent*() = branch or
   count(MethodAccess a | a.getParent*() = branch) > 1
 }
 
diff --git a/java/ql/src/Language Abuse/UselessUpcast.ql b/java/ql/src/Language Abuse/UselessUpcast.ql
index d8b5761c909..062d6fb961e 100644
--- a/java/ql/src/Language Abuse/UselessUpcast.ql	
+++ b/java/ql/src/Language Abuse/UselessUpcast.ql	
@@ -36,7 +36,7 @@ predicate usefulUpcast(CastExpr e) {
   )
   or
   // Upcasts that are performed on an operand of a ternary expression.
-  exists(ConditionalExpr ce | e = ce.getTrueExpr() or e = ce.getFalseExpr())
+  e = any(ConditionalExpr ce).getABranchExpr()
   or
   // Upcasts to raw types.
   e.getType() instanceof RawType
diff --git a/java/ql/src/Likely Bugs/Arithmetic/CondExprTypes.ql b/java/ql/src/Likely Bugs/Arithmetic/CondExprTypes.ql
index b4168130312..4d375864b2a 100644
--- a/java/ql/src/Likely Bugs/Arithmetic/CondExprTypes.ql	
+++ b/java/ql/src/Likely Bugs/Arithmetic/CondExprTypes.ql	
@@ -16,10 +16,7 @@ class CharType extends PrimitiveType {
   CharType() { this.hasName("char") }
 }
 
-private Type getABranchType(ConditionalExpr ce) {
-  result = ce.getTrueExpr().getType() or
-  result = ce.getFalseExpr().getType()
-}
+private Type getABranchType(ConditionalExpr ce) { result = ce.getABranchExpr().getType() }
 
 from ConditionalExpr ce
 where
diff --git a/java/ql/src/Likely Bugs/Comparison/NoAssignInBooleanExprs.ql b/java/ql/src/Likely Bugs/Comparison/NoAssignInBooleanExprs.ql
index 0d4f56eb764..33f6c61050a 100644
--- a/java/ql/src/Likely Bugs/Comparison/NoAssignInBooleanExprs.ql	
+++ b/java/ql/src/Likely Bugs/Comparison/NoAssignInBooleanExprs.ql	
@@ -17,8 +17,8 @@ import semmle.code.java.Statement
 /** An expression that is used as a condition. */
 class BooleanExpr extends Expr {
   BooleanExpr() {
-    exists(ConditionalStmt s | s.getCondition() = this) or
-    exists(ConditionalExpr s | s.getCondition() = this)
+    this = any(ConditionalStmt s).getCondition() or
+    this = any(ConditionalExpr s).getCondition()
   }
 }
 
diff --git a/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll b/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll
index 16f8d6f8bcc..46d88f86f41 100644
--- a/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll	
+++ b/java/ql/src/Likely Bugs/Resource Leaks/CloseType.qll	
@@ -11,7 +11,7 @@ private predicate flowsInto(Expr e, Variable v) {
   or
   exists(CastExpr c | flowsInto(c, v) | e = c.getExpr())
   or
-  exists(ConditionalExpr c | flowsInto(c, v) | e = c.getTrueExpr() or e = c.getFalseExpr())
+  exists(ConditionalExpr c | flowsInto(c, v) | e = c.getABranchExpr())
 }
 
 /**
diff --git a/java/ql/src/Security/CWE/CWE-190/ArithmeticCommon.qll b/java/ql/src/Security/CWE/CWE-190/ArithmeticCommon.qll
index 9d081e34420..21f6708f472 100644
--- a/java/ql/src/Security/CWE/CWE-190/ArithmeticCommon.qll
+++ b/java/ql/src/Security/CWE/CWE-190/ArithmeticCommon.qll
@@ -148,9 +148,7 @@ predicate upcastToWiderType(Expr e) {
     or
     exists(Parameter p | p.getAnArgument() = e and t2 = p.getType())
     or
-    exists(ConditionalExpr cond | cond.getTrueExpr() = e or cond.getFalseExpr() = e |
-      t2 = cond.getType()
-    )
+    exists(ConditionalExpr cond | cond.getABranchExpr() = e | t2 = cond.getType())
   )
 }
 
diff --git a/java/ql/src/Violations of Best Practice/legacy/AutoBoxing.ql b/java/ql/src/Violations of Best Practice/legacy/AutoBoxing.ql
index 1f6d251b49e..b80f86cd810 100644
--- a/java/ql/src/Violations of Best Practice/legacy/AutoBoxing.ql	
+++ b/java/ql/src/Violations of Best Practice/legacy/AutoBoxing.ql	
@@ -45,9 +45,7 @@ predicate unboxed(BoxedExpr e) {
   or
   flowTarget(e).getType() instanceof PrimitiveType
   or
-  exists(ConditionalExpr cond | cond instanceof PrimitiveExpr |
-    cond.getTrueExpr() = e or cond.getFalseExpr() = e
-  )
+  exists(ConditionalExpr cond | cond instanceof PrimitiveExpr | cond.getABranchExpr() = e)
 }
 
 /**
diff --git a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.java b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.java
new file mode 100644
index 00000000000..e45039e0fef
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.java
@@ -0,0 +1,23 @@
+public static void main(String[] args) {
+	{
+		Browser browser = new Browser();
+		browser.loadURL("https://example.com");
+		// no further calls
+		// BAD: The browser ignores any certificate error by default!
+	}
+
+	{
+		Browser browser = new Browser();
+		browser.setLoadHandler(new LoadHandler() {
+			public boolean onLoad(LoadParams params) {
+				return true;
+			}
+
+			public boolean onCertificateError(CertificateErrorParams params){
+				return true; // GOOD: This means that loading will be cancelled on certificate errors
+			}
+		}); // GOOD: A secure `LoadHandler` is used.
+		browser.loadURL("https://example.com");
+
+	}
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.qhelp b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.qhelp
new file mode 100644
index 00000000000..7327573b8ba
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.qhelp
@@ -0,0 +1,32 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>JxBrowser is a Java library that allows to embed the Chromium browser inside Java applications.
+Versions smaller than 6.24 by default ignore any HTTPS certificate errors thereby allowing man-in-the-middle attacks.
+</p>
+</overview>
+
+<recommendation>
+<p>Do either of these:</p>
+<ul>
+  <li>Update to version 6.24 or 7.x.x as these correctly reject certificate errors by default.</li>
+  <li>Add a custom implementation of the <code>LoadHandler</code> interface whose <code>onCertificateError</code> method always returns <b>true</b> indicating that loading should be cancelled.
+  Then use the <code>setLoadHandler</code> method with your custom <code>LoadHandler</code> on every <code>Browser</code> you use.</li>
+</ul>
+</recommendation>
+
+<example>
+<p>The following two examples show two ways of using a <code>Browser</code>. In the 'BAD' case,
+all certificate errors are ignored. In the 'GOOD' case, certificate errors are rejected.</p>
+<sample src="JxBrowserWithoutCertValidation.java" />
+</example>
+
+<references>
+<li>Teamdev:
+<a href="https://jxbrowser.support.teamdev.com/support/discussions/topics/9000051708">
+Changelog of JxBrowser 6.24</a>.</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
new file mode 100644
index 00000000000..aecffaf3f3b
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
@@ -0,0 +1,86 @@
+/**
+ * @name JxBrowser with disabled certificate validation
+ * @description Insecure configuration of JxBrowser disables certificate validation making the app vulnerable to man-in-the-middle attacks.
+ * @kind problem
+ * @id java/jxbrowser/disabled-certificate-validation
+ * @tags security
+ *       external/cwe/cwe-295
+ */
+
+import java
+import semmle.code.java.security.Encryption
+import semmle.code.java.dataflow.DataFlow
+
+/*
+ * This query is version specific to JxBrowser < 6.24. The version is indirectly detected.
+ * In version 6.x.x the `Browser` class is in a different package compared to version 7.x.x.
+ */
+
+/**
+ * Holds if a safe JxBrowser 6.x.x version is used, such as version 6.24.
+ * This is detected by the the presence of the `addBoundsListener` in the `Browser` class.
+ */
+private predicate isSafeJxBrowserVersion() {
+  exists(Method m | m.getDeclaringType() instanceof JxBrowser | m.hasName("addBoundsListener"))
+}
+
+/** The `com.teamdev.jxbrowser.chromium.Browser` class. */
+private class JxBrowser extends RefType {
+  JxBrowser() { this.hasQualifiedName("com.teamdev.jxbrowser.chromium", "Browser") }
+}
+
+/** The `setLoadHandler` method on the `com.teamdev.jxbrowser.chromium.Browser` class. */
+private class JxBrowserSetLoadHandler extends Method {
+  JxBrowserSetLoadHandler() {
+    this.hasName("setLoadHandler") and this.getDeclaringType() instanceof JxBrowser
+  }
+}
+
+/** The `com.teamdev.jxbrowser.chromium.LoadHandler` interface. */
+private class JxBrowserLoadHandler extends RefType {
+  JxBrowserLoadHandler() { this.hasQualifiedName("com.teamdev.jxbrowser.chromium", "LoadHandler") }
+}
+
+private predicate isOnCertificateErrorMethodSafe(Method m) {
+  forex(ReturnStmt rs | rs.getEnclosingCallable() = m |
+    rs.getResult().(CompileTimeConstantExpr).getBooleanValue() = true
+  )
+}
+
+/** A class that securely implements the `com.teamdev.jxbrowser.chromium.LoadHandler` interface. */
+private class JxBrowserSafeLoadHandler extends RefType {
+  JxBrowserSafeLoadHandler() {
+    this.getASupertype() instanceof JxBrowserLoadHandler and
+    exists(Method m | m.hasName("onCertificateError") and m.getDeclaringType() = this |
+      isOnCertificateErrorMethodSafe(m)
+    )
+  }
+}
+
+/**
+ * Models flow from the source `new Browser()` to a sink `browser.setLoadHandler(loadHandler)` where `loadHandler`
+ * has been determined to be safe.
+ */
+private class JxBrowserFlowConfiguration extends DataFlow::Configuration {
+  JxBrowserFlowConfiguration() { this = "JxBrowserFlowConfiguration" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(ClassInstanceExpr newJxBrowser | newJxBrowser.getConstructedType() instanceof JxBrowser |
+      newJxBrowser = src.asExpr()
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess ma | ma.getMethod() instanceof JxBrowserSetLoadHandler |
+      ma.getArgument(0).getType() instanceof JxBrowserSafeLoadHandler and
+      ma.getQualifier() = sink.asExpr()
+    )
+  }
+}
+
+from JxBrowserFlowConfiguration cfg, DataFlow::Node src
+where
+  cfg.isSource(src) and
+  not cfg.hasFlow(src, _) and
+  not isSafeJxBrowserVersion()
+select src, "This JxBrowser instance may not check HTTPS certificates."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.java b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.java
new file mode 100644
index 00000000000..df7562d252d
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.java
@@ -0,0 +1,13 @@
+public class SensitiveGetQuery extends HttpServlet {
+	// BAD - Tests sending sensitive information in a GET request.
+	public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String password = request.getParameter("password");
+		System.out.println("password = " + password);
+	}
+	
+	// GOOD - Tests sending sensitive information in a POST request.
+	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String password = request.getParameter("password");
+		System.out.println("password = " + password);
+	}
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.qhelp b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.qhelp
new file mode 100644
index 00000000000..c77804a6f2c
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.qhelp
@@ -0,0 +1,31 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+  <overview>
+    <p>Sensitive information such as user passwords should not be transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL therefore increases the risk that they will be captured by an attacker.</p>
+  </overview>
+
+  <recommendation>
+    <p>Use HTTP POST to send sensitive information as part of the request body; for example, as form data.</p>
+  </recommendation>
+
+  <example>
+    <p>The following example shows two ways of sending sensitive information. In the 'BAD' case, a password is transmitted using the GET method. In the 'GOOD' case, the password is transmitted using the POST method.</p>
+    <sample src="SensitiveGetQuery.java" />
+  </example>
+
+  <references>
+    <li>
+      CWE:
+      <a href="https://cwe.mitre.org/data/definitions/598.html">CWE-598: Use of GET Request Method with Sensitive Query Strings</a>
+    </li>
+    <li>
+      PortSwigger (Burp):
+      <a href="https://portswigger.net/kb/issues/00400300_password-submitted-using-get-method">Password Submitted using GET Method</a>
+    </li>
+    <li>
+      OWASP:
+      <a href="https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url">Information Exposure through Query Strings in URL</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
new file mode 100644
index 00000000000..bc9850cfddb
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -0,0 +1,77 @@
+/**
+ * @name Sensitive GET Query
+ * @description Use of GET request method with sensitive query strings.
+ * @kind path-problem
+ * @id java/sensitive-query-with-get
+ * @tags security
+ *       external/cwe-598
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.security.SensitiveActions
+import DataFlow::PathGraph
+
+/** A variable that holds sensitive information judging by its name. */
+class SensitiveInfoExpr extends Expr {
+  SensitiveInfoExpr() {
+    exists(Variable v | this = v.getAnAccess() |
+      v.getName().regexpMatch(getCommonSensitiveInfoRegex()) and
+      not v.getName().regexpMatch("token.*") // exclude ^token.* since sensitive tokens are usually in the form of accessToken, authToken, ...
+    )
+  }
+}
+
+/** Holds if `m` is a method of some override of `HttpServlet.doGet`. */
+private predicate isGetServletMethod(Method m) {
+  isServletRequestMethod(m) and m.getName() = "doGet"
+}
+
+/** The `doGet` method of `HttpServlet`. */
+class DoGetServletMethod extends Method {
+  DoGetServletMethod() { isGetServletMethod(this) }
+}
+
+/** Holds if `ma` is (perhaps indirectly) called from the `doGet` method of `HttpServlet`. */
+predicate isReachableFromServletDoGet(MethodAccess ma) {
+  ma.getEnclosingCallable() instanceof DoGetServletMethod
+  or
+  exists(Method pm, MethodAccess pma |
+    ma.getEnclosingCallable() = pm and
+    pma.getMethod() = pm and
+    isReachableFromServletDoGet(pma)
+  )
+}
+
+/** Source of GET servlet requests. */
+class RequestGetParamSource extends DataFlow::ExprNode {
+  RequestGetParamSource() {
+    exists(MethodAccess ma |
+      isRequestGetParamMethod(ma) and
+      ma = this.asExpr() and
+      isReachableFromServletDoGet(ma)
+    )
+  }
+}
+
+/** A taint configuration tracking flow from the `ServletRequest` of a GET request handler to an expression whose name suggests it holds security-sensitive data. */
+class SensitiveGetQueryConfiguration extends TaintTracking::Configuration {
+  SensitiveGetQueryConfiguration() { this = "SensitiveGetQueryConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RequestGetParamSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof SensitiveInfoExpr }
+
+  /** Holds if the node is in a servlet method other than `doGet`. */
+  override predicate isSanitizer(DataFlow::Node node) {
+    isServletRequestMethod(node.getEnclosingCallable()) and
+    not isGetServletMethod(node.getEnclosingCallable())
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveGetQueryConfiguration c
+where c.hasFlowPath(source, sink)
+select sink.getNode(), source, sink,
+  "$@ uses the GET request method to transmit sensitive information.", source.getNode(),
+  "This request"
diff --git a/java/ql/src/experimental/CWE-918/RequestForgery.java b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.java
similarity index 100%
rename from java/ql/src/experimental/CWE-918/RequestForgery.java
rename to java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.java
diff --git a/java/ql/src/experimental/CWE-918/RequestForgery.qhelp b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qhelp
similarity index 100%
rename from java/ql/src/experimental/CWE-918/RequestForgery.qhelp
rename to java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qhelp
diff --git a/java/ql/src/experimental/CWE-918/RequestForgery.ql b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
similarity index 100%
rename from java/ql/src/experimental/CWE-918/RequestForgery.ql
rename to java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.ql
diff --git a/java/ql/src/experimental/CWE-918/RequestForgery.qll b/java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
similarity index 100%
rename from java/ql/src/experimental/CWE-918/RequestForgery.qll
rename to java/ql/src/experimental/Security/CWE/CWE-918/RequestForgery.qll
diff --git a/java/ql/src/semmle/code/java/ControlFlowGraph.qll b/java/ql/src/semmle/code/java/ControlFlowGraph.qll
index 016f2bd6874..dc38ffb1a8f 100644
--- a/java/ql/src/semmle/code/java/ControlFlowGraph.qll
+++ b/java/ql/src/semmle/code/java/ControlFlowGraph.qll
@@ -293,7 +293,7 @@ private module ControlFlowGraphImpl {
     exists(ConditionalExpr condexpr |
       condexpr.getCondition() = b
       or
-      (condexpr.getTrueExpr() = b or condexpr.getFalseExpr() = b) and
+      condexpr.getABranchExpr() = b and
       inBooleanContext(condexpr)
     )
     or
@@ -706,8 +706,7 @@ private module ControlFlowGraphImpl {
     or
     // The last node of a `ConditionalExpr` is in either of its branches.
     exists(ConditionalExpr condexpr | condexpr = n |
-      last(condexpr.getFalseExpr(), last, completion) or
-      last(condexpr.getTrueExpr(), last, completion)
+      last(condexpr.getABranchExpr(), last, completion)
     )
     or
     exists(InstanceOfExpr ioe | ioe.isPattern() and ioe = n |
@@ -915,14 +914,10 @@ private module ControlFlowGraphImpl {
     )
     or
     // Control flows to the corresponding branch depending on the boolean completion of the condition.
-    exists(ConditionalExpr e |
+    exists(ConditionalExpr e, boolean branch |
       last(e.getCondition(), n, completion) and
-      completion = BooleanCompletion(true, _) and
-      result = first(e.getTrueExpr())
-      or
-      last(e.getCondition(), n, completion) and
-      completion = BooleanCompletion(false, _) and
-      result = first(e.getFalseExpr())
+      completion = BooleanCompletion(branch, _) and
+      result = first(e.getBranchExpr(branch))
     )
     or
     exists(InstanceOfExpr ioe | ioe.isPattern() |
diff --git a/java/ql/src/semmle/code/java/Expr.qll b/java/ql/src/semmle/code/java/Expr.qll
index aef353088be..43ad6634fc1 100755
--- a/java/ql/src/semmle/code/java/Expr.qll
+++ b/java/ql/src/semmle/code/java/Expr.qll
@@ -184,11 +184,8 @@ class CompileTimeConstantExpr extends Expr {
     // Ternary conditional, with compile-time constant condition.
     exists(ConditionalExpr ce, boolean condition |
       ce = this and
-      condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
-    |
-      if condition = true
-      then result = ce.getTrueExpr().(CompileTimeConstantExpr).getStringValue()
-      else result = ce.getFalseExpr().(CompileTimeConstantExpr).getStringValue()
+      condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue() and
+      result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getStringValue()
     )
     or
     exists(Variable v | this = v.getAnAccess() |
@@ -295,11 +292,8 @@ class CompileTimeConstantExpr extends Expr {
     // Ternary expressions, where the `true` and `false` expressions are boolean compile-time constants.
     exists(ConditionalExpr ce, boolean condition |
       ce = this and
-      condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
-    |
-      if condition = true
-      then result = ce.getTrueExpr().(CompileTimeConstantExpr).getBooleanValue()
-      else result = ce.getFalseExpr().(CompileTimeConstantExpr).getBooleanValue()
+      condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue() and
+      result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getBooleanValue()
     )
     or
     // Simple or qualified names where the variable is final and the initializer is a constant.
@@ -380,11 +374,8 @@ class CompileTimeConstantExpr extends Expr {
       // Ternary conditional, with compile-time constant condition.
       exists(ConditionalExpr ce, boolean condition |
         ce = this and
-        condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue()
-      |
-        if condition = true
-        then result = ce.getTrueExpr().(CompileTimeConstantExpr).getIntValue()
-        else result = ce.getFalseExpr().(CompileTimeConstantExpr).getIntValue()
+        condition = ce.getCondition().(CompileTimeConstantExpr).getBooleanValue() and
+        result = ce.getBranchExpr(condition).(CompileTimeConstantExpr).getIntValue()
       )
       or
       // If a `Variable` is a `CompileTimeConstantExpr`, its value is its initializer.
@@ -1186,8 +1177,7 @@ class ChooseExpr extends Expr {
 
   /** Gets a result expression of this `switch` or conditional expression. */
   Expr getAResultExpr() {
-    result = this.(ConditionalExpr).getTrueExpr() or
-    result = this.(ConditionalExpr).getFalseExpr() or
+    result = this.(ConditionalExpr).getABranchExpr() or
     result = this.(SwitchExpr).getAResult()
   }
 }
@@ -1213,6 +1203,23 @@ class ConditionalExpr extends Expr, @conditionalexpr {
    */
   Expr getFalseExpr() { result.isNthChildOf(this, 2) }
 
+  /**
+   * Gets the expression that is evaluated by the specific branch of this
+   * conditional expression. If `true` that is `getTrueExpr()`, if `false`
+   * it is `getFalseExpr()`.
+   */
+  Expr getBranchExpr(boolean branch) {
+    branch = true and result = getTrueExpr()
+    or
+    branch = false and result = getFalseExpr()
+  }
+
+  /**
+   * Gets the expressions that is evaluated by one of the branches (`true`
+   * or `false` branch) of this conditional expression.
+   */
+  Expr getABranchExpr() { result = getBranchExpr(_) }
+
   /** Gets a printable representation of this expression. */
   override string toString() { result = "...?...:..." }
 
diff --git a/java/ql/src/semmle/code/java/Member.qll b/java/ql/src/semmle/code/java/Member.qll
index e9d4fe82978..a0e988bd386 100755
--- a/java/ql/src/semmle/code/java/Member.qll
+++ b/java/ql/src/semmle/code/java/Member.qll
@@ -23,6 +23,14 @@ class Member extends Element, Annotatable, Modifiable, @member {
   /** Gets the qualified name of this member. */
   string getQualifiedName() { result = getDeclaringType().getName() + "." + getName() }
 
+  /**
+   * Holds if this member has the specified name and is declared in the
+   * specified package and type.
+   */
+  predicate hasQualifiedName(string package, string type, string name) {
+    this.getDeclaringType().hasQualifiedName(package, type) and this.hasName(name)
+  }
+
   /** Holds if this member is package protected, that is, neither public nor private nor protected. */
   predicate isPackageProtected() {
     not isPrivate() and
diff --git a/java/ql/src/semmle/code/java/controlflow/internal/GuardsLogic.qll b/java/ql/src/semmle/code/java/controlflow/internal/GuardsLogic.qll
index fc2b8a84c0f..7c4d49c90c7 100644
--- a/java/ql/src/semmle/code/java/controlflow/internal/GuardsLogic.qll
+++ b/java/ql/src/semmle/code/java/controlflow/internal/GuardsLogic.qll
@@ -40,19 +40,14 @@ predicate implies_v1(Guard g1, boolean b1, Guard g2, boolean b2) {
   )
   or
   exists(ConditionalExpr cond, boolean branch, BooleanLiteral boollit, boolean boolval |
-    cond.getTrueExpr() = boollit and branch = true
-    or
-    cond.getFalseExpr() = boollit and branch = false
-  |
+    cond.getBranchExpr(branch) = boollit and
     cond = g1 and
     boolval = boollit.getBooleanValue() and
     b1 = boolval.booleanNot() and
     (
       g2 = cond.getCondition() and b2 = branch.booleanNot()
       or
-      g2 = cond.getTrueExpr() and b2 = b1
-      or
-      g2 = cond.getFalseExpr() and b2 = b1
+      g2 = cond.getABranchExpr() and b2 = b1
     )
   )
   or
@@ -216,9 +211,7 @@ private predicate hasPossibleUnknownValue(SsaVariable v) {
  * `ConditionalExpr`s.
  */
 private Expr possibleValue(Expr e) {
-  result = possibleValue(e.(ConditionalExpr).getTrueExpr())
-  or
-  result = possibleValue(e.(ConditionalExpr).getFalseExpr())
+  result = possibleValue(e.(ConditionalExpr).getABranchExpr())
   or
   result = e and not e instanceof ConditionalExpr
 }
@@ -316,9 +309,7 @@ private predicate conditionalAssign(SsaVariable v, Guard guard, boolean branch,
     v.(SsaExplicitUpdate).getDefiningExpr().(VariableAssign).getSource() = c and
     guard = c.getCondition()
   |
-    branch = true and e = c.getTrueExpr()
-    or
-    branch = false and e = c.getFalseExpr()
+    e = c.getBranchExpr(branch)
   )
   or
   exists(SsaExplicitUpdate upd, SsaPhiNode phi |
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
new file mode 100644
index 00000000000..0df58641ad6
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -0,0 +1,519 @@
+/**
+ * INTERNAL use only. This is an experimental API subject to change without notice.
+ *
+ * Provides classes and predicates for dealing with flow models specified in CSV format.
+ *
+ * The CSV specification has the following columns:
+ * - Sources:
+ *   `namespace; type; subtypes; name; signature; ext; output; kind`
+ * - Sinks:
+ *   `namespace; type; subtypes; name; signature; ext; input; kind`
+ * - Summaries:
+ *   `namespace; type; subtypes; name; signature; ext; input; output; kind`
+ *
+ * The interpretation of a row is similar to API-graphs with a left-to-right
+ * reading.
+ * 1. The `namespace` column selects a package.
+ * 2. The `type` column selects a type within that package.
+ * 3. The `subtypes` is a boolean that indicates whether to jump to an
+ *    arbitrary subtype of that type.
+ * 4. The `name` column optionally selects a specific named member of the type.
+ * 5. The `signature` column optionally restricts the named member. If
+ *    `signature` is blank then no such filtering is done. The format of the
+ *    signature is a comma-separated list of types enclosed in parentheses. The
+ *    types can be short names or fully qualified names (mixing these two options
+ *    is not allowed within a single signature).
+ * 6. The `ext` column specifies additional API-graph-like edges. Currently
+ *    there are only two valid values: "" and "Annotated". The empty string has no
+ *    effect. "Annotated" applies if `name` and `signature` were left blank and
+ *    acts by selecting an element that is annotated by the annotation type
+ *    selected by the first 4 columns. This can be another member such as a field
+ *    or method, or a parameter.
+ * 7. The `input` column specifies how data enters the element selected by the
+ *    first 6 columns, and the `output` column specifies how data leaves the
+ *    element selected by the first 6 columns. An `input` can be either "",
+ *    "Argument", "Argument[n]", "ReturnValue":
+ *    - "": Selects a write to the selected element in case this is a field.
+ *    - "Argument": Selects any argument in a call to the selected element.
+ *    - "Argument[n]": Similar to "Argument" but restricted to a specific numbered
+ *      argument (zero-indexed, and `-1` specifies the qualifier).
+ *    - "ReturnValue": Selects a value being returned by the selected element.
+ *      This requires that the selected element is a method with a body.
+ *
+ *    An `output` can be either "", "Argument", "Argument[n]", "Parameter",
+ *    "Parameter[n]", or "ReturnValue":
+ *    - "": Selects a read of a selected field, or a selected parameter.
+ *    - "Argument": Selects the post-update value of an argument in a call to the
+ *      selected element. That is, the value of the argument after the call returns.
+ *    - "Argument[n]": Similar to "Argument" but restricted to a specific numbered
+ *      argument (zero-indexed, and `-1` specifies the qualifier).
+ *    - "Parameter": Selects the value of a parameter of the selected element.
+ *      "Parameter" is also allowed in case the selected element is already a
+ *      parameter itself.
+ *    - "Parameter[n]": Similar to "Parameter" but restricted to a specific
+ *      numbered parameter (zero-indexed, and `-1` specifies the value of `this`).
+ *    - "ReturnValue": Selects the return value of a call to the selected element.
+ * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ *    which classes the interpreted elements should be added. For example, for
+ *    sources "remote" indicates a default remote flow source, and for summaries
+ *    "taint" indicates a default additional taint step and "value" indicates a
+ *    globally applicable value-preserving step.
+ */
+
+import java
+private import semmle.code.java.dataflow.DataFlow::DataFlow
+private import internal.DataFlowPrivate
+
+private predicate sourceModelCsv(string row) {
+  row =
+    [
+      // ServletRequestGetParameterMethod
+      "javax.servlet;ServletRequest;false;getParameter;(String);;ReturnValue;remote",
+      "javax.servlet;ServletRequest;false;getParameterValues;(String);;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getParameter;(String);;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getParameterValues;(String);;ReturnValue;remote",
+      // ServletRequestGetParameterMapMethod
+      "javax.servlet;ServletRequest;false;getParameterMap;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getParameterMap;();;ReturnValue;remote",
+      // ServletRequestGetParameterNamesMethod
+      "javax.servlet;ServletRequest;false;getParameterNames;();;ReturnValue;remote",
+      "javax.servlet.http;HttpServletRequest;false;getParameterNames;();;ReturnValue;remote",
+      // HttpServletRequestGetQueryStringMethod
+      "javax.servlet.http;HttpServletRequest;false;getQueryString;();;ReturnValue;remote",
+      //
+      // URLConnectionGetInputStreamMethod
+      "java.net;URLConnection;false;getInputStream;();;ReturnValue;remote",
+      // SocketGetInputStreamMethod
+      "java.net;Socket;false;getInputStream;();;ReturnValue;remote",
+      // BeanValidationSource
+      "javax.validation;ConstraintValidator;true;isValid;;;Parameter[0];remote"
+    ]
+}
+
+private predicate sinkModelCsv(string row) { none() }
+
+private predicate summaryModelCsv(string row) { none() }
+
+/**
+ * A unit class for adding additional source model rows.
+ *
+ * Extend this class to add additional source definitions.
+ */
+class SourceModelCsv extends Unit {
+  /** Holds if `row` specifies a source definition. */
+  abstract predicate row(string row);
+}
+
+/**
+ * A unit class for adding additional sink model rows.
+ *
+ * Extend this class to add additional sink definitions.
+ */
+class SinkModelCsv extends Unit {
+  /** Holds if `row` specifies a sink definition. */
+  abstract predicate row(string row);
+}
+
+/**
+ * A unit class for adding additional summary model rows.
+ *
+ * Extend this class to add additional flow summary definitions.
+ */
+class SummaryModelCsv extends Unit {
+  /** Holds if `row` specifies a summary definition. */
+  abstract predicate row(string row);
+}
+
+private predicate sourceModel(string row) {
+  sourceModelCsv(row) or
+  any(SourceModelCsv s).row(row)
+}
+
+private predicate sinkModel(string row) {
+  sinkModelCsv(row) or
+  any(SinkModelCsv s).row(row)
+}
+
+private predicate summaryModel(string row) {
+  summaryModelCsv(row) or
+  any(SummaryModelCsv s).row(row)
+}
+
+private predicate sourceModel(
+  string namespace, string type, boolean subtypes, string name, string signature, string ext,
+  string output, string kind
+) {
+  exists(string row |
+    sourceModel(row) and
+    row.splitAt(";", 0) = namespace and
+    row.splitAt(";", 1) = type and
+    row.splitAt(";", 2) = subtypes.toString() and
+    subtypes = [true, false] and
+    row.splitAt(";", 3) = name and
+    row.splitAt(";", 4) = signature and
+    row.splitAt(";", 5) = ext and
+    row.splitAt(";", 6) = output and
+    row.splitAt(";", 7) = kind
+  )
+}
+
+private predicate sinkModel(
+  string namespace, string type, boolean subtypes, string name, string signature, string ext,
+  string input, string kind
+) {
+  exists(string row |
+    sinkModel(row) and
+    row.splitAt(";", 0) = namespace and
+    row.splitAt(";", 1) = type and
+    row.splitAt(";", 2) = subtypes.toString() and
+    subtypes = [true, false] and
+    row.splitAt(";", 3) = name and
+    row.splitAt(";", 4) = signature and
+    row.splitAt(";", 5) = ext and
+    row.splitAt(";", 6) = input and
+    row.splitAt(";", 7) = kind
+  )
+}
+
+private predicate summaryModel(
+  string namespace, string type, boolean subtypes, string name, string signature, string ext,
+  string input, string output, string kind
+) {
+  exists(string row |
+    summaryModel(row) and
+    row.splitAt(";", 0) = namespace and
+    row.splitAt(";", 1) = type and
+    row.splitAt(";", 2) = subtypes.toString() and
+    subtypes = [true, false] and
+    row.splitAt(";", 3) = name and
+    row.splitAt(";", 4) = signature and
+    row.splitAt(";", 5) = ext and
+    row.splitAt(";", 6) = input and
+    row.splitAt(";", 7) = output and
+    row.splitAt(";", 8) = kind
+  )
+}
+
+/** Provides a query predicate to check the CSV data for validation errors. */
+module CsvValidation {
+  /** Holds if some row in a CSV-based flow model appears to contain typos. */
+  query predicate invalidModelRow(string msg) {
+    exists(string pred, string namespace, string type, string name, string signature, string ext |
+      sourceModel(namespace, type, _, name, signature, ext, _, _) and pred = "source"
+      or
+      sinkModel(namespace, type, _, name, signature, ext, _, _) and pred = "sink"
+      or
+      summaryModel(namespace, type, _, name, signature, ext, _, _, _) and pred = "summary"
+    |
+      not namespace.regexpMatch("[a-zA-Z0-9_\\.]+") and
+      msg = "Dubious namespace \"" + namespace + "\" in " + pred + " model."
+      or
+      not type.regexpMatch("[a-zA-Z0-9_\\$]+") and
+      msg = "Dubious type \"" + type + "\" in " + pred + " model."
+      or
+      not name.regexpMatch("[a-zA-Z0-9_]*") and
+      msg = "Dubious name \"" + name + "\" in " + pred + " model."
+      or
+      not signature.regexpMatch("|\\([a-zA-Z0-9_\\.\\$<>,]*\\)") and
+      msg = "Dubious signature \"" + signature + "\" in " + pred + " model."
+      or
+      not ext.regexpMatch("|Annotated") and
+      msg = "Unrecognized extra API graph element \"" + ext + "\" in " + pred + " model."
+    )
+    or
+    exists(string pred, string input, string part |
+      sinkModel(_, _, _, _, _, _, input, _) and pred = "sink"
+      or
+      summaryModel(_, _, _, _, _, _, input, _, _) and pred = "summary"
+    |
+      specSplit(input, part, _) and
+      not part.regexpMatch("|Argument|ReturnValue") and
+      not parseArg(part, _) and
+      msg = "Unrecognized input specification \"" + part + "\" in " + pred + " model."
+    )
+    or
+    exists(string pred, string output, string part |
+      sourceModel(_, _, _, _, _, _, output, _) and pred = "source"
+      or
+      summaryModel(_, _, _, _, _, _, _, output, _) and pred = "summary"
+    |
+      specSplit(output, part, _) and
+      not part.regexpMatch("|Argument|Parameter|ReturnValue") and
+      not parseArg(part, _) and
+      not parseParam(part, _) and
+      msg = "Unrecognized output specification \"" + part + "\" in " + pred + " model."
+    )
+    or
+    exists(string pred, string row, int expect |
+      sourceModel(row) and expect = 8 and pred = "source"
+      or
+      sinkModel(row) and expect = 8 and pred = "sink"
+      or
+      summaryModel(row) and expect = 9 and pred = "summary"
+    |
+      exists(int cols |
+        cols = 1 + max(int n | exists(row.splitAt(";", n))) and
+        cols != expect and
+        msg =
+          "Wrong number of columns in " + pred + " model row, expected " + expect + ", got " + cols +
+            "."
+      )
+      or
+      exists(string b |
+        b = row.splitAt(";", 2) and
+        not b = ["true", "false"] and
+        msg = "Invalid boolean \"" + b + "\" in " + pred + " model."
+      )
+    )
+  }
+}
+
+private predicate elementSpec(
+  string namespace, string type, boolean subtypes, string name, string signature, string ext
+) {
+  sourceModel(namespace, type, subtypes, name, signature, ext, _, _) or
+  sinkModel(namespace, type, subtypes, name, signature, ext, _, _) or
+  summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _)
+}
+
+bindingset[namespace, type, subtypes]
+private RefType interpretType(string namespace, string type, boolean subtypes) {
+  exists(RefType t |
+    t.hasQualifiedName(namespace, type) and
+    if subtypes = true then result.getASourceSupertype*() = t else result = t
+  )
+}
+
+private string paramsStringPart(Callable c, int i) {
+  i = -1 and result = "("
+  or
+  exists(int n, string p | c.getParameterType(n).toString() = p |
+    i = 2 * n and result = p
+    or
+    i = 2 * n - 1 and result = "," and n != 0
+  )
+  or
+  i = 2 * c.getNumberOfParameters() and result = ")"
+}
+
+private string paramsString(Callable c) {
+  result = concat(int i | | paramsStringPart(c, i) order by i)
+}
+
+private Element interpretElement0(
+  string namespace, string type, boolean subtypes, string name, string signature
+) {
+  elementSpec(namespace, type, subtypes, name, signature, _) and
+  exists(RefType t | t = interpretType(namespace, type, subtypes) |
+    exists(Member m |
+      result = m and
+      m.getDeclaringType() = t and
+      m.hasName(name)
+    |
+      signature = "" or
+      m.(Callable).getSignature() = any(string nameprefix) + signature or
+      paramsString(m) = signature
+    )
+    or
+    result = t and
+    name = "" and
+    signature = ""
+  )
+}
+
+private Element interpretElement(
+  string namespace, string type, boolean subtypes, string name, string signature, string ext
+) {
+  elementSpec(namespace, type, subtypes, name, signature, ext) and
+  exists(Element e | e = interpretElement0(namespace, type, subtypes, name, signature) |
+    ext = "" and result = e
+    or
+    ext = "Annotated" and result.(Annotatable).getAnAnnotation().getType() = e
+  )
+}
+
+private predicate sourceElement(Element e, string output, string kind) {
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext
+  |
+    sourceModel(namespace, type, subtypes, name, signature, ext, output, kind) and
+    e = interpretElement(namespace, type, subtypes, name, signature, ext)
+  )
+}
+
+private predicate sinkElement(Element e, string input, string kind) {
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext
+  |
+    sinkModel(namespace, type, subtypes, name, signature, ext, input, kind) and
+    e = interpretElement(namespace, type, subtypes, name, signature, ext)
+  )
+}
+
+private predicate summaryElement(Element e, string input, string output, string kind) {
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext
+  |
+    summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind) and
+    e = interpretElement(namespace, type, subtypes, name, signature, ext)
+  )
+}
+
+private string inOutSpec() {
+  sourceModel(_, _, _, _, _, _, result, _) or
+  sinkModel(_, _, _, _, _, _, result, _) or
+  summaryModel(_, _, _, _, _, _, result, _, _) or
+  summaryModel(_, _, _, _, _, _, _, result, _)
+}
+
+private predicate specSplit(string s, string c, int n) {
+  inOutSpec() = s and s.splitAt(" of ", n) = c
+}
+
+private predicate len(string s, int len) { len = 1 + max(int n | specSplit(s, _, n)) }
+
+private string getLast(string s) {
+  exists(int len |
+    len(s, len) and
+    specSplit(s, result, len - 1)
+  )
+}
+
+private predicate parseParam(string c, int n) {
+  specSplit(_, c, _) and c.regexpCapture("Parameter\\[([-0-9]+)\\]", 1).toInt() = n
+}
+
+private predicate parseArg(string c, int n) {
+  specSplit(_, c, _) and c.regexpCapture("Argument\\[([-0-9]+)\\]", 1).toInt() = n
+}
+
+private predicate inputNeedsReference(string c) {
+  c = "Argument" or
+  parseArg(c, _)
+}
+
+private predicate outputNeedsReference(string c) {
+  c = "Argument" or
+  parseArg(c, _) or
+  c = "ReturnValue"
+}
+
+private predicate sourceElementRef(Top ref, string output, string kind) {
+  exists(Element e |
+    sourceElement(e, output, kind) and
+    if outputNeedsReference(getLast(output)) then ref.(Call).getCallee() = e else ref = e
+  )
+}
+
+private predicate sinkElementRef(Top ref, string input, string kind) {
+  exists(Element e |
+    sinkElement(e, input, kind) and
+    if inputNeedsReference(getLast(input)) then ref.(Call).getCallee() = e else ref = e
+  )
+}
+
+private predicate summaryElementRef(Top ref, string input, string output, string kind) {
+  exists(Element e |
+    summaryElement(e, input, output, kind) and
+    if inputNeedsReference(getLast(input)) then ref.(Call).getCallee() = e else ref = e
+  )
+}
+
+private newtype TAstOrNode =
+  TAst(Top t) or
+  TNode(Node n)
+
+private predicate interpretOutput(string output, int idx, Top ref, TAstOrNode node) {
+  (
+    sourceElementRef(ref, output, _) or
+    summaryElementRef(ref, _, output, _)
+  ) and
+  len(output, idx) and
+  node = TAst(ref)
+  or
+  exists(Top mid, string c, Node n |
+    interpretOutput(output, idx + 1, ref, TAst(mid)) and
+    specSplit(output, c, idx) and
+    node = TNode(n)
+  |
+    exists(int pos | n.(PostUpdateNode).getPreUpdateNode().(ArgumentNode).argumentOf(mid, pos) |
+      c = "Argument" or parseArg(c, pos)
+    )
+    or
+    exists(int pos | n.(ParameterNode).isParameterOf(mid, pos) |
+      c = "Parameter" or parseParam(c, pos)
+    )
+    or
+    (c = "Parameter" or c = "") and
+    n.asParameter() = mid
+    or
+    c = "ReturnValue" and
+    n.asExpr().(Call) = mid
+    or
+    c = "" and
+    n.asExpr().(FieldRead).getField() = mid
+  )
+}
+
+private predicate interpretInput(string input, int idx, Top ref, TAstOrNode node) {
+  (
+    sinkElementRef(ref, input, _) or
+    summaryElementRef(ref, input, _, _)
+  ) and
+  len(input, idx) and
+  node = TAst(ref)
+  or
+  exists(Top mid, string c, Node n |
+    interpretInput(input, idx + 1, ref, TAst(mid)) and
+    specSplit(input, c, idx) and
+    node = TNode(n)
+  |
+    exists(int pos | n.(ArgumentNode).argumentOf(mid, pos) | c = "Argument" or parseArg(c, pos))
+    or
+    exists(ReturnStmt ret |
+      c = "ReturnValue" and
+      n.asExpr() = ret.getResult() and
+      mid = ret.getEnclosingCallable()
+    )
+    or
+    exists(FieldWrite fw |
+      c = "" and
+      fw.getField() = mid and
+      n.asExpr() = fw.getRHS()
+    )
+  )
+}
+
+/**
+ * Holds if `node` is specified as a source with the given kind in a CSV flow
+ * model.
+ */
+predicate sourceNode(Node node, string kind) {
+  exists(Top ref, string output |
+    sourceElementRef(ref, output, kind) and
+    interpretOutput(output, 0, ref, TNode(node))
+  )
+}
+
+/**
+ * Holds if `node` is specified as a sink with the given kind in a CSV flow
+ * model.
+ */
+predicate sinkNode(Node node, string kind) {
+  exists(Top ref, string input |
+    sinkElementRef(ref, input, kind) and
+    interpretInput(input, 0, ref, TNode(node))
+  )
+}
+
+/**
+ * Holds if `node1` to `node2` is specified as a flow step with the given kind
+ * in a CSV flow model.
+ */
+predicate summaryStep(Node node1, Node node2, string kind) {
+  exists(Top ref, string input, string output |
+    summaryElementRef(ref, input, output, kind) and
+    interpretInput(input, 0, ref, TNode(node1)) and
+    interpretOutput(output, 0, ref, TNode(node2))
+  )
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
index 4359fdbcbc2..b4235cb2635 100644
--- a/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSources.qll
@@ -24,6 +24,7 @@ import semmle.code.java.frameworks.spring.SpringWebClient
 import semmle.code.java.frameworks.Guice
 import semmle.code.java.frameworks.struts.StrutsActions
 import semmle.code.java.frameworks.Thrift
+private import semmle.code.java.dataflow.ExternalFlow
 
 /** A data flow source of remote user input. */
 abstract class RemoteFlowSource extends DataFlow::Node {
@@ -31,6 +32,12 @@ abstract class RemoteFlowSource extends DataFlow::Node {
   abstract string getSourceType();
 }
 
+private class ExternalRemoteFlowSource extends RemoteFlowSource {
+  ExternalRemoteFlowSource() { sourceNode(this, "remote") }
+
+  override string getSourceType() { result = "external" }
+}
+
 private class RemoteTaintedMethodAccessSource extends RemoteFlowSource {
   RemoteTaintedMethodAccessSource() {
     this.asExpr().(MethodAccess).getMethod() instanceof RemoteTaintedMethod
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
index d129ee6544e..cb219650414 100644
--- a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
@@ -16,6 +16,7 @@ module Frameworks {
   private import semmle.code.java.frameworks.Guice
   private import semmle.code.java.frameworks.Protobuf
   private import semmle.code.java.frameworks.guava.Guava
+  private import semmle.code.java.frameworks.apache.Lang
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll b/java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll
index 2964353ce69..2a58cba6209 100644
--- a/java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll
@@ -268,9 +268,7 @@ predicate exprModulus(Expr e, Bound b, int val, int mod) {
 private predicate condExprBranchModulus(
   ConditionalExpr cond, boolean branch, Bound b, int val, int mod
 ) {
-  exprModulus(cond.getTrueExpr(), b, val, mod) and branch = true
-  or
-  exprModulus(cond.getFalseExpr(), b, val, mod) and branch = false
+  exprModulus(cond.getBranchExpr(branch), b, val, mod)
 }
 
 private predicate addModulus(Expr add, boolean isLeft, Bound b, int val, int mod) {
diff --git a/java/ql/src/semmle/code/java/dataflow/Nullness.qll b/java/ql/src/semmle/code/java/dataflow/Nullness.qll
index 5e90693b0f1..b3c36767758 100644
--- a/java/ql/src/semmle/code/java/dataflow/Nullness.qll
+++ b/java/ql/src/semmle/code/java/dataflow/Nullness.qll
@@ -191,7 +191,7 @@ private predicate varMaybeNull(SsaVariable v, string msg, Expr reason) {
     // Comparisons in finally blocks are excluded since missing exception edges in the CFG could otherwise yield FPs.
     not exists(TryStmt try | try.getFinally() = e.getEnclosingStmt().getEnclosingStmt*()) and
     (
-      exists(ConditionalExpr c | c.getCondition().getAChildExpr*() = e) or
+      e = any(ConditionalExpr c).getCondition().getAChildExpr*() or
       not exists(MethodAccess ma | ma.getAnArgument().getAChildExpr*() = e)
     ) and
     // Don't use a guard as reason if there is a null assignment.
@@ -438,13 +438,8 @@ private predicate varConditionallyNull(SsaExplicitUpdate v, ConditionBlock cond,
     v.getDefiningExpr().(VariableAssign).getSource() = condexpr and
     condexpr.getCondition() = cond.getCondition()
   |
-    condexpr.getTrueExpr() = nullExpr() and
-    branch = true and
-    not condexpr.getFalseExpr() = nullExpr()
-    or
-    condexpr.getFalseExpr() = nullExpr() and
-    branch = false and
-    not condexpr.getTrueExpr() = nullExpr()
+    condexpr.getBranchExpr(branch) = nullExpr() and
+    not condexpr.getBranchExpr(branch.booleanNot()) = nullExpr()
   )
   or
   v.getDefiningExpr().(VariableAssign).getSource() = nullExpr() and
diff --git a/java/ql/src/semmle/code/java/dataflow/RangeAnalysis.qll b/java/ql/src/semmle/code/java/dataflow/RangeAnalysis.qll
index 07860c76ee4..fbda4b5c53d 100644
--- a/java/ql/src/semmle/code/java/dataflow/RangeAnalysis.qll
+++ b/java/ql/src/semmle/code/java/dataflow/RangeAnalysis.qll
@@ -874,7 +874,5 @@ private predicate boundedConditionalExpr(
   ConditionalExpr cond, Bound b, boolean upper, boolean branch, int delta, boolean fromBackEdge,
   int origdelta, Reason reason
 ) {
-  branch = true and bounded(cond.getTrueExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
-  or
-  branch = false and bounded(cond.getFalseExpr(), b, delta, upper, fromBackEdge, origdelta, reason)
+  bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
 }
diff --git a/java/ql/src/semmle/code/java/dataflow/RangeUtils.qll b/java/ql/src/semmle/code/java/dataflow/RangeUtils.qll
index 631145a2aa2..93241e1fe85 100644
--- a/java/ql/src/semmle/code/java/dataflow/RangeUtils.qll
+++ b/java/ql/src/semmle/code/java/dataflow/RangeUtils.qll
@@ -27,10 +27,9 @@ private predicate nonNullSsaFwdStep(SsaVariable v, SsaVariable phi) {
 }
 
 private predicate nonNullDefStep(Expr e1, Expr e2) {
-  exists(ConditionalExpr cond | cond = e2 |
-    cond.getTrueExpr() = e1 and cond.getFalseExpr() instanceof NullLiteral
-    or
-    cond.getFalseExpr() = e1 and cond.getTrueExpr() instanceof NullLiteral
+  exists(ConditionalExpr cond, boolean branch | cond = e2 |
+    cond.getBranchExpr(branch) = e1 and
+    cond.getBranchExpr(branch.booleanNot()) instanceof NullLiteral
   )
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index a80d2940084..015fffe2661 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -7,6 +7,7 @@ private import DataFlowPrivate
 private import semmle.code.java.dataflow.SSA
 private import semmle.code.java.dataflow.TypeFlow
 private import semmle.code.java.controlflow.Guards
+private import semmle.code.java.dataflow.ExternalFlow
 import semmle.code.java.dataflow.InstanceAccess
 
 cached
@@ -405,6 +406,8 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   or
   node2.asExpr().(AssignExpr).getSource() = node1.asExpr()
   or
+  summaryStep(node1, node2, "value")
+  or
   exists(MethodAccess ma, Method m |
     ma = node2.asExpr() and
     m = ma.getMethod() and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index 69189d949f1..f03dab44a4f 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -10,6 +10,7 @@ private import semmle.code.java.dataflow.internal.ContainerFlow
 private import semmle.code.java.frameworks.spring.SpringController
 private import semmle.code.java.frameworks.spring.SpringHttp
 private import semmle.code.java.frameworks.Networking
+private import semmle.code.java.dataflow.ExternalFlow
 import semmle.code.java.dataflow.FlowSteps
 
 /**
@@ -45,6 +46,8 @@ predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   localAdditionalTaintUpdateStep(src.asExpr(),
     sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
   or
+  summaryStep(src, sink, "taint")
+  or
   exists(Argument arg |
     src.asExpr() = arg and
     arg.isVararg() and
diff --git a/java/ql/src/semmle/code/java/deadcode/DeadEnumConstant.qll b/java/ql/src/semmle/code/java/deadcode/DeadEnumConstant.qll
index c29b167d31e..13efdce9a9d 100644
--- a/java/ql/src/semmle/code/java/deadcode/DeadEnumConstant.qll
+++ b/java/ql/src/semmle/code/java/deadcode/DeadEnumConstant.qll
@@ -7,10 +7,7 @@ import semmle.code.java.JDKAnnotations
 Expr valueFlow(Expr src) {
   result = src
   or
-  exists(ConditionalExpr c | result = c |
-    src = c.getTrueExpr() or
-    src = c.getFalseExpr()
-  )
+  result.(ConditionalExpr).getABranchExpr() = src
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/frameworks/Servlets.qll b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
index aa725596c84..3fad8c4e18b 100644
--- a/java/ql/src/semmle/code/java/frameworks/Servlets.qll
+++ b/java/ql/src/semmle/code/java/frameworks/Servlets.qll
@@ -322,3 +322,18 @@ class ServletWebXMLListenerType extends RefType {
     //  - `HttpSessionBindingListener`
   }
 }
+
+/** Holds if `m` is a request handler method (for example `doGet` or `doPost`). */
+predicate isServletRequestMethod(Method m) {
+  m.getDeclaringType() instanceof ServletClass and
+  m.getNumberOfParameters() = 2 and
+  m.getParameter(0).getType() instanceof ServletRequest and
+  m.getParameter(1).getType() instanceof ServletResponse
+}
+
+/** Holds if `ma` is a call that gets a request parameter. */
+predicate isRequestGetParamMethod(MethodAccess ma) {
+  ma.getMethod() instanceof ServletRequestGetParameterMethod or
+  ma.getMethod() instanceof ServletRequestGetParameterMapMethod or
+  ma.getMethod() instanceof HttpServletRequestGetQueryStringMethod
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll b/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll
index 5c277b7200b..db5687f916a 100644
--- a/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll
+++ b/java/ql/src/semmle/code/java/frameworks/SnakeYaml.qll
@@ -7,13 +7,6 @@ import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.DataFlow2
 import semmle.code.java.dataflow.DataFlow3
 
-/**
- * The class `org.yaml.snakeyaml.constructor.Constructor`.
- */
-class SnakeYamlConstructor extends RefType {
-  SnakeYamlConstructor() { this.hasQualifiedName("org.yaml.snakeyaml.constructor", "Constructor") }
-}
-
 /**
  * The class `org.yaml.snakeyaml.constructor.SafeConstructor`.
  */
@@ -24,15 +17,10 @@ class SnakeYamlSafeConstructor extends RefType {
 }
 
 /**
- * An instance of `SafeConstructor` or a `Constructor` that only allows the type that is passed into its argument.
+ * An instance of `SafeConstructor`.
  */
 class SafeSnakeYamlConstruction extends ClassInstanceExpr {
-  SafeSnakeYamlConstruction() {
-    this.getConstructedType() instanceof SnakeYamlSafeConstructor
-    or
-    this.getConstructedType() instanceof SnakeYamlConstructor and
-    this.getNumArgument() > 0
-  }
+  SafeSnakeYamlConstruction() { this.getConstructedType() instanceof SnakeYamlSafeConstructor }
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
index dcf91b36132..e7383affae3 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
@@ -1,27 +1,213 @@
 /** Definitions related to the Apache Commons Lang library. */
 
 import java
+private import semmle.code.java.dataflow.FlowSteps
 
-/*--- Types ---*/
-/** The class `org.apache.commons.lang.RandomStringUtils` or `org.apache.commons.lang3.RandomStringUtils`. */
+/**
+ * The class `org.apache.commons.lang.RandomStringUtils` or `org.apache.commons.lang3.RandomStringUtils`.
+ */
 class TypeApacheRandomStringUtils extends Class {
   TypeApacheRandomStringUtils() {
-    hasQualifiedName("org.apache.commons.lang", "RandomStringUtils") or
-    hasQualifiedName("org.apache.commons.lang3", "RandomStringUtils")
+    this.hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"],
+      "RandomStringUtils")
+  }
+}
+
+/**
+ * The class `org.apache.commons.lang.ArrayUtils` or `org.apache.commons.lang3.ArrayUtils`.
+ */
+class TypeApacheArrayUtils extends Class {
+  TypeApacheArrayUtils() {
+    hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "ArrayUtils")
   }
 }
 
-/*--- Methods ---*/
 /**
  * The method `deserialize` in either `org.apache.commons.lang.SerializationUtils`
  * or `org.apache.commons.lang3.SerializationUtils`.
  */
 class MethodApacheSerializationUtilsDeserialize extends Method {
   MethodApacheSerializationUtilsDeserialize() {
-    (
-      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang", "SerializationUtils") or
-      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "SerializationUtils")
-    ) and
+    this.getDeclaringType()
+        .hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"],
+          "SerializationUtils") and
     this.hasName("deserialize")
   }
 }
+
+/**
+ * A taint preserving method on `org.apache.commons.lang.ArrayUtils` or `org.apache.commons.lang3.ArrayUtils`
+ */
+private class ApacheLangArrayUtilsTaintPreservingMethod extends TaintPreservingCallable {
+  ApacheLangArrayUtilsTaintPreservingMethod() {
+    this.getDeclaringType() instanceof TypeApacheArrayUtils
+  }
+
+  override predicate returnsTaintFrom(int src) {
+    this.hasName(["addAll", "addFirst"]) and
+    src = [0 .. getNumberOfParameters() - 1]
+    or
+    this.hasName([
+        "clone", "nullToEmpty", "remove", "removeAll", "removeElement", "removeElements", "reverse",
+        "shift", "shuffle", "subarray", "swap", "toArray", "toMap", "toObject", "toPrimitive",
+        "toString", "toStringArray"
+      ]) and
+    src = 0
+    or
+    this.hasName("add") and
+    this.getNumberOfParameters() = 2 and
+    src = [0, 1]
+    or
+    this.hasName("add") and
+    this.getNumberOfParameters() = 3 and
+    src = [0, 2]
+  }
+}
+
+private Type getAnExcludedParameterType() {
+  result instanceof PrimitiveType or
+  result.(RefType).hasQualifiedName("java.nio.charset", "Charset") or
+  result.(RefType).hasQualifiedName("java.util", "Locale")
+}
+
+private class ApacheStringUtilsTaintPreservingMethod extends TaintPreservingCallable {
+  ApacheStringUtilsTaintPreservingMethod() {
+    this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "StringUtils") and
+    this.hasName([
+        "abbreviate", "abbreviateMiddle", "appendIfMissing", "appendIfMissingIgnoreCase",
+        "capitalize", "center", "chomp", "chop", "defaultIfBlank", "defaultIfEmpty",
+        "defaultString", "deleteWhitespace", "difference", "firstNonBlank", "firstNonEmpty",
+        "getBytes", "getCommonPrefix", "getDigits", "getIfBlank", "getIfEmpty", "join", "joinWith",
+        "left", "leftPad", "lowerCase", "mid", "normalizeSpace", "overlay", "prependIfMissing",
+        "prependIfMissingIgnoreCase", "remove", "removeAll", "removeEnd", "removeEndIgnoreCase",
+        "removeFirst", "removeIgnoreCase", "removePattern", "removeStart", "removeStartIgnoreCase",
+        "repeat", "replace", "replaceAll", "replaceChars", "replaceEach", "replaceEachRepeatedly",
+        "replaceFirst", "replaceIgnoreCase", "replaceOnce", "replaceOnceIgnoreCase",
+        "replacePattern", "reverse", "reverseDelimited", "right", "rightPad", "rotate", "split",
+        "splitByCharacterType", "splitByCharacterTypeCamelCase", "splitByWholeSeparator",
+        "splitByWholeSeparatorPreserveAllTokens", "splitPreserveAllTokens", "strip", "stripAccents",
+        "stripAll", "stripEnd", "stripStart", "stripToEmpty", "stripToNull", "substring",
+        "substringAfter", "substringAfterLast", "substringBefore", "substringBeforeLast",
+        "substringBetween", "substringsBetween", "swapCase", "toCodePoints", "toEncodedString",
+        "toRootLowerCase", "toRootUpperCase", "toString", "trim", "trimToEmpty", "trimToNull",
+        "truncate", "uncapitalize", "unwrap", "upperCase", "valueOf", "wrap", "wrapIfMissing"
+      ])
+  }
+
+  private predicate isExcludedParameter(int arg) {
+    this.getName().matches(["appendIfMissing%", "prependIfMissing%"]) and arg = [2, 3]
+    or
+    this.getName().matches(["remove%", "split%", "substring%", "strip%"]) and
+    arg = [1 .. getNumberOfParameters() - 1]
+    or
+    this.getName().matches(["chomp", "getBytes", "replace%", "toString", "unwrap"]) and arg = 1
+    or
+    this.getName() = "join" and
+    // Exclude joins of types that render numerically (char[] and non-primitive arrays
+    // are still considered taint sources)
+    exists(PrimitiveType pt |
+      this.getParameterType(arg).(Array).getComponentType() = pt and
+      not pt instanceof CharacterType
+    ) and
+    arg = 0
+  }
+
+  override predicate returnsTaintFrom(int arg) {
+    arg = [0 .. getNumberOfParameters() - 1] and
+    not this.getParameterType(arg) = getAnExcludedParameterType() and
+    not isExcludedParameter(arg)
+  }
+}
+
+/**
+ * A method declared on Apache Commons Lang's `StrBuilder`, or the same class or its
+ * renamed version `TextStringBuilder` in Commons Text.
+ */
+class ApacheStrBuilderCallable extends Callable {
+  ApacheStrBuilderCallable() {
+    this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3.text", "StrBuilder") or
+    this.getDeclaringType()
+        .hasQualifiedName("org.apache.commons.text", ["StrBuilder", "TextStringBuilder"])
+  }
+}
+
+/**
+ * An Apache Commons Lang `StrBuilder` method that adds taint to the `StrBuilder`.
+ */
+private class ApacheStrBuilderTaintingMethod extends ApacheStrBuilderCallable,
+  TaintPreservingCallable {
+  ApacheStrBuilderTaintingMethod() {
+    this instanceof Constructor
+    or
+    this.hasName([
+        "append", "appendAll", "appendFixedWidthPadLeft", "appendFixedWidthPadRight", "appendln",
+        "appendSeparator", "appendWithSeparators", "insert", "readFrom", "replace", "replaceAll",
+        "replaceFirst"
+      ])
+  }
+
+  private predicate consumesTaintFromAllArgs() {
+    // Specifically the append[ln](String, Object...) overloads also consume taint from their other arguments:
+    this.getName() in ["appendAll", "appendWithSeparators"]
+    or
+    this.getName() = ["append", "appendln"] and this.getAParameter().isVarargs()
+    or
+    this.getName() = "appendSeparator" and this.getParameterType(1) instanceof TypeString
+  }
+
+  override predicate transfersTaint(int fromArg, int toArg) {
+    // Taint the qualifier
+    toArg = -1 and
+    (
+      this.getName().matches(["append%", "readFrom"]) and fromArg = 0
+      or
+      this.getName() = "insert" and fromArg = 1
+      or
+      this.getName().matches("replace%") and
+      (
+        if this.getParameterType(0).(PrimitiveType).getName() = "int"
+        then fromArg = 2
+        else fromArg = 1
+      )
+      or
+      this.consumesTaintFromAllArgs() and fromArg in [0 .. this.getNumberOfParameters() - 1]
+    )
+  }
+
+  override predicate returnsTaintFrom(int arg) { this instanceof Constructor and arg = 0 }
+}
+
+/**
+ * An Apache Commons Lang `StrBuilder` method that returns taint from the `StrBuilder`.
+ */
+private class ApacheStrBuilderTaintGetter extends ApacheStrBuilderCallable, TaintPreservingCallable {
+  ApacheStrBuilderTaintGetter() {
+    // Taint getters:
+    this.hasName([
+        "asReader", "asTokenizer", "build", "getChars", "leftString", "midString", "rightString",
+        "subSequence", "substring", "toCharArray", "toString", "toStringBuffer", "toStringBuilder"
+      ])
+    or
+    // Fluent methods that return an alias of `this`:
+    this.getReturnType() = this.getDeclaringType()
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+}
+
+/**
+ * An Apache Commons Lang `StrBuilder` method that writes taint from the `StrBuilder` to some parameter.
+ */
+private class ApacheStrBuilderTaintWriter extends ApacheStrBuilderCallable, TaintPreservingCallable {
+  ApacheStrBuilderTaintWriter() { this.hasName(["appendTo", "getChars"]) }
+
+  override predicate transfersTaint(int fromArg, int toArg) {
+    fromArg = -1 and
+    // appendTo(Readable) and getChars(char[])
+    if this.getNumberOfParameters() = 1
+    then toArg = 0
+    else
+      // getChars(int, int, char[], int)
+      toArg = 2
+  }
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll b/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
index 547a920d749..c6bdf0ea9b9 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
@@ -5,3 +5,4 @@
 import java
 import StringUtils
 import Collections
+import Preconditions
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Preconditions.qll b/java/ql/src/semmle/code/java/frameworks/guava/Preconditions.qll
new file mode 100644
index 00000000000..f9fce517988
--- /dev/null
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Preconditions.qll
@@ -0,0 +1,23 @@
+/** Definitions of flow steps through the Preconditions class in the Guava framework. */
+
+import java
+private import semmle.code.java.dataflow.FlowSteps
+
+/**
+ * The class `com.google.common.base.Preconditions`.
+ */
+class TypeGuavaPreconditions extends Class {
+  TypeGuavaPreconditions() { this.hasQualifiedName("com.google.common.base", "Preconditions") }
+}
+
+/**
+ * A method that returns its argumnets.
+ */
+private class GuavaPreconditionsMethod extends TaintPreservingCallable {
+  GuavaPreconditionsMethod() {
+    this.getDeclaringType() instanceof TypeGuavaPreconditions and
+    this.hasName("checkNotNull")
+  }
+
+  override predicate returnsTaintFrom(int src) { src = 0 }
+}
diff --git a/java/ql/src/semmle/code/xml/MavenPom.qll b/java/ql/src/semmle/code/xml/MavenPom.qll
index 0a545c0bc99..f13680b2b44 100644
--- a/java/ql/src/semmle/code/xml/MavenPom.qll
+++ b/java/ql/src/semmle/code/xml/MavenPom.qll
@@ -28,7 +28,7 @@ class ProtoPom extends XMLElement {
   Version getVersion() { result = this.getAChild() }
 
   /**
-   * Gets a string representing the version, or an empty string if no version
+   * Gets a string representing the version, or an empty string if no `version`
    * tag was provided.
    */
   string getVersionString() {
@@ -53,7 +53,7 @@ class Pom extends ProtoPom {
   Pom() {
     this.getName() = "project" and
     // Ignore "dependency-reduced-pom" files - these are generated by the
-    // shading plugin, and duplicate existing pom files.
+    // Maven Shade Plugin, and duplicate existing POM files.
     this.getFile().getStem() != "dependency-reduced-pom"
   }
 
@@ -77,7 +77,7 @@ class Pom extends ProtoPom {
   /** Gets a child XML element named "dependencies". */
   Dependencies getDependencies() { result = this.getAChild() }
 
-  /** Gets a child XML element named `dependencyManagement`. */
+  /** Gets a child XML element named "dependencyManagement". */
   DependencyManagement getDependencyManagement() { result = getAChild() }
 
   /** Gets a Dependency element for this POM. */
@@ -100,7 +100,8 @@ class Pom extends ProtoPom {
   }
 
   /**
-   * Gets a property value defined for this project with the given name.
+   * Gets a property value defined for this project with the given name, either in a local
+   * `<properties>` section, or in the `<properties>` section of an ancestor POM.
    */
   PomProperty getProperty(string name) {
     result.getName() = name and
@@ -112,7 +113,7 @@ class Pom extends ProtoPom {
    */
   PomElement getProjectProperty() {
     (
-      // It must either be a child of the pom, or a child of the parent node of the pom
+      // It must either be a child of the POM, or a child of the parent node of the POM
       result = getAChild()
       or
       result = getParentPom().getAChild() and
@@ -124,8 +125,8 @@ class Pom extends ProtoPom {
   }
 
   /**
-   * Resolve the given placeholder (if possible) in the static context of this pom. Resolution
-   * occurs by considering the properties defined by this project.
+   * Resolve the given placeholder (if possible) in the static context of this POM. Resolution
+   * occurs by considering the properties defined by this project or an ancestor project.
    */
   string resolvePlaceholder(string name) {
     if name.prefix(8) = "project."
@@ -142,32 +143,33 @@ class Pom extends ProtoPom {
   }
 
   /**
-   * Gets all the dependencies that are exported by this pom. An exported dependency is one that
-   * is transitively available, i.e. one with scope compile.
+   * Gets all the dependencies that are exported by this POM. An exported dependency is one that
+   * is transitively available, i.e. one with scope "compile".
    */
   Dependency getAnExportedDependency() {
     result = getADependency() and result.getScope() = "compile"
   }
 
   /**
-   * Gets a pom dependency that is exported by this pom. An exported dependency is one that
-   * is transitively available, i.e. one with scope compile.
+   * Gets a POM dependency that is exported by this POM. An exported dependency is one that
+   * is transitively available, i.e. one with scope "compile".
    */
   Pom getAnExportedPom() { result = getAnExportedDependency().getPom() }
 
   /**
-   * Gets the `<parent>` element of this pom, if any.
+   * Gets the `<parent>` element of this POM, if any.
    */
   Parent getParentElement() { result = getAChild() }
 
   /**
-   * Gets the pom referred to by the `<parent>` element of this pom, if any.
+   * Gets the POM referred to by the `<parent>` element of this POM, if any.
    */
   Pom getParentPom() { result = getParentElement().getPom() }
 
   /**
    * Gets the version specified for dependency `dep` in a `dependencyManagement`
-   * section if this pom or one of its ancestors.
+   * section in this POM or one of its ancestors, or an empty string if no version
+   * is specified.
    */
   string getVersionStringForDependency(Dependency dep) {
     if exists(getDependencyManagement().getDependency(dep))
@@ -223,12 +225,13 @@ class Dependency extends ProtoPom {
   Pom getPom() { result.getShortCoordinate() = this.getShortCoordinate() }
 
   /**
-   * Gets the jar file that we think maven resolved this dependency to (if any).
+   * Gets the jar file that Maven likely resolved this dependency to (if any).
+   * See `MavenRepo.getAnArtifact(ProtoPom)` for how this match is determined.
    */
   File getJar() { exists(MavenRepo mr | result = mr.getAnArtifact(this)) }
 
   /**
-   * Gets the scope of this dependency. If the scope tag is present, this will
+   * Gets the scope of this dependency. If the `scope` tag is present, this will
    * be the string contents of that tag, otherwise it defaults to "compile".
    */
   string getScope() {
@@ -249,14 +252,14 @@ class Dependency extends ProtoPom {
 }
 
 /**
- * A Maven dependency element that represents an actual dependency from a given pom project.
+ * A Maven dependency element that represents an actual dependency from a given POM project.
  */
 class PomDependency extends Dependency {
   PomDependency() {
     exists(Pom source |
-      // This dependency must be a dependency of a pom - dependency tags can also appear in the dependency
-      // management section, where they do not directly contribute to the dependencies of the containing
-      // pom.
+      // This dependency must be a dependency of a POM - dependency tags can also appear in the
+      // dependencyManagement section, where they do not directly contribute to the dependencies of
+      // the containing POM.
       source.getADependency() = this and
       // Consider dependencies that can be used at compile time.
       (
@@ -284,7 +287,7 @@ class PomElement extends XMLElement {
       s = allCharactersString() and
       if s.matches("${%")
       then
-        // Resolve the placeholder in the parent pom
+        // Resolve the placeholder in the parent POM
         result = getParent*().(Pom).resolvePlaceholder(s.substring(2, s.length() - 1))
       else result = s
     )
@@ -330,7 +333,7 @@ class Dependencies extends PomElement {
   Dependency getADependency() { result = this.getAChild() }
 }
 
-/** An XML element named `dependencyManagement`, as found in Maven POM XML files. */
+/** An XML element named "dependencyManagement", as found in Maven POM XML files. */
 class DependencyManagement extends PomElement {
   DependencyManagement() { getName() = "dependencyManagement" }
 
@@ -349,7 +352,7 @@ class DependencyManagement extends PomElement {
 }
 
 /**
- * An XML element name "properties", as found in Maven POM XML files.
+ * An XML element named "properties", as found in Maven POM XML files.
  */
 class PomProperties extends PomElement {
   PomProperties() { this.getName() = "properties" }
@@ -366,8 +369,8 @@ class PomProperty extends PomElement {
 }
 
 /**
- * A folder that represents a maven local repository using the standard layout. Any folder called
- * "repository" with a parent name ".m2" is considered to be a maven repository.
+ * A folder that represents a local Maven repository using the standard layout. Any folder called
+ * "repository" with a parent name ".m2" is considered to be a Maven repository.
  */
 class MavenRepo extends Folder {
   MavenRepo() { getBaseName() = "repository" and getParentContainer().getBaseName() = ".m2" }
@@ -378,10 +381,10 @@ class MavenRepo extends Folder {
   File getAJarFile() { result = getAChildContainer*().(File) and result.getExtension() = "jar" }
 
   /**
-   * Gets any jar artifacts in this repository that match the pom project definition. This is an
-   * over approximation. For soft qualifiers (e.g. 1.0) we return precise matches in preference to
-   * artefact only matches. For hard qualifiers (e.g. [1.0]) we return only precise matches. For
-   * all other qualifiers, we return all matches regardless of version.
+   * Gets any jar artifacts in this repository that match the POM project definition. This is an
+   * over approximation. For soft qualifiers (e.g. 1.0) precise matches are returned in preference
+   * to artifact-only matches. For hard qualifiers (e.g. [1.0]) only precise matches are returned.
+   * For all other qualifiers, all matches are returned regardless of version.
    */
   MavenRepoJar getAnArtifact(ProtoPom pom) {
     result = getAJarFile() and
@@ -389,7 +392,7 @@ class MavenRepo extends Folder {
     then
       // Either a hard match qualifier, or soft and there is at least one precise match
       result.preciseMatch(pom)
-    else result.artefactMatches(pom)
+    else result.artifactMatches(pom)
   }
 }
 
@@ -401,16 +404,19 @@ private predicate versionHardMatch(ProtoPom pom) {
 }
 
 /**
- * A jar file inside a maven repository.
+ * A jar file inside a Maven repository.
  *
  * See: https://cwiki.apache.org/confluence/display/MAVENOLD/Repository+Layout+-+Final
  */
 class MavenRepoJar extends File {
   MavenRepoJar() { exists(MavenRepo mr | mr.getAJarFile() = this) }
 
-  string getGroupID() {
+  /**
+   * Gets the `groupId` of this jar.
+   */
+  string getGroupId() {
     exists(MavenRepo mr | mr.getAJarFile() = this |
-      // Assuming the standard layout, the first part of the directory structure from the maven
+      // Assuming the standard layout, the first part of the directory structure from the Maven
       // repository will be the groupId converted to a path by replacing "." with "/".
       result =
         getParentContainer()
@@ -422,24 +428,45 @@ class MavenRepoJar extends File {
     )
   }
 
-  string getArtefactID() { result = getParentContainer().getParentContainer().getBaseName() }
+  /**
+   * DEPRECATED: name changed to `getGroupId` for consistent use of camel-case.
+   */
+  deprecated string getGroupID() { result = getGroupId() }
 
+  /**
+   * Gets the `artifactId` of this jar.
+   */
+  string getArtifactId() { result = getParentContainer().getParentContainer().getBaseName() }
+
+  /**
+   * DEPRECATED: name changed to `getArtifactId` for consistent casing and consistent spelling with Maven.
+   */
+  deprecated string getArtefactID() { result = getArtifactId() }
+
+  /**
+   * Gets the artifact version string of this jar.
+   */
   string getVersion() { result = getParentContainer().getBaseName() }
 
   /**
-   * Holds if this jar is an artefact for the given pom or dependency, regardless of which version it is.
+   * Holds if this jar is an artifact for the given POM or dependency, regardless of which version it is.
    */
-  predicate artefactMatches(ProtoPom pom) {
-    pom.getGroup().getValue() = getGroupID() and
-    pom.getArtifact().getValue() = getArtefactID()
+  predicate artifactMatches(ProtoPom pom) {
+    pom.getGroup().getValue() = getGroupId() and
+    pom.getArtifact().getValue() = getArtifactId()
   }
 
   /**
-   * Holds if this jar is both an artefact for the pom, and has a version string that matches the pom
+   * DEPRECATED: name changed to `artifactMatches` for consistent spelling with Maven.
+   */
+  deprecated predicate artefactMatches(ProtoPom pom) { artifactMatches(pom) }
+
+  /**
+   * Holds if this jar is both an artifact for the POM, and has a version string that matches the POM
    * version string. Only soft and hard version matches are supported.
    */
   predicate preciseMatch(ProtoPom pom) {
-    artefactMatches(pom) and
+    artifactMatches(pom) and
     if versionHardMatch(pom)
     then ("[" + getVersion() + "]").matches(pom.getVersionString() + "%")
     else getVersion().matches(pom.getVersionString() + "%")
diff --git a/java/ql/test/TestUtilities/InlineExpectationsTest.qll b/java/ql/test/TestUtilities/InlineExpectationsTest.qll
new file mode 100644
index 00000000000..35798415078
--- /dev/null
+++ b/java/ql/test/TestUtilities/InlineExpectationsTest.qll
@@ -0,0 +1,343 @@
+/**
+ * Provides a library for writing QL tests whose success or failure is based on expected results
+ * embedded in the test source code as comments, rather than a `.expected` file.
+ *
+ * To add this framework to a new language:
+ * - Add a file `InlineExpectationsTestPrivate.qll` that defines a `LineComment` class. This class
+ *   must support a `getContents` method that returns the contents of the given comment, _excluding_
+ *   the comment indicator itself. It should also define `toString` and `getLocation` as usual.
+ *
+ * To create a new inline expectations test:
+ * - Declare a class that extends `InlineExpectationsTest`. In the characteristic predicate of the
+ * new class, bind `this` to a unique string (usually the name of the test).
+ * - Override the `hasActualResult()` predicate to produce the actual results of the query. For each
+ * result, specify a `Location`, a text description of the element for which the result was
+ * reported, a short string to serve as the tag to identify expected results for this test, and the
+ * expected value of the result.
+ * - Override `getARelevantTag()` to return the set of tags that can be produced by
+ * `hasActualResult()`. Often this is just a single tag.
+ *
+ * Example:
+ * ```ql
+ * class ConstantValueTest extends InlineExpectationsTest {
+ *   ConstantValueTest() { this = "ConstantValueTest" }
+ *
+ *   override string getARelevantTag() {
+ *     // We only use one tag for this test.
+ *     result = "const"
+ *   }
+ *
+ *   override predicate hasActualResult(
+ *     Location location, string element, string tag, string value
+ *   ) {
+ *     exists(Expr e |
+ *       tag = "const" and // The tag for this test.
+ *       value = e.getValue() and // The expected value. Will only hold for constant expressions.
+ *       location = e.getLocation() and // The location of the result to be reported.
+ *       element = e.toString() // The display text for the result.
+ *     )
+ *   }
+ * }
+ * ```
+ *
+ * There is no need to write a `select` clause or query predicate. All of the differences between
+ * expected results and actual results will be reported in the `failures()` query predicate.
+ *
+ * To annotate the test source code with an expected result, place a comment starting with a `$` on the
+ * same line as the expected result, with text of the following format as the body of the comment:
+ *
+ * `tag=expected-value`
+ *
+ * Where `tag` is the value of the `tag` parameter from `hasActualResult()`, and `expected-value` is
+ * the value of the `value` parameter from `hasActualResult()`. The `=expected-value` portion may be
+ * omitted, in which case `expected-value` is treated as the empty string. Multiple expectations may
+ * be placed in the same comment. Any actual result that
+ * appears on a line that does not contain a matching expected result comment will be reported with
+ * a message of the form "Unexpected result: tag=value". Any expected result comment for which there
+ * is no matching actual result will be reported with a message of the form
+ * "Missing result: tag=expected-value".
+ *
+ * Example:
+ * ```cpp
+ * int i = x + 5;  // $const=5
+ * int j = y + (7 - 3)  // $const=7 const=3 const=4  // The result of the subtraction is a constant.
+ * ```
+ *
+ * For tests that contain known missing and spurious results, it is possible to further
+ * annotate that a particular expected result is known to be spurious, or that a particular
+ * missing result is known to be missing:
+ *
+ * `$ SPURIOUS: tag=expected-value`  // Spurious result
+ * `$ MISSING: tag=expected-value`  // Missing result
+ *
+ * A spurious expectation is treated as any other expected result, except that if there is no
+ * matching actual result, the message will be of the form "Fixed spurious result: tag=value". A
+ * missing expectation is treated as if there were no expected result, except that if a
+ * matching expected result is found, the message will be of the form
+ * "Fixed missing result: tag=value".
+ *
+ * A single line can contain all the expected, spurious and missing results of that line. For instance:
+ * `$ tag1=value1 SPURIOUS: tag2=value2 MISSING: tag3=value3`.
+ *
+ * If the same result value is expected for two or more tags on the same line, there is a shorthand
+ * notation available:
+ *
+ * `tag1,tag2=expected-value`
+ *
+ * is equivalent to:
+ *
+ * `tag1=expected-value tag2=expected-value`
+ */
+
+private import InlineExpectationsTestPrivate
+
+/**
+ * Base class for tests with inline expectations. The test extends this class to provide the actual
+ * results of the query, which are then compared with the expected results in comments to produce a
+ * list of failure messages that point out where the actual results differ from the expected
+ * results.
+ */
+abstract class InlineExpectationsTest extends string {
+  bindingset[this]
+  InlineExpectationsTest() { any() }
+
+  /**
+   * Returns all tags that can be generated by this test. Most tests will only ever produce a single
+   * tag. Any expected result comments for a tag that is not returned by the `getARelevantTag()`
+   * predicate for an active test will be ignored. This makes it possible to write multiple tests in
+   * different `.ql` files that all query the same source code.
+   */
+  abstract string getARelevantTag();
+
+  /**
+   * Returns the actual results of the query that is being tested. Each result consist of the
+   * following values:
+   * - `location` - The source code location of the result. Any expected result comment must appear
+   *   on the start line of this location.
+   * - `element` - Display text for the element on which the result is reported.
+   * - `tag` - The tag that marks this result as coming from this test. This must be one of the tags
+   *   returned by `getARelevantTag()`.
+   * - `value` - The value of the result, which will be matched against the value associated with
+   *   `tag` in any expected result comment on that line.
+   */
+  abstract predicate hasActualResult(Location location, string element, string tag, string value);
+
+  final predicate hasFailureMessage(FailureLocatable element, string message) {
+    exists(ActualResult actualResult |
+      actualResult.getTest() = this and
+      element = actualResult and
+      (
+        exists(FalseNegativeExpectation falseNegative |
+          falseNegative.matchesActualResult(actualResult) and
+          message = "Fixed missing result:" + falseNegative.getExpectationText()
+        )
+        or
+        not exists(ValidExpectation expectation | expectation.matchesActualResult(actualResult)) and
+        message = "Unexpected result: " + actualResult.getExpectationText()
+      )
+    )
+    or
+    exists(ValidExpectation expectation |
+      not exists(ActualResult actualResult | expectation.matchesActualResult(actualResult)) and
+      expectation.getTag() = getARelevantTag() and
+      element = expectation and
+      (
+        expectation instanceof GoodExpectation and
+        message = "Missing result:" + expectation.getExpectationText()
+        or
+        expectation instanceof FalsePositiveExpectation and
+        message = "Fixed spurious result:" + expectation.getExpectationText()
+      )
+    )
+    or
+    exists(InvalidExpectation expectation |
+      element = expectation and
+      message = "Invalid expectation syntax: " + expectation.getExpectation()
+    )
+  }
+}
+
+/**
+ * RegEx pattern to match a comment containing one or more expected results. The comment must have
+ * `$` as its first non-whitespace character. Any subsequent character
+ * is treated as part of the expected results, except that the comment may contain a `//` sequence
+ * to treat the remainder of the line as a regular (non-interpreted) comment.
+ */
+private string expectationCommentPattern() { result = "\\s*\\$((?:[^/]|/[^/])*)(?://.*)?" }
+
+/**
+ * The possible columns in an expectation comment. The `TDefaultColumn` branch represents the first
+ * column in a comment. This column is not precedeeded by a name. `TNamedColumn(name)` represents a
+ * column containing expected results preceeded by the string `name:`.
+ */
+private newtype TColumn =
+  TDefaultColumn() or
+  TNamedColumn(string name) { name = ["MISSING", "SPURIOUS"] }
+
+bindingset[start, content]
+private int getEndOfColumnPosition(int start, string content) {
+  result =
+    min(string name, int cand |
+      exists(TNamedColumn(name)) and
+      cand = content.indexOf(name + ":") and
+      cand > start
+    |
+      cand
+    )
+  or
+  not exists(string name |
+    exists(TNamedColumn(name)) and
+    content.indexOf(name + ":") > start
+  ) and
+  result = content.length()
+}
+
+private predicate getAnExpectation(
+  LineComment comment, TColumn column, string expectation, string tags, string value
+) {
+  exists(string content |
+    content = comment.getContents().regexpCapture(expectationCommentPattern(), 1) and
+    (
+      column = TDefaultColumn() and
+      exists(int end |
+        end = getEndOfColumnPosition(0, content) and
+        expectation = content.prefix(end).regexpFind(expectationPattern(), _, _).trim()
+      )
+      or
+      exists(string name, int start, int end |
+        column = TNamedColumn(name) and
+        start = content.indexOf(name + ":") + name.length() + 1 and
+        end = getEndOfColumnPosition(start, content) and
+        expectation = content.substring(start, end).regexpFind(expectationPattern(), _, _).trim()
+      )
+    )
+  ) and
+  tags = expectation.regexpCapture(expectationPattern(), 1) and
+  if exists(expectation.regexpCapture(expectationPattern(), 2))
+  then value = expectation.regexpCapture(expectationPattern(), 2)
+  else value = ""
+}
+
+private string getColumnString(TColumn column) {
+  column = TDefaultColumn() and result = ""
+  or
+  column = TNamedColumn(result)
+}
+
+/**
+ * RegEx pattern to match a single expected result, not including the leading `$`. It consists of one or
+ * more comma-separated tags containing only letters, digits, `-` and `_` (note that the first character
+ * must not be a digit), optionally followed by `=` and the expected value.
+ */
+private string expectationPattern() {
+  exists(string tag, string tags, string value |
+    tag = "[A-Za-z-_][A-Za-z-_0-9]*" and
+    tags = "((?:" + tag + ")(?:\\s*,\\s*" + tag + ")*)" and
+    value = "((?:\"[^\"]*\"|'[^']*'|\\S+)*)" and
+    result = tags + "(?:=" + value + ")?"
+  )
+}
+
+private newtype TFailureLocatable =
+  TActualResult(
+    InlineExpectationsTest test, Location location, string element, string tag, string value
+  ) {
+    test.hasActualResult(location, element, tag, value)
+  } or
+  TValidExpectation(LineComment comment, string tag, string value, string knownFailure) {
+    exists(TColumn column, string tags |
+      getAnExpectation(comment, column, _, tags, value) and
+      tag = tags.splitAt(",") and
+      knownFailure = getColumnString(column)
+    )
+  } or
+  TInvalidExpectation(LineComment comment, string expectation) {
+    getAnExpectation(comment, _, expectation, _, _) and
+    not expectation.regexpMatch(expectationPattern())
+  }
+
+class FailureLocatable extends TFailureLocatable {
+  string toString() { none() }
+
+  Location getLocation() { none() }
+
+  final string getExpectationText() { result = getTag() + "=" + getValue() }
+
+  string getTag() { none() }
+
+  string getValue() { none() }
+}
+
+class ActualResult extends FailureLocatable, TActualResult {
+  InlineExpectationsTest test;
+  Location location;
+  string element;
+  string tag;
+  string value;
+
+  ActualResult() { this = TActualResult(test, location, element, tag, value) }
+
+  override string toString() { result = element }
+
+  override Location getLocation() { result = location }
+
+  InlineExpectationsTest getTest() { result = test }
+
+  override string getTag() { result = tag }
+
+  override string getValue() { result = value }
+}
+
+abstract private class Expectation extends FailureLocatable {
+  LineComment comment;
+
+  override string toString() { result = comment.toString() }
+
+  override Location getLocation() { result = comment.getLocation() }
+}
+
+private class ValidExpectation extends Expectation, TValidExpectation {
+  string tag;
+  string value;
+  string knownFailure;
+
+  ValidExpectation() { this = TValidExpectation(comment, tag, value, knownFailure) }
+
+  override string getTag() { result = tag }
+
+  override string getValue() { result = value }
+
+  string getKnownFailure() { result = knownFailure }
+
+  predicate matchesActualResult(ActualResult actualResult) {
+    getLocation().getStartLine() = actualResult.getLocation().getStartLine() and
+    getLocation().getFile() = actualResult.getLocation().getFile() and
+    getTag() = actualResult.getTag() and
+    getValue() = actualResult.getValue()
+  }
+}
+
+/* Note: These next three classes correspond to all the possible values of type `TColumn`. */
+class GoodExpectation extends ValidExpectation {
+  GoodExpectation() { getKnownFailure() = "" }
+}
+
+class FalsePositiveExpectation extends ValidExpectation {
+  FalsePositiveExpectation() { getKnownFailure() = "SPURIOUS" }
+}
+
+class FalseNegativeExpectation extends ValidExpectation {
+  FalseNegativeExpectation() { getKnownFailure() = "MISSING" }
+}
+
+class InvalidExpectation extends Expectation, TInvalidExpectation {
+  string expectation;
+
+  InvalidExpectation() { this = TInvalidExpectation(comment, expectation) }
+
+  string getExpectation() { result = expectation }
+}
+
+query predicate failures(FailureLocatable element, string message) {
+  exists(InlineExpectationsTest test | test.hasFailureMessage(element, message))
+}
diff --git a/java/ql/test/TestUtilities/InlineExpectationsTestPrivate.qll b/java/ql/test/TestUtilities/InlineExpectationsTestPrivate.qll
new file mode 100644
index 00000000000..e2c0e0091ba
--- /dev/null
+++ b/java/ql/test/TestUtilities/InlineExpectationsTestPrivate.qll
@@ -0,0 +1,12 @@
+import java
+
+/**
+ * A class representing line comments in Java, which is simply Javadoc restricted
+ * to EOL comments, with an extra accessor used by the InlineExpectations core code
+ */
+class LineComment extends Javadoc {
+  LineComment() { isEolComment(this) }
+
+  /** Gets the contents of the given comment, _without_ the preceding comment marker (`//`). */
+  string getContents() { result = this.getChild(0).toString() }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java b/java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java
index a45727a7406..1e8ecbbc20d 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java
@@ -87,7 +87,7 @@ public class UnsafeCertTrustTest {
 	/**
 	 * Test the endpoint identification of SSL engine is set to null
 	 */
-	public void testSSLEngineEndpointIdSetNull() {
+	public void testSSLEngineEndpointIdSetNull() throws java.security.NoSuchAlgorithmException {
 		SSLContext sslContext = SSLContext.getInstance("TLS");
 		SSLEngine sslEngine = sslContext.createSSLEngine();
 		SSLParameters sslParameters = sslEngine.getSSLParameters();
@@ -98,7 +98,7 @@ public class UnsafeCertTrustTest {
 	/**
 	 * Test the endpoint identification of SSL engine is not set
 	 */
-	public void testSSLEngineEndpointIdNotSet() {
+	public void testSSLEngineEndpointIdNotSet() throws java.security.NoSuchAlgorithmException {
 		SSLContext sslContext = SSLContext.getInstance("TLS");
 		SSLEngine sslEngine = sslContext.createSSLEngine();
 	}
@@ -106,7 +106,7 @@ public class UnsafeCertTrustTest {
 	/**
 	 * Test the endpoint identification of SSL socket is not set
 	 */
-	public void testSSLSocketEndpointIdNotSet() {
+	public void testSSLSocketEndpointIdNotSet() throws java.security.NoSuchAlgorithmException, java.io.IOException {
 		SSLContext sslContext = SSLContext.getInstance("TLS");
 		final SSLSocketFactory socketFactory = sslContext.getSocketFactory();
 		SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443);
@@ -115,7 +115,7 @@ public class UnsafeCertTrustTest {
 	/**
 	 * Test the endpoint identification of regular socket is not set
 	 */
-	public void testSocketEndpointIdNotSet() {
+	public void testSocketEndpointIdNotSet() throws java.io.IOException {
 		SocketFactory socketFactory = SocketFactory.getDefault();
 		Socket socket = socketFactory.createSocket("www.example.com", 80);
 	}
@@ -127,4 +127,4 @@ public class UnsafeCertTrustTest {
 	// ConnectionFactory connectionFactory = new ConnectionFactory();
 	// connectionFactory.useSslProtocol();
 	// }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.expected b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.expected
new file mode 100644
index 00000000000..605aca10a26
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.expected
@@ -0,0 +1 @@
+| JxBrowserWithoutCertValidationV6_23_1.java:17:27:17:39 | new Browser(...) | This JxBrowser instance may not check HTTPS certificates. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.qlref b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.qlref
new file mode 100644
index 00000000000..cab6f2a4962
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidation.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidationV6_23_1.java b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidationV6_23_1.java
new file mode 100644
index 00000000000..8f7be261413
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/JxBrowserWithoutCertValidationV6_23_1.java
@@ -0,0 +1,36 @@
+import com.teamdev.jxbrowser.chromium.Browser;
+import com.teamdev.jxbrowser.chromium.LoadHandler;
+import com.teamdev.jxbrowser.chromium.LoadParams;
+import com.teamdev.jxbrowser.chromium.CertificateErrorParams;
+
+public class JxBrowserWithoutCertValidationV6_23_1 {
+
+    public static void main(String[] args) {
+
+        badUsage();
+
+        goodUsage();
+
+    }
+
+    private static void badUsage() {
+        Browser browser = new Browser();
+        browser.loadURL("https://example.com");
+        // no further calls
+        // BAD: The browser ignores any certificate error by default!
+    }
+
+    private static void goodUsage() {
+        Browser browser = new Browser();
+        browser.setLoadHandler(new LoadHandler() {
+            public boolean onLoad(LoadParams params) {
+                return true;
+            }
+
+            public boolean onCertificateError(CertificateErrorParams params) {
+                return true; // GOOD: This means that loading will be cancelled on certificate errors
+            }
+        }); // GOOD: A secure `LoadHandler` is used.
+        browser.loadURL("https://example.com");
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/options b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/options
new file mode 100644
index 00000000000..37339271f9c
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.23.1/options
@@ -0,0 +1 @@
+ //semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/jxbrowser-6.23.1
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidation.expected b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidation.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidation.qlref b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidation.qlref
new file mode 100644
index 00000000000..cab6f2a4962
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidation.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidationV6_24.java b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidationV6_24.java
new file mode 100644
index 00000000000..62057fcb8ef
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/JxBrowserWithoutCertValidationV6_24.java
@@ -0,0 +1,36 @@
+import com.teamdev.jxbrowser.chromium.Browser;
+import com.teamdev.jxbrowser.chromium.LoadHandler;
+import com.teamdev.jxbrowser.chromium.LoadParams;
+import com.teamdev.jxbrowser.chromium.CertificateErrorParams;
+
+public class JxBrowserWithoutCertValidationV6_24 {
+
+    public static void main(String[] args) {
+
+        goodUsage();
+
+        goodUsage2();
+
+    }
+
+    private static void goodUsage() {
+        Browser browser = new Browser();
+        browser.loadURL("https://example.com");
+        // no further calls
+        // GOOD: On version 6.24 the browser properly validates certificates by default!
+    }
+
+    private static void goodUsage2() {
+        Browser browser = new Browser();
+        browser.setLoadHandler(new LoadHandler() {
+            public boolean onLoad(LoadParams params) {
+                return true;
+            }
+
+            public boolean onCertificateError(CertificateErrorParams params) {
+                return true; // GOOD: This means that loading will be cancelled on certificate errors
+            }
+        }); // GOOD: A secure `LoadHandler` is used.
+        browser.loadURL("https://example.com");
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/options b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/options
new file mode 100644
index 00000000000..f001bf777a2
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-295/jxbrowser-6.24/options
@@ -0,0 +1 @@
+ //semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/jxbrowser-6.24
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java
index 05d700437dd..62c64027695 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureJavaMail.java
@@ -29,7 +29,7 @@ class InsecureJavaMail {
 		final Session session = Session.getInstance(properties, authenticator);
 	}
 
-	public void testSimpleMail() {
+	public void testSimpleMail() throws Exception {
 		Email email = new SimpleEmail();
 		email.setHostName("config.hostName");
 		email.setSmtpPort(25);
@@ -42,4 +42,4 @@ class InsecureJavaMail {
 		email.addTo("toAddress");
 		email.send();
 	}
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-312/CleartextStorageSharedPrefs.java b/java/ql/test/experimental/query-tests/security/CWE-312/CleartextStorageSharedPrefs.java
index 51a92314c67..39614c82234 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-312/CleartextStorageSharedPrefs.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-312/CleartextStorageSharedPrefs.java
@@ -20,7 +20,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 	}
 
 	// GOOD - save sensitive information in encrypted format
-	public void testSetSharedPrefs2(Context context, String name, String password) {
+	public void testSetSharedPrefs2(Context context, String name, String password) throws Exception {
 		SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
 		Editor editor = sharedPrefs.edit();
 		editor.putString("name", encrypt(name));
@@ -28,7 +28,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 		editor.commit();
 	}
 
-	private static String encrypt(String cleartext) {
+	private static String encrypt(String cleartext) throws Exception {
 		// Use an encryption or hashing algorithm in real world. The demo below just returns its hash.
 		MessageDigest digest = MessageDigest.getInstance("SHA-256");
 		byte[] hash = digest.digest(cleartext.getBytes(StandardCharsets.UTF_8));
@@ -37,7 +37,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 	}
 
 	// GOOD - save sensitive information in encrypted format using separate variables
-	public void testSetSharedPrefs3(Context context, String name, String password) {
+	public void testSetSharedPrefs3(Context context, String name, String password) throws Exception {
 		String encUsername = encrypt(name);
 		String encPassword = encrypt(password);
 		SharedPreferences sharedPrefs = context.getSharedPreferences("user_prefs", Context.MODE_PRIVATE);
@@ -49,7 +49,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 
 
 	// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
-	public void testSetSharedPrefs4(Context context, String name, String password) {
+	public void testSetSharedPrefs4(Context context, String name, String password) throws Exception {
 		MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
 			.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
 			.build();
@@ -69,7 +69,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 	}
 
 	// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
-	public void testSetSharedPrefs5(Context context, String name, String password) {
+	public void testSetSharedPrefs5(Context context, String name, String password) throws Exception {
 		MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
 			.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
 			.build();
@@ -89,7 +89,7 @@ public class CleartextStorageSharedPrefs extends Activity {
 	}
 
 	// GOOD - save sensitive information using the built-in `EncryptedSharedPreferences` class in androidx
-	public void testSetSharedPrefs6(Context context, String name, String password) {
+	public void testSetSharedPrefs6(Context context, String name, String password) throws Exception {
 		MasterKey masterKey = new MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
 			.setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
 			.build();
diff --git a/java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java b/java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java
index df46d6e69a9..a606017a27e 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java
@@ -3,7 +3,7 @@ import java.security.spec.ECGenParameterSpec;
 import javax.crypto.KeyGenerator;
 
 public class InsufficientKeySize {
-    public void CryptoMethod() {
+    public void CryptoMethod() throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
         KeyGenerator keyGen1 = KeyGenerator.getInstance("AES");
         // BAD: Key size is less than 128
         keyGen1.init(64);
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.java b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.java
index 1f7be303471..c59af48e09b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.java
@@ -57,7 +57,7 @@ public class InsecureBasicAuth {
 	/**
 	 * Test basic authentication with Apache HTTP POST request using the URI constructor with one argument.
 	 */
-	public void testApacheHttpRequest4(String username, String password) {
+	public void testApacheHttpRequest4(String username, String password) throws Exception {
 		String uriStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
 		URI uri = new URI(uriStr);
 		HttpRequestBase post = new HttpPost(uri);
@@ -74,7 +74,7 @@ public class InsecureBasicAuth {
 	/**
 	 * Test basic authentication with Apache HTTP POST request using a URI constructor with multiple arguments.
 	 */
-	public void testApacheHttpRequest5(String username, String password) {
+	public void testApacheHttpRequest5(String username, String password) throws Exception {
 		HttpRequestBase post = new HttpPost(new URI("http", "www.example.com", "/test", "abc=123", null));
 		post.setHeader("Accept", "application/json");
 		post.setHeader("Content-type", "application/json");
@@ -122,7 +122,7 @@ public class InsecureBasicAuth {
 	/**
 	 * Test basic authentication with Java HTTP URL connection using the `URL(String spec)` constructor.
 	 */
-	public void testHttpUrlConnection(String username, String password) {
+	public void testHttpUrlConnection(String username, String password) throws Exception {
 		String urlStr = "http://www.example.com/rest/getuser.do?uid=abcdx";
 		String authString = username + ":" + password;
 		String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
@@ -136,7 +136,7 @@ public class InsecureBasicAuth {
 	/**
 	 * Test basic authentication with Java HTTP URL connection using the `URL(String protocol, String host, String file)` constructor.
 	 */
-	public void testHttpUrlConnection2(String username, String password) {
+	public void testHttpUrlConnection2(String username, String password) throws Exception {
 		String host = "www.example.com";
 		String path = "/rest/getuser.do?uid=abcdx";
 		String protocol = "http";
@@ -152,7 +152,7 @@ public class InsecureBasicAuth {
 	/**
 	 * Test basic authentication with Java HTTP URL connection using a constructor with private URL.
 	 */
-	public void testHttpUrlConnection3(String username, String password) {
+	public void testHttpUrlConnection3(String username, String password) throws Exception {
 		String host = "LOCALHOST";
 		String authString = username + ":" + password;
 		String encoding = Base64.getEncoder().encodeToString(authString.getBytes("UTF-8"));
@@ -161,4 +161,4 @@ public class InsecureBasicAuth {
 		conn.setDoOutput(true);
 		conn.setRequestProperty("Authorization", "Basic " + encoding);
 	}
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java
index 14142d31b21..978a4df671b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureLdapAuth.java
@@ -7,7 +7,7 @@ import javax.naming.ldap.InitialLdapContext;
 
 public class InsecureLdapAuth {
 	// BAD - Test LDAP authentication in cleartext using `DirContext`.
-	public void testCleartextLdapAuth(String ldapUserName, String password) {
+	public void testCleartextLdapAuth(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://ad.your-server.com:389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -21,7 +21,7 @@ public class InsecureLdapAuth {
 	}
 
 	// BAD - Test LDAP authentication in cleartext using `DirContext`.
-	public void testCleartextLdapAuth(String ldapUserName, String password, String serverName) {
+	public void testCleartextLdapAuth(String ldapUserName, String password, String serverName) throws Exception {
 		String ldapUrl = "ldap://"+serverName+":389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -35,7 +35,7 @@ public class InsecureLdapAuth {
 	}
 
 	// GOOD - Test LDAP authentication over SSL.
-	public void testSslLdapAuth(String ldapUserName, String password) {
+	public void testSslLdapAuth(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldaps://ad.your-server.com:636";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -49,7 +49,7 @@ public class InsecureLdapAuth {
 	}
 
 	// GOOD - Test LDAP authentication over SSL.
-	public void testSslLdapAuth2(String ldapUserName, String password) {
+	public void testSslLdapAuth2(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://ad.your-server.com:636";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -64,7 +64,7 @@ public class InsecureLdapAuth {
 	}
 
 	// GOOD - Test LDAP authentication with SASL authentication.
-	public void testSaslLdapAuth(String ldapUserName, String password) {
+	public void testSaslLdapAuth(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://ad.your-server.com:389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -78,7 +78,7 @@ public class InsecureLdapAuth {
 	}
 
 	// GOOD - Test LDAP authentication in cleartext connecting to local LDAP server.
-	public void testCleartextLdapAuth2(String ldapUserName, String password) {
+	public void testCleartextLdapAuth2(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://localhost:389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -92,7 +92,7 @@ public class InsecureLdapAuth {
 	}
 
 	// BAD - Test LDAP authentication in cleartext using `InitialLdapContext`.
-	public void testCleartextLdapAuth3(String ldapUserName, String password) {
+	public void testCleartextLdapAuth3(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://ad.your-server.com:389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
@@ -107,7 +107,7 @@ public class InsecureLdapAuth {
 
 
 	// BAD - Test LDAP authentication in cleartext using `DirContext` and string literals.
-	public void testCleartextLdapAuth4(String ldapUserName, String password) {
+	public void testCleartextLdapAuth4(String ldapUserName, String password) throws Exception {
 		String ldapUrl = "ldap://ad.your-server.com:389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put("java.naming.factory.initial",
@@ -131,7 +131,7 @@ public class InsecureLdapAuth {
 	}
 
 	// GOOD - Test LDAP authentication with `ssl` configuration and basic authentication.
-	public void testCleartextLdapAuth5(String ldapUserName, String password, String serverName) {
+	public void testCleartextLdapAuth5(String ldapUserName, String password, String serverName) throws Exception {
 		String ldapUrl = "ldap://"+serverName+":389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		setSSL(environment);
@@ -143,7 +143,7 @@ public class InsecureLdapAuth {
 	}
 
 	// BAD - Test LDAP authentication with basic authentication.
-	public void testCleartextLdapAuth6(String ldapUserName, String password, String serverName) {
+	public void testCleartextLdapAuth6(String ldapUserName, String password, String serverName) throws Exception {
 		String ldapUrl = "ldap://"+serverName+":389";
 		Hashtable<String, String> environment = new Hashtable<String, String>();
 		environment.put(Context.INITIAL_CONTEXT_FACTORY,
diff --git a/java/ql/test/experimental/query-tests/security/CWE-548/A.java b/java/ql/test/experimental/query-tests/security/CWE-548/A.java
new file mode 100644
index 00000000000..f7e8cc3b903
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-548/A.java
@@ -0,0 +1,2 @@
+public class A {
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/A.java b/java/ql/test/experimental/query-tests/security/CWE-555/A.java
new file mode 100644
index 00000000000..f7e8cc3b903
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/A.java
@@ -0,0 +1,2 @@
+public class A {
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected
new file mode 100644
index 00000000000..8e96a3ebfc0
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.expected
@@ -0,0 +1,39 @@
+edges
+| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object |
+| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password |
+| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | SensitiveGetQuery2.java:15:29:15:36 | password : Object |
+| SensitiveGetQuery2.java:15:29:15:36 | password : Object | SensitiveGetQuery2.java:18:40:18:54 | password : Object |
+| SensitiveGetQuery2.java:18:40:18:54 | password : Object | SensitiveGetQuery2.java:19:61:19:68 | password |
+| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password |
+| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String |
+| SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String | SensitiveGetQuery4.java:16:37:16:47 | accessToken |
+| SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String |
+| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password |
+| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password : String |
+| SensitiveGetQuery.java:14:29:14:36 | password : String | SensitiveGetQuery.java:17:40:17:54 | password : String |
+| SensitiveGetQuery.java:17:40:17:54 | password : String | SensitiveGetQuery.java:18:61:18:68 | password |
+nodes
+| SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | semmle.label | getParameterMap(...) : Map |
+| SensitiveGetQuery2.java:14:21:14:48 | (...)... : Object | semmle.label | (...)... : Object |
+| SensitiveGetQuery2.java:15:29:15:36 | password | semmle.label | password |
+| SensitiveGetQuery2.java:15:29:15:36 | password : Object | semmle.label | password : Object |
+| SensitiveGetQuery2.java:18:40:18:54 | password : Object | semmle.label | password : Object |
+| SensitiveGetQuery2.java:19:61:19:68 | password | semmle.label | password |
+| SensitiveGetQuery3.java:12:21:12:60 | getRequestParameter(...) : String | semmle.label | getRequestParameter(...) : String |
+| SensitiveGetQuery3.java:13:57:13:64 | password | semmle.label | password |
+| SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SensitiveGetQuery4.java:14:24:14:66 | getRequestParameter(...) : String | semmle.label | getRequestParameter(...) : String |
+| SensitiveGetQuery4.java:16:37:16:47 | accessToken | semmle.label | accessToken |
+| SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SensitiveGetQuery.java:14:29:14:36 | password | semmle.label | password |
+| SensitiveGetQuery.java:14:29:14:36 | password : String | semmle.label | password : String |
+| SensitiveGetQuery.java:17:40:17:54 | password : String | semmle.label | password : String |
+| SensitiveGetQuery.java:18:61:18:68 | password | semmle.label | password |
+#select
+| SensitiveGetQuery2.java:15:29:15:36 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:15:29:15:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
+| SensitiveGetQuery2.java:19:61:19:68 | password | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) : Map | SensitiveGetQuery2.java:19:61:19:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery2.java:12:13:12:37 | getParameterMap(...) | This request |
+| SensitiveGetQuery3.java:13:57:13:64 | password | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) : String | SensitiveGetQuery3.java:13:57:13:64 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery3.java:17:10:17:40 | getParameter(...) | This request |
+| SensitiveGetQuery4.java:16:37:16:47 | accessToken | SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) : String | SensitiveGetQuery4.java:16:37:16:47 | accessToken | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery4.java:20:10:20:40 | getParameter(...) | This request |
+| SensitiveGetQuery.java:14:29:14:36 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:14:29:14:36 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |
+| SensitiveGetQuery.java:18:61:18:68 | password | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) : String | SensitiveGetQuery.java:18:61:18:68 | password | $@ uses the GET request method to transmit sensitive information. | SensitiveGetQuery.java:12:21:12:52 | getParameter(...) | This request |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.java b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.java
new file mode 100644
index 00000000000..2b7386bb600
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.java
@@ -0,0 +1,26 @@
+import java.io.IOException;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+public class SensitiveGetQuery extends HttpServlet {
+	// BAD - Tests retrieving sensitive information through `request.getParameter()` in a GET request.
+	public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String username = request.getParameter("username");
+		String password = request.getParameter("password");
+
+		processUserInfo(username, password);
+	}
+
+	void processUserInfo(String username, String password) {
+		System.out.println("username = " + username+"; password "+password);
+	}
+
+	// GOOD - Tests retrieving sensitive information through `request.getParameter()` in a POST request.
+	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String password = request.getParameter("password");
+		System.out.println("password = " + password);
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.qlref b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.qlref
new file mode 100644
index 00000000000..733a97af52d
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery2.java b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery2.java
new file mode 100644
index 00000000000..6b4fec0b331
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery2.java
@@ -0,0 +1,29 @@
+import java.io.IOException;
+import java.util.Map;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+public class SensitiveGetQuery2 extends HttpServlet {
+	// BAD - Tests retrieving sensitive information through `request.getParameterMap()` in a GET request.
+	public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		Map map = request.getParameterMap();
+		String username = (String) map.get("username");
+		String password = (String) map.get("password");
+		processUserInfo(username, password);
+	}
+
+	void processUserInfo(String username, String password) {
+		System.out.println("username = " + username+"; password "+password);
+	}
+
+	// GOOD - Tests retrieving sensitive information through `request.getParameterMap()` in a POST request.
+	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		Map map = request.getParameterMap();
+		String username = (String) map.get("username");
+		String password = (String) map.get("password");
+		processUserInfo(username, password);
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery3.java b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery3.java
new file mode 100644
index 00000000000..5d191bb52b1
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery3.java
@@ -0,0 +1,26 @@
+import java.io.IOException;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+public class SensitiveGetQuery3 extends HttpServlet {
+	// BAD - Tests retrieving sensitive information through a wrapper call in a GET request.
+	public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String username = getRequestParameter(request, "username");
+		String password = getRequestParameter(request, "password");
+		System.out.println("Username="+username+"; password="+password);
+	}
+
+	String getRequestParameter(HttpServletRequest request, String paramName) {
+		return request.getParameter(paramName);
+	}
+
+	// GOOD - Tests retrieving sensitive information through a wrapper call in a POST request.
+	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String username = getRequestParameter(request, "username");
+		String password = getRequestParameter(request, "password");
+		System.out.println("Username="+username+"; password="+password);
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery4.java b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery4.java
new file mode 100644
index 00000000000..29e94d254d4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/SensitiveGetQuery4.java
@@ -0,0 +1,32 @@
+import java.io.IOException;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+public class SensitiveGetQuery4 extends HttpServlet {
+	// BAD - Tests retrieving non-sensitive tokens and sensitive tokens in a GET request.
+	public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String username = getRequestParameter(request, "username");
+		String token = getRequestParameter(request, "token");
+		String tokenType = getRequestParameter(request, "tokenType");
+		String accessToken = getRequestParameter(request, "accessToken");
+		System.out.println("Username="+username+"; token="+token+"; tokenType="+tokenType);
+		System.out.println("AccessToken="+accessToken);
+	}
+
+	String getRequestParameter(HttpServletRequest request, String paramName) {
+		return request.getParameter(paramName);
+	}
+
+	// GOOD - Tests retrieving non-sensitive tokens and sensitive tokens in a POST request.
+	public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+		String username = getRequestParameter(request, "username");
+		String token = getRequestParameter(request, "token");
+		String tokenType = getRequestParameter(request, "tokenType");
+		String accessToken = getRequestParameter(request, "accessToken");
+		System.out.println("Username="+username+"; token="+token+"; tokenType="+tokenType);
+		System.out.println("AccessToken="+accessToken);
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-598/options b/java/ql/test/experimental/query-tests/security/CWE-598/options
new file mode 100644
index 00000000000..dd125ad0f4e
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-598/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.qlref b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.qlref
index 3d529ae5a2c..3e35024c212 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.qlref
+++ b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.qlref
@@ -1 +1 @@
-experimental/CWE-918/RequestForgery.ql
\ No newline at end of file
+experimental/Security/CWE/CWE-918/RequestForgery.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-918/SpringSSRF.java b/java/ql/test/experimental/query-tests/security/CWE-918/SpringSSRF.java
index ddd8ecc3dd6..a7d3cb32b87 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-918/SpringSSRF.java
+++ b/java/ql/test/experimental/query-tests/security/CWE-918/SpringSSRF.java
@@ -26,7 +26,7 @@ public class SpringSSRF extends HttpServlet {
         String fooResourceUrl = request2.getParameter("uri");;
         RestTemplate restTemplate = new RestTemplate();
         HttpEntity<String> request = new HttpEntity<>(new String("bar"));
-
+        try {
         {
             ResponseEntity<String> response =
                     restTemplate.getForEntity(fooResourceUrl + "/1", String.class);
@@ -68,5 +68,6 @@ public class SpringSSRF extends HttpServlet {
         {
             restTemplate.put(fooResourceUrl, new String("object"));
         }
+        } catch (org.springframework.web.client.RestClientException | java.net.URISyntaxException e) {}
     }
 }
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/Browser.java b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/Browser.java
new file mode 100644
index 00000000000..327a4b4ecd8
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/Browser.java
@@ -0,0 +1,9 @@
+package com.teamdev.jxbrowser.chromium;
+
+public class Browser extends java.lang.Object {
+    public void setLoadHandler(LoadHandler handler) {
+    }
+
+    public void loadURL(String url) {
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java
new file mode 100644
index 00000000000..904b98a6c51
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java
@@ -0,0 +1,5 @@
+package com.teamdev.jxbrowser.chromium;
+
+public final class CertificateErrorParams extends Object {
+
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadHandler.java b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadHandler.java
new file mode 100644
index 00000000000..a628d88439c
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadHandler.java
@@ -0,0 +1,7 @@
+package com.teamdev.jxbrowser.chromium;
+
+public interface LoadHandler {
+    boolean onCertificateError(CertificateErrorParams params);
+
+    boolean onLoad(LoadParams params);
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadParams.java b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadParams.java
new file mode 100644
index 00000000000..213e54f1dbc
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.23.1/com/teamdev/jxbrowser/chromium/LoadParams.java
@@ -0,0 +1,5 @@
+package com.teamdev.jxbrowser.chromium;
+
+public final class LoadParams extends Object {
+
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/BoundsListener.java b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/BoundsListener.java
new file mode 100644
index 00000000000..39bb56e0565
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/BoundsListener.java
@@ -0,0 +1,5 @@
+package com.teamdev.jxbrowser.chromium;
+
+public interface BoundsListener {
+
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/Browser.java b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/Browser.java
new file mode 100644
index 00000000000..c32656e4228
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/Browser.java
@@ -0,0 +1,13 @@
+package com.teamdev.jxbrowser.chromium;
+
+public class Browser extends java.lang.Object {
+    public void setLoadHandler(LoadHandler handler) {
+    }
+
+    public void loadURL(String url) {
+    }
+
+    public void addBoundsListener(BoundsListener listener) {
+
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java
new file mode 100644
index 00000000000..904b98a6c51
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/CertificateErrorParams.java
@@ -0,0 +1,5 @@
+package com.teamdev.jxbrowser.chromium;
+
+public final class CertificateErrorParams extends Object {
+
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadHandler.java b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadHandler.java
new file mode 100644
index 00000000000..a628d88439c
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadHandler.java
@@ -0,0 +1,7 @@
+package com.teamdev.jxbrowser.chromium;
+
+public interface LoadHandler {
+    boolean onCertificateError(CertificateErrorParams params);
+
+    boolean onLoad(LoadParams params);
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadParams.java b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadParams.java
new file mode 100644
index 00000000000..213e54f1dbc
--- /dev/null
+++ b/java/ql/test/experimental/stubs/jxbrowser-6.24/com/teamdev/jxbrowser/chromium/LoadParams.java
@@ -0,0 +1,5 @@
+package com.teamdev.jxbrowser.chromium;
+
+public final class LoadParams extends Object {
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/ExternalProcess/Test.java b/java/ql/test/library-tests/ExternalProcess/Test.java
index c3554589282..ee29327ef90 100644
--- a/java/ql/test/library-tests/ExternalProcess/Test.java
+++ b/java/ql/test/library-tests/ExternalProcess/Test.java
@@ -43,28 +43,28 @@ class Test {
 		new Bogus().exec("Irrelevant version of exec");
 	}
 
-	void apacheExecute1() {
+	void apacheExecute1() throws IOException {
 		String line = "AcroRd32.exe /p /h some.file";
 		CommandLine cmdLine = CommandLine.parse(line);
 		DefaultExecutor executor = new DefaultExecutor();
 		int exitValue = executor.execute(cmdLine);
 	}
 
-	void apacheExecute2() {
+	void apacheExecute2() throws IOException {
 		String line = "AcroRd32.exe /p /h some.file";
 		CommandLine cmdLine = CommandLine.parse(line, null);
 		DefaultExecutor executor = new DefaultExecutor();
 		int exitValue = executor.execute(cmdLine);
 	}
 
-	void apacheExecute3() {
+	void apacheExecute3() throws IOException {
 		CommandLine cmdLine = new CommandLine("AcroRd32.exe");
 		cmdLine.addArguments("/p /h some.file");
 		DefaultExecutor executor = new DefaultExecutor();
 		int exitValue = executor.execute(cmdLine);
 	}
 
-	void apacheExecute4() {
+	void apacheExecute4() throws IOException {
 		CommandLine cmdLine = new CommandLine("AcroRd32.exe");
 		cmdLine.addArguments("/p /h some.file", false);
 		DefaultExecutor executor = new DefaultExecutor();
diff --git a/java/ql/test/library-tests/RelativePaths/Test.java b/java/ql/test/library-tests/RelativePaths/Test.java
index 860b7ffbecf..4c020819121 100644
--- a/java/ql/test/library-tests/RelativePaths/Test.java
+++ b/java/ql/test/library-tests/RelativePaths/Test.java
@@ -1,5 +1,5 @@
 class Test {
-	public static void main(String[] args) {
+	public static void main(String[] args) throws java.io.IOException {
 		// Relative paths
 		Runtime.getRuntime().exec("make");
 		Runtime.getRuntime().exec("m");
diff --git a/java/ql/test/library-tests/commentedcode/CommentedCode.java b/java/ql/test/library-tests/commentedcode/CommentedCode.java
index fa14ad7cc69..02bee2fe2f9 100644
--- a/java/ql/test/library-tests/commentedcode/CommentedCode.java
+++ b/java/ql/test/library-tests/commentedcode/CommentedCode.java
@@ -88,8 +88,8 @@ public class CommentedCode {
 		 * &nbsp ;
 		 * &nbsp ;
 		 */
+		return -1;
 	}
-	
 //	public static int commentedOutMethod(){
 //		
 //		return 123;
diff --git a/java/ql/test/library-tests/dataflow/capture/A.java b/java/ql/test/library-tests/dataflow/capture/A.java
index 2311179499a..8bc40f9ae77 100644
--- a/java/ql/test/library-tests/dataflow/capture/A.java
+++ b/java/ql/test/library-tests/dataflow/capture/A.java
@@ -32,7 +32,7 @@ public class A {
           case 0: return p;
           case 1: return s;
           case 2: return b1.getElem();
-          case 3: return b2.getElem();
+          default:return b2.getElem();
         }
       }
     };
diff --git a/java/ql/test/library-tests/dataflow/external-models/A.java b/java/ql/test/library-tests/dataflow/external-models/A.java
new file mode 100644
index 00000000000..01ef7bfd977
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/A.java
@@ -0,0 +1,62 @@
+package my.qltest;
+
+public class A {
+  void foo() {
+    Object x;
+    x = src1();
+    x = src1("");
+
+    Sub sub = new Sub();
+    x = sub.src2();
+    x = sub.src3();
+
+    srcArg(x);
+
+    Handler h = srcparam1 -> { };
+
+    Handler h2 = new Handler() {
+      @Override public void handle(Object srcparam2) { }
+    };
+
+    x = taggedSrcMethod();
+    x = taggedSrcField;
+
+    x = srcTwoArg("", "");
+  }
+
+  @Tag
+  void tagged1(Object taggedMethodParam) {
+  }
+
+  void tagged2(@Tag Object taggedSrcParam) {
+  }
+
+  Object src1() { return null; }
+
+  Object src1(String s) { return null; }
+
+  Object src2() { return null; }
+
+  Object src3() { return null; }
+
+  static class Sub extends A {
+    // inherit src2
+    @Override Object src3() { return null; }
+  }
+
+  void srcArg(Object src) { }
+
+  interface Handler {
+    void handle(Object src);
+  }
+
+  @interface Tag { }
+
+  @Tag
+  Object taggedSrcMethod() { return null; }
+
+  @Tag
+  Object taggedSrcField;
+
+  Object srcTwoArg(String s1, String s2) { return null; }
+}
diff --git a/java/ql/test/library-tests/dataflow/external-models/B.java b/java/ql/test/library-tests/dataflow/external-models/B.java
new file mode 100644
index 00000000000..23f0d323e6f
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/B.java
@@ -0,0 +1,35 @@
+package my.qltest;
+
+public class B {
+  void foo() {
+    Object arg1 = new Object();
+    sink1(arg1);
+
+    Object argToTagged = new Object();
+    taggedSinkMethod(argToTagged);
+
+    Object fieldWrite = new Object();
+    taggedField = fieldWrite;
+  }
+
+  Object sinkMethod() {
+    Object res = new Object();
+    return res;
+  }
+
+  @Tag
+  Object taggedSinkMethod() {
+    Object resTag = new Object();
+    return resTag;
+  }
+
+  void sink1(Object x) { }
+
+  @interface Tag { }
+
+  @Tag
+  void taggedSinkMethod(Object x) { }
+
+  @Tag
+  Object taggedField;
+}
diff --git a/java/ql/test/library-tests/dataflow/external-models/C.java b/java/ql/test/library-tests/dataflow/external-models/C.java
new file mode 100644
index 00000000000..44e01158a1f
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/C.java
@@ -0,0 +1,36 @@
+package my.qltest;
+
+public class C {
+  void foo() {
+    Object arg1 = new Object();
+    stepArgRes(arg1);
+
+    Object argIn1 = new Object();
+    Object argOut1 = new Object();
+    stepArgArg(argIn1, argOut1);
+    Object argIn2 = new Object();
+    Object argOut2 = new Object();
+    stepArgArg(argIn2, argOut2);
+
+    Object arg2 = new Object();
+    stepArgQual(arg2);
+    Object arg3 = new Object();
+    this.stepArgQual(arg3);
+
+    this.stepQualRes();
+    stepQualRes();
+
+    Object argOut = new Object();
+    stepQualArg(argOut);
+  }
+
+  Object stepArgRes(Object x) { return null; }
+
+  void stepArgArg(Object in, Object out) { }
+
+  void stepArgQual(Object x) { }
+
+  Object stepQualRes() { return null; }
+
+  void stepQualArg(Object out) { }
+}
diff --git a/java/ql/test/library-tests/dataflow/external-models/sinks.expected b/java/ql/test/library-tests/dataflow/external-models/sinks.expected
new file mode 100644
index 00000000000..f98b757a313
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/sinks.expected
@@ -0,0 +1,8 @@
+invalidModelRow
+#select
+| B.java:6:11:6:14 | arg1 | qltest |
+| B.java:9:5:9:33 | this <.method> | qltest-arg |
+| B.java:9:22:9:32 | argToTagged | qltest-arg |
+| B.java:12:19:12:28 | fieldWrite | qltest-nospec |
+| B.java:17:12:17:14 | res | qltest |
+| B.java:23:12:23:17 | resTag | qltest-retval |
diff --git a/java/ql/test/library-tests/dataflow/external-models/sinks.ql b/java/ql/test/library-tests/dataflow/external-models/sinks.ql
new file mode 100644
index 00000000000..eb7388fc289
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/sinks.ql
@@ -0,0 +1,22 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.ExternalFlow
+import CsvValidation
+
+class SinkModelTest extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //"package;type;overrides;name;signature;ext;spec;kind",
+        "my.qltest;B;false;sink1;(Object);;Argument[0];qltest",
+        "my.qltest;B;false;sinkMethod;();;ReturnValue;qltest",
+        "my.qltest;B$Tag;false;;;Annotated;ReturnValue;qltest-retval",
+        "my.qltest;B$Tag;false;;;Annotated;Argument;qltest-arg",
+        "my.qltest;B$Tag;false;;;Annotated;;qltest-nospec"
+      ]
+  }
+}
+
+from DataFlow::Node node, string kind
+where sinkNode(node, kind)
+select node, kind
diff --git a/java/ql/test/library-tests/dataflow/external-models/srcs.expected b/java/ql/test/library-tests/dataflow/external-models/srcs.expected
new file mode 100644
index 00000000000..637deb94fba
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/srcs.expected
@@ -0,0 +1,24 @@
+invalidModelRow
+#select
+| A.java:6:9:6:14 | src1(...) | qltest |
+| A.java:6:9:6:14 | src1(...) | qltest-all-overloads |
+| A.java:7:9:7:16 | src1(...) | qltest |
+| A.java:7:9:7:16 | src1(...) | qltest-all-overloads |
+| A.java:7:9:7:16 | src1(...) | qltest-alt |
+| A.java:10:9:10:18 | src2(...) | qltest |
+| A.java:10:9:10:18 | src2(...) | qltest-w-subtypes |
+| A.java:11:9:11:18 | src3(...) | qltest-w-subtypes |
+| A.java:13:5:13:13 | this <.method> [post update] | qltest-argany |
+| A.java:13:12:13:12 | x [post update] | qltest-argany |
+| A.java:13:12:13:12 | x [post update] | qltest-argnum |
+| A.java:15:17:15:25 | srcparam1 | qltest-param-override |
+| A.java:18:36:18:51 | srcparam2 | qltest-param-override |
+| A.java:21:9:21:25 | taggedSrcMethod(...) | qltest-retval |
+| A.java:22:9:22:22 | taggedSrcField | qltest-nospec |
+| A.java:24:9:24:25 | srcTwoArg(...) | qltest-longsig |
+| A.java:24:9:24:25 | srcTwoArg(...) | qltest-shortsig |
+| A.java:28:8:28:14 | parameter this | qltest-param |
+| A.java:28:16:28:39 | taggedMethodParam | qltest-param |
+| A.java:31:16:31:41 | taggedSrcParam | qltest-nospec |
+| A.java:31:16:31:41 | taggedSrcParam | qltest-param |
+| A.java:56:10:56:24 | parameter this | qltest-param |
diff --git a/java/ql/test/library-tests/dataflow/external-models/srcs.ql b/java/ql/test/library-tests/dataflow/external-models/srcs.ql
new file mode 100644
index 00000000000..daa3440d940
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/srcs.ql
@@ -0,0 +1,33 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.ExternalFlow
+import CsvValidation
+
+class SourceModelTest extends SourceModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //"package;type;overrides;name;signature;ext;spec;kind",
+        "my.qltest;A;false;src1;();;ReturnValue;qltest",
+        "my.qltest;A;false;src1;(String);;ReturnValue;qltest",
+        "my.qltest;A;false;src1;(java.lang.String);;ReturnValue;qltest-alt",
+        "my.qltest;A;false;src1;;;ReturnValue;qltest-all-overloads",
+        "my.qltest;A;false;src2;();;ReturnValue;qltest",
+        "my.qltest;A;false;src3;();;ReturnValue;qltest",
+        "my.qltest;A;true;src2;();;ReturnValue;qltest-w-subtypes",
+        "my.qltest;A;true;src3;();;ReturnValue;qltest-w-subtypes",
+        "my.qltest;A;false;srcArg;(Object);;Argument[0];qltest-argnum",
+        "my.qltest;A;false;srcArg;(Object);;Argument;qltest-argany",
+        "my.qltest;A$Handler;true;handle;(Object);;Parameter[0];qltest-param-override",
+        "my.qltest;A$Tag;false;;;Annotated;ReturnValue;qltest-retval",
+        "my.qltest;A$Tag;false;;;Annotated;Parameter;qltest-param",
+        "my.qltest;A$Tag;false;;;Annotated;;qltest-nospec",
+        "my.qltest;A;false;srcTwoArg;(String,String);;ReturnValue;qltest-shortsig",
+        "my.qltest;A;false;srcTwoArg;(java.lang.String,java.lang.String);;ReturnValue;qltest-longsig"
+      ]
+  }
+}
+
+from DataFlow::Node node, string kind
+where sourceNode(node, kind)
+select node, kind
diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.expected b/java/ql/test/library-tests/dataflow/external-models/steps.expected
new file mode 100644
index 00000000000..f7e0c0fb23e
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.expected
@@ -0,0 +1,10 @@
+invalidModelRow
+#select
+| C.java:6:16:6:19 | arg1 | C.java:6:5:6:20 | stepArgRes(...) | qltest |
+| C.java:10:16:10:21 | argIn1 | C.java:10:24:10:30 | argOut1 [post update] | qltest |
+| C.java:13:16:13:21 | argIn2 | C.java:13:24:13:30 | argOut2 [post update] | qltest |
+| C.java:16:17:16:20 | arg2 | C.java:16:5:16:21 | this <.method> [post update] | qltest |
+| C.java:18:22:18:25 | arg3 | C.java:18:5:18:8 | this [post update] | qltest |
+| C.java:20:5:20:8 | this | C.java:20:5:20:22 | stepQualRes(...) | qltest |
+| C.java:21:5:21:17 | this <.method> | C.java:21:5:21:17 | stepQualRes(...) | qltest |
+| C.java:24:5:24:23 | this <.method> | C.java:24:17:24:22 | argOut [post update] | qltest |
diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.ql b/java/ql/test/library-tests/dataflow/external-models/steps.ql
new file mode 100644
index 00000000000..441d5eeca2b
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.ql
@@ -0,0 +1,22 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.ExternalFlow
+import CsvValidation
+
+class SummaryModelTest extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
+        "my.qltest;C;false;stepArgRes;(Object);;Argument[0];ReturnValue;qltest",
+        "my.qltest;C;false;stepArgArg;(Object,Object);;Argument[0];Argument[1];qltest",
+        "my.qltest;C;false;stepArgQual;(Object);;Argument[0];Argument[-1];qltest",
+        "my.qltest;C;false;stepQualRes;();;Argument[-1];ReturnValue;qltest",
+        "my.qltest;C;false;stepQualArg;(Object);;Argument[-1];Argument[0];qltest"
+      ]
+  }
+}
+
+from DataFlow::Node node1, DataFlow::Node node2, string kind
+where summaryStep(node1, node2, kind)
+select node1, node2, kind
diff --git a/java/ql/test/library-tests/dataflow/taint-ioutils/Test.java b/java/ql/test/library-tests/dataflow/taint-ioutils/Test.java
index 1d616184705..a6660c87252 100644
--- a/java/ql/test/library-tests/dataflow/taint-ioutils/Test.java
+++ b/java/ql/test/library-tests/dataflow/taint-ioutils/Test.java
@@ -8,7 +8,7 @@ import java.util.List;
 import org.apache.commons.io.IOUtils;
 
 class Test {
-	public static void ioutils() {
+	public static void ioutils() throws java.io.FileNotFoundException, java.io.IOException {
 		InputStream inp = new FileInputStream("test"); // user input
 
 		InputStream buf = IOUtils.buffer(inp);
diff --git a/java/ql/test/library-tests/dataflow/taint-jackson/Test.java b/java/ql/test/library-tests/dataflow/taint-jackson/Test.java
index 6c3a7dbf4b5..2caf9e4ee80 100644
--- a/java/ql/test/library-tests/dataflow/taint-jackson/Test.java
+++ b/java/ql/test/library-tests/dataflow/taint-jackson/Test.java
@@ -14,7 +14,7 @@ class Test {
 		return "tainted";
 	}
 
-	public static void jacksonObjectMapper() {
+	public static void jacksonObjectMapper() throws java.io.FileNotFoundException, java.io.UnsupportedEncodingException {
 		String s = taint();
 		ObjectMapper om = new ObjectMapper();
 		File file = new File("testFile");
@@ -32,7 +32,7 @@ class Test {
 		System.out.println(reconstructed);
 	}
 
-	public static void jacksonObjectWriter() {
+	public static void jacksonObjectWriter() throws java.io.FileNotFoundException, java.io.UnsupportedEncodingException {
 		String s = taint();
 		ObjectWriter ow = new ObjectWriter();
 		File file = new File("testFile");
diff --git a/java/ql/test/library-tests/dataflow/taint/A.java b/java/ql/test/library-tests/dataflow/taint/A.java
index e3a38d8e191..55fd9796586 100644
--- a/java/ql/test/library-tests/dataflow/taint/A.java
+++ b/java/ql/test/library-tests/dataflow/taint/A.java
@@ -15,7 +15,7 @@ public class A {
     sink(b2);
   }
 
-  void test2() {
+  void test2() throws IOException {
     ByteArrayOutputStream bOutput = new ByteArrayOutputStream();
     bOutput.write(taint());
     byte[] b = bOutput.toByteArray();
@@ -25,11 +25,11 @@ public class A {
     sink(b2);
   }
 
-  void streamWrite(ByteArrayOutputStream baos, byte[] data) {
+  void streamWrite(ByteArrayOutputStream baos, byte[] data) throws IOException {
     baos.write(data);
   }
 
-  void test3(ByteArrayOutputStream baos) {
+  void test3(ByteArrayOutputStream baos) throws IOException {
     streamWrite(baos, taint());
     sink(baos.toByteArray());
   }
@@ -38,11 +38,11 @@ public class A {
     ByteArrayOutputStream baos = new ByteArrayOutputStream();
   }
 
-  void streamWriteHolder(BaosHolder bh, byte[] data) {
+  void streamWriteHolder(BaosHolder bh, byte[] data) throws IOException {
     bh.baos.write(data);
   }
 
-  void test4(BaosHolder bh) {
+  void test4(BaosHolder bh) throws IOException {
     streamWriteHolder(bh, taint());
     sink(bh.baos.toByteArray());
   }
@@ -51,7 +51,7 @@ public class A {
     byte[] data = new byte[10];
   }
 
-  void test5_a(DataHolder dh) {
+  void test5_a(DataHolder dh) throws IOException {
     ByteArrayInputStream bais = new ByteArrayInputStream(taint());
     bais.read(dh.data);
     test5_b(dh);
diff --git a/java/ql/test/library-tests/dataflow/taint/B.java b/java/ql/test/library-tests/dataflow/taint/B.java
index b53c49bdc39..81b007e6871 100644
--- a/java/ql/test/library-tests/dataflow/taint/B.java
+++ b/java/ql/test/library-tests/dataflow/taint/B.java
@@ -11,7 +11,7 @@ public class B {
 
   public static void sink(Object o) { }
 
-  public static void maintest() {
+  public static void maintest() throws java.io.UnsupportedEncodingException, java.net.MalformedURLException {
     String[] args = taint();
     // tainted - access to main args
     String[] aaaargs = args;
diff --git a/java/ql/test/library-tests/dataflow/taintsources/IntentSources.java b/java/ql/test/library-tests/dataflow/taintsources/IntentSources.java
index 960bbff0bce..6f0051f0d10 100644
--- a/java/ql/test/library-tests/dataflow/taintsources/IntentSources.java
+++ b/java/ql/test/library-tests/dataflow/taintsources/IntentSources.java
@@ -4,21 +4,21 @@ import android.app.Activity;
 
 public class IntentSources extends Activity {
 
-	public void test() {
+	public void test() throws java.io.IOException {
 
 		String trouble = this.getIntent().getStringExtra("key");
 		Runtime.getRuntime().exec(trouble);
 
 	}
 
-	public void test2() {
+	public void test2() throws java.io.IOException {
 
 		String trouble = getIntent().getStringExtra("key");
 		Runtime.getRuntime().exec(trouble);
 
 	}
 
-	public void test3() {
+	public void test3() throws java.io.IOException {
 
 		String trouble = getIntent().getExtras().getString("key");
 		Runtime.getRuntime().exec(trouble);
@@ -29,9 +29,9 @@ public class IntentSources extends Activity {
 
 class OtherClass {
 
-	public void test(IntentSources is) {
+	public void test(IntentSources is) throws java.io.IOException {
 		String trouble = is.getIntent().getStringExtra("key");
 		Runtime.getRuntime().exec(trouble);
 	}
 
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/library-tests/dataflow/taintsources/RmiFlow.java b/java/ql/test/library-tests/dataflow/taintsources/RmiFlow.java
index eeab5a1fa09..69d7c9449ee 100644
--- a/java/ql/test/library-tests/dataflow/taintsources/RmiFlow.java
+++ b/java/ql/test/library-tests/dataflow/taintsources/RmiFlow.java
@@ -4,5 +4,5 @@ import java.rmi.Remote;
 import java.rmi.RemoteException;
 
 public interface RmiFlow extends Remote {
-	String listDirectory(String path);
+	String listDirectory(String path) throws java.io.IOException;
 }
diff --git a/java/ql/test/library-tests/dataflow/taintsources/RmiFlowImpl.java b/java/ql/test/library-tests/dataflow/taintsources/RmiFlowImpl.java
index eee65d5c64e..f75c6ddf2b7 100644
--- a/java/ql/test/library-tests/dataflow/taintsources/RmiFlowImpl.java
+++ b/java/ql/test/library-tests/dataflow/taintsources/RmiFlowImpl.java
@@ -1,13 +1,13 @@
 package security.library.dataflow;
 
 public class RmiFlowImpl implements RmiFlow {
-	public String listDirectory(String path) {
+	public String listDirectory(String path) throws java.io.IOException {
 		String command = "ls " + path;
 		Runtime.getRuntime().exec(command);
 		return "pretend there are some results here";
 	}
 
-	public String notRemotable(String path) {
+	public String notRemotable(String path) throws java.io.IOException {
 		String command = "ls " + path;
 		Runtime.getRuntime().exec(command);
 		return "pretend there are some results here";
diff --git a/java/ql/test/library-tests/dataflow/taintsources/remote.expected b/java/ql/test/library-tests/dataflow/taintsources/remote.expected
index 57acdb6d26c..e4f1dac7ca6 100644
--- a/java/ql/test/library-tests/dataflow/taintsources/remote.expected
+++ b/java/ql/test/library-tests/dataflow/taintsources/remote.expected
@@ -5,21 +5,21 @@
 | A.java:41:5:41:53 | getInputStream(...) | A.java:41:5:41:53 | getInputStream(...) |
 | A.java:42:5:42:45 | getInputStream(...) | A.java:42:5:42:45 | getInputStream(...) |
 | A.java:43:5:43:47 | getHostName(...) | A.java:43:5:43:47 | getHostName(...) |
-| IntentSources.java:9:20:9:35 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1057:19:1057:32 | parameter this |
+| IntentSources.java:9:20:9:35 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1059:19:1059:32 | parameter this |
 | IntentSources.java:9:20:9:35 | getIntent(...) | IntentSources.java:9:20:9:35 | getIntent(...) |
 | IntentSources.java:9:20:9:35 | getIntent(...) | IntentSources.java:9:20:9:57 | getStringExtra(...) |
 | IntentSources.java:9:20:9:35 | getIntent(...) | IntentSources.java:10:29:10:35 | trouble |
-| IntentSources.java:16:20:16:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1057:19:1057:32 | parameter this |
+| IntentSources.java:16:20:16:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1059:19:1059:32 | parameter this |
 | IntentSources.java:16:20:16:30 | getIntent(...) | IntentSources.java:16:20:16:30 | getIntent(...) |
 | IntentSources.java:16:20:16:30 | getIntent(...) | IntentSources.java:16:20:16:52 | getStringExtra(...) |
 | IntentSources.java:16:20:16:30 | getIntent(...) | IntentSources.java:17:29:17:35 | trouble |
-| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1356:19:1356:27 | parameter this |
-| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/os/BaseBundle.java:599:19:599:27 | parameter this |
+| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1358:19:1358:27 | parameter this |
+| IntentSources.java:23:20:23:30 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/os/BaseBundle.java:600:19:600:27 | parameter this |
 | IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:23:20:23:30 | getIntent(...) |
 | IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:23:20:23:42 | getExtras(...) |
 | IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:23:20:23:59 | getString(...) |
 | IntentSources.java:23:20:23:30 | getIntent(...) | IntentSources.java:24:29:24:35 | trouble |
-| IntentSources.java:33:20:33:33 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1057:19:1057:32 | parameter this |
+| IntentSources.java:33:20:33:33 | getIntent(...) | ../../../stubs/google-android-9.0.0/android/content/Intent.java:1059:19:1059:32 | parameter this |
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:33:20:33:33 | getIntent(...) |
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:33:20:33:55 | getStringExtra(...) |
 | IntentSources.java:33:20:33:33 | getIntent(...) | IntentSources.java:34:29:34:35 | trouble |
diff --git a/java/ql/test/library-tests/dispatch/ViableCallable.java b/java/ql/test/library-tests/dispatch/ViableCallable.java
index 1e404463c05..f698ea0fb9d 100644
--- a/java/ql/test/library-tests/dispatch/ViableCallable.java
+++ b/java/ql/test/library-tests/dispatch/ViableCallable.java
@@ -36,7 +36,7 @@ class ViableCallable {
 		i2.f("", 0l);
 	}
 
-	<TMock> TMock Mock() { throw new Exception(); }
+	<TMock> TMock Mock() { throw new Error(); }
 
 	void CreateTypeInstance() {
 		Run(new C2<Boolean>(), null, null, null);
@@ -63,7 +63,7 @@ abstract class C1<T1_C1, T2_C1> {
 		M(x, 8);
 	}
 
-	public void f(T1_C1 x, T2_C1 y) { throw new Exception(); }
+	public void f(T1_C1 x, T2_C1 y) { throw new Error(); }
 }
 
 interface I1<T_I1> {
@@ -80,27 +80,27 @@ interface I2<T_I2> {
 
 class C2<T_C2> extends C1<String, T_C2> implements I1<T_C2> {
 	@Override
-	public <T3_C2> T_C2 M(String x, T3_C2 y) { throw new Exception(); }
+	public <T3_C2> T_C2 M(String x, T3_C2 y) { throw new Error(); }
 }
 
 class C3 extends C1<String, Long> implements I2<Long> {
 	@Override
-	public <T3_C3> Long M(String x, T3_C3 y) { throw new Exception(); }
+	public <T3_C3> Long M(String x, T3_C3 y) { throw new Error(); }
 }
 
 class C4<T_C4> extends C1<T_C4[], Boolean> {
 	@Override
-	public <T3_C4> Boolean M(T_C4[] x, T3_C4 y) { throw new Exception(); }
+	public <T3_C4> Boolean M(T_C4[] x, T3_C4 y) { throw new Error(); }
 }
 
 class C5 extends C1<String, Boolean> {
 	@Override
-	public <T3_C5> Boolean M(String x, T3_C5 y) { throw new Exception(); }
+	public <T3_C5> Boolean M(String x, T3_C5 y) { throw new Error(); }
 }
 
 class C6<T1_C6, T2_C6> extends C1<T1_C6, T2_C6> {
 	@Override
-	public <T3_C6> T2_C6 M(T1_C6 x, T3_C6 y) { throw new Exception(); }
+	public <T3_C6> T2_C6 M(T1_C6 x, T3_C6 y) { throw new Error(); }
 
 	public void Run(T1_C6 x) {
 		// Viable callables: C6.M(), C7.M()
@@ -113,7 +113,7 @@ class C6<T1_C6, T2_C6> extends C1<T1_C6, T2_C6> {
 
 class C7<T1_C7> extends C6<T1_C7, Byte> {
 	@Override
-	public <T3_C7> Byte M(T1_C7 x, T3_C7 y) { throw new Exception(); }
+	public <T3_C7> Byte M(T1_C7 x, T3_C7 y) { throw new Error(); }
 
 	public void Run(T1_C7 x) {
 		// Viable callables: C7.M()
@@ -129,11 +129,11 @@ class C7<T1_C7> extends C6<T1_C7, Byte> {
 
 class C8<T_C8, T2_C8> extends C1<String, T2_C8> {
 	@Override
-	public <T3_C8> T2_C8 M(String x, T3_C8 y) { throw new Exception(); }
+	public <T3_C8> T2_C8 M(String x, T3_C8 y) { throw new Error(); }
 }
 
 class C9<T_C9> extends C8<Boolean, Boolean> {
 	@Override
-	public <T3_C9> Boolean M(String x, T3_C9 y) { throw new Exception(); }
+	public <T3_C9> Boolean M(String x, T3_C9 y) { throw new Error(); }
 }
 
diff --git a/java/ql/test/library-tests/dispatch/ViableCallable2.java b/java/ql/test/library-tests/dispatch/ViableCallable2.java
index a1d17b63162..79ecc9d3cd0 100644
--- a/java/ql/test/library-tests/dispatch/ViableCallable2.java
+++ b/java/ql/test/library-tests/dispatch/ViableCallable2.java
@@ -20,10 +20,10 @@ class ViableCallable2 {
 }
 
 class A {
-    public void m() { throw new Exception(); }
+    public void m() { throw new Error(); }
 }
 
 class B extends A {
     @Override
-    public void m() { throw new Exception(); }
+    public void m() { throw new Error(); }
 }
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTest.java
new file mode 100644
index 00000000000..043bc3973da
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTest.java
@@ -0,0 +1,133 @@
+import org.apache.commons.lang3.text.StrBuilder;
+import org.apache.commons.lang3.text.StrMatcher;
+import org.apache.commons.lang3.text.StrTokenizer;
+import java.io.StringReader;
+import java.nio.CharBuffer;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+class StrBuilderTest {
+    String taint() { return "tainted"; }
+
+    void sink(Object o) {}
+
+    void test() throws Exception {
+
+        StrBuilder cons1 = new StrBuilder(taint()); sink(cons1.toString()); // $hasTaintFlow=y
+
+        StrBuilder sb1 = new StrBuilder(); sb1.append(taint().toCharArray()); sink(sb1.toString()); // $hasTaintFlow=y
+        StrBuilder sb2 = new StrBuilder(); sb2.append(taint().toCharArray(), 0, 0); sink(sb2.toString()); // $hasTaintFlow=y
+        StrBuilder sb3 = new StrBuilder(); sb3.append(CharBuffer.wrap(taint().toCharArray())); sink(sb3.toString()); // $ MISSING: hasTaintFlow=y
+        StrBuilder sb4 = new StrBuilder(); sb4.append(CharBuffer.wrap(taint().toCharArray()), 0, 0); sink(sb4.toString()); // $ MISSING: hasTaintFlow=y
+        StrBuilder sb5 = new StrBuilder(); sb5.append((CharSequence)taint()); sink(sb5.toString()); // $hasTaintFlow=y
+        StrBuilder sb6 = new StrBuilder(); sb6.append((CharSequence)taint(), 0, 0); sink(sb6.toString()); // $hasTaintFlow=y
+        StrBuilder sb7 = new StrBuilder(); sb7.append((Object)taint()); sink(sb7.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.append(taint());
+            StrBuilder sb8 = new StrBuilder(); sb8.append(auxsb); sink(sb8.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb9 = new StrBuilder(); sb9.append(new StringBuffer(taint())); sink(sb9.toString()); // $hasTaintFlow=y
+        StrBuilder sb10 = new StrBuilder(); sb10.append(new StringBuffer(taint()), 0, 0); sink(sb10.toString()); // $hasTaintFlow=y
+        StrBuilder sb11 = new StrBuilder(); sb11.append(new StringBuilder(taint())); sink(sb11.toString()); // $hasTaintFlow=y
+        StrBuilder sb12 = new StrBuilder(); sb12.append(new StringBuilder(taint()), 0, 0); sink(sb12.toString()); // $hasTaintFlow=y
+        StrBuilder sb13 = new StrBuilder(); sb13.append(taint()); sink(sb13.toString()); // $hasTaintFlow=y
+        StrBuilder sb14 = new StrBuilder(); sb14.append(taint(), 0, 0); sink(sb14.toString()); // $hasTaintFlow=y
+        StrBuilder sb15 = new StrBuilder(); sb15.append(taint(), "format", "args"); sink(sb15.toString()); // $hasTaintFlow=y
+        StrBuilder sb16 = new StrBuilder(); sb16.append("Format string", taint(), "args"); sink(sb16.toString()); // $hasTaintFlow=y
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            StrBuilder sb17 = new StrBuilder(); sb17.appendAll(taintedList); sink(sb17.toString()); // $hasTaintFlow=y
+            StrBuilder sb18 = new StrBuilder(); sb18.appendAll(taintedList.iterator()); sink(sb18.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb19 = new StrBuilder(); sb19.appendAll("clean", taint()); sink(sb19.toString()); // $hasTaintFlow=y
+        StrBuilder sb20 = new StrBuilder(); sb20.appendAll(taint(), "clean"); sink(sb20.toString()); // $hasTaintFlow=y
+        StrBuilder sb21 = new StrBuilder(); sb21.appendFixedWidthPadLeft(taint(), 0, ' '); sink(sb21.toString()); // $hasTaintFlow=y
+        StrBuilder sb22 = new StrBuilder(); sb22.appendFixedWidthPadRight(taint(), 0, ' '); sink(sb22.toString()); // $hasTaintFlow=y
+        StrBuilder sb23 = new StrBuilder(); sb23.appendln(taint().toCharArray()); sink(sb23.toString()); // $hasTaintFlow=y
+        StrBuilder sb24 = new StrBuilder(); sb24.appendln(taint().toCharArray(), 0, 0); sink(sb24.toString()); // $hasTaintFlow=y
+        StrBuilder sb25 = new StrBuilder(); sb25.appendln((Object)taint()); sink(sb25.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.appendln(taint());
+            StrBuilder sb26 = new StrBuilder(); sb26.appendln(auxsb); sink(sb26.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb27 = new StrBuilder(); sb27.appendln(new StringBuffer(taint())); sink(sb27.toString()); // $hasTaintFlow=y
+        StrBuilder sb28 = new StrBuilder(); sb28.appendln(new StringBuffer(taint()), 0, 0); sink(sb28.toString()); // $hasTaintFlow=y
+        StrBuilder sb29 = new StrBuilder(); sb29.appendln(new StringBuilder(taint())); sink(sb29.toString()); // $hasTaintFlow=y
+        StrBuilder sb30 = new StrBuilder(); sb30.appendln(new StringBuilder(taint()), 0, 0); sink(sb30.toString()); // $hasTaintFlow=y
+        StrBuilder sb31 = new StrBuilder(); sb31.appendln(taint()); sink(sb31.toString()); // $hasTaintFlow=y
+        StrBuilder sb32 = new StrBuilder(); sb32.appendln(taint(), 0, 0); sink(sb32.toString()); // $hasTaintFlow=y
+        StrBuilder sb33 = new StrBuilder(); sb33.appendln(taint(), "format", "args"); sink(sb33.toString()); // $hasTaintFlow=y
+        StrBuilder sb34 = new StrBuilder(); sb34.appendln("Format string", taint(), "args"); sink(sb34.toString()); // $hasTaintFlow=y
+        StrBuilder sb35 = new StrBuilder(); sb35.appendSeparator(taint()); sink(sb35.toString()); // $hasTaintFlow=y
+        StrBuilder sb36 = new StrBuilder(); sb36.appendSeparator(taint(), 0); sink(sb36.toString()); // $hasTaintFlow=y
+        StrBuilder sb37 = new StrBuilder(); sb37.appendSeparator(taint(), "default"); sink(sb37.toString()); // $hasTaintFlow=y
+        StrBuilder sb38 = new StrBuilder(); sb38.appendSeparator("", taint()); sink(sb38.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.appendln(taint());
+            StrBuilder sb39 = new StrBuilder(); auxsb.appendTo(sb39); sink(sb39.toString()); // $hasTaintFlow=y
+        }
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            StrBuilder sb40 = new StrBuilder(); sb40.appendWithSeparators(taintedList, ", "); sink(sb40.toString()); // $hasTaintFlow=y
+            StrBuilder sb41 = new StrBuilder(); sb41.appendWithSeparators(taintedList.iterator(), ", "); sink(sb41.toString()); // $hasTaintFlow=y
+            List<String> untaintedList = new ArrayList<>();
+            StrBuilder sb42 = new StrBuilder(); sb42.appendWithSeparators(untaintedList, taint()); sink(sb42.toString()); // $hasTaintFlow=y
+            StrBuilder sb43 = new StrBuilder(); sb43.appendWithSeparators(untaintedList.iterator(), taint()); sink(sb43.toString()); // $hasTaintFlow=y
+            String[] taintedArray = new String[] { taint() };
+            String[] untaintedArray = new String[] {};
+            StrBuilder sb44 = new StrBuilder(); sb44.appendWithSeparators(taintedArray, ", "); sink(sb44.toString()); // $hasTaintFlow=y
+            StrBuilder sb45 = new StrBuilder(); sb45.appendWithSeparators(untaintedArray, taint()); sink(sb45.toString()); // $hasTaintFlow=y
+        }
+        {
+            StrBuilder sb46 = new StrBuilder(); sb46.append(taint());
+            char[] target = new char[100];
+            sb46.asReader().read(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        StrBuilder sb47 = new StrBuilder(); sb47.append(taint()); sink(sb47.asTokenizer().next()); // $hasTaintFlow=y
+        StrBuilder sb48 = new StrBuilder(); sb48.append(taint()); sink(sb48.build()); // $hasTaintFlow=y
+        StrBuilder sb49 = new StrBuilder(); sb49.append(taint()); sink(sb49.getChars(null)); // $hasTaintFlow=y
+        {
+            StrBuilder sb50 = new StrBuilder(); sb50.append(taint());
+            char[] target = new char[100];
+            sb50.getChars(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        {
+            StrBuilder sb51 = new StrBuilder(); sb51.append(taint());
+            char[] target = new char[100];
+            sb51.getChars(0, 0, target, 0);
+            sink(target); // $hasTaintFlow=y
+        }
+        StrBuilder sb52 = new StrBuilder(); sb52.insert(0, taint().toCharArray()); sink(sb52.toString()); // $hasTaintFlow=y
+        StrBuilder sb53 = new StrBuilder(); sb53.insert(0, taint().toCharArray(), 0, 0); sink(sb53.toString()); // $hasTaintFlow=y
+        StrBuilder sb54 = new StrBuilder(); sb54.insert(0, taint()); sink(sb54.toString()); // $hasTaintFlow=y
+        StrBuilder sb55 = new StrBuilder(); sb55.insert(0, (Object)taint()); sink(sb55.toString()); // $hasTaintFlow=y
+        StrBuilder sb56 = new StrBuilder(); sb56.append(taint()); sink(sb56.leftString(0)); // $hasTaintFlow=y
+        StrBuilder sb57 = new StrBuilder(); sb57.append(taint()); sink(sb57.midString(0, 0)); // $hasTaintFlow=y
+        {
+            StringReader reader = new StringReader(taint());
+            StrBuilder sb58 = new StrBuilder(); sb58.readFrom(reader); sink(sb58.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb59 = new StrBuilder(); sb59.replace(0, 0, taint()); sink(sb59.toString()); // $hasTaintFlow=y
+        StrBuilder sb60 = new StrBuilder(); sb60.replace(null, taint(), 0, 0, 0); sink(sb60.toString()); // $hasTaintFlow=y
+        StrBuilder sb61 = new StrBuilder(); sb61.replaceAll((StrMatcher)null, taint()); sink(sb61.toString()); // $hasTaintFlow=y
+        StrBuilder sb62 = new StrBuilder(); sb62.replaceAll("search", taint()); sink(sb62.toString()); // $hasTaintFlow=y
+        StrBuilder sb63 = new StrBuilder(); sb63.replaceAll(taint(), "replace"); sink(sb63.toString()); // GOOD (search string doesn't convey taint)
+        StrBuilder sb64 = new StrBuilder(); sb64.replaceFirst((StrMatcher)null, taint()); sink(sb64.toString()); // $hasTaintFlow=y
+        StrBuilder sb65 = new StrBuilder(); sb65.replaceFirst("search", taint()); sink(sb65.toString()); // $hasTaintFlow=y
+        StrBuilder sb66 = new StrBuilder(); sb66.replaceFirst(taint(), "replace"); sink(sb66.toString()); // GOOD (search string doesn't convey taint)
+        StrBuilder sb67 = new StrBuilder(); sb67.append(taint()); sink(sb67.rightString(0)); // $hasTaintFlow=y
+        StrBuilder sb68 = new StrBuilder(); sb68.append(taint()); sink(sb68.subSequence(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb69 = new StrBuilder(); sb69.append(taint()); sink(sb69.substring(0)); // $hasTaintFlow=y
+        StrBuilder sb70 = new StrBuilder(); sb70.append(taint()); sink(sb70.substring(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb71 = new StrBuilder(); sb71.append(taint()); sink(sb71.toCharArray()); // $hasTaintFlow=y
+        StrBuilder sb72 = new StrBuilder(); sb72.append(taint()); sink(sb72.toCharArray(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb73 = new StrBuilder(); sb73.append(taint()); sink(sb73.toStringBuffer()); // $hasTaintFlow=y
+        StrBuilder sb74 = new StrBuilder(); sb74.append(taint()); sink(sb74.toStringBuilder()); // $hasTaintFlow=y
+    }
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTextTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTextTest.java
new file mode 100644
index 00000000000..cb1749c5ef7
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/StrBuilderTextTest.java
@@ -0,0 +1,133 @@
+import org.apache.commons.text.StrBuilder;
+import org.apache.commons.text.StrMatcher;
+import org.apache.commons.text.StrTokenizer;
+import java.io.StringReader;
+import java.nio.CharBuffer;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+class StrBuilderTextTest {
+    String taint() { return "tainted"; }
+
+    void sink(Object o) {}
+
+    void test() throws Exception {
+
+        StrBuilder cons1 = new StrBuilder(taint()); sink(cons1.toString()); // $hasTaintFlow=y
+
+        StrBuilder sb1 = new StrBuilder(); sb1.append(taint().toCharArray()); sink(sb1.toString()); // $hasTaintFlow=y
+        StrBuilder sb2 = new StrBuilder(); sb2.append(taint().toCharArray(), 0, 0); sink(sb2.toString()); // $hasTaintFlow=y
+        StrBuilder sb3 = new StrBuilder(); sb3.append(CharBuffer.wrap(taint().toCharArray())); sink(sb3.toString()); // $ MISSING: hasTaintFlow=y
+        StrBuilder sb4 = new StrBuilder(); sb4.append(CharBuffer.wrap(taint().toCharArray()), 0, 0); sink(sb4.toString()); // $ MISSING: hasTaintFlow=y
+        StrBuilder sb5 = new StrBuilder(); sb5.append((CharSequence)taint()); sink(sb5.toString()); // $hasTaintFlow=y
+        StrBuilder sb6 = new StrBuilder(); sb6.append((CharSequence)taint(), 0, 0); sink(sb6.toString()); // $hasTaintFlow=y
+        StrBuilder sb7 = new StrBuilder(); sb7.append((Object)taint()); sink(sb7.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.append(taint());
+            StrBuilder sb8 = new StrBuilder(); sb8.append(auxsb); sink(sb8.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb9 = new StrBuilder(); sb9.append(new StringBuffer(taint())); sink(sb9.toString()); // $hasTaintFlow=y
+        StrBuilder sb10 = new StrBuilder(); sb10.append(new StringBuffer(taint()), 0, 0); sink(sb10.toString()); // $hasTaintFlow=y
+        StrBuilder sb11 = new StrBuilder(); sb11.append(new StringBuilder(taint())); sink(sb11.toString()); // $hasTaintFlow=y
+        StrBuilder sb12 = new StrBuilder(); sb12.append(new StringBuilder(taint()), 0, 0); sink(sb12.toString()); // $hasTaintFlow=y
+        StrBuilder sb13 = new StrBuilder(); sb13.append(taint()); sink(sb13.toString()); // $hasTaintFlow=y
+        StrBuilder sb14 = new StrBuilder(); sb14.append(taint(), 0, 0); sink(sb14.toString()); // $hasTaintFlow=y
+        StrBuilder sb15 = new StrBuilder(); sb15.append(taint(), "format", "args"); sink(sb15.toString()); // $hasTaintFlow=y
+        StrBuilder sb16 = new StrBuilder(); sb16.append("Format string", taint(), "args"); sink(sb16.toString()); // $hasTaintFlow=y
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            StrBuilder sb17 = new StrBuilder(); sb17.appendAll(taintedList); sink(sb17.toString()); // $hasTaintFlow=y
+            StrBuilder sb18 = new StrBuilder(); sb18.appendAll(taintedList.iterator()); sink(sb18.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb19 = new StrBuilder(); sb19.appendAll("clean", taint()); sink(sb19.toString()); // $hasTaintFlow=y
+        StrBuilder sb20 = new StrBuilder(); sb20.appendAll(taint(), "clean"); sink(sb20.toString()); // $hasTaintFlow=y
+        StrBuilder sb21 = new StrBuilder(); sb21.appendFixedWidthPadLeft(taint(), 0, ' '); sink(sb21.toString()); // $hasTaintFlow=y
+        StrBuilder sb22 = new StrBuilder(); sb22.appendFixedWidthPadRight(taint(), 0, ' '); sink(sb22.toString()); // $hasTaintFlow=y
+        StrBuilder sb23 = new StrBuilder(); sb23.appendln(taint().toCharArray()); sink(sb23.toString()); // $hasTaintFlow=y
+        StrBuilder sb24 = new StrBuilder(); sb24.appendln(taint().toCharArray(), 0, 0); sink(sb24.toString()); // $hasTaintFlow=y
+        StrBuilder sb25 = new StrBuilder(); sb25.appendln((Object)taint()); sink(sb25.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.appendln(taint());
+            StrBuilder sb26 = new StrBuilder(); sb26.appendln(auxsb); sink(sb26.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb27 = new StrBuilder(); sb27.appendln(new StringBuffer(taint())); sink(sb27.toString()); // $hasTaintFlow=y
+        StrBuilder sb28 = new StrBuilder(); sb28.appendln(new StringBuffer(taint()), 0, 0); sink(sb28.toString()); // $hasTaintFlow=y
+        StrBuilder sb29 = new StrBuilder(); sb29.appendln(new StringBuilder(taint())); sink(sb29.toString()); // $hasTaintFlow=y
+        StrBuilder sb30 = new StrBuilder(); sb30.appendln(new StringBuilder(taint()), 0, 0); sink(sb30.toString()); // $hasTaintFlow=y
+        StrBuilder sb31 = new StrBuilder(); sb31.appendln(taint()); sink(sb31.toString()); // $hasTaintFlow=y
+        StrBuilder sb32 = new StrBuilder(); sb32.appendln(taint(), 0, 0); sink(sb32.toString()); // $hasTaintFlow=y
+        StrBuilder sb33 = new StrBuilder(); sb33.appendln(taint(), "format", "args"); sink(sb33.toString()); // $hasTaintFlow=y
+        StrBuilder sb34 = new StrBuilder(); sb34.appendln("Format string", taint(), "args"); sink(sb34.toString()); // $hasTaintFlow=y
+        StrBuilder sb35 = new StrBuilder(); sb35.appendSeparator(taint()); sink(sb35.toString()); // $hasTaintFlow=y
+        StrBuilder sb36 = new StrBuilder(); sb36.appendSeparator(taint(), 0); sink(sb36.toString()); // $hasTaintFlow=y
+        StrBuilder sb37 = new StrBuilder(); sb37.appendSeparator(taint(), "default"); sink(sb37.toString()); // $hasTaintFlow=y
+        StrBuilder sb38 = new StrBuilder(); sb38.appendSeparator("", taint()); sink(sb38.toString()); // $hasTaintFlow=y
+        {
+            StrBuilder auxsb = new StrBuilder(); auxsb.appendln(taint());
+            StrBuilder sb39 = new StrBuilder(); auxsb.appendTo(sb39); sink(sb39.toString()); // $hasTaintFlow=y
+        }
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            StrBuilder sb40 = new StrBuilder(); sb40.appendWithSeparators(taintedList, ", "); sink(sb40.toString()); // $hasTaintFlow=y
+            StrBuilder sb41 = new StrBuilder(); sb41.appendWithSeparators(taintedList.iterator(), ", "); sink(sb41.toString()); // $hasTaintFlow=y
+            List<String> untaintedList = new ArrayList<>();
+            StrBuilder sb42 = new StrBuilder(); sb42.appendWithSeparators(untaintedList, taint()); sink(sb42.toString()); // $hasTaintFlow=y
+            StrBuilder sb43 = new StrBuilder(); sb43.appendWithSeparators(untaintedList.iterator(), taint()); sink(sb43.toString()); // $hasTaintFlow=y
+            String[] taintedArray = new String[] { taint() };
+            String[] untaintedArray = new String[] {};
+            StrBuilder sb44 = new StrBuilder(); sb44.appendWithSeparators(taintedArray, ", "); sink(sb44.toString()); // $hasTaintFlow=y
+            StrBuilder sb45 = new StrBuilder(); sb45.appendWithSeparators(untaintedArray, taint()); sink(sb45.toString()); // $hasTaintFlow=y
+        }
+        {
+            StrBuilder sb46 = new StrBuilder(); sb46.append(taint());
+            char[] target = new char[100];
+            sb46.asReader().read(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        StrBuilder sb47 = new StrBuilder(); sb47.append(taint()); sink(sb47.asTokenizer().next()); // $hasTaintFlow=y
+        StrBuilder sb48 = new StrBuilder(); sb48.append(taint()); sink(sb48.build()); // $hasTaintFlow=y
+        StrBuilder sb49 = new StrBuilder(); sb49.append(taint()); sink(sb49.getChars(null)); // $hasTaintFlow=y
+        {
+            StrBuilder sb50 = new StrBuilder(); sb50.append(taint());
+            char[] target = new char[100];
+            sb50.getChars(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        {
+            StrBuilder sb51 = new StrBuilder(); sb51.append(taint());
+            char[] target = new char[100];
+            sb51.getChars(0, 0, target, 0);
+            sink(target); // $hasTaintFlow=y
+        }
+        StrBuilder sb52 = new StrBuilder(); sb52.insert(0, taint().toCharArray()); sink(sb52.toString()); // $hasTaintFlow=y
+        StrBuilder sb53 = new StrBuilder(); sb53.insert(0, taint().toCharArray(), 0, 0); sink(sb53.toString()); // $hasTaintFlow=y
+        StrBuilder sb54 = new StrBuilder(); sb54.insert(0, taint()); sink(sb54.toString()); // $hasTaintFlow=y
+        StrBuilder sb55 = new StrBuilder(); sb55.insert(0, (Object)taint()); sink(sb55.toString()); // $hasTaintFlow=y
+        StrBuilder sb56 = new StrBuilder(); sb56.append(taint()); sink(sb56.leftString(0)); // $hasTaintFlow=y
+        StrBuilder sb57 = new StrBuilder(); sb57.append(taint()); sink(sb57.midString(0, 0)); // $hasTaintFlow=y
+        {
+            StringReader reader = new StringReader(taint());
+            StrBuilder sb58 = new StrBuilder(); sb58.readFrom(reader); sink(sb58.toString()); // $hasTaintFlow=y
+        }
+        StrBuilder sb59 = new StrBuilder(); sb59.replace(0, 0, taint()); sink(sb59.toString()); // $hasTaintFlow=y
+        StrBuilder sb60 = new StrBuilder(); sb60.replace(null, taint(), 0, 0, 0); sink(sb60.toString()); // $hasTaintFlow=y
+        StrBuilder sb61 = new StrBuilder(); sb61.replaceAll((StrMatcher)null, taint()); sink(sb61.toString()); // $hasTaintFlow=y
+        StrBuilder sb62 = new StrBuilder(); sb62.replaceAll("search", taint()); sink(sb62.toString()); // $hasTaintFlow=y
+        StrBuilder sb63 = new StrBuilder(); sb63.replaceAll(taint(), "replace"); sink(sb63.toString()); // GOOD (search string doesn't convey taint)
+        StrBuilder sb64 = new StrBuilder(); sb64.replaceFirst((StrMatcher)null, taint()); sink(sb64.toString()); // $hasTaintFlow=y
+        StrBuilder sb65 = new StrBuilder(); sb65.replaceFirst("search", taint()); sink(sb65.toString()); // $hasTaintFlow=y
+        StrBuilder sb66 = new StrBuilder(); sb66.replaceFirst(taint(), "replace"); sink(sb66.toString()); // GOOD (search string doesn't convey taint)
+        StrBuilder sb67 = new StrBuilder(); sb67.append(taint()); sink(sb67.rightString(0)); // $hasTaintFlow=y
+        StrBuilder sb68 = new StrBuilder(); sb68.append(taint()); sink(sb68.subSequence(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb69 = new StrBuilder(); sb69.append(taint()); sink(sb69.substring(0)); // $hasTaintFlow=y
+        StrBuilder sb70 = new StrBuilder(); sb70.append(taint()); sink(sb70.substring(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb71 = new StrBuilder(); sb71.append(taint()); sink(sb71.toCharArray()); // $hasTaintFlow=y
+        StrBuilder sb72 = new StrBuilder(); sb72.append(taint()); sink(sb72.toCharArray(0, 0)); // $hasTaintFlow=y
+        StrBuilder sb73 = new StrBuilder(); sb73.append(taint()); sink(sb73.toStringBuffer()); // $hasTaintFlow=y
+        StrBuilder sb74 = new StrBuilder(); sb74.append(taint()); sink(sb74.toStringBuilder()); // $hasTaintFlow=y
+    }
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/Test.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/Test.java
new file mode 100644
index 00000000000..0a554a7d449
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/Test.java
@@ -0,0 +1,278 @@
+import org.apache.commons.lang3.StringUtils;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+class Test {
+    String taint() { return "tainted"; }
+
+    void sink(Object o) {}
+
+    void test() throws Exception {
+
+        // All these calls should convey taint to `sink` except as noted.
+        sink(StringUtils.abbreviate(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviate(taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviate(taint(), "...", 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviate("Untainted", taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviate(taint(), "...", 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviate("Untainted", taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviateMiddle(taint(), "...", 0)); // $hasTaintFlow=y
+        sink(StringUtils.abbreviateMiddle("Untainted", taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.appendIfMissing(taint(), "suffix", "candsuffix1", "candsuffix2")); // $hasTaintFlow=y
+        sink(StringUtils.appendIfMissing("prefix", taint(), "candsuffix1", "candsuffix2")); // $hasTaintFlow=y
+        // (next 2 calls) GOOD: candidate suffixes do not flow to the return value.
+        sink(StringUtils.appendIfMissing("prefix", "suffix", taint(), "candsuffix2"));
+        sink(StringUtils.appendIfMissing("prefix", "suffix", "candsuffix1", taint()));
+        sink(StringUtils.appendIfMissingIgnoreCase(taint(), "suffix", "candsuffix1", "candsuffix2")); // $hasTaintFlow=y
+        sink(StringUtils.appendIfMissingIgnoreCase("prefix", taint(), "candsuffix1", "candsuffix2")); // $hasTaintFlow=y
+        // (next 2 calls) GOOD: candidate suffixes do not flow to the return value.
+        sink(StringUtils.appendIfMissingIgnoreCase("prefix", "suffix", taint(), "candsuffix2"));
+        sink(StringUtils.appendIfMissingIgnoreCase("prefix", "suffix", "candsuffix1", taint()));
+        sink(StringUtils.capitalize(taint())); // $hasTaintFlow=y
+        sink(StringUtils.center(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.center(taint(), 0, 'x')); // $hasTaintFlow=y
+        sink(StringUtils.center(taint(), 0, "padding string")); // $hasTaintFlow=y
+        sink(StringUtils.center("Center me", 0, taint())); // $hasTaintFlow=y
+        sink(StringUtils.chomp(taint())); // $hasTaintFlow=y
+        sink(StringUtils.chomp(taint(), "separator")); // $hasTaintFlow=y
+        // GOOD: separator does not flow to the return value.
+        sink(StringUtils.chomp("Chomp me", taint()));
+        sink(StringUtils.chop(taint())); // $hasTaintFlow=y
+        sink(StringUtils.defaultIfBlank(taint(), "default")); // $hasTaintFlow=y
+        sink(StringUtils.defaultIfBlank("Perhaps blank", taint())); // $hasTaintFlow=y
+        sink(StringUtils.defaultIfEmpty(taint(), "default")); // $hasTaintFlow=y
+        sink(StringUtils.defaultIfEmpty("Perhaps empty", taint())); // $hasTaintFlow=y
+        sink(StringUtils.defaultString(taint())); // $hasTaintFlow=y
+        sink(StringUtils.defaultString(taint(), "default string")); // $hasTaintFlow=y
+        sink(StringUtils.defaultString("perhaps null", taint())); // $hasTaintFlow=y
+        sink(StringUtils.deleteWhitespace(taint())); // $hasTaintFlow=y
+        sink(StringUtils.difference(taint(), "rhs")); // $hasTaintFlow=y
+        sink(StringUtils.difference("lhs", taint())); // $hasTaintFlow=y
+        sink(StringUtils.firstNonBlank(taint(), "second string")); // $hasTaintFlow=y
+        sink(StringUtils.firstNonBlank("first string", taint())); // $hasTaintFlow=y
+        sink(StringUtils.firstNonEmpty(taint(), "second string")); // $hasTaintFlow=y
+        sink(StringUtils.firstNonEmpty("first string", taint())); // $hasTaintFlow=y
+        sink(StringUtils.getBytes(taint(), (Charset)null)); // $hasTaintFlow=y
+        sink(StringUtils.getBytes(taint(), "some charset")); // $hasTaintFlow=y
+        // GOOD: charset names are not a source of taint
+        sink(StringUtils.getBytes("some string", taint()));
+        sink(StringUtils.getCommonPrefix(taint(), "second string")); // $hasTaintFlow=y
+        sink(StringUtils.getCommonPrefix("first string", taint())); // $hasTaintFlow=y
+        sink(StringUtils.getDigits(taint())); // $hasTaintFlow=y
+        sink(StringUtils.getIfBlank(taint(), () -> "default")); // $hasTaintFlow=y
+        sink(StringUtils.getIfEmpty(taint(), () -> "default")); // $hasTaintFlow=y
+        // BAD (but not detected yet): latent taint in lambdas
+        sink(StringUtils.getIfBlank("maybe blank", () -> taint()));
+        sink(StringUtils.getIfEmpty("maybe blank", () -> taint()));
+        // GOOD: byte arrays render as numbers, so can't usefully convey most forms
+        // of tainted data.
+        sink(StringUtils.join(StringUtils.getBytes(taint(), "UTF-8"), ' '));
+        sink(StringUtils.join(StringUtils.getBytes(taint(), "UTF-8"), ' ', 0, 0));
+        sink(StringUtils.join(taint().toCharArray(), ' ')); // $hasTaintFlow=y
+        sink(StringUtils.join(taint().toCharArray(), ' ', 0, 0)); // $hasTaintFlow=y
+        // Testing the Iterable<?> overloads of `join`
+        List<String> taintedList = new ArrayList<>();
+        taintedList.add(taint());
+        sink(StringUtils.join(taintedList, ' ')); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedList, "sep")); // $hasTaintFlow=y
+        List<String> untaintedList = new ArrayList<>();
+        sink(StringUtils.join(untaintedList, taint())); // $hasTaintFlow=y
+        // Testing the Iterator<?> overloads of `join`
+        sink(StringUtils.join(taintedList.iterator(), ' ')); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedList.iterator(), "sep")); // $hasTaintFlow=y
+        sink(StringUtils.join(untaintedList.iterator(), taint())); // $hasTaintFlow=y
+        // Testing the List<?> overloads of `join`, which have start/end indices
+        sink(StringUtils.join(taintedList, ' ', 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedList, "sep", 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.join(untaintedList, taint(), 0, 0)); // $hasTaintFlow=y
+        // Testing the Object[] overloads of `join`, which may have start/end indices
+        Object[] taintedArray = new Object[] { taint() };
+        sink(StringUtils.join(taintedArray, ' ')); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedArray, "sep")); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedArray, ' ', 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.join(taintedArray, "sep", 0, 0)); // $hasTaintFlow=y
+        Object[] untaintedArray = new Object[] { "safe" };
+        sink(StringUtils.join(untaintedArray, taint())); // $hasTaintFlow=y
+        sink(StringUtils.join(untaintedArray, taint(), 0, 0)); // $hasTaintFlow=y
+        // Testing the variadic overload of `join` and `joinWith`
+        sink(StringUtils.join(taint(), "other string")); // $hasTaintFlow=y
+        sink(StringUtils.join("other string before", taint())); // $hasTaintFlow=y
+        sink(StringUtils.joinWith("separator", taint(), "other string")); // $hasTaintFlow=y
+        sink(StringUtils.joinWith("separator", "other string before", taint())); // $hasTaintFlow=y
+        sink(StringUtils.joinWith(taint(), "other string before", "other string after")); // $hasTaintFlow=y
+        // End of `join` tests
+        sink(StringUtils.left(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.leftPad(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.leftPad(taint(), 0, ' ')); // $hasTaintFlow=y
+        sink(StringUtils.leftPad(taint(), 0, "padding")); // $hasTaintFlow=y
+        sink(StringUtils.leftPad("to pad", 0, taint())); // $hasTaintFlow=y
+        sink(StringUtils.lowerCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.lowerCase(taint(), Locale.UK)); // $hasTaintFlow=y
+        sink(StringUtils.mid(taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.normalizeSpace(taint())); // $hasTaintFlow=y
+        sink(StringUtils.overlay(taint(), "overlay", 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.overlay("underlay", taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.prependIfMissing(taint(), "append prefix", "check prefix 1", "check prefix 2")); // $hasTaintFlow=y
+        sink(StringUtils.prependIfMissing("original string", taint(), "check prefix 1", "check prefix 2")); // $hasTaintFlow=y
+        // (next 2 calls) GOOD: args 3+ are checked against but do not propagate to the return value
+        sink(StringUtils.prependIfMissing("original string", "append prefix", taint(), "check prefix 2"));
+        sink(StringUtils.prependIfMissing("original string", "append prefix", "check prefix 1", taint()));
+        sink(StringUtils.prependIfMissingIgnoreCase(taint(), "append prefix", "check prefix 1", "check prefix 2")); // $hasTaintFlow=y
+        sink(StringUtils.prependIfMissingIgnoreCase("original string", taint(), "check prefix 1", "check prefix 2")); // $hasTaintFlow=y
+        // (next 2 calls) GOOD: args 3+ are checked against but do not propagate to the return value
+        sink(StringUtils.prependIfMissingIgnoreCase("original string", "append prefix", taint(), "check prefix 2"));
+        sink(StringUtils.prependIfMissingIgnoreCase("original string", "append prefix", "check prefix 1", taint()));
+        sink(StringUtils.remove(taint(), ' ')); // $hasTaintFlow=y
+        sink(StringUtils.remove(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeAll(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeEnd(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeEndIgnoreCase(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeFirst(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeIgnoreCase(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removePattern(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeStart(taint(), "delete me")); // $hasTaintFlow=y
+        sink(StringUtils.removeStartIgnoreCase(taint(), "delete me")); // $hasTaintFlow=y
+        // GOOD (next 9 calls): the removed string doesn't propagate to the return value
+        sink(StringUtils.remove("remove from", taint()));
+        sink(StringUtils.removeAll("remove from", taint()));
+        sink(StringUtils.removeEnd("remove from", taint()));
+        sink(StringUtils.removeEndIgnoreCase("remove from", taint()));
+        sink(StringUtils.removeFirst("remove from", taint()));
+        sink(StringUtils.removeIgnoreCase("remove from", taint()));
+        sink(StringUtils.removePattern("remove from", taint()));
+        sink(StringUtils.removeStart("remove from", taint()));
+        sink(StringUtils.removeStartIgnoreCase("remove from", taint()));
+        sink(StringUtils.repeat(taint(), 1)); // $hasTaintFlow=y
+        sink(StringUtils.repeat(taint(), "separator", 1)); // $hasTaintFlow=y
+        sink(StringUtils.repeat("repeat me", taint(), 1)); // $hasTaintFlow=y
+        sink(StringUtils.replace(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replace("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replace(taint(), "search", "replacement", 0)); // $hasTaintFlow=y
+        sink(StringUtils.replace("haystack", "search", taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.replaceAll(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replaceAll("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replaceChars(taint(), 'a', 'b')); // $hasTaintFlow=y
+        sink(StringUtils.replaceChars(taint(), "abc", "xyz")); // $hasTaintFlow=y
+        sink(StringUtils.replaceChars("haystack", "abc", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replaceEach(taint(), new String[] { "search" }, new String[] { "replacement" })); // $hasTaintFlow=y
+        sink(StringUtils.replaceEach("haystack", new String[] { "search" }, new String[] { taint() })); // $hasTaintFlow=y
+        sink(StringUtils.replaceEachRepeatedly(taint(), new String[] { "search" }, new String[] { "replacement" })); // $hasTaintFlow=y
+        sink(StringUtils.replaceEachRepeatedly("haystack", new String[] { "search" }, new String[] { taint() })); // $hasTaintFlow=y
+        sink(StringUtils.replaceFirst(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replaceFirst("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replaceIgnoreCase(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replaceIgnoreCase("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replaceOnce(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replaceOnce("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replaceOnceIgnoreCase(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replaceOnceIgnoreCase("haystack", "search", taint())); // $hasTaintFlow=y
+        sink(StringUtils.replacePattern(taint(), "search", "replacement")); // $hasTaintFlow=y
+        sink(StringUtils.replacePattern("haystack", "search", taint())); // $hasTaintFlow=y
+        // GOOD (next 11 calls): searched string in replace methods does not flow to the return value.
+        sink(StringUtils.replace("haystack", taint(), "replacement"));
+        sink(StringUtils.replace("haystack", taint(), "replacement", 0));
+        sink(StringUtils.replaceAll("haystack", taint(), "replacement"));
+        sink(StringUtils.replaceChars("haystack", taint(), "xyz"));
+        sink(StringUtils.replaceEach("haystack", new String[] { taint() }, new String[] { "replacement" }));
+        sink(StringUtils.replaceEachRepeatedly("haystack", new String[] { taint() }, new String[] { "replacement" }));
+        sink(StringUtils.replaceFirst("haystack", taint(), "replacement"));
+        sink(StringUtils.replaceIgnoreCase("haystack", taint(), "replacement"));
+        sink(StringUtils.replaceOnce("haystack", taint(), "replacement"));
+        sink(StringUtils.replaceOnceIgnoreCase("haystack", taint(), "replacement"));
+        sink(StringUtils.replacePattern("haystack", taint(), "replacement"));
+        sink(StringUtils.reverse(taint())); // $hasTaintFlow=y
+        sink(StringUtils.reverseDelimited(taint(), ',')); // $hasTaintFlow=y
+        sink(StringUtils.right(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.rightPad(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.rightPad(taint(), 0, ' ')); // $hasTaintFlow=y
+        sink(StringUtils.rightPad(taint(), 0, "padding")); // $hasTaintFlow=y
+        sink(StringUtils.rightPad("to pad", 0, taint())); // $hasTaintFlow=y
+        sink(StringUtils.rotate(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.split(taint())); // $hasTaintFlow=y
+        sink(StringUtils.split(taint(), ' ')); // $hasTaintFlow=y
+        sink(StringUtils.split(taint(), " ,; // $hasTaintFlow=y")); // $hasTaintFlow=y
+        sink(StringUtils.split(taint(), " ,; // $hasTaintFlow=y", 0)); // $hasTaintFlow=y
+        sink(StringUtils.splitByCharacterType(taint())); // $hasTaintFlow=y
+        sink(StringUtils.splitByCharacterTypeCamelCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.splitByWholeSeparator(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.splitByWholeSeparator(taint(), "separator", 0)); // $hasTaintFlow=y
+        sink(StringUtils.splitByWholeSeparatorPreserveAllTokens(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.splitByWholeSeparatorPreserveAllTokens(taint(), "separator", 0)); // $hasTaintFlow=y
+        sink(StringUtils.splitPreserveAllTokens(taint())); // $hasTaintFlow=y
+        sink(StringUtils.splitPreserveAllTokens(taint(), ' ')); // $hasTaintFlow=y
+        sink(StringUtils.splitPreserveAllTokens(taint(), " ,;")); // $hasTaintFlow=y
+        sink(StringUtils.splitPreserveAllTokens(taint(), " ,;", 0)); // $hasTaintFlow=y
+        // GOOD (next 8 calls): separators don't propagate to the return value
+        sink(StringUtils.split("to split", taint()));
+        sink(StringUtils.split("to split", taint(), 0));
+        sink(StringUtils.splitPreserveAllTokens("to split", taint(), 0));
+        sink(StringUtils.splitByWholeSeparator("to split", taint()));
+        sink(StringUtils.splitByWholeSeparator("to split", taint(), 0));
+        sink(StringUtils.splitByWholeSeparatorPreserveAllTokens("to split", taint()));
+        sink(StringUtils.splitByWholeSeparatorPreserveAllTokens("to split", taint(), 0));
+        sink(StringUtils.splitPreserveAllTokens("to split", taint()));
+        sink(StringUtils.strip(taint())); // $hasTaintFlow=y
+        sink(StringUtils.strip(taint(), "charstoremove")); // $hasTaintFlow=y
+        sink(StringUtils.stripAccents(taint())); // $hasTaintFlow=y
+        sink(StringUtils.stripAll(new String[] { taint() }, "charstoremove")); // $hasTaintFlow=y
+        sink(StringUtils.stripEnd(taint(), "charstoremove")); // $hasTaintFlow=y
+        sink(StringUtils.stripStart(taint(), "charstoremove")); // $hasTaintFlow=y
+        // GOOD (next 4 calls): stripped chars do not flow to the return value.
+        sink(StringUtils.strip("original text", taint()));
+        sink(StringUtils.stripAll(new String[] { "original text" }, taint()));
+        sink(StringUtils.stripEnd("original text", taint()));
+        sink(StringUtils.stripStart("original text", taint()));
+        sink(StringUtils.stripToEmpty(taint())); // $hasTaintFlow=y
+        sink(StringUtils.stripToNull(taint())); // $hasTaintFlow=y
+        sink(StringUtils.substring(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.substring(taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.substringAfter(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.substringAfter(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.substringAfterLast(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.substringAfterLast(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.substringBefore(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.substringBeforeLast(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.substringBetween(taint(), "separator")); // $hasTaintFlow=y
+        sink(StringUtils.substringBetween(taint(), "start-tag", "end-tag")); // $hasTaintFlow=y
+        sink(StringUtils.substringsBetween(taint(), "start-tag", "end-tag")[0]); // $hasTaintFlow=y
+        // GOOD (next 9 calls): separators and bounding tags do not flow to the return value.
+        sink(StringUtils.substringAfter("original text", taint()));
+        sink(StringUtils.substringAfterLast("original text", taint()));
+        sink(StringUtils.substringBefore("original text", taint()));
+        sink(StringUtils.substringBeforeLast("original text", taint()));
+        sink(StringUtils.substringBetween("original text", taint()));
+        sink(StringUtils.substringBetween("original text", taint(), "end-tag"));
+        sink(StringUtils.substringBetween("original text", "start-tag", taint()));
+        sink(StringUtils.substringsBetween("original text", taint(), "end-tag")[0]);
+        sink(StringUtils.substringsBetween("original text", "start-tag", taint())[0]);
+        sink(StringUtils.swapCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.toCodePoints(taint())); // $hasTaintFlow=y
+        sink(StringUtils.toEncodedString(StringUtils.getBytes(taint(), "charset"), null)); // $hasTaintFlow=y
+        sink(StringUtils.toRootLowerCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.toRootUpperCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.toString(StringUtils.getBytes(taint(), "charset"), "charset")); // $hasTaintFlow=y
+        sink(StringUtils.trim(taint())); // $hasTaintFlow=y
+        sink(StringUtils.trimToEmpty(taint())); // $hasTaintFlow=y
+        sink(StringUtils.trimToNull(taint())); // $hasTaintFlow=y
+        sink(StringUtils.truncate(taint(), 0)); // $hasTaintFlow=y
+        sink(StringUtils.truncate(taint(), 0, 0)); // $hasTaintFlow=y
+        sink(StringUtils.uncapitalize(taint())); // $hasTaintFlow=y
+        sink(StringUtils.unwrap(taint(), '"')); // $hasTaintFlow=y
+        sink(StringUtils.unwrap(taint(), "separator")); // $hasTaintFlow=y
+        // GOOD: the wrapper string does not flow to the return value.
+        sink(StringUtils.unwrap("original string", taint()));
+        sink(StringUtils.upperCase(taint())); // $hasTaintFlow=y
+        sink(StringUtils.upperCase(taint(), null)); // $hasTaintFlow=y
+        sink(StringUtils.valueOf(taint().toCharArray())); // $hasTaintFlow=y
+        sink(StringUtils.wrap(taint(), '"')); // $hasTaintFlow=y
+        sink(StringUtils.wrap(taint(), "wrapper token")); // $hasTaintFlow=y
+        sink(StringUtils.wrap("wrap me", taint())); // $hasTaintFlow=y
+        sink(StringUtils.wrapIfMissing(taint(), '"')); // $hasTaintFlow=y
+        sink(StringUtils.wrapIfMissing(taint(), "wrapper token")); // $hasTaintFlow=y
+        sink(StringUtils.wrapIfMissing("wrap me", taint())); // $hasTaintFlow=y
+
+    }
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/TextStringBuilderTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/TextStringBuilderTest.java
new file mode 100644
index 00000000000..f70e3ac1797
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/TextStringBuilderTest.java
@@ -0,0 +1,134 @@
+import org.apache.commons.text.TextStringBuilder;
+import org.apache.commons.text.matcher.StringMatcher;
+import org.apache.commons.text.StringTokenizer;
+import java.io.StringReader;
+import java.nio.CharBuffer;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+class TextStringBuilderTest {
+    String taint() { return "tainted"; }
+
+    void sink(Object o) {}
+
+    void test() throws Exception {
+
+        TextStringBuilder cons1 = new TextStringBuilder(taint()); sink(cons1.toString()); // $hasTaintFlow=y
+        TextStringBuilder cons2 = new TextStringBuilder((CharSequence)taint()); sink(cons2.toString()); // $hasTaintFlow=y
+
+        TextStringBuilder sb1 = new TextStringBuilder(); sb1.append(taint().toCharArray()); sink(sb1.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb2 = new TextStringBuilder(); sb2.append(taint().toCharArray(), 0, 0); sink(sb2.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb3 = new TextStringBuilder(); sb3.append(CharBuffer.wrap(taint().toCharArray())); sink(sb3.toString()); // $ MISSING: hasTaintFlow=y
+        TextStringBuilder sb4 = new TextStringBuilder(); sb4.append(CharBuffer.wrap(taint().toCharArray()), 0, 0); sink(sb4.toString()); // $ MISSING: hasTaintFlow=y
+        TextStringBuilder sb5 = new TextStringBuilder(); sb5.append((CharSequence)taint()); sink(sb5.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb6 = new TextStringBuilder(); sb6.append((CharSequence)taint(), 0, 0); sink(sb6.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb7 = new TextStringBuilder(); sb7.append((Object)taint()); sink(sb7.toString()); // $hasTaintFlow=y
+        {
+            TextStringBuilder auxsb = new TextStringBuilder(); auxsb.append(taint());
+            TextStringBuilder sb8 = new TextStringBuilder(); sb8.append(auxsb); sink(sb8.toString()); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb9 = new TextStringBuilder(); sb9.append(new StringBuffer(taint())); sink(sb9.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb10 = new TextStringBuilder(); sb10.append(new StringBuffer(taint()), 0, 0); sink(sb10.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb11 = new TextStringBuilder(); sb11.append(new StringBuilder(taint())); sink(sb11.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb12 = new TextStringBuilder(); sb12.append(new StringBuilder(taint()), 0, 0); sink(sb12.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb13 = new TextStringBuilder(); sb13.append(taint()); sink(sb13.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb14 = new TextStringBuilder(); sb14.append(taint(), 0, 0); sink(sb14.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb15 = new TextStringBuilder(); sb15.append(taint(), "format", "args"); sink(sb15.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb16 = new TextStringBuilder(); sb16.append("Format string", taint(), "args"); sink(sb16.toString()); // $hasTaintFlow=y
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            TextStringBuilder sb17 = new TextStringBuilder(); sb17.appendAll(taintedList); sink(sb17.toString()); // $hasTaintFlow=y
+            TextStringBuilder sb18 = new TextStringBuilder(); sb18.appendAll(taintedList.iterator()); sink(sb18.toString()); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb19 = new TextStringBuilder(); sb19.appendAll("clean", taint()); sink(sb19.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb20 = new TextStringBuilder(); sb20.appendAll(taint(), "clean"); sink(sb20.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb21 = new TextStringBuilder(); sb21.appendFixedWidthPadLeft(taint(), 0, ' '); sink(sb21.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb22 = new TextStringBuilder(); sb22.appendFixedWidthPadRight(taint(), 0, ' '); sink(sb22.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb23 = new TextStringBuilder(); sb23.appendln(taint().toCharArray()); sink(sb23.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb24 = new TextStringBuilder(); sb24.appendln(taint().toCharArray(), 0, 0); sink(sb24.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb25 = new TextStringBuilder(); sb25.appendln((Object)taint()); sink(sb25.toString()); // $hasTaintFlow=y
+        {
+            TextStringBuilder auxsb = new TextStringBuilder(); auxsb.appendln(taint());
+            TextStringBuilder sb26 = new TextStringBuilder(); sb26.appendln(auxsb); sink(sb26.toString()); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb27 = new TextStringBuilder(); sb27.appendln(new StringBuffer(taint())); sink(sb27.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb28 = new TextStringBuilder(); sb28.appendln(new StringBuffer(taint()), 0, 0); sink(sb28.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb29 = new TextStringBuilder(); sb29.appendln(new StringBuilder(taint())); sink(sb29.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb30 = new TextStringBuilder(); sb30.appendln(new StringBuilder(taint()), 0, 0); sink(sb30.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb31 = new TextStringBuilder(); sb31.appendln(taint()); sink(sb31.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb32 = new TextStringBuilder(); sb32.appendln(taint(), 0, 0); sink(sb32.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb33 = new TextStringBuilder(); sb33.appendln(taint(), "format", "args"); sink(sb33.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb34 = new TextStringBuilder(); sb34.appendln("Format string", taint(), "args"); sink(sb34.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb35 = new TextStringBuilder(); sb35.appendSeparator(taint()); sink(sb35.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb36 = new TextStringBuilder(); sb36.appendSeparator(taint(), 0); sink(sb36.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb37 = new TextStringBuilder(); sb37.appendSeparator(taint(), "default"); sink(sb37.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb38 = new TextStringBuilder(); sb38.appendSeparator("", taint()); sink(sb38.toString()); // $hasTaintFlow=y
+        {
+            TextStringBuilder auxsb = new TextStringBuilder(); auxsb.appendln(taint());
+            TextStringBuilder sb39 = new TextStringBuilder(); auxsb.appendTo(sb39); sink(sb39.toString()); // $hasTaintFlow=y
+        }
+        {
+            List<String> taintedList = new ArrayList<>();
+            taintedList.add(taint());
+            TextStringBuilder sb40 = new TextStringBuilder(); sb40.appendWithSeparators(taintedList, ", "); sink(sb40.toString()); // $hasTaintFlow=y
+            TextStringBuilder sb41 = new TextStringBuilder(); sb41.appendWithSeparators(taintedList.iterator(), ", "); sink(sb41.toString()); // $hasTaintFlow=y
+            List<String> untaintedList = new ArrayList<>();
+            TextStringBuilder sb42 = new TextStringBuilder(); sb42.appendWithSeparators(untaintedList, taint()); sink(sb42.toString()); // $hasTaintFlow=y
+            TextStringBuilder sb43 = new TextStringBuilder(); sb43.appendWithSeparators(untaintedList.iterator(), taint()); sink(sb43.toString()); // $hasTaintFlow=y
+            String[] taintedArray = new String[] { taint() };
+            String[] untaintedArray = new String[] {};
+            TextStringBuilder sb44 = new TextStringBuilder(); sb44.appendWithSeparators(taintedArray, ", "); sink(sb44.toString()); // $hasTaintFlow=y
+            TextStringBuilder sb45 = new TextStringBuilder(); sb45.appendWithSeparators(untaintedArray, taint()); sink(sb45.toString()); // $hasTaintFlow=y
+        }
+        {
+            TextStringBuilder sb46 = new TextStringBuilder(); sb46.append(taint());
+            char[] target = new char[100];
+            sb46.asReader().read(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb47 = new TextStringBuilder(); sb47.append(taint()); sink(sb47.asTokenizer().next()); // $hasTaintFlow=y
+        TextStringBuilder sb48 = new TextStringBuilder(); sb48.append(taint()); sink(sb48.build()); // $hasTaintFlow=y
+        TextStringBuilder sb49 = new TextStringBuilder(); sb49.append(taint()); sink(sb49.getChars(null)); // $hasTaintFlow=y
+        {
+            TextStringBuilder sb50 = new TextStringBuilder(); sb50.append(taint());
+            char[] target = new char[100];
+            sb50.getChars(target);
+            sink(target); // $hasTaintFlow=y
+        }
+        {
+            TextStringBuilder sb51 = new TextStringBuilder(); sb51.append(taint());
+            char[] target = new char[100];
+            sb51.getChars(0, 0, target, 0);
+            sink(target); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb52 = new TextStringBuilder(); sb52.insert(0, taint().toCharArray()); sink(sb52.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb53 = new TextStringBuilder(); sb53.insert(0, taint().toCharArray(), 0, 0); sink(sb53.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb54 = new TextStringBuilder(); sb54.insert(0, taint()); sink(sb54.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb55 = new TextStringBuilder(); sb55.insert(0, (Object)taint()); sink(sb55.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb56 = new TextStringBuilder(); sb56.append(taint()); sink(sb56.leftString(0)); // $hasTaintFlow=y
+        TextStringBuilder sb57 = new TextStringBuilder(); sb57.append(taint()); sink(sb57.midString(0, 0)); // $hasTaintFlow=y
+        {
+            StringReader reader = new StringReader(taint());
+            TextStringBuilder sb58 = new TextStringBuilder(); sb58.readFrom(reader); sink(sb58.toString()); // $hasTaintFlow=y
+        }
+        TextStringBuilder sb59 = new TextStringBuilder(); sb59.replace(0, 0, taint()); sink(sb59.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb60 = new TextStringBuilder(); sb60.replace(null, taint(), 0, 0, 0); sink(sb60.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb61 = new TextStringBuilder(); sb61.replaceAll((StringMatcher)null, taint()); sink(sb61.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb62 = new TextStringBuilder(); sb62.replaceAll("search", taint()); sink(sb62.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb63 = new TextStringBuilder(); sb63.replaceAll(taint(), "replace"); sink(sb63.toString()); // GOOD (search string doesn't convey taint)
+        TextStringBuilder sb64 = new TextStringBuilder(); sb64.replaceFirst((StringMatcher)null, taint()); sink(sb64.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb65 = new TextStringBuilder(); sb65.replaceFirst("search", taint()); sink(sb65.toString()); // $hasTaintFlow=y
+        TextStringBuilder sb66 = new TextStringBuilder(); sb66.replaceFirst(taint(), "replace"); sink(sb66.toString()); // GOOD (search string doesn't convey taint)
+        TextStringBuilder sb67 = new TextStringBuilder(); sb67.append(taint()); sink(sb67.rightString(0)); // $hasTaintFlow=y
+        TextStringBuilder sb68 = new TextStringBuilder(); sb68.append(taint()); sink(sb68.subSequence(0, 0)); // $hasTaintFlow=y
+        TextStringBuilder sb69 = new TextStringBuilder(); sb69.append(taint()); sink(sb69.substring(0)); // $hasTaintFlow=y
+        TextStringBuilder sb70 = new TextStringBuilder(); sb70.append(taint()); sink(sb70.substring(0, 0)); // $hasTaintFlow=y
+        TextStringBuilder sb71 = new TextStringBuilder(); sb71.append(taint()); sink(sb71.toCharArray()); // $hasTaintFlow=y
+        TextStringBuilder sb72 = new TextStringBuilder(); sb72.append(taint()); sink(sb72.toCharArray(0, 0)); // $hasTaintFlow=y
+        TextStringBuilder sb73 = new TextStringBuilder(); sb73.append(taint()); sink(sb73.toStringBuffer()); // $hasTaintFlow=y
+        TextStringBuilder sb74 = new TextStringBuilder(); sb74.append(taint()); sink(sb74.toStringBuilder()); // $hasTaintFlow=y
+    }
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.expected b/java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.ql b/java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.ql
new file mode 100644
index 00000000000..110a4e96689
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/flow.ql
@@ -0,0 +1,30 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+import TestUtilities.InlineExpectationsTest
+
+class Conf extends TaintTracking::Configuration {
+  Conf() { this = "qltest:frameworks:apache-commons-lang3" }
+
+  override predicate isSource(DataFlow::Node n) {
+    n.asExpr().(MethodAccess).getMethod().hasName("taint")
+  }
+
+  override predicate isSink(DataFlow::Node n) {
+    exists(MethodAccess ma | ma.getMethod().hasName("sink") | n.asExpr() = ma.getAnArgument())
+  }
+}
+
+class HasFlowTest extends InlineExpectationsTest {
+  HasFlowTest() { this = "HasFlowTest" }
+
+  override string getARelevantTag() { result = "hasTaintFlow" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasTaintFlow" and
+    exists(DataFlow::Node src, DataFlow::Node sink, Conf conf | conf.hasFlow(src, sink) |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      value = "y"
+    )
+  }
+}
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/options b/java/ql/test/library-tests/frameworks/apache-commons-lang3/options
new file mode 100644
index 00000000000..400cde48d69
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/apache-commons-lang3-3.7:${testdir}/../../../stubs/apache-commons-text-1.9
diff --git a/java/ql/test/library-tests/guards/Logic.java b/java/ql/test/library-tests/guards/Logic.java
index a07890a4a75..afe646908a0 100644
--- a/java/ql/test/library-tests/guards/Logic.java
+++ b/java/ql/test/library-tests/guards/Logic.java
@@ -41,7 +41,7 @@ public class Logic {
   }
 
   private static void checkTrue(boolean b, String msg) {
-    if (!b) throw new Exception(msg);
+    if (!b) throw new Error    (msg);
   }
 
   private static void checkFalse(boolean b, String msg) {
diff --git a/java/ql/test/library-tests/guards/Test.java b/java/ql/test/library-tests/guards/Test.java
index 59f63917b09..d4441f98fdd 100644
--- a/java/ql/test/library-tests/guards/Test.java
+++ b/java/ql/test/library-tests/guards/Test.java
@@ -3,7 +3,7 @@ class Test {
 	void test(int x) {
 		z = 0;
 		if (x < 0) {
-			throw new Exception();
+			throw new Error();
 		}
 		int y = 0;
 		while(x >= 0) {
diff --git a/java/ql/test/library-tests/pathcreation/PathCreation.java b/java/ql/test/library-tests/pathcreation/PathCreation.java
index dcdb28adf45..fcd1eed3e28 100644
--- a/java/ql/test/library-tests/pathcreation/PathCreation.java
+++ b/java/ql/test/library-tests/pathcreation/PathCreation.java
@@ -18,7 +18,7 @@ class PathCreation {
         File f = new File(new File("dir"), "sub");
     }
 
-    public void testNewFileWithURI() {
+    public void testNewFileWithURI() throws java.net.URISyntaxException {
         File f = new File(new URI("dir"));
     }
 
@@ -27,7 +27,7 @@ class PathCreation {
         Path p2 = Path.of("dir", "sub");
     }
 
-    public void testPathOfWithURI() {
+    public void testPathOfWithURI() throws java.net.URISyntaxException {
         Path p = Path.of(new URI("dir"));
     }
 
@@ -36,7 +36,7 @@ class PathCreation {
         Path p2 = Paths.get("dir", "sub");
     }
 
-    public void testPathsGetWithURI() {
+    public void testPathsGetWithURI() throws java.net.URISyntaxException {
         Path p = Paths.get(new URI("dir"));
     }
 
@@ -53,19 +53,19 @@ class PathCreation {
         Path p = Path.of("dir").resolve("sub");
     }
 
-    public void testNewFileWriterWithString() {
+    public void testNewFileWriterWithString() throws java.io.IOException {
         FileWriter fw = new FileWriter("dir");
     }
 
-    public void testNewFileReaderWithString() {
+    public void testNewFileReaderWithString() throws java.io.FileNotFoundException {
         FileReader fr = new FileReader("dir");
     }
 
-    public void testNewFileOutputStreamWithString() {
+    public void testNewFileOutputStreamWithString() throws java.io.FileNotFoundException {
         FileOutputStream fos = new FileOutputStream("dir");
     }
 
-    public void testNewFileInputStreamWithString() {
+    public void testNewFileInputStreamWithString() throws java.io.FileNotFoundException {
         FileInputStream fis = new FileInputStream("dir");
     }
 }
diff --git a/java/ql/test/library-tests/reflection/reflection/ReflectiveAccess.java b/java/ql/test/library-tests/reflection/reflection/ReflectiveAccess.java
index 2a729af39fd..99687ea2649 100644
--- a/java/ql/test/library-tests/reflection/reflection/ReflectiveAccess.java
+++ b/java/ql/test/library-tests/reflection/reflection/ReflectiveAccess.java
@@ -14,7 +14,7 @@ public class ReflectiveAccess {
 		return classContainingAnnotation.getAnnotation(annotationClass);
 	}
 
-	public static void main(String[] args) {
+	public static void main(String[] args) throws ClassNotFoundException, InstantiationException, IllegalAccessException {
 		Class<?> testClass = Class.forName("reflection.ReflectiveAccess$TestClass");
 
 		testClass.newInstance();
diff --git a/java/ql/test/library-tests/successors/TestThrow2/TestThrow2.java b/java/ql/test/library-tests/successors/TestThrow2/TestThrow2.java
index c3652aa161c..29f86a7bb58 100644
--- a/java/ql/test/library-tests/successors/TestThrow2/TestThrow2.java
+++ b/java/ql/test/library-tests/successors/TestThrow2/TestThrow2.java
@@ -5,8 +5,8 @@ class TestThrow2 {
 	{
 		try {
 			thrower();
-		} catch (Exception e) {
+		} catch (Throwable e) {
 			;
 		}
 	}
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/query-tests/CloseResource/CloseReader/CloseReader.java b/java/ql/test/query-tests/CloseResource/CloseReader/CloseReader.java
index 38549f5873c..7d78f8dbfef 100644
--- a/java/ql/test/query-tests/CloseResource/CloseReader/CloseReader.java
+++ b/java/ql/test/query-tests/CloseResource/CloseReader/CloseReader.java
@@ -100,7 +100,7 @@ class CloseReader {
 		private void init(InputStreamReader reader) {
 			fileRd = new BufferedReader(reader);
 		}
-		public void readStuff() {
+		public void readStuff() throws java.io.IOException {
 			System.out.println(fileRd.readLine());
 			fileRd.close();
 		}
diff --git a/java/ql/test/query-tests/ContinueInFalseLoop/A.java b/java/ql/test/query-tests/ContinueInFalseLoop/A.java
index 14c4ee0e7aa..51f381b94c8 100644
--- a/java/ql/test/query-tests/ContinueInFalseLoop/A.java
+++ b/java/ql/test/query-tests/ContinueInFalseLoop/A.java
@@ -30,21 +30,21 @@ public class A {
         break;
     } while (c.cond());
 
-    // --- while, for loops ---
 
-    while (false) {
-      if (c.cond())
-        continue; // GOOD [never reached, if the condition changed so it was then the result would no longer apply]
-      if (c.cond())
-        break;
-    }
 
-    for (i = 0; false; i++) {
-      if (c.cond())
-        continue; // GOOD [never reached, if the condition changed so it was then the result would no longer apply]
-      if (c.cond())
-        break;
-    }
+
+
+
+
+
+
+
+
+
+
+
+
+
 
     // --- nested loops ---
 
diff --git a/java/ql/test/query-tests/MissingCallToSuperClone/Test.java b/java/ql/test/query-tests/MissingCallToSuperClone/Test.java
index 77efe645ef5..a236543a695 100644
--- a/java/ql/test/query-tests/MissingCallToSuperClone/Test.java
+++ b/java/ql/test/query-tests/MissingCallToSuperClone/Test.java
@@ -1,10 +1,10 @@
 class IAmAGoodCloneable implements Cloneable {
-	public Object clone() {
+	public Object clone() throws CloneNotSupportedException {
 		return super.clone();
 	}
 }
 
-class Sub1 extends IAmAGoodCloneable { public Object clone() { return super.clone(); } }
+class Sub1 extends IAmAGoodCloneable { public Object clone() throws CloneNotSupportedException { return super.clone(); } }
 
 class IAmABadCloneable implements Cloneable {
 	public Object clone() {
diff --git a/java/ql/test/query-tests/MissingInstanceofInEquals/GoodReturn.java b/java/ql/test/query-tests/MissingInstanceofInEquals/GoodReturn.java
index 593469fe6fb..0de780e4162 100644
--- a/java/ql/test/query-tests/MissingInstanceofInEquals/GoodReturn.java
+++ b/java/ql/test/query-tests/MissingInstanceofInEquals/GoodReturn.java
@@ -3,7 +3,7 @@ class GoodReturn {
 
   @Override
   public int hashCode() {
-    getClass().hashCode();
+    return getClass().hashCode();
   }
 
   @Override
diff --git a/java/ql/test/query-tests/Nullness/C.java b/java/ql/test/query-tests/Nullness/C.java
index c9fe368a394..ac6a5f291da 100644
--- a/java/ql/test/query-tests/Nullness/C.java
+++ b/java/ql/test/query-tests/Nullness/C.java
@@ -171,7 +171,7 @@ public class C {
 
   private void verifyBool(boolean b) {
     if (!b) {
-      throw new Exception();
+      throw new Error();
     }
   }
 
@@ -192,7 +192,7 @@ public class C {
 
   private void verifyNotNull(Object obj) {
     if (obj == null) {
-      throw new Exception();
+      throw new Error();
     }
   }
 
diff --git a/java/ql/test/query-tests/RangeAnalysis/A.java b/java/ql/test/query-tests/RangeAnalysis/A.java
index f2cb4918387..53fbc62f83b 100644
--- a/java/ql/test/query-tests/RangeAnalysis/A.java
+++ b/java/ql/test/query-tests/RangeAnalysis/A.java
@@ -5,7 +5,7 @@ public class A {
 
   public A(int[] arr2, int n) {
     if (arr2.length % 2 != 0)
-      throw new Exception();
+      throw new Error();
     this.arr2 = arr2;
     this.arr3 = new int[n << 1];
   }
@@ -168,7 +168,7 @@ public class A {
     if (n > 0) {
       a = n > 0 ? new int[3 * n] : null;
     }
-    int sum;
+    int sum = 0;
     if (a != null) {
       for (int i = 0; i < a.length; i += 3) {
         sum += a[i + 2]; // OK
diff --git a/java/ql/test/query-tests/UseBraces/UseBraces.java b/java/ql/test/query-tests/UseBraces/UseBraces.java
index c823456cd2a..756050b2c44 100644
--- a/java/ql/test/query-tests/UseBraces/UseBraces.java
+++ b/java/ql/test/query-tests/UseBraces/UseBraces.java
@@ -7,9 +7,9 @@ class UseBraces
 	void f() { }
 	void g() { }
 	void h() { }
-	void test()
+	void test(boolean bb)
 	{
-		int x, y;
+		int x = 0, y;
 		int[] branches = new int[10];
 		
 		// If-then statement
@@ -67,27 +67,27 @@ class UseBraces
 
 		// While statement
 
-		while(false)
+		while(bb)
 		{
 			f();
 		}
 			g();		// No alert
 
 
-		while(false)
+		while(bb)
 			f();
 		g();
 
-		while(false)
+		while(bb   )
 			f();
 			g();		// Alert
 			g();		// No alert
 
-		while(false)
+		while(bb   )
 			f();	g();		// Alert
 
 
-		while(false)
+		while(bb)
 			if (x != 0) x = 1;
 
 		// Do-while statement
diff --git a/java/ql/test/query-tests/UselessComparisonTest/Test.java b/java/ql/test/query-tests/UselessComparisonTest/Test.java
index 4b9d7488317..eafac84dea5 100644
--- a/java/ql/test/query-tests/UselessComparisonTest/Test.java
+++ b/java/ql/test/query-tests/UselessComparisonTest/Test.java
@@ -3,7 +3,7 @@ class Test {
 	void test(int x) {
 		z = getInt();
 		if (x < 0 || z < 0) {
-			throw new Exception();
+			throw new Error();
 		}
 		int y = 0;
 		if (x >= 0) y++; // useless test due to test in line 5 being false
diff --git a/java/ql/test/query-tests/UselessNullCheck/A.java b/java/ql/test/query-tests/UselessNullCheck/A.java
index 017629ec516..009f5efadd3 100644
--- a/java/ql/test/query-tests/UselessNullCheck/A.java
+++ b/java/ql/test/query-tests/UselessNullCheck/A.java
@@ -7,7 +7,7 @@ public class A {
       new Object();
     } catch(Exception e) {
       if (e == null) { // Useless check
-        throw new Exception();
+        throw new Error();
       }
     }
   }
@@ -16,7 +16,7 @@ public class A {
     if (o instanceof A) {
       A a = (A)o;
       if (a != null) { // Useless check
-        throw new Exception();
+        throw new Error();
       }
     }
   }
diff --git a/java/ql/test/query-tests/dead-code/DeadField/ReflectionTest.java b/java/ql/test/query-tests/dead-code/DeadField/ReflectionTest.java
index 418975b0281..72ca3ae46f6 100644
--- a/java/ql/test/query-tests/dead-code/DeadField/ReflectionTest.java
+++ b/java/ql/test/query-tests/dead-code/DeadField/ReflectionTest.java
@@ -16,7 +16,7 @@ public class ReflectionTest {
 		public int shadowedField;
 	}
 
-	public static void main(String[] args) {
+	public static void main(String[] args) throws NoSuchFieldException {
 		// Ensure the two classes are live, otherwise we might hide some results
 		new ParentClass();
 		new ChildClass();
diff --git a/java/ql/test/query-tests/dead-code/DeadMethod/ReflectionMethodTest.java b/java/ql/test/query-tests/dead-code/DeadMethod/ReflectionMethodTest.java
index 4336655a664..c77718f9750 100644
--- a/java/ql/test/query-tests/dead-code/DeadMethod/ReflectionMethodTest.java
+++ b/java/ql/test/query-tests/dead-code/DeadMethod/ReflectionMethodTest.java
@@ -19,7 +19,7 @@ public class ReflectionMethodTest {
     public void test4() { }
   }
 
-  public static void main(String[] args) throws InstantiationException, IllegalAccessException, ClassNotFoundException {
+  public static void main(String[] args) throws InstantiationException, IllegalAccessException, ClassNotFoundException, NoSuchMethodException {
     // Get class by name
     Class.forName("ReflectionTest$TestObject1").getMethod("test1");
     // Use classloader
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java
index 46ed97e2d98..b5bee61b965 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java
@@ -3,7 +3,7 @@ import java.nio.file.*;
 import java.util.zip.*;
 
 public class ZipTest {
-  public void m1(ZipEntry entry, File dir) {
+  public void m1(ZipEntry entry, File dir) throws Exception {
     String name = entry.getName();
     File file = new File(dir, name);
     FileOutputStream os = new FileOutputStream(file); // ZipSlip
@@ -11,7 +11,7 @@ public class ZipTest {
     FileWriter fw = new FileWriter(file); // ZipSlip
   }
 
-  public void m2(ZipEntry entry, File dir) {
+  public void m2(ZipEntry entry, File dir) throws Exception {
     String name = entry.getName();
     File file = new File(dir, name);
     File canFile = file.getCanonicalFile();
@@ -21,7 +21,7 @@ public class ZipTest {
     FileOutputStream os = new FileOutputStream(file); // OK
   }
 
-  public void m3(ZipEntry entry, File dir) {
+  public void m3(ZipEntry entry, File dir) throws Exception {
     String name = entry.getName();
     File file = new File(dir, name);
     if (!file.toPath().normalize().startsWith(dir.toPath()))
@@ -29,20 +29,20 @@ public class ZipTest {
     FileOutputStream os = new FileOutputStream(file); // OK
   }
 
-  private void validate(File tgtdir, File file) {
+  private void validate(File tgtdir, File file) throws Exception {
     File canFile = file.getCanonicalFile();
     if (!canFile.toPath().startsWith(tgtdir.toPath()))
       throw new Exception();
   }
 
-  public void m4(ZipEntry entry, File dir) {
+  public void m4(ZipEntry entry, File dir) throws Exception {
     String name = entry.getName();
     File file = new File(dir, name);
     validate(dir, file);
     FileOutputStream os = new FileOutputStream(file); // OK
   }
 
-  public void m5(ZipEntry entry, File dir) {
+  public void m5(ZipEntry entry, File dir) throws Exception {
     String name = entry.getName();
     File file = new File(dir, name);
     Path absfile = file.toPath().toAbsolutePath().normalize();
@@ -52,7 +52,7 @@ public class ZipTest {
     FileOutputStream os = new FileOutputStream(file); // OK
   }
 
-  public void m6(ZipEntry entry, Path dir) {
+  public void m6(ZipEntry entry, Path dir) throws Exception {
     String canonicalDest = dir.toFile().getCanonicalPath();
     Path target = dir.resolve(entry.getName());
     String canonicalTarget = target.toFile().getCanonicalPath();
diff --git a/java/ql/test/query-tests/security/CWE-078/Test.java b/java/ql/test/query-tests/security/CWE-078/Test.java
index 6e185b86bbd..1ac5dc47882 100644
--- a/java/ql/test/query-tests/security/CWE-078/Test.java
+++ b/java/ql/test/query-tests/security/CWE-078/Test.java
@@ -3,7 +3,7 @@ import java.util.List;
 import java.util.ArrayList;
 
 class Test {
-  public static void shellCommand(String arg) {
+  public static void shellCommand(String arg) throws java.io.IOException {
     ProcessBuilder pb = new ProcessBuilder("/bin/bash -c echo " + arg);
     pb.start();
 
@@ -25,7 +25,7 @@ class Test {
     pb.start();
   }
 
-  public static void nonShellCommand(String arg) {
+  public static void nonShellCommand(String arg) throws java.io.IOException {
     ProcessBuilder pb = new ProcessBuilder("./customTool " + arg);
     pb.start();
 
@@ -46,7 +46,7 @@ class Test {
     pb.start();
   }
 
-  public static void relativeCommand() {
+  public static void relativeCommand() throws java.io.IOException {
       ProcessBuilder pb = new ProcessBuilder("ls");
       pb.start();
 
@@ -54,11 +54,11 @@ class Test {
       pb.start();
   }
 
-  public static void main(String[] args) {
+  public static void main(String[] args) throws java.io.IOException {
       String arg = args.length > 1 ? args[1] : "default";
 
       shellCommand(arg);
       nonShellCommand(arg);
       relativeCommand();
   }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java b/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java
index 005271998ba..c893e0b8eef 100644
--- a/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java
+++ b/java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java
@@ -66,7 +66,7 @@ public class UnsafeHostnameVerification {
         HostnameVerifier verifier = new HostnameVerifier() {
             @Override
             public boolean verify(String hostname, SSLSession session) {
-                verify(hostname, session.getPeerCertificates());
+                try { verify(hostname, session.getPeerCertificates()); } catch (Exception e) { throw new RuntimeException(); }
                 return true; // GOOD [but detected as BAD]. The verification of the certificate is done in
                              // another method and
                 // in the case of a mismatch, an `Exception` is thrown so the `return true`
diff --git a/java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java b/java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java
index 568a9d89f85..9e2f3f923e8 100644
--- a/java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java
+++ b/java/ql/test/query-tests/security/CWE-311/CWE-319/Test.java
@@ -3,7 +3,7 @@ import javax.net.ssl.HttpsURLConnection;
 import java.io.*;
 
 class Test {
-  public void m1(HttpURLConnection connection) {
+  public void m1(HttpURLConnection connection) throws java.io.IOException {
     InputStream input;
     if (connection instanceof HttpsURLConnection) {
       input = connection.getInputStream(); // OK
diff --git a/java/ql/test/query-tests/security/CWE-421/semmle/Test.java b/java/ql/test/query-tests/security/CWE-421/semmle/Test.java
index 31d20ae133a..0e2dc665a4b 100644
--- a/java/ql/test/query-tests/security/CWE-421/semmle/Test.java
+++ b/java/ql/test/query-tests/security/CWE-421/semmle/Test.java
@@ -31,7 +31,7 @@ class Test {
 		return true;
 	}
 	
-	public void doConnect(int desiredPort, String username) {
+	public void doConnect(int desiredPort, String username) throws Exception {
 		ServerSocket listenSocket = new ServerSocket(desiredPort);
 
 		if (isAuthenticated(username)) {
@@ -56,7 +56,7 @@ class Test {
 		
 	}
 
-	public void doConnectChannel(int desiredPort, String username) {
+	public void doConnectChannel(int desiredPort, String username) throws Exception {
 		ServerSocketChannel listenChannel = ServerSocketChannel.open();
 		SocketAddress port = new InetSocketAddress(desiredPort);
 		listenChannel.bind(port);
diff --git a/java/ql/test/query-tests/security/CWE-502/A.java b/java/ql/test/query-tests/security/CWE-502/A.java
index 3b3de5f8ed2..50090f69132 100644
--- a/java/ql/test/query-tests/security/CWE-502/A.java
+++ b/java/ql/test/query-tests/security/CWE-502/A.java
@@ -9,32 +9,32 @@ import org.yaml.snakeyaml.constructor.Constructor;
 import org.yaml.snakeyaml.Yaml;
 
 public class A {
-  public Object deserialize1(Socket sock) {
+  public Object deserialize1(Socket sock) throws java.io.IOException, ClassNotFoundException {
     InputStream inputStream = sock.getInputStream();
     ObjectInputStream in = new ObjectInputStream(inputStream);
     return in.readObject(); // unsafe
   }
 
-  public Object deserialize2(Socket sock) {
+  public Object deserialize2(Socket sock) throws java.io.IOException, ClassNotFoundException {
     InputStream inputStream = sock.getInputStream();
     ObjectInputStream in = new ObjectInputStream(inputStream);
     return in.readUnshared(); // unsafe
   }
 
-  public Object deserialize3(Socket sock) {
+  public Object deserialize3(Socket sock) throws java.io.IOException {
     InputStream inputStream = sock.getInputStream();
     XMLDecoder d = new XMLDecoder(inputStream);
     return d.readObject(); // unsafe
   }
 
-  public Object deserialize4(Socket sock) {
+  public Object deserialize4(Socket sock) throws java.io.IOException {
     XStream xs = new XStream();
     InputStream inputStream = sock.getInputStream();
     Reader reader = new InputStreamReader(inputStream);
     return xs.fromXML(reader); // unsafe
   }
 
-  public void deserialize5(Socket sock) {
+  public void deserialize5(Socket sock) throws java.io.IOException {
     Kryo kryo = new Kryo();
     Input input = new Input(sock.getInputStream());
     A a1 = kryo.readObject(input, A.class); // unsafe
@@ -42,20 +42,20 @@ public class A {
     Object o = kryo.readClassAndObject(input); // unsafe
   }
 
-  private Kryo getSafeKryo() {
+  private Kryo getSafeKryo() throws java.io.IOException {
     Kryo kryo = new Kryo();
     kryo.setRegistrationRequired(true);
     // ... kryo.register(A.class) ...
     return kryo;
   }
 
-  public void deserialize6(Socket sock) {
+  public void deserialize6(Socket sock) throws java.io.IOException {
     Kryo kryo = getSafeKryo();
     Input input = new Input(sock.getInputStream());
     Object o = kryo.readClassAndObject(input); // OK
   }
 
-  public void deserializeSnakeYaml(Socket sock) {
+  public void deserializeSnakeYaml(Socket sock) throws java.io.IOException {
     Yaml yaml = new Yaml();
     InputStream input = sock.getInputStream();
     Object o = yaml.load(input); //unsafe
@@ -65,7 +65,7 @@ public class A {
     A o5 = yaml.loadAs(new InputStreamReader(input), A.class); //unsafe
   }
 
-  public void deserializeSnakeYaml2(Socket sock) {
+  public void deserializeSnakeYaml2(Socket sock) throws java.io.IOException {
     Yaml yaml = new Yaml(new Constructor());
     InputStream input = sock.getInputStream();
     Object o = yaml.load(input); //unsafe
@@ -75,7 +75,7 @@ public class A {
     A o5 = yaml.loadAs(new InputStreamReader(input), A.class); //unsafe
   }
 
-  public void deserializeSnakeYaml3(Socket sock) {
+  public void deserializeSnakeYaml3(Socket sock) throws java.io.IOException {
     Yaml yaml = new Yaml(new SafeConstructor());
     InputStream input = sock.getInputStream();
     Object o = yaml.load(input); //OK
@@ -85,13 +85,13 @@ public class A {
     A o5 = yaml.loadAs(new InputStreamReader(input), A.class); //OK
   }
 
-  public void deserializeSnakeYaml4(Socket sock) {
+  public void deserializeSnakeYaml4(Socket sock) throws java.io.IOException {
     Yaml yaml = new Yaml(new Constructor(A.class));
     InputStream input = sock.getInputStream();
-    Object o = yaml.load(input); //OK
-    Object o2 = yaml.loadAll(input); //OK
-    Object o3 = yaml.parse(new InputStreamReader(input)); //OK
-    A o4 = yaml.loadAs(input, A.class); //OK
-    A o5 = yaml.loadAs(new InputStreamReader(input), A.class); //OK
+    Object o = yaml.load(input); //unsafe
+    Object o2 = yaml.loadAll(input); //unsafe
+    Object o3 = yaml.parse(new InputStreamReader(input)); //unsafe
+    A o4 = yaml.loadAs(input, A.class); //unsafe
+    A o5 = yaml.loadAs(new InputStreamReader(input), A.class); //unsafe
   }
 }
diff --git a/java/ql/test/query-tests/security/CWE-502/B.java b/java/ql/test/query-tests/security/CWE-502/B.java
index 671442a9346..a12555edd70 100644
--- a/java/ql/test/query-tests/security/CWE-502/B.java
+++ b/java/ql/test/query-tests/security/CWE-502/B.java
@@ -3,19 +3,19 @@ import java.net.Socket;
 import com.alibaba.fastjson.JSON;
 
 public class B {
-  public Object deserializeJson1(Socket sock) {
+  public Object deserializeJson1(Socket sock) throws java.io.IOException {
     InputStream inputStream = sock.getInputStream();
     return JSON.parseObject(inputStream, null); // unsafe
   }
 
-  public Object deserializeJson2(Socket sock) {
+  public Object deserializeJson2(Socket sock) throws java.io.IOException {
     InputStream inputStream = sock.getInputStream();
     byte[] bytes = new byte[100];
     inputStream.read(bytes);
     return JSON.parse(bytes); // unsafe
   }
 
-  public Object deserializeJson3(Socket sock) {
+  public Object deserializeJson3(Socket sock) throws java.io.IOException {
     InputStream inputStream = sock.getInputStream();
     byte[] bytes = new byte[100];
     inputStream.read(bytes);
@@ -23,7 +23,7 @@ public class B {
     return JSON.parseObject(s); // unsafe
   }
 
-  public Object deserializeJson4(Socket sock) {
+  public Object deserializeJson4(Socket sock) throws java.io.IOException {
     InputStream inputStream = sock.getInputStream();
     byte[] bytes = new byte[100];
     inputStream.read(bytes);
diff --git a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
index 672a692c03f..f575a093d6e 100644
--- a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
+++ b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
@@ -16,6 +16,11 @@ edges
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:91:26:91:30 | input |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:92:30:92:34 | input |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:94:24:94:28 | input |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream |
 | B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes |
 | B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s |
@@ -46,6 +51,12 @@ nodes
 | A.java:73:28:73:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | A.java:74:24:74:28 | input | semmle.label | input |
 | A.java:75:24:75:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:91:26:91:30 | input | semmle.label | input |
+| A.java:92:30:92:34 | input | semmle.label | input |
+| A.java:93:28:93:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:94:24:94:28 | input | semmle.label | input |
+| A.java:95:24:95:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | B.java:8:29:8:39 | inputStream | semmle.label | inputStream |
 | B.java:12:31:12:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -74,6 +85,11 @@ nodes
 | A.java:73:17:73:56 | parse(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
 | A.java:74:12:74:38 | loadAs(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
 | A.java:75:12:75:61 | loadAs(...) | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:70:25:70:45 | getInputStream(...) | user input |
+| A.java:91:16:91:31 | load(...) | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:91:26:91:30 | input | Unsafe deserialization of $@. | A.java:90:25:90:45 | getInputStream(...) | user input |
+| A.java:92:17:92:35 | loadAll(...) | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:92:30:92:34 | input | Unsafe deserialization of $@. | A.java:90:25:90:45 | getInputStream(...) | user input |
+| A.java:93:17:93:56 | parse(...) | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:90:25:90:45 | getInputStream(...) | user input |
+| A.java:94:12:94:38 | loadAs(...) | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:94:24:94:28 | input | Unsafe deserialization of $@. | A.java:90:25:90:45 | getInputStream(...) | user input |
+| A.java:95:12:95:61 | loadAs(...) | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) | Unsafe deserialization of $@. | A.java:90:25:90:45 | getInputStream(...) | user input |
 | B.java:8:12:8:46 | parseObject(...) | B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream | Unsafe deserialization of $@. | B.java:7:31:7:51 | getInputStream(...) | user input |
 | B.java:15:12:15:28 | parse(...) | B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes | Unsafe deserialization of $@. | B.java:12:31:12:51 | getInputStream(...) | user input |
 | B.java:23:12:23:30 | parseObject(...) | B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s | Unsafe deserialization of $@. | B.java:19:31:19:51 | getInputStream(...) | user input |
diff --git a/java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java b/java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
index f70b44e2f1a..cb25141a90d 100644
--- a/java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
+++ b/java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
@@ -102,7 +102,7 @@ class DocumentBuilderTests {
 	builder.parse(source.getInputStream()); //unsafe
   }
 
-  private static DocumentBuilderFactory getDocumentBuilderFactory() {
+  private static DocumentBuilderFactory getDocumentBuilderFactory() throws Exception {
     DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
     String feature = "";
     feature = "http://xml.org/sax/features/external-parameter-entities";
@@ -115,8 +115,8 @@ class DocumentBuilderTests {
   private static final ThreadLocal<DocumentBuilder> XML_DOCUMENT_BUILDER = new ThreadLocal<DocumentBuilder>() {
     @Override
     protected DocumentBuilder initialValue() {
-      DocumentBuilderFactory factory = getDocumentBuilderFactory();
       try {
+        DocumentBuilderFactory factory = getDocumentBuilderFactory();
         return factory.newDocumentBuilder();
       } catch (Exception ex) {
         throw new RuntimeException(ex);
diff --git a/java/ql/test/query-tests/security/CWE-732/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-732/semmle/tests/Test.java
index ec1dfd1289c..8717203802d 100644
--- a/java/ql/test/query-tests/security/CWE-732/semmle/tests/Test.java
+++ b/java/ql/test/query-tests/security/CWE-732/semmle/tests/Test.java
@@ -31,11 +31,11 @@ class Test {
 		new FileInputStream(f2);
 	}
 
-	public static void readFile(File f) {
+	public static void readFile(File f) throws java.io.FileNotFoundException {
 		new FileReader(f);
 	}
 
 	public static void setWorldWritable(File f) {
 		f.setWritable(true, false);
 	}
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/query-tests/security/CWE-833/semmle/tests/LockOrderInconsistency.expected b/java/ql/test/query-tests/security/CWE-833/semmle/tests/LockOrderInconsistency.expected
index 89a404374cc..995d2a75277 100644
--- a/java/ql/test/query-tests/security/CWE-833/semmle/tests/LockOrderInconsistency.expected
+++ b/java/ql/test/query-tests/security/CWE-833/semmle/tests/LockOrderInconsistency.expected
@@ -1,4 +1,4 @@
-| MethodAccessLockOrder.java:29:4:29:40 | transferFrom(...) | Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock. | MethodAccessLockOrder.java:8:21:8:41 | subtract(...) | here | MethodAccessLockOrder.java:31:4:31:40 | transferFrom(...) | here |
+| MethodAccessLockOrder.java:29:11:29:47 | transferFrom(...) | Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock. | MethodAccessLockOrder.java:8:21:8:41 | subtract(...) | here | MethodAccessLockOrder.java:31:11:31:47 | transferFrom(...) | here |
 | ReentrantLockOrder.java:11:4:11:21 | lock(...) | Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock. | ReentrantLockOrder.java:12:4:12:21 | lock(...) | here | ReentrantLockOrder.java:28:4:28:21 | lock(...) | here |
 | ReentrantLockOrder.java:28:4:28:21 | lock(...) | Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock. | ReentrantLockOrder.java:29:4:29:21 | lock(...) | here | ReentrantLockOrder.java:11:4:11:21 | lock(...) | here |
 | SynchronizedStmtLockOrder.java:8:16:8:26 | primaryLock | Synchronization here and $@ may be performed in reverse order starting $@ and result in deadlock. | SynchronizedStmtLockOrder.java:9:17:9:27 | savingsLock | here | SynchronizedStmtLockOrder.java:22:16:22:26 | savingsLock | here |
diff --git a/java/ql/test/query-tests/security/CWE-833/semmle/tests/MethodAccessLockOrder.java b/java/ql/test/query-tests/security/CWE-833/semmle/tests/MethodAccessLockOrder.java
index 9092bfee427..e02364c05ec 100644
--- a/java/ql/test/query-tests/security/CWE-833/semmle/tests/MethodAccessLockOrder.java
+++ b/java/ql/test/query-tests/security/CWE-833/semmle/tests/MethodAccessLockOrder.java
@@ -26,9 +26,9 @@ class MethodAccessLockOrder {
 	public boolean initiateTransfer(boolean fromSavings, int amount) {
 		// AVOID: inconsistent lock order
 		if (fromSavings) {
-			primary.transferFrom(savings, amount);
+			return primary.transferFrom(savings, amount);
 		} else {
-			savings.transferFrom(primary, amount);
+			return savings.transferFrom(primary, amount);
 		}
 	}
 
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
new file mode 100644
index 00000000000..800b62a545b
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
@@ -0,0 +1,963 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3;
+
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.Charset;
+import java.text.Normalizer;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.Set;
+import java.util.StringJoiner;
+import java.util.function.Supplier;
+import java.util.regex.Pattern;
+
+
+public class StringUtils {
+    public static String abbreviate(final String str, final int maxWidth) {
+      return null;
+    }
+
+    public static String abbreviate(final String str, final int offset, final int maxWidth) {
+      return null;
+    }
+
+    public static String abbreviate(final String str, final String abbrevMarker, final int maxWidth) {
+      return null;
+    }
+
+    public static String abbreviate(final String str, final String abbrevMarker, int offset, final int maxWidth) {
+      return null;
+    }
+
+    public static String abbreviateMiddle(final String str, final String middle, final int length) {
+      return null;
+    }
+
+    public static String appendIfMissing(final String str, final CharSequence suffix, final CharSequence... suffixes) {
+      return null;
+    }
+
+    public static String appendIfMissingIgnoreCase(final String str, final CharSequence suffix, final CharSequence... suffixes) {
+      return null;
+    }
+
+    public static String capitalize(final String str) {
+      return null;
+    }
+
+    public static String center(final String str, final int size) {
+      return null;
+    }
+
+    public static String center(String str, final int size, final char padChar) {
+      return null;
+    }
+
+    public static String center(String str, final int size, String padStr) {
+      return null;
+    }
+
+    public static String chomp(final String str) {
+      return null;
+    }
+
+    public static String chomp(final String str, final String separator) {
+      return null;
+    }
+
+    public static String chop(final String str) {
+      return null;
+    }
+
+    public static int compare(final String str1, final String str2) {
+      return 0;
+    }
+
+    public static int compare(final String str1, final String str2, final boolean nullIsLess) {
+      return 0;
+    }
+
+    public static int compareIgnoreCase(final String str1, final String str2) {
+      return 0;
+    }
+
+    public static int compareIgnoreCase(final String str1, final String str2, final boolean nullIsLess) {
+      return 0;
+    }
+
+    public static boolean contains(final CharSequence seq, final CharSequence searchSeq) {
+      return false;
+    }
+
+    public static boolean contains(final CharSequence seq, final int searchChar) {
+      return false;
+    }
+
+    public static boolean containsAny(final CharSequence cs, final char... searchChars) {
+      return false;
+    }
+
+    public static boolean containsAny(final CharSequence cs, final CharSequence searchChars) {
+      return false;
+    }
+
+    public static boolean containsAny(final CharSequence cs, final CharSequence... searchCharSequences) {
+      return false;
+    }
+
+    public static boolean containsAnyIgnoreCase(final CharSequence cs, final CharSequence... searchCharSequences) {
+      return false;
+    }
+
+    public static boolean containsIgnoreCase(final CharSequence str, final CharSequence searchStr) {
+      return false;
+    }
+
+    public static boolean containsNone(final CharSequence cs, final char... searchChars) {
+      return false;
+    }
+
+    public static boolean containsNone(final CharSequence cs, final String invalidChars) {
+      return false;
+    }
+
+    public static boolean containsOnly(final CharSequence cs, final char... valid) {
+      return false;
+    }
+
+    public static boolean containsOnly(final CharSequence cs, final String validChars) {
+      return false;
+    }
+
+    public static boolean containsWhitespace(final CharSequence seq) {
+      return false;
+    }
+
+    public static int countMatches(final CharSequence str, final char ch) {
+      return 0;
+    }
+
+    public static int countMatches(final CharSequence str, final CharSequence sub) {
+      return 0;
+    }
+
+    public static <T extends CharSequence> T defaultIfBlank(final T str, final T defaultStr) {
+      return null;
+    }
+
+    public static <T extends CharSequence> T defaultIfEmpty(final T str, final T defaultStr) {
+      return null;
+    }
+
+    public static String defaultString(final String str) {
+      return null;
+    }
+
+    public static String defaultString(final String str, final String defaultStr) {
+      return null;
+    }
+
+    public static String deleteWhitespace(final String str) {
+      return null;
+    }
+
+    public static String difference(final String str1, final String str2) {
+      return null;
+    }
+
+    public static boolean endsWith(final CharSequence str, final CharSequence suffix) {
+      return false;
+    }
+
+    public static boolean endsWithAny(final CharSequence sequence, final CharSequence... searchStrings) {
+      return false;
+    }
+
+    public static boolean endsWithIgnoreCase(final CharSequence str, final CharSequence suffix) {
+      return false;
+    }
+
+    public static boolean equals(final CharSequence cs1, final CharSequence cs2) {
+      return false;
+    }
+
+    public static boolean equalsAny(final CharSequence string, final CharSequence... searchStrings) {
+      return false;
+    }
+
+    public static boolean equalsAnyIgnoreCase(final CharSequence string, final CharSequence...searchStrings) {
+      return false;
+    }
+
+    public static boolean equalsIgnoreCase(final CharSequence cs1, final CharSequence cs2) {
+      return false;
+    }
+
+    public static <T extends CharSequence> T firstNonBlank(final T... values) {
+      return null;
+    }
+
+    public static <T extends CharSequence> T firstNonEmpty(final T... values) {
+      return null;
+    }
+
+    public static byte[] getBytes(final String string, final Charset charset) {
+      return null;
+    }
+
+    public static byte[] getBytes(final String string, final String charset) throws UnsupportedEncodingException {
+      return null;
+    }
+
+    public static String getCommonPrefix(final String... strs) {
+      return null;
+    }
+
+    public static String getDigits(final String str) {
+      return null;
+    }
+
+    public static int getFuzzyDistance(final CharSequence term, final CharSequence query, final Locale locale) {
+      return 0;
+    }
+
+    public static <T extends CharSequence> T getIfBlank(final T str, final Supplier<T> defaultSupplier) {
+      return null;
+    }
+
+    public static <T extends CharSequence> T getIfEmpty(final T str, final Supplier<T> defaultSupplier) {
+      return null;
+    }
+
+    public static double getJaroWinklerDistance(final CharSequence first, final CharSequence second) {
+      return 0;
+    }
+
+    public static int getLevenshteinDistance(CharSequence s, CharSequence t) {
+      return 0;
+    }
+
+    public static int getLevenshteinDistance(CharSequence s, CharSequence t, final int threshold) {
+      return 0;
+    }
+
+    public static int indexOf(final CharSequence seq, final CharSequence searchSeq) {
+      return 0;
+    }
+
+    public static int indexOf(final CharSequence seq, final CharSequence searchSeq, final int startPos) {
+      return 0;
+    }
+
+    public static int indexOf(final CharSequence seq, final int searchChar) {
+      return 0;
+    }
+
+    public static int indexOf(final CharSequence seq, final int searchChar, final int startPos) {
+      return 0;
+    }
+
+    public static int indexOfAny(final CharSequence cs, final char... searchChars) {
+      return 0;
+    }
+
+    public static int indexOfAny(final CharSequence str, final CharSequence... searchStrs) {
+      return 0;
+    }
+
+    public static int indexOfAny(final CharSequence cs, final String searchChars) {
+      return 0;
+    }
+
+    public static int indexOfAnyBut(final CharSequence cs, final char... searchChars) {
+      return 0;
+    }
+
+    public static int indexOfAnyBut(final CharSequence seq, final CharSequence searchChars) {
+      return 0;
+    }
+
+    public static int indexOfDifference(final CharSequence... css) {
+      return 0;
+    }
+
+    public static int indexOfDifference(final CharSequence cs1, final CharSequence cs2) {
+      return 0;
+    }
+
+    public static int indexOfIgnoreCase(final CharSequence str, final CharSequence searchStr) {
+      return 0;
+    }
+
+    public static int indexOfIgnoreCase(final CharSequence str, final CharSequence searchStr, int startPos) {
+      return 0;
+    }
+
+    public static boolean isAllBlank(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isAllEmpty(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isAllLowerCase(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAllUpperCase(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAlpha(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAlphanumeric(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAlphanumericSpace(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAlphaSpace(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isAnyBlank(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isAnyEmpty(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isAsciiPrintable(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isBlank(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isEmpty(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isMixedCase(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isNoneBlank(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isNoneEmpty(final CharSequence... css) {
+      return false;
+    }
+
+    public static boolean isNotBlank(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isNumeric(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isNumericSpace(final CharSequence cs) {
+      return false;
+    }
+
+    public static boolean isWhitespace(final CharSequence cs) {
+      return false;
+    }
+
+    public static String join(final boolean[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final boolean[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final byte[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final byte[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final char[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final char[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final double[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final double[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final float[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final float[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final int[] array, final char separator) {
+      return null;
+    }
+
+    public static String join(final int[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final Iterable<?> iterable, final char separator) {
+      return null;
+    }
+
+    public static String join(final Iterable<?> iterable, final String separator) {
+      return null;
+    }
+
+    public static String join(final Iterator<?> iterator, final char separator) {
+      return null;
+    }
+
+    public static String join(final Iterator<?> iterator, final String separator) {
+      return null;
+    }
+
+    public static String join(final List<?> list, final char separator, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final List<?> list, final String separator, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final long[] array, final char separator) {
+      return null;
+    }
+
+    public static String join(final long[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final Object[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final Object[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final Object[] array, final String delimiter) {
+      return null;
+    }
+
+    public static String join(final Object[] array, String delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static String join(final short[] array, final char delimiter) {
+      return null;
+    }
+
+    public static String join(final short[] array, final char delimiter, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public static <T> String join(final T... elements) {
+      return null;
+    }
+
+    public static String joinWith(final String delimiter, final Object... array) {
+      return null;
+    }
+
+    public static int lastIndexOf(final CharSequence seq, final CharSequence searchSeq) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final CharSequence seq, final CharSequence searchSeq, final int startPos) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final CharSequence seq, final int searchChar) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final CharSequence seq, final int searchChar, final int startPos) {
+      return 0;
+    }
+
+    public static int lastIndexOfAny(final CharSequence str, final CharSequence... searchStrs) {
+      return 0;
+    }
+
+    public static int lastIndexOfIgnoreCase(final CharSequence str, final CharSequence searchStr) {
+      return 0;
+    }
+
+    public static int lastIndexOfIgnoreCase(final CharSequence str, final CharSequence searchStr, int startPos) {
+      return 0;
+    }
+
+    public static int lastOrdinalIndexOf(final CharSequence str, final CharSequence searchStr, final int ordinal) {
+      return 0;
+    }
+
+    public static String left(final String str, final int len) {
+      return null;
+    }
+
+    public static String leftPad(final String str, final int size) {
+      return null;
+    }
+
+    public static String leftPad(final String str, final int size, final char padChar) {
+      return null;
+    }
+
+    public static String leftPad(final String str, final int size, String padStr) {
+      return null;
+    }
+
+    public static int length(final CharSequence cs) {
+      return 0;
+    }
+
+    public static String lowerCase(final String str) {
+      return null;
+    }
+
+    public static String lowerCase(final String str, final Locale locale) {
+      return null;
+    }
+
+    public static String mid(final String str, int pos, final int len) {
+      return null;
+    }
+
+    public static String normalizeSpace(final String str) {
+      return null;
+    }
+
+    public static int ordinalIndexOf(final CharSequence str, final CharSequence searchStr, final int ordinal) {
+      return 0;
+    }
+
+    public static String overlay(final String str, String overlay, int start, int end) {
+      return null;
+    }
+
+    public static String prependIfMissing(final String str, final CharSequence prefix, final CharSequence... prefixes) {
+      return null;
+    }
+
+    public static String prependIfMissingIgnoreCase(final String str, final CharSequence prefix, final CharSequence... prefixes) {
+      return null;
+    }
+
+    public static String remove(final String str, final char remove) {
+      return null;
+    }
+
+    public static String remove(final String str, final String remove) {
+      return null;
+    }
+
+    public static String removeAll(final String text, final String regex) {
+      return null;
+    }
+
+    public static String removeEnd(final String str, final String remove) {
+      return null;
+    }
+
+    public static String removeEndIgnoreCase(final String str, final String remove) {
+      return null;
+    }
+
+    public static String removeFirst(final String text, final String regex) {
+      return null;
+    }
+
+    public static String removeIgnoreCase(final String str, final String remove) {
+      return null;
+    }
+
+    public static String removePattern(final String source, final String regex) {
+      return null;
+    }
+
+    public static String removeStart(final String str, final String remove) {
+      return null;
+    }
+
+    public static String removeStartIgnoreCase(final String str, final String remove) {
+      return null;
+    }
+
+    public static String repeat(final char ch, final int repeat) {
+      return null;
+    }
+
+    public static String repeat(final String str, final int repeat) {
+      return null;
+    }
+
+    public static String repeat(final String str, final String separator, final int repeat) {
+      return null;
+    }
+
+    public static String replace(final String text, final String searchString, final String replacement) {
+      return null;
+    }
+
+    public static String replace(final String text, final String searchString, final String replacement, final int max) {
+      return null;
+    }
+
+    public static String replaceAll(final String text, final String regex, final String replacement) {
+      return null;
+    }
+
+    public static String replaceChars(final String str, final char searchChar, final char replaceChar) {
+      return null;
+    }
+
+    public static String replaceChars(final String str, final String searchChars, String replaceChars) {
+      return null;
+    }
+
+    public static String replaceEach(final String text, final String[] searchList, final String[] replacementList) {
+      return null;
+    }
+
+    public static String replaceEachRepeatedly(final String text, final String[] searchList, final String[] replacementList) {
+      return null;
+    }
+
+    public static String replaceFirst(final String text, final String regex, final String replacement) {
+      return null;
+    }
+
+   public static String replaceIgnoreCase(final String text, final String searchString, final String replacement) {
+     return null;
+   }
+
+    public static String replaceIgnoreCase(final String text, final String searchString, final String replacement, final int max) {
+      return null;
+    }
+
+    public static String replaceOnce(final String text, final String searchString, final String replacement) {
+      return null;
+    }
+
+    public static String replaceOnceIgnoreCase(final String text, final String searchString, final String replacement) {
+      return null;
+    }
+
+    public static String replacePattern(final String source, final String regex, final String replacement) {
+      return null;
+    }
+
+    public static String reverse(final String str) {
+      return null;
+    }
+
+    public static String reverseDelimited(final String str, final char separatorChar) {
+      return null;
+    }
+
+    public static String right(final String str, final int len) {
+      return null;
+    }
+
+    public static String rightPad(final String str, final int size) {
+      return null;
+    }
+
+    public static String rightPad(final String str, final int size, final char padChar) {
+      return null;
+    }
+
+    public static String rightPad(final String str, final int size, String padStr) {
+      return null;
+    }
+
+    public static String rotate(final String str, final int shift) {
+      return null;
+    }
+
+    public static String[] split(final String str) {
+      return null;
+    }
+
+    public static String[] split(final String str, final char separatorChar) {
+      return null;
+    }
+
+    public static String[] split(final String str, final String separatorChars) {
+      return null;
+    }
+
+    public static String[] split(final String str, final String separatorChars, final int max) {
+      return null;
+    }
+
+    public static String[] splitByCharacterType(final String str) {
+      return null;
+    }
+
+    public static String[] splitByCharacterTypeCamelCase(final String str) {
+      return null;
+    }
+
+    public static String[] splitByWholeSeparator(final String str, final String separator) {
+      return null;
+    }
+
+    public static String[] splitByWholeSeparator( final String str, final String separator, final int max) {
+      return null;
+    }
+
+    public static String[] splitByWholeSeparatorPreserveAllTokens(final String str, final String separator) {
+      return null;
+    }
+
+    public static String[] splitByWholeSeparatorPreserveAllTokens(final String str, final String separator, final int max) {
+      return null;
+    }
+
+    public static String[] splitPreserveAllTokens(final String str) {
+      return null;
+    }
+
+    public static String[] splitPreserveAllTokens(final String str, final char separatorChar) {
+      return null;
+    }
+
+    public static String[] splitPreserveAllTokens(final String str, final String separatorChars) {
+      return null;
+    }
+
+    public static String[] splitPreserveAllTokens(final String str, final String separatorChars, final int max) {
+      return null;
+    }
+
+    public static boolean startsWith(final CharSequence str, final CharSequence prefix) {
+      return false;
+    }
+
+    public static boolean startsWithAny(final CharSequence sequence, final CharSequence... searchStrings) {
+      return false;
+    }
+
+    public static boolean startsWithIgnoreCase(final CharSequence str, final CharSequence prefix) {
+      return false;
+    }
+
+    public static String strip(final String str) {
+      return null;
+    }
+
+    public static String strip(String str, final String stripChars) {
+      return null;
+    }
+
+    public static String stripAccents(final String input) {
+      return null;
+    }
+
+    public static String[] stripAll(final String... strs) {
+      return null;
+    }
+
+    public static String[] stripAll(final String[] strs, final String stripChars) {
+      return null;
+    }
+
+    public static String stripEnd(final String str, final String stripChars) {
+      return null;
+    }
+
+    public static String stripStart(final String str, final String stripChars) {
+      return null;
+    }
+
+    public static String stripToEmpty(final String str) {
+      return null;
+    }
+
+    public static String stripToNull(String str) {
+      return null;
+    }
+
+    public static String substring(final String str, int start) {
+      return null;
+    }
+
+    public static String substring(final String str, int start, int end) {
+      return null;
+    }
+
+    public static String substringAfter(final String str, final int separator) {
+      return null;
+    }
+
+    public static String substringAfter(final String str, final String separator) {
+      return null;
+    }
+
+    public static String substringAfterLast(final String str, final int separator) {
+      return null;
+    }
+
+    public static String substringAfterLast(final String str, final String separator) {
+      return null;
+    }
+
+    public static String substringBefore(final String str, final String separator) {
+      return null;
+    }
+
+    public static String substringBeforeLast(final String str, final String separator) {
+      return null;
+    }
+
+    public static String substringBetween(final String str, final String tag) {
+      return null;
+    }
+
+    public static String substringBetween(final String str, final String open, final String close) {
+      return null;
+    }
+
+    public static String[] substringsBetween(final String str, final String open, final String close) {
+      return null;
+    }
+
+    public static String swapCase(final String str) {
+      return null;
+    }
+
+    public static int[] toCodePoints(final CharSequence cs) {
+      return null;
+    }
+
+    public static String toEncodedString(final byte[] bytes, final Charset charset) {
+      return null;
+    }
+
+    public static String toRootLowerCase(final String source) {
+      return null;
+    }
+
+    public static String toRootUpperCase(final String source) {
+      return null;
+    }
+
+    public static String toString(final byte[] bytes, final String charsetName) throws UnsupportedEncodingException {
+      return null;
+    }
+
+    public static String trim(final String str) {
+      return null;
+    }
+
+    public static String trimToEmpty(final String str) {
+      return null;
+    }
+
+    public static String trimToNull(final String str) {
+      return null;
+    }
+
+    public static String truncate(final String str, final int maxWidth) {
+      return null;
+    }
+
+    public static String truncate(final String str, final int offset, final int maxWidth) {
+      return null;
+    }
+
+    public static String uncapitalize(final String str) {
+      return null;
+    }
+
+    public static String unwrap(final String str, final char wrapChar) {
+      return null;
+    }
+
+    public static String unwrap(final String str, final String wrapToken) {
+      return null;
+    }
+
+    public static String upperCase(final String str) {
+      return null;
+    }
+
+    public static String upperCase(final String str, final Locale locale) {
+      return null;
+    }
+
+    public static String valueOf(final char[] value) {
+      return null;
+    }
+
+    public static String wrap(final String str, final char wrapWith) {
+      return null;
+    }
+
+    public static String wrap(final String str, final String wrapWith) {
+      return null;
+    }
+
+    public static String wrapIfMissing(final String str, final char wrapWith) {
+      return null;
+    }
+
+    public static String wrapIfMissing(final String str, final String wrapWith) {
+      return null;
+    }
+
+    public StringUtils() {
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/builder/Builder.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/builder/Builder.java
new file mode 100644
index 00000000000..285aaa82183
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/builder/Builder.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3.builder;
+
+/**
+ * <p>
+ * The Builder interface is designed to designate a class as a <em>builder</em> 
+ * object in the Builder design pattern. Builders are capable of creating and 
+ * configuring objects or results that normally take multiple steps to construct 
+ * or are very complex to derive. 
+ * </p>
+ * 
+ * <p>
+ * The builder interface defines a single method, {@link #build()}, that 
+ * classes must implement. The result of this method should be the final 
+ * configured object or result after all building operations are performed.
+ * </p>
+ * 
+ * <p>
+ * It is a recommended practice that the methods supplied to configure the 
+ * object or result being built return a reference to {@code this} so that
+ * method calls can be chained together.
+ * </p>
+ * 
+ * <p>
+ * Example Builder:
+ * <pre><code>
+ * class FontBuilder implements Builder&lt;Font&gt; {
+ *     private Font font;
+ *     
+ *     public FontBuilder(String fontName) {
+ *         this.font = new Font(fontName, Font.PLAIN, 12);
+ *     }
+ * 
+ *     public FontBuilder bold() {
+ *         this.font = this.font.deriveFont(Font.BOLD);
+ *         return this; // Reference returned so calls can be chained
+ *     }
+ *     
+ *     public FontBuilder size(float pointSize) {
+ *         this.font = this.font.deriveFont(pointSize);
+ *         return this; // Reference returned so calls can be chained
+ *     }
+ * 
+ *     // Other Font construction methods
+ * 
+ *     public Font build() {
+ *         return this.font;
+ *     }
+ * }
+ * </code></pre>
+ * 
+ * Example Builder Usage:
+ * <pre><code>
+ * Font bold14ptSansSerifFont = new FontBuilder(Font.SANS_SERIF).bold()
+ *                                                              .size(14.0f)
+ *                                                              .build();
+ * </code></pre>
+ *
+ * 
+ * @param <T> the type of object that the builder will construct or compute.
+ * 
+ * @since 3.0
+ */
+public interface Builder<T> {
+    T build();
+
+}
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrBuilder.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrBuilder.java
new file mode 100644
index 00000000000..2b6f4524733
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrBuilder.java
@@ -0,0 +1,614 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3.text;
+
+import org.apache.commons.lang3.builder.Builder;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.io.Serializable;
+import java.io.Writer;
+import java.nio.CharBuffer;
+import java.util.Iterator;
+import java.util.List;
+
+
+public class StrBuilder implements CharSequence, Appendable, Serializable, Builder<String> {
+    public StrBuilder() {
+    }
+
+    public StrBuilder(int initialCapacity) {
+    }
+
+    public StrBuilder(final String str) {
+    }
+
+    public String getNewLineText() {
+      return null;
+    }
+
+    public StrBuilder setNewLineText(final String newLine) {
+      return null;
+    }
+
+    public String getNullText() {
+      return null;
+    }
+
+    public StrBuilder setNullText(String nullText) {
+      return null;
+    }
+
+    @Override
+    public int length() {
+      return 0;
+    }
+
+    public StrBuilder setLength(final int length) {
+      return null;
+    }
+
+    public int capacity() {
+      return 0;
+    }
+
+    public StrBuilder ensureCapacity(final int capacity) {
+      return null;
+    }
+
+    public StrBuilder minimizeCapacity() {
+      return null;
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    public boolean isEmpty() {
+      return false;
+    }
+
+    public StrBuilder clear() {
+      return null;
+    }
+
+    @Override
+    public char charAt(final int index) {
+      return 0;
+    }
+
+    public StrBuilder setCharAt(final int index, final char ch) {
+      return null;
+    }
+
+    public StrBuilder deleteCharAt(final int index) {
+      return null;
+    }
+
+    public char[] toCharArray() {
+      return null;
+    }
+
+    public char[] toCharArray(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public char[] getChars(char[] destination) {
+      return null;
+    }
+
+    public void getChars(final int startIndex, final int endIndex, final char destination[], final int destinationIndex) {
+    }
+
+    public int readFrom(final Readable readable) throws IOException {
+      return 0;
+    }
+
+    public StrBuilder appendNewLine() {
+      return null;
+    }
+
+    public StrBuilder appendNull() {
+      return null;
+    }
+
+    public StrBuilder append(final Object obj) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final CharSequence seq) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final CharSequence seq, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final String str) {
+      return null;
+    }
+
+    public StrBuilder append(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final String format, final Object... objs) {
+      return null;
+    }
+
+    public StrBuilder append(final CharBuffer buf) {
+      return null;
+    }
+
+    public StrBuilder append(final CharBuffer buf, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuffer str) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuilder str) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final StrBuilder str) {
+      return null;
+    }
+
+    public StrBuilder append(final StrBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final char[] chars) {
+      return null;
+    }
+
+    public StrBuilder append(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final boolean value) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final char ch) {
+      return null;
+    }
+
+    public StrBuilder append(final int value) {
+      return null;
+    }
+
+    public StrBuilder append(final long value) {
+      return null;
+    }
+
+    public StrBuilder append(final float value) {
+      return null;
+    }
+
+    public StrBuilder append(final double value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final Object obj) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String format, final Object... objs) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuffer str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuilder str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StrBuilder str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StrBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char[] chars) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final boolean value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char ch) {
+      return null;
+    }
+
+    public StrBuilder appendln(final int value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final long value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final float value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final double value) {
+      return null;
+    }
+
+    public <T> StrBuilder appendAll(final T... array) {
+      return null;
+    }
+
+    public StrBuilder appendAll(final Iterable<?> iterable) {
+      return null;
+    }
+
+    public StrBuilder appendAll(final Iterator<?> it) {
+      return null;
+    }
+
+    public StrBuilder appendWithSeparators(final Object[] array, final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendWithSeparators(final Iterable<?> iterable, final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendWithSeparators(final Iterator<?> it, final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String standard, final String defaultIfEmpty) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char separator) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char standard, final char defaultIfEmpty) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String separator, final int loopIndex) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char separator, final int loopIndex) {
+      return null;
+    }
+
+    public StrBuilder appendPadding(final int length, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadLeft(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadLeft(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadRight(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadRight(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final Object obj) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, String str) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char chars[]) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char chars[], final int offset, final int length) {
+      return null;
+    }
+
+    public StrBuilder insert(int index, final boolean value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final int value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final long value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final float value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final double value) {
+      return null;
+    }
+
+    public StrBuilder delete(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final char ch) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final char ch) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final String str) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final String str) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final StrMatcher matcher) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final StrMatcher matcher) {
+      return null;
+    }
+
+    public StrBuilder replace(final int startIndex, int endIndex, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final char search, final char replace) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final char search, final char replace) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final StrMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final StrMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replace(
+            final StrMatcher matcher, final String replaceStr,
+            final int startIndex, int endIndex, final int replaceCount) {
+      return null;
+    }
+
+    public StrBuilder reverse() {
+      return null;
+    }
+
+    public StrBuilder trim() {
+      return null;
+    }
+
+    public boolean startsWith(final String str) {
+      return false;
+    }
+
+    public boolean endsWith(final String str) {
+      return false;
+    }
+
+    @Override
+    public CharSequence subSequence(final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public String substring(final int start) {
+      return null;
+    }
+
+    public String substring(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public String leftString(final int length) {
+      return null;
+    }
+
+    public String rightString(final int length) {
+      return null;
+    }
+
+    public String midString(int index, final int length) {
+      return null;
+    }
+
+    public boolean contains(final char ch) {
+      return false;
+    }
+
+    public boolean contains(final String str) {
+      return false;
+    }
+
+    public boolean contains(final StrMatcher matcher) {
+      return false;
+    }
+
+    public int indexOf(final char ch) {
+      return 0;
+    }
+
+    public int indexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final String str) {
+      return 0;
+    }
+
+    public int indexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final StrMatcher matcher) {
+      return 0;
+    }
+
+    public int indexOf(final StrMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final char ch) {
+      return 0;
+    }
+
+    public int lastIndexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StrMatcher matcher) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StrMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public StrTokenizer asTokenizer() {
+      return null;
+    }
+
+    public Reader asReader() {
+      return null;
+    }
+
+    public Writer asWriter() {
+      return null;
+    }
+
+    public void appendTo(final Appendable appendable) throws IOException {
+    }
+
+    public boolean equalsIgnoreCase(final StrBuilder other) {
+      return false;
+    }
+
+    public boolean equals(final StrBuilder other) {
+      return false;
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+      return false;
+    }
+
+    @Override
+    public int hashCode() {
+      return 0;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+    public StringBuffer toStringBuffer() {
+      return null;
+    }
+
+    public StringBuilder toStringBuilder() {
+      return null;
+    }
+
+    @Override
+    public String build() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrMatcher.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrMatcher.java
new file mode 100644
index 00000000000..1cb68a5d554
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrMatcher.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3.text;
+
+import java.util.Arrays;
+
+
+public abstract class StrMatcher {
+    public static StrMatcher commaMatcher() {
+      return null;
+    }
+
+    public static StrMatcher tabMatcher() {
+      return null;
+    }
+
+    public static StrMatcher spaceMatcher() {
+      return null;
+    }
+
+    public static StrMatcher splitMatcher() {
+      return null;
+    }
+
+    public static StrMatcher trimMatcher() {
+      return null;
+    }
+
+    public static StrMatcher singleQuoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher doubleQuoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher quoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher noneMatcher() {
+      return null;
+    }
+
+    public static StrMatcher charMatcher(final char ch) {
+      return null;
+    }
+
+    public static StrMatcher charSetMatcher(final char... chars) {
+      return null;
+    }
+
+    public static StrMatcher charSetMatcher(final String chars) {
+      return null;
+    }
+
+    public static StrMatcher stringMatcher(final String str) {
+      return null;
+    }
+
+    public abstract int isMatch(char[] buffer, int pos, int bufferStart, int bufferEnd);
+
+    public int isMatch(final char[] buffer, final int pos) {
+      return 0;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrTokenizer.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrTokenizer.java
new file mode 100644
index 00000000000..c558b35dd54
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/text/StrTokenizer.java
@@ -0,0 +1,242 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3.text;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.ListIterator;
+import java.util.NoSuchElementException;
+
+
+public class StrTokenizer implements ListIterator<String>, Cloneable {
+    public static StrTokenizer getCSVInstance() {
+      return null;
+    }
+
+    public static StrTokenizer getCSVInstance(final String input) {
+      return null;
+    }
+
+    public static StrTokenizer getCSVInstance(final char[] input) {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance() {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance(final String input) {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance(final char[] input) {
+      return null;
+    }
+
+    public StrTokenizer() {
+    }
+
+    public StrTokenizer(final String input) {
+    }
+
+    public StrTokenizer(final String input, final char delim) {
+    }
+
+    public StrTokenizer(final String input, final String delim) {
+    }
+
+    public StrTokenizer(final String input, final StrMatcher delim) {
+    }
+
+    public StrTokenizer(final String input, final char delim, final char quote) {
+    }
+
+    public StrTokenizer(final String input, final StrMatcher delim, final StrMatcher quote) {
+    }
+
+    public StrTokenizer(final char[] input) {
+    }
+
+    public StrTokenizer(final char[] input, final char delim) {
+    }
+
+    public StrTokenizer(final char[] input, final String delim) {
+    }
+
+    public StrTokenizer(final char[] input, final StrMatcher delim) {
+    }
+
+    public StrTokenizer(final char[] input, final char delim, final char quote) {
+    }
+
+    public StrTokenizer(final char[] input, final StrMatcher delim, final StrMatcher quote) {
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    public String nextToken() {
+      return null;
+    }
+
+    public String previousToken() {
+      return null;
+    }
+
+    public String[] getTokenArray() {
+      return null;
+    }
+
+    public List<String> getTokenList() {
+      return null;
+    }
+
+    public StrTokenizer reset() {
+      return null;
+    }
+
+    public StrTokenizer reset(final String input) {
+      return null;
+    }
+
+    public StrTokenizer reset(final char[] input) {
+      return null;
+    }
+
+    @Override
+    public boolean hasNext() {
+      return false;
+    }
+
+    @Override
+    public String next() {
+      return null;
+    }
+
+    @Override
+    public int nextIndex() {
+      return 0;
+    }
+
+    @Override
+    public boolean hasPrevious() {
+      return false;
+    }
+
+    @Override
+    public String previous() {
+      return null;
+    }
+
+    @Override
+    public int previousIndex() {
+      return 0;
+    }
+
+    @Override
+    public void remove() {
+    }
+
+    @Override
+    public void set(final String obj) {
+    }
+
+    @Override
+    public void add(final String obj) {
+    }
+
+    public StrMatcher getDelimiterMatcher() {
+      return null;
+    }
+
+    public StrTokenizer setDelimiterMatcher(final StrMatcher delim) {
+      return null;
+    }
+
+    public StrTokenizer setDelimiterChar(final char delim) {
+      return null;
+    }
+
+    public StrTokenizer setDelimiterString(final String delim) {
+      return null;
+    }
+
+    public StrMatcher getQuoteMatcher() {
+      return null;
+    }
+
+    public StrTokenizer setQuoteMatcher(final StrMatcher quote) {
+      return null;
+    }
+
+    public StrTokenizer setQuoteChar(final char quote) {
+      return null;
+    }
+
+    public StrMatcher getIgnoredMatcher() {
+      return null;
+    }
+
+    public StrTokenizer setIgnoredMatcher(final StrMatcher ignored) {
+      return null;
+    }
+
+    public StrTokenizer setIgnoredChar(final char ignored) {
+      return null;
+    }
+
+    public StrMatcher getTrimmerMatcher() {
+      return null;
+    }
+
+    public StrTokenizer setTrimmerMatcher(final StrMatcher trimmer) {
+      return null;
+    }
+
+    public boolean isEmptyTokenAsNull() {
+      return false;
+    }
+
+    public StrTokenizer setEmptyTokenAsNull(final boolean emptyAsNull) {
+      return null;
+    }
+
+    public boolean isIgnoreEmptyTokens() {
+      return false;
+    }
+
+    public StrTokenizer setIgnoreEmptyTokens(final boolean ignoreEmptyTokens) {
+      return null;
+    }
+
+    public String getContent() {
+      return null;
+    }
+
+    @Override
+    public Object clone() {
+      return null;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/Builder.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/Builder.java
new file mode 100644
index 00000000000..3419d519f29
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/Builder.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+/**
+ * <p>
+ * The Builder interface is designed to designate a class as a <em>builder</em>
+ * object in the Builder design pattern. Builders are capable of creating and
+ * configuring objects or results that normally take multiple steps to construct
+ * or are very complex to derive.
+ * </p>
+ *
+ * <p>
+ * The builder interface defines a single method, {@link #build()}, that
+ * classes must implement. The result of this method should be the final
+ * configured object or result after all building operations are performed.
+ * </p>
+ *
+ * <p>
+ * It is a recommended practice that the methods supplied to configure the
+ * object or result being built return a reference to {@code this} so that
+ * method calls can be chained together.
+ * </p>
+ *
+ * <p>
+ * Example Builder:
+ * </p>
+ * <pre><code>
+ * class FontBuilder implements Builder&lt;Font&gt; {
+ *     private Font font;
+ *
+ *     public FontBuilder(String fontName) {
+ *         this.font = new Font(fontName, Font.PLAIN, 12);
+ *     }
+ *
+ *     public FontBuilder bold() {
+ *         this.font = this.font.deriveFont(Font.BOLD);
+ *         return this; // Reference returned so calls can be chained
+ *     }
+ *
+ *     public FontBuilder size(float pointSize) {
+ *         this.font = this.font.deriveFont(pointSize);
+ *         return this; // Reference returned so calls can be chained
+ *     }
+ *
+ *     // Other Font construction methods
+ *
+ *     public Font build() {
+ *         return this.font;
+ *     }
+ * }
+ * </code></pre>
+ *
+ * Example Builder Usage:
+ * <pre><code>
+ * Font bold14ptSansSerifFont = new FontBuilder(Font.SANS_SERIF).bold()
+ *                                                              .size(14.0f)
+ *                                                              .build();
+ * </code></pre>
+ *
+ *
+ * @param <T> the type of object that the builder will construct or compute.
+ * @since 1.0
+ *
+ */
+public interface Builder<T> {
+    T build();
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrBuilder.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrBuilder.java
new file mode 100644
index 00000000000..6f8f5e4e74d
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrBuilder.java
@@ -0,0 +1,619 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.io.Serializable;
+import java.io.Writer;
+import java.nio.CharBuffer;
+import java.util.Iterator;
+import java.util.List;
+
+
+public class StrBuilder implements CharSequence, Appendable, Serializable, Builder<String> {
+    public StrBuilder() {
+    }
+
+    public StrBuilder(int initialCapacity) {
+    }
+
+    public StrBuilder(final String str) {
+    }
+
+    public StrBuilder append(final boolean value) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final char ch) {
+      return null;
+    }
+
+    public StrBuilder append(final char[] chars) {
+      return null;
+    }
+
+    public StrBuilder append(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final CharBuffer buf) {
+      return null;
+    }
+
+    public StrBuilder append(final CharBuffer buf, final int startIndex, final int length) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final CharSequence seq) {
+      return null;
+    }
+
+    @Override
+    public StrBuilder append(final CharSequence seq, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final double value) {
+      return null;
+    }
+
+    public StrBuilder append(final float value) {
+      return null;
+    }
+
+    public StrBuilder append(final int value) {
+      return null;
+    }
+
+    public StrBuilder append(final long value) {
+      return null;
+    }
+
+    public StrBuilder append(final Object obj) {
+      return null;
+    }
+
+    public StrBuilder append(final StrBuilder str) {
+      return null;
+    }
+
+    public StrBuilder append(final StrBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final String str) {
+      return null;
+    }
+
+    public StrBuilder append(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final String format, final Object... objs) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuffer str) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuilder str) {
+      return null;
+    }
+
+    public StrBuilder append(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendAll(final Iterable<?> iterable) {
+      return null;
+    }
+
+    public StrBuilder appendAll(final Iterator<?> it) {
+      return null;
+    }
+
+    public <T> StrBuilder appendAll(@SuppressWarnings("unchecked") final T... array) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadLeft(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadLeft(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadRight(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendFixedWidthPadRight(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendln(final boolean value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char ch) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char[] chars) {
+      return null;
+    }
+
+    public StrBuilder appendln(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final double value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final float value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final int value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final long value) {
+      return null;
+    }
+
+    public StrBuilder appendln(final Object obj) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StrBuilder str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StrBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final String format, final Object... objs) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuffer str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuilder str) {
+      return null;
+    }
+
+    public StrBuilder appendln(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public StrBuilder appendNewLine() {
+      return null;
+    }
+
+    public StrBuilder appendNull() {
+      return null;
+    }
+
+    public StrBuilder appendPadding(final int length, final char padChar) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char separator) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char standard, final char defaultIfEmpty) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final char separator, final int loopIndex) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String separator, final int loopIndex) {
+      return null;
+    }
+
+    public StrBuilder appendSeparator(final String standard, final String defaultIfEmpty) {
+      return null;
+    }
+
+    public void appendTo(final Appendable appendable) throws IOException {
+    }
+
+    public StrBuilder appendWithSeparators(final Iterable<?> iterable, final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendWithSeparators(final Iterator<?> it, final String separator) {
+      return null;
+    }
+
+    public StrBuilder appendWithSeparators(final Object[] array, final String separator) {
+      return null;
+    }
+
+    public Reader asReader() {
+      return null;
+    }
+
+    public StrTokenizer asTokenizer() {
+      return null;
+    }
+
+    public Writer asWriter() {
+      return null;
+    }
+
+    @Override
+    public String build() {
+      return null;
+    }
+
+    public int capacity() {
+      return 0;
+    }
+
+    @Override
+    public char charAt(final int index) {
+      return 0;
+    }
+
+    public StrBuilder clear() {
+      return null;
+    }
+
+    public boolean contains(final char ch) {
+      return false;
+    }
+
+    public boolean contains(final String str) {
+      return false;
+    }
+
+    public boolean contains(final StrMatcher matcher) {
+      return false;
+    }
+
+    public StrBuilder delete(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final char ch) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final String str) {
+      return null;
+    }
+
+    public StrBuilder deleteAll(final StrMatcher matcher) {
+      return null;
+    }
+
+    public StrBuilder deleteCharAt(final int index) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final char ch) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final String str) {
+      return null;
+    }
+
+    public StrBuilder deleteFirst(final StrMatcher matcher) {
+      return null;
+    }
+
+    public boolean endsWith(final String str) {
+      return false;
+    }
+
+    public StrBuilder ensureCapacity(final int capacity) {
+      return null;
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+      return false;
+    }
+
+    public boolean equals(final StrBuilder other) {
+      return false;
+    }
+
+    public boolean equalsIgnoreCase(final StrBuilder other) {
+      return false;
+    }
+
+    public char[] getChars(char[] destination) {
+      return null;
+    }
+
+    public void getChars(final int startIndex,
+                         final int endIndex,
+                         final char[] destination,
+                         final int destinationIndex) {
+    }
+
+    public String getNewLineText() {
+      return null;
+    }
+
+    public String getNullText() {
+      return null;
+    }
+
+    @Override
+    public int hashCode() {
+      return 0;
+    }
+
+    public int indexOf(final char ch) {
+      return 0;
+    }
+
+    public int indexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final String str) {
+      return 0;
+    }
+
+    public int indexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final StrMatcher matcher) {
+      return 0;
+    }
+
+    public int indexOf(final StrMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public StrBuilder insert(int index, final boolean value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char[] chars) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final char[] chars, final int offset, final int length) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final double value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final float value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final int value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final long value) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, final Object obj) {
+      return null;
+    }
+
+    public StrBuilder insert(final int index, String str) {
+      return null;
+    }
+
+    public boolean isEmpty() {
+      return false;
+    }
+
+    public boolean isNotEmpty() {
+      return false;
+    }
+
+    public int lastIndexOf(final char ch) {
+      return 0;
+    }
+
+    public int lastIndexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StrMatcher matcher) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StrMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public String leftString(final int length) {
+      return null;
+    }
+
+    @Override
+    public int length() {
+      return 0;
+    }
+
+    public String midString(int index, final int length) {
+      return null;
+    }
+
+    public StrBuilder minimizeCapacity() {
+      return null;
+    }
+
+    public int readFrom(final Readable readable) throws IOException {
+      return 0;
+    }
+
+    public StrBuilder replace(final int startIndex, int endIndex, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replace(
+            final StrMatcher matcher, final String replaceStr,
+            final int startIndex, int endIndex, final int replaceCount) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final char search, final char replace) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceAll(final StrMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final char search, final char replace) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder replaceFirst(final StrMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public StrBuilder reverse() {
+      return null;
+    }
+
+    public String rightString(final int length) {
+      return null;
+    }
+
+    public StrBuilder setCharAt(final int index, final char ch) {
+      return null;
+    }
+
+    public StrBuilder setLength(final int length) {
+      return null;
+    }
+
+    public StrBuilder setNewLineText(final String newLine) {
+      return null;
+    }
+
+    public StrBuilder setNullText(String nullText) {
+      return null;
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    public boolean startsWith(final String str) {
+      return false;
+    }
+
+    @Override
+    public CharSequence subSequence(final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public String substring(final int start) {
+      return null;
+    }
+
+    public String substring(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public char[] toCharArray() {
+      return null;
+    }
+
+    public char[] toCharArray(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+    public StringBuffer toStringBuffer() {
+      return null;
+    }
+
+    public StringBuilder toStringBuilder() {
+      return null;
+    }
+
+    public StrBuilder trim() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrMatcher.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrMatcher.java
new file mode 100644
index 00000000000..0fdb5b1a204
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrMatcher.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+public abstract class StrMatcher {
+    public static StrMatcher commaMatcher() {
+      return null;
+    }
+
+    public static StrMatcher tabMatcher() {
+      return null;
+    }
+
+    public static StrMatcher spaceMatcher() {
+      return null;
+    }
+
+    public static StrMatcher splitMatcher() {
+      return null;
+    }
+
+    public static StrMatcher trimMatcher() {
+      return null;
+    }
+
+    public static StrMatcher singleQuoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher doubleQuoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher quoteMatcher() {
+      return null;
+    }
+
+    public static StrMatcher noneMatcher() {
+      return null;
+    }
+
+    public static StrMatcher charMatcher(final char ch) {
+      return null;
+    }
+
+    public static StrMatcher charSetMatcher(final char... chars) {
+      return null;
+    }
+
+    public static StrMatcher charSetMatcher(final String chars) {
+      return null;
+    }
+
+    public static StrMatcher stringMatcher(final String str) {
+      return null;
+    }
+
+    public abstract int isMatch(char[] buffer, int pos, int bufferStart, int bufferEnd);
+
+    public int isMatch(final char[] buffer, final int pos) {
+      return 0;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrTokenizer.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrTokenizer.java
new file mode 100644
index 00000000000..db19fde3a02
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StrTokenizer.java
@@ -0,0 +1,238 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+import java.util.List;
+import java.util.ListIterator;
+
+public class StrTokenizer implements ListIterator<String>, Cloneable {
+    public static StrTokenizer getCSVInstance() {
+      return null;
+    }
+
+    public static StrTokenizer getCSVInstance(final char[] input) {
+      return null;
+    }
+
+    public static StrTokenizer getCSVInstance(final String input) {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance() {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance(final char[] input) {
+      return null;
+    }
+
+    public static StrTokenizer getTSVInstance(final String input) {
+      return null;
+    }
+
+    public StrTokenizer() {
+    }
+
+    public StrTokenizer(final char[] input) {
+    }
+
+    public StrTokenizer(final char[] input, final char delim) {
+    }
+
+    public StrTokenizer(final char[] input, final char delim, final char quote) {
+    }
+
+    public StrTokenizer(final char[] input, final String delim) {
+    }
+
+    public StrTokenizer(final char[] input, final StrMatcher delim) {
+    }
+
+    public StrTokenizer(final char[] input, final StrMatcher delim, final StrMatcher quote) {
+    }
+
+    public StrTokenizer(final String input) {
+    }
+
+    public StrTokenizer(final String input, final char delim) {
+    }
+
+    public StrTokenizer(final String input, final char delim, final char quote) {
+    }
+
+    public StrTokenizer(final String input, final String delim) {
+    }
+
+    public StrTokenizer(final String input, final StrMatcher delim) {
+    }
+
+    public StrTokenizer(final String input, final StrMatcher delim, final StrMatcher quote) {
+    }
+
+    @Override
+    public void add(final String obj) {
+    }
+
+    @Override
+    public Object clone() {
+      return null;
+    }
+
+    public String getContent() {
+      return null;
+    }
+
+    public StrMatcher getDelimiterMatcher() {
+      return null;
+    }
+
+    public StrMatcher getIgnoredMatcher() {
+      return null;
+    }
+
+    public StrMatcher getQuoteMatcher() {
+      return null;
+    }
+
+    public String[] getTokenArray() {
+      return null;
+    }
+
+    public List<String> getTokenList() {
+      return null;
+    }
+
+    public StrMatcher getTrimmerMatcher() {
+      return null;
+    }
+
+    @Override
+    public boolean hasNext() {
+      return false;
+    }
+
+    @Override
+    public boolean hasPrevious() {
+      return false;
+    }
+
+    public boolean isEmptyTokenAsNull() {
+      return false;
+    }
+
+    public boolean isIgnoreEmptyTokens() {
+      return false;
+    }
+
+    @Override
+    public String next() {
+      return null;
+    }
+
+    @Override
+    public int nextIndex() {
+      return 0;
+    }
+
+    public String nextToken() {
+      return null;
+    }
+
+    @Override
+    public String previous() {
+      return null;
+    }
+
+    @Override
+    public int previousIndex() {
+      return 0;
+    }
+
+    public String previousToken() {
+      return null;
+    }
+
+    @Override
+    public void remove() {
+    }
+
+    public StrTokenizer reset() {
+      return null;
+    }
+
+    public StrTokenizer reset(final char[] input) {
+      return null;
+    }
+
+    public StrTokenizer reset(final String input) {
+      return null;
+    }
+
+    @Override
+    public void set(final String obj) {
+    }
+
+    public StrTokenizer setDelimiterChar(final char delim) {
+      return null;
+    }
+
+    public StrTokenizer setDelimiterMatcher(final StrMatcher delim) {
+      return null;
+    }
+
+    public StrTokenizer setDelimiterString(final String delim) {
+      return null;
+    }
+
+    public StrTokenizer setEmptyTokenAsNull(final boolean emptyAsNull) {
+      return null;
+    }
+
+    public StrTokenizer setIgnoredChar(final char ignored) {
+      return null;
+    }
+
+    public StrTokenizer setIgnoredMatcher(final StrMatcher ignored) {
+      return null;
+    }
+
+    public StrTokenizer setIgnoreEmptyTokens(final boolean ignoreEmptyTokens) {
+      return null;
+    }
+
+    public StrTokenizer setQuoteChar(final char quote) {
+      return null;
+    }
+
+    public StrTokenizer setQuoteMatcher(final StrMatcher quote) {
+      return null;
+    }
+
+    public StrTokenizer setTrimmerMatcher(final StrMatcher trimmer) {
+      return null;
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StringTokenizer.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StringTokenizer.java
new file mode 100644
index 00000000000..cc649dc821c
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/StringTokenizer.java
@@ -0,0 +1,240 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+import java.util.List;
+import java.util.ListIterator;
+
+import org.apache.commons.text.matcher.StringMatcher;
+
+public class StringTokenizer implements ListIterator<String>, Cloneable {
+    public static StringTokenizer getCSVInstance() {
+      return null;
+    }
+
+    public static StringTokenizer getCSVInstance(final char[] input) {
+      return null;
+    }
+
+    public static StringTokenizer getCSVInstance(final String input) {
+      return null;
+    }
+
+    public static StringTokenizer getTSVInstance() {
+      return null;
+    }
+
+    public static StringTokenizer getTSVInstance(final char[] input) {
+      return null;
+    }
+
+    public static StringTokenizer getTSVInstance(final String input) {
+      return null;
+    }
+
+    public StringTokenizer() {
+    }
+
+    public StringTokenizer(final char[] input) {
+    }
+
+    public StringTokenizer(final char[] input, final char delim) {
+    }
+
+    public StringTokenizer(final char[] input, final char delim, final char quote) {
+    }
+
+    public StringTokenizer(final char[] input, final String delim) {
+    }
+
+    public StringTokenizer(final char[] input, final StringMatcher delim) {
+    }
+
+    public StringTokenizer(final char[] input, final StringMatcher delim, final StringMatcher quote) {
+    }
+
+    public StringTokenizer(final String input) {
+    }
+
+    public StringTokenizer(final String input, final char delim) {
+    }
+
+    public StringTokenizer(final String input, final char delim, final char quote) {
+    }
+
+    public StringTokenizer(final String input, final String delim) {
+    }
+
+    public StringTokenizer(final String input, final StringMatcher delim) {
+    }
+
+    public StringTokenizer(final String input, final StringMatcher delim, final StringMatcher quote) {
+    }
+
+    @Override
+    public void add(final String obj) {
+    }
+
+    @Override
+    public Object clone() {
+      return null;
+    }
+
+    public String getContent() {
+      return null;
+    }
+
+    public StringMatcher getDelimiterMatcher() {
+      return null;
+    }
+
+    public StringMatcher getIgnoredMatcher() {
+      return null;
+    }
+
+    public StringMatcher getQuoteMatcher() {
+      return null;
+    }
+
+    public String[] getTokenArray() {
+      return null;
+    }
+
+    public List<String> getTokenList() {
+      return null;
+    }
+
+    public StringMatcher getTrimmerMatcher() {
+      return null;
+    }
+
+    @Override
+    public boolean hasNext() {
+      return false;
+    }
+
+    @Override
+    public boolean hasPrevious() {
+      return false;
+    }
+
+    public boolean isEmptyTokenAsNull() {
+      return false;
+    }
+
+    public boolean isIgnoreEmptyTokens() {
+      return false;
+    }
+
+    @Override
+    public String next() {
+      return null;
+    }
+
+    @Override
+    public int nextIndex() {
+      return 0;
+    }
+
+    public String nextToken() {
+      return null;
+    }
+
+    @Override
+    public String previous() {
+      return null;
+    }
+
+    @Override
+    public int previousIndex() {
+      return 0;
+    }
+
+    public String previousToken() {
+      return null;
+    }
+
+    @Override
+    public void remove() {
+    }
+
+    public StringTokenizer reset() {
+      return null;
+    }
+
+    public StringTokenizer reset(final char[] input) {
+      return null;
+    }
+
+    public StringTokenizer reset(final String input) {
+      return null;
+    }
+
+    @Override
+    public void set(final String obj) {
+    }
+
+    public StringTokenizer setDelimiterChar(final char delim) {
+      return null;
+    }
+
+    public StringTokenizer setDelimiterMatcher(final StringMatcher delim) {
+      return null;
+    }
+
+    public StringTokenizer setDelimiterString(final String delim) {
+      return null;
+    }
+
+    public StringTokenizer setEmptyTokenAsNull(final boolean emptyAsNull) {
+      return null;
+    }
+
+    public StringTokenizer setIgnoredChar(final char ignored) {
+      return null;
+    }
+
+    public StringTokenizer setIgnoredMatcher(final StringMatcher ignored) {
+      return null;
+    }
+
+    public StringTokenizer setIgnoreEmptyTokens(final boolean ignoreEmptyTokens) {
+      return null;
+    }
+
+    public StringTokenizer setQuoteChar(final char quote) {
+      return null;
+    }
+
+    public StringTokenizer setQuoteMatcher(final StringMatcher quote) {
+      return null;
+    }
+
+    public StringTokenizer setTrimmerMatcher(final StringMatcher trimmer) {
+      return null;
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/TextStringBuilder.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/TextStringBuilder.java
new file mode 100644
index 00000000000..dcb1ec6187a
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/TextStringBuilder.java
@@ -0,0 +1,655 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.text;
+
+import java.io.IOException;
+import java.io.Reader;
+import java.io.Serializable;
+import java.io.Writer;
+import java.nio.CharBuffer;
+import java.util.Iterator;
+import java.util.List;
+
+import org.apache.commons.text.matcher.StringMatcher;
+
+public class TextStringBuilder implements CharSequence, Appendable, Serializable, Builder<String> {
+    public static TextStringBuilder wrap(final char[] initialBuffer) {
+      return null;
+    }
+
+    public static TextStringBuilder wrap(final char[] initialBuffer, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder() {
+    }
+
+    public TextStringBuilder(final CharSequence seq) {
+    }
+
+    public TextStringBuilder(final int initialCapacity) {
+    }
+
+    public TextStringBuilder(final String str) {
+    }
+
+    public TextStringBuilder append(final boolean value) {
+      return null;
+    }
+
+    @Override
+    public TextStringBuilder append(final char ch) {
+      return null;
+    }
+
+    public TextStringBuilder append(final char[] chars) {
+      return null;
+    }
+
+    public TextStringBuilder append(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder append(final CharBuffer str) {
+      return null;
+    }
+
+    public TextStringBuilder append(final CharBuffer buf, final int startIndex, final int length) {
+      return null;
+    }
+
+    @Override
+    public TextStringBuilder append(final CharSequence seq) {
+      return null;
+    }
+
+    @Override
+    public TextStringBuilder append(final CharSequence seq, final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public TextStringBuilder append(final double value) {
+      return null;
+    }
+
+    public TextStringBuilder append(final float value) {
+      return null;
+    }
+
+    public TextStringBuilder append(final int value) {
+      return null;
+    }
+
+    public TextStringBuilder append(final long value) {
+      return null;
+    }
+
+    public TextStringBuilder append(final Object obj) {
+      return null;
+    }
+
+    public TextStringBuilder append(final String str) {
+      return null;
+    }
+
+    public TextStringBuilder append(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder append(final String format, final Object... objs) {
+      return null;
+    }
+
+    public TextStringBuilder append(final StringBuffer str) {
+      return null;
+    }
+
+    public TextStringBuilder append(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder append(final StringBuilder str) {
+      return null;
+    }
+
+    public TextStringBuilder append(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder append(final TextStringBuilder str) {
+      return null;
+    }
+
+    public TextStringBuilder append(final TextStringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendAll(final Iterable<?> iterable) {
+      return null;
+    }
+
+    public TextStringBuilder appendAll(final Iterator<?> it) {
+      return null;
+    }
+
+    public <T> TextStringBuilder appendAll(@SuppressWarnings("unchecked") final T... array) {
+      return null;
+    }
+
+    public TextStringBuilder appendFixedWidthPadLeft(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public TextStringBuilder appendFixedWidthPadLeft(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public TextStringBuilder appendFixedWidthPadRight(final int value, final int width, final char padChar) {
+      return null;
+    }
+
+    public TextStringBuilder appendFixedWidthPadRight(final Object obj, final int width, final char padChar) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final boolean value) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final char ch) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final char[] chars) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final char[] chars, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final double value) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final float value) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final int value) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final long value) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final Object obj) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final String str) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final String str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final String format, final Object... objs) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final StringBuffer str) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final StringBuffer str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final StringBuilder str) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final StringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final TextStringBuilder str) {
+      return null;
+    }
+
+    public TextStringBuilder appendln(final TextStringBuilder str, final int startIndex, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder appendNewLine() {
+      return null;
+    }
+
+    public TextStringBuilder appendNull() {
+      return null;
+    }
+
+    public TextStringBuilder appendPadding(final int length, final char padChar) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final char separator) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final char standard, final char defaultIfEmpty) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final char separator, final int loopIndex) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final String separator) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final String separator, final int loopIndex) {
+      return null;
+    }
+
+    public TextStringBuilder appendSeparator(final String standard, final String defaultIfEmpty) {
+      return null;
+    }
+
+    public void appendTo(final Appendable appendable) throws IOException {
+    }
+
+    public TextStringBuilder appendWithSeparators(final Iterable<?> iterable, final String separator) {
+      return null;
+    }
+
+    public TextStringBuilder appendWithSeparators(final Iterator<?> it, final String separator) {
+      return null;
+    }
+
+    public TextStringBuilder appendWithSeparators(final Object[] array, final String separator) {
+      return null;
+    }
+
+    public Reader asReader() {
+      return null;
+    }
+
+    public StringTokenizer asTokenizer() {
+      return null;
+    }
+
+    public Writer asWriter() {
+      return null;
+    }
+
+    @Override
+    public String build() {
+      return null;
+    }
+
+    public int capacity() {
+      return 0;
+    }
+
+    @Override
+    public char charAt(final int index) {
+      return 0;
+    }
+
+    public TextStringBuilder clear() {
+      return null;
+    }
+
+    public boolean contains(final char ch) {
+      return false;
+    }
+
+    public boolean contains(final String str) {
+      return false;
+    }
+
+    public boolean contains(final StringMatcher matcher) {
+      return false;
+    }
+
+    public TextStringBuilder delete(final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public TextStringBuilder deleteAll(final char ch) {
+      return null;
+    }
+
+    public TextStringBuilder deleteAll(final String str) {
+      return null;
+    }
+
+    public TextStringBuilder deleteAll(final StringMatcher matcher) {
+      return null;
+    }
+
+    public TextStringBuilder deleteCharAt(final int index) {
+      return null;
+    }
+
+    public TextStringBuilder deleteFirst(final char ch) {
+      return null;
+    }
+
+    public TextStringBuilder deleteFirst(final String str) {
+      return null;
+    }
+
+    public TextStringBuilder deleteFirst(final StringMatcher matcher) {
+      return null;
+    }
+
+    public char drainChar(final int index) {
+      return 0;
+    }
+
+    public int drainChars(final int startIndex, final int endIndex, final char[] target, final int targetIndex) {
+      return 0;
+    }
+
+    public boolean endsWith(final String str) {
+      return false;
+    }
+
+    public TextStringBuilder ensureCapacity(final int capacity) {
+      return null;
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+      return false;
+    }
+
+    public boolean equals(final TextStringBuilder other) {
+      return false;
+    }
+
+    public boolean equalsIgnoreCase(final TextStringBuilder other) {
+      return false;
+    }
+
+    public char[] getChars(char[] target) {
+      return null;
+    }
+
+    public void getChars(final int startIndex, final int endIndex, final char[] target, final int targetIndex) {
+    }
+
+    public String getNewLineText() {
+      return null;
+    }
+
+    public String getNullText() {
+      return null;
+    }
+
+    @Override
+    public int hashCode() {
+      return 0;
+    }
+
+    public int indexOf(final char ch) {
+      return 0;
+    }
+
+    public int indexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final String str) {
+      return 0;
+    }
+
+    public int indexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int indexOf(final StringMatcher matcher) {
+      return 0;
+    }
+
+    public int indexOf(final StringMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public TextStringBuilder insert(final int index, final boolean value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final char value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final char[] chars) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final char[] chars, final int offset, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final double value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final float value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final int value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final long value) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, final Object obj) {
+      return null;
+    }
+
+    public TextStringBuilder insert(final int index, String str) {
+      return null;
+    }
+
+    public boolean isEmpty() {
+      return false;
+    }
+
+    public boolean isNotEmpty() {
+      return false;
+    }
+
+    public boolean isReallocated() {
+      return false;
+    }
+
+    public int lastIndexOf(final char ch) {
+      return 0;
+    }
+
+    public int lastIndexOf(final char ch, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str) {
+      return 0;
+    }
+
+    public int lastIndexOf(final String str, int startIndex) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StringMatcher matcher) {
+      return 0;
+    }
+
+    public int lastIndexOf(final StringMatcher matcher, int startIndex) {
+      return 0;
+    }
+
+    public String leftString(final int length) {
+      return null;
+    }
+
+    @Override
+    public int length() {
+      return 0;
+    }
+
+    public String midString(int index, final int length) {
+      return null;
+    }
+
+    public TextStringBuilder minimizeCapacity() {
+      return null;
+    }
+
+    public int readFrom(final CharBuffer charBuffer) throws IOException {
+      return 0;
+    }
+
+    public int readFrom(final Readable readable) throws IOException {
+      return 0;
+    }
+
+    public int readFrom(final Reader reader) throws IOException {
+      return 0;
+    }
+
+    public int readFrom(final Reader reader, final int count) throws IOException {
+      return 0;
+    }
+
+    public TextStringBuilder replace(final int startIndex, int endIndex, final String replaceStr) {
+      return null;
+    }
+
+    public TextStringBuilder replace(final StringMatcher matcher, final String replaceStr, final int startIndex,
+        int endIndex, final int replaceCount) {
+      return null;
+    }
+
+    public TextStringBuilder replaceAll(final char search, final char replace) {
+      return null;
+    }
+
+    public TextStringBuilder replaceAll(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public TextStringBuilder replaceAll(final StringMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public TextStringBuilder replaceFirst(final char search, final char replace) {
+      return null;
+    }
+
+    public TextStringBuilder replaceFirst(final String searchStr, final String replaceStr) {
+      return null;
+    }
+
+    public TextStringBuilder replaceFirst(final StringMatcher matcher, final String replaceStr) {
+      return null;
+    }
+
+    public TextStringBuilder reverse() {
+      return null;
+    }
+
+    public String rightString(final int length) {
+      return null;
+    }
+
+    public TextStringBuilder set(final CharSequence str) {
+      return null;
+    }
+
+    public TextStringBuilder setCharAt(final int index, final char ch) {
+      return null;
+    }
+
+    public TextStringBuilder setLength(final int length) {
+      return null;
+    }
+
+    public TextStringBuilder setNewLineText(final String newLine) {
+      return null;
+    }
+
+    public TextStringBuilder setNullText(String nullText) {
+      return null;
+    }
+
+    public int size() {
+      return 0;
+    }
+
+    public boolean startsWith(final String str) {
+      return false;
+    }
+
+    @Override
+    public CharSequence subSequence(final int startIndex, final int endIndex) {
+      return null;
+    }
+
+    public String substring(final int start) {
+      return null;
+    }
+
+    public String substring(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    public char[] toCharArray() {
+      return null;
+    }
+
+    public char[] toCharArray(final int startIndex, int endIndex) {
+      return null;
+    }
+
+    @Override
+    public String toString() {
+      return null;
+    }
+
+    public StringBuffer toStringBuffer() {
+      return null;
+    }
+
+    public StringBuilder toStringBuilder() {
+      return null;
+    }
+
+    public TextStringBuilder trim() {
+      return null;
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/matcher/StringMatcher.java b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/matcher/StringMatcher.java
new file mode 100644
index 00000000000..d9a1c855356
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-text-1.9/org/apache/commons/text/matcher/StringMatcher.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.commons.text.matcher;
+
+
+public interface StringMatcher {
+    default StringMatcher andThen(final StringMatcher stringMatcher) {
+      return null;
+    }
+
+    default int isMatch(final char[] buffer, final int pos) {
+      return 0;
+    }
+
+    int isMatch(char[] buffer, int start, int bufferStart, int bufferEnd);
+
+    default int isMatch(final CharSequence buffer, final int pos) {
+      return 0;
+    }
+
+    default int isMatch(final CharSequence buffer, final int start, final int bufferStart, final int bufferEnd) {
+      return 0;
+    }
+
+    default int size() {
+      return 0;
+    }
+
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java b/java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java
index 19a2662b96c..e04f68a203d 100644
--- a/java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java
+++ b/java/ql/test/stubs/google-android-9.0.0/android/app/Activity.java
@@ -1019,6 +1019,7 @@ public class Activity {
      * @see Activity#requireViewById(int)
      */
     public <T> T findViewById(int id) {
+        return null;
     }
 
     /**
@@ -1141,4 +1142,4 @@ public class Activity {
      */
     public void startActivities(Intent[] intents, Bundle options) {
     }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/content/Intent.java b/java/ql/test/stubs/google-android-9.0.0/android/content/Intent.java
index 292069c0f71..09422c7a48a 100644
--- a/java/ql/test/stubs/google-android-9.0.0/android/content/Intent.java
+++ b/java/ql/test/stubs/google-android-9.0.0/android/content/Intent.java
@@ -821,6 +821,7 @@ public class Intent implements Parcelable, Cloneable {
      */
     @Deprecated
     public static Intent getIntent(String uri) {
+        return null;
     }
 
     /**
@@ -845,6 +846,7 @@ public class Intent implements Parcelable, Cloneable {
      * @see #toUri
      */
     public static Intent parseUri(String uri, int flags) {
+        return null;
     }
 
     /**
@@ -2069,4 +2071,4 @@ public class Intent implements Parcelable, Cloneable {
         return null;
     }
 
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/os/BaseBundle.java b/java/ql/test/stubs/google-android-9.0.0/android/os/BaseBundle.java
index 4b85ae8e67a..3ac33642ab4 100644
--- a/java/ql/test/stubs/google-android-9.0.0/android/os/BaseBundle.java
+++ b/java/ql/test/stubs/google-android-9.0.0/android/os/BaseBundle.java
@@ -97,6 +97,7 @@ public class BaseBundle {
      * @hide
      */
     public String getPairValue() {
+        return null;
     }
 
     /**
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/os/Parcel.java b/java/ql/test/stubs/google-android-9.0.0/android/os/Parcel.java
index 2670e258e4f..077da662edb 100644
--- a/java/ql/test/stubs/google-android-9.0.0/android/os/Parcel.java
+++ b/java/ql/test/stubs/google-android-9.0.0/android/os/Parcel.java
@@ -229,6 +229,7 @@ public final class Parcel {
     }
 
     public final float[] createFloatArray() {
+        return null;
     }
 
     public final void readFloatArray(float[] val) {
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/security/crypto/EncryptedSharedPreferences.java b/java/ql/test/stubs/google-android-9.0.0/androidx/security/crypto/EncryptedSharedPreferences.java
index db918d448f2..8ca1443d049 100644
--- a/java/ql/test/stubs/google-android-9.0.0/androidx/security/crypto/EncryptedSharedPreferences.java
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/security/crypto/EncryptedSharedPreferences.java
@@ -85,6 +85,7 @@ public final class EncryptedSharedPreferences implements SharedPreferences {
             PrefKeyEncryptionScheme prefKeyEncryptionScheme,
             PrefValueEncryptionScheme prefValueEncryptionScheme)
             throws GeneralSecurityException, IOException {
+        return null;
     }
 
     /**
@@ -168,4 +169,4 @@ public final class EncryptedSharedPreferences implements SharedPreferences {
     public void unregisterOnSharedPreferenceChangeListener(
             OnSharedPreferenceChangeListener listener) {
     }
-}
\ No newline at end of file
+}
diff --git a/javascript/change-notes/202020-12-22-execa.md b/javascript/change-notes/2020-12-22-execa.md
similarity index 100%
rename from javascript/change-notes/202020-12-22-execa.md
rename to javascript/change-notes/2020-12-22-execa.md
diff --git a/javascript/change-notes/2021-02-08-immutable.md b/javascript/change-notes/2021-02-08-immutable.md
new file mode 100644
index 00000000000..8f4a11113e2
--- /dev/null
+++ b/javascript/change-notes/2021-02-08-immutable.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The dataflow libraries now model dataflow in the Immutable.js library.
+  Affected packages are
+    [Immutable.js](https://npmjs.com/package/immutable)
diff --git a/javascript/change-notes/2021-02-08-xml-parser-taint.md b/javascript/change-notes/2021-02-08-xml-parser-taint.md
new file mode 100644
index 00000000000..2028be3e06f
--- /dev/null
+++ b/javascript/change-notes/2021-02-08-xml-parser-taint.md
@@ -0,0 +1,8 @@
+lgtm,codescanning
+* The security queries now track taint through XML parsers. 
+  Affected packages are
+    [xml2js](https://www.npmjs.com/package/xml2js),
+    [sax](https://www.npmjs.com/package/sax),
+    [xml-js](https://www.npmjs.com/package/xml-js),
+    [htmlparser2](https://www.npmjs.com/package/htmlparser2), and
+    [node-expat](https://www.npmjs.com/package/node-expat)
diff --git a/javascript/change-notes/2021-02-08-xss-through-dom-forms.md b/javascript/change-notes/2021-02-08-xss-through-dom-forms.md
new file mode 100644
index 00000000000..33c864bbaef
--- /dev/null
+++ b/javascript/change-notes/2021-02-08-xss-through-dom-forms.md
@@ -0,0 +1,6 @@
+lgtm,codescanning
+* The `js/xss-through-dom` query now recognizes form inputs as sources.
+  Affected packages are
+    [formik](https://www.npmjs.com/package/formik) and
+    [react-final-form](https://www.npmjs.com/package/react-final-form) and
+    [react-hook-form](https://www.npmjs.com/package/react-hook-form)
diff --git a/javascript/change-notes/2021-02-09-form-parsers.md b/javascript/change-notes/2021-02-09-form-parsers.md
new file mode 100644
index 00000000000..ec45a6c144d
--- /dev/null
+++ b/javascript/change-notes/2021-02-09-form-parsers.md
@@ -0,0 +1,7 @@
+lgtm,codescanning
+* Server side form parsing libraries are now recognized as source of remote user input. 
+  Affected packages are
+    [multer](https://www.npmjs.com/package/multer),
+    [busboy](https://www.npmjs.com/package/busboy),
+    [formidable](https://www.npmjs.com/package/formidable), and
+    [multiparty](https://www.npmjs.com/package/formidable).
diff --git a/javascript/change-notes/2021-02-10-markdown.md b/javascript/change-notes/2021-02-10-markdown.md
new file mode 100644
index 00000000000..41072ef598f
--- /dev/null
+++ b/javascript/change-notes/2021-02-10-markdown.md
@@ -0,0 +1,9 @@
+lgtm,codescanning
+* The security queries now track taint through markdown parsers.
+  Affected packages are
+    [marked](https://npmjs.com/package/marked), 
+    [markdown-table](https://npmjs.com/package/markdown-table), 
+    [showdown](https://npmjs.com/package/showdown), 
+    [snarkdown](https://npmjs.com/package/snarkdown), 
+    [unified](https://npmjs.com/package/unified), and
+    [remark](https://npmjs.com/package/remark)
diff --git a/javascript/change-notes/2021-02-11-apollo-client.md b/javascript/change-notes/2021-02-11-apollo-client.md
new file mode 100644
index 00000000000..93ec78f1f41
--- /dev/null
+++ b/javascript/change-notes/2021-02-11-apollo-client.md
@@ -0,0 +1,8 @@
+lgtm,codescanning
+* URIs used in the Apollo-link libraries are now recognized as sinks for `js/request-forgery`.
+  Affected packages are
+    [apollo-link-http](https://www.npmjs.com/package/apollo-link-http), 
+    [apollo-client](https://www.npmjs.com/package/apollo-client), 
+    [apollo-boost](https://www.npmjs.com/package/apollo-boost), 
+    [apollo-client-preset](https://www.npmjs.com/package/apollo-client-preset), and
+    [apollo-link-ws](https://www.npmjs.com/package/apollo-link-ws)
diff --git a/javascript/extractor/src/com/semmle/js/ast/DeclarationFlags.java b/javascript/extractor/src/com/semmle/js/ast/DeclarationFlags.java
index 28546fdeca8..cbd8b1eedf7 100644
--- a/javascript/extractor/src/com/semmle/js/ast/DeclarationFlags.java
+++ b/javascript/extractor/src/com/semmle/js/ast/DeclarationFlags.java
@@ -88,59 +88,59 @@ public class DeclarationFlags {
     return (flags & declareKeyword) != 0;
   }
 
-  /** Returns a mask with the computed bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the computed bit set to the value of <code>enable</code>. */
   public static int getComputed(boolean enable) {
     return enable ? computed : 0;
   }
 
-  /** Returns a mask with the abstract bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the abstract bit set to the value of <code>enable</code>. */
   public static int getAbstract(boolean enable) {
     return enable ? abstract_ : 0;
   }
 
-  /** Returns a mask with the static bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the static bit set to the value of <code>enable</code>. */
   public static int getStatic(boolean enable) {
     return enable ? static_ : 0;
   }
 
-  /** Returns a mask with the public bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the public bit set to the value of <code>enable</code>. */
   public static int getPublic(boolean enable) {
     return enable ? public_ : 0;
   }
 
-  /** Returns a mask with the readonly bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the readonly bit set to the value of <code>enable</code>. */
   public static int getReadonly(boolean enable) {
     return enable ? readonly : 0;
   }
 
-  /** Returns a mask with the private bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the private bit set to the value of <code>enable</code>. */
   public static int getPrivate(boolean enable) {
     return enable ? private_ : 0;
   }
 
-  /** Returns a mask with the protected bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the protected bit set to the value of <code>enable</code>. */
   public static int getProtected(boolean enable) {
     return enable ? protected_ : 0;
   }
 
-  /** Returns a mask with the optional bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the optional bit set to the value of <code>enable</code>. */
   public static int getOptional(boolean enable) {
     return enable ? optional : 0;
   }
 
   /**
-   * Returns a mask with the definite assignment assertion bit set to the value of <tt>enable</tt>.
+   * Returns a mask with the definite assignment assertion bit set to the value of <code>enable</code>.
    */
   public static int getDefiniteAssignmentAssertion(boolean enable) {
     return enable ? definiteAssignmentAssertion : 0;
   }
 
-  /** Returns a mask with the declare keyword bit set to the value of <tt>enable</tt>. */
+  /** Returns a mask with the declare keyword bit set to the value of <code>enable</code>. */
   public static int getDeclareKeyword(boolean enable) {
     return enable ? declareKeyword : 0;
   }
 
-  /** Returns true if the <tt>n</tt>th bit is set in <tt>flags</tt>. */
+  /** Returns true if the <code>n</code>th bit is set in <code>flags</code>. */
   public static boolean hasNthFlag(int flags, int n) {
     return (flags & (1 << n)) != 0;
   }
diff --git a/javascript/extractor/src/com/semmle/js/ast/Literal.java b/javascript/extractor/src/com/semmle/js/ast/Literal.java
index 15408b05916..3c53798b851 100644
--- a/javascript/extractor/src/com/semmle/js/ast/Literal.java
+++ b/javascript/extractor/src/com/semmle/js/ast/Literal.java
@@ -6,7 +6,7 @@ import com.semmle.ts.ast.ITypeExpression;
 /**
  * A literal constant.
  *
- * <p>A <tt>null</tt> literal may occur as a TypeScript type annotation - other literals are always
+ * <p>A <code>null</code> literal may occur as a TypeScript type annotation - other literals are always
  * expressions.
  */
 public class Literal extends Expression implements ITypeExpression {
diff --git a/javascript/extractor/src/com/semmle/js/ast/MemberDefinition.java b/javascript/extractor/src/com/semmle/js/ast/MemberDefinition.java
index c04b79fa366..7cacafa96ed 100644
--- a/javascript/extractor/src/com/semmle/js/ast/MemberDefinition.java
+++ b/javascript/extractor/src/com/semmle/js/ast/MemberDefinition.java
@@ -40,7 +40,7 @@ public abstract class MemberDefinition<V extends Expression> extends Node {
     return flags;
   }
 
-  /** Returns true if this has the <tt>static</tt> modifier. */
+  /** Returns true if this has the <code>static</code> modifier. */
   public boolean isStatic() {
     return DeclarationFlags.isStatic(flags);
   }
@@ -55,7 +55,7 @@ public abstract class MemberDefinition<V extends Expression> extends Node {
     return DeclarationFlags.isAbstract(flags);
   }
 
-  /** Returns true if has the <tt>public</tt> modifier (not true for implicitly public members). */
+  /** Returns true if has the <code>public</code> modifier (not true for implicitly public members). */
   public boolean hasPublicKeyword() {
     return DeclarationFlags.isPublic(flags);
   }
@@ -75,7 +75,7 @@ public abstract class MemberDefinition<V extends Expression> extends Node {
     return DeclarationFlags.isReadonly(flags);
   }
 
-  /** Returns true if this has the <tt>declare</tt> modifier. */
+  /** Returns true if this has the <code>declare</code> modifier. */
   public boolean hasDeclareKeyword() {
     return DeclarationFlags.hasDeclareKeyword(flags);
   }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 73cefdae30d..bb270353869 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -253,7 +253,7 @@ public class ASTExtractor {
 
     /**
      * An identifier that refers to a variable from inside a type, i.e. the operand to a
-     * <tt>typeof</tt> type or left operand to an <tt>is</tt> type.
+     * <code>typeof</code> type or left operand to an <code>is</code> type.
      *
      * <p>This is generally treated as a type, except a variable binding will be emitted for it.
      */
@@ -288,7 +288,7 @@ public class ASTExtractor {
     VAR_AND_TYPE_AND_NAMESPACE_DECL,
 
     /**
-     * An identifier that occurs as part of a named export, such as <tt>export { A }</tt>.
+     * An identifier that occurs as part of a named export, such as <code>export { A }</code>.
      *
      * <p>This may refer to a variable, type, and/or a namespace, and will export exactly those that
      * can be resolved.
@@ -301,7 +301,7 @@ public class ASTExtractor {
 
     /**
      * An identifier that occurs as a qualified name in a default export expression, such as
-     * <tt>A</tt> in <tt>export default A.B</tt>.
+     * <code>A</code> in <code>export default A.B</code>.
      *
      * <p>This acts like {@link #EXPORT}, except it cannot refer to a type (i.e. it must be a
      * variable and/or a namespace).
diff --git a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
index 398330acd59..505c45832e2 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
@@ -722,13 +722,13 @@ public class AutoBuild {
   }
 
   /**
-   * Prepares <tt>package.json</tt> files in a virtual source root, and, if enabled,
+   * Prepares <code>package.json</code> files in a virtual source root, and, if enabled,
    * installs dependencies for use by the TypeScript type checker.
    * <p>
    * Some packages must be downloaded while others exist within the same repo ("monorepos")
    * but are not in a location where TypeScript would look for it.
    * <p>
-   * Downloaded packages are intalled under <tt>SCRATCH_DIR</tt>, in a mirrored directory hierarchy
+   * Downloaded packages are intalled under <code>SCRATCH_DIR</code>, in a mirrored directory hierarchy
    * we call the "virtual source root".
    * <p>
    * Packages that exists within the repo are not downloaded. Since they are part of the main source tree,
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 561bbdb9171..004cd893d27 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -143,6 +143,18 @@ public class HTMLExtractor implements IExtractor {
           }
       }
     }
+
+    @Override
+    public boolean shouldExtractAttributes(Element element) {
+      Attributes attributes = element.getAttributes();
+      if (attributes == null) return false;
+      for (Attribute attr : attributes) {
+        if (!VALID_ATTRIBUTE_NAME.matcher(attr.getName()).matches()) {
+          return false;
+        }
+      }
+      return true;
+    }
   }
 
   private boolean isAngularTemplateAttributeName(String name) {
@@ -153,6 +165,8 @@ public class HTMLExtractor implements IExtractor {
 
   private static final Pattern ANGULAR_FOR_LOOP_DECL = Pattern.compile("^ *let +(\\w+) +of(?: +|(?!\\w))(.*)");
 
+  private static final Pattern VALID_ATTRIBUTE_NAME = Pattern.compile("\\*?\\[?\\(?[\\w:_\\-]+\\]?\\)?");
+
   /** List of HTML attributes whose value is interpreted as JavaScript. */
   private static final Pattern JS_ATTRIBUTE =
       Pattern.compile(
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
index 14e88a92c9d..923635037c7 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
@@ -149,7 +149,7 @@ public class ScopeManager {
   }
 
   /**
-   * Enters a scope for a block of form <tt>declare global { ... }</tt>.
+   * Enters a scope for a block of form <code>declare global { ... }</code>.
    *
    * <p>Declarations in this block will contribute to the global scope, but references can still be
    * resolved in the scope enclosing the declaration itself. The scope itself does not have its own
diff --git a/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java b/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
index 49c6049d452..34315111ba6 100644
--- a/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
+++ b/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
@@ -14,7 +14,7 @@ public class ParsedProject {
     this.allFiles = allFiles;
   }
 
-  /** Returns the <tt>tsconfig.json</tt> file that defines this project. */
+  /** Returns the <code>tsconfig.json</code> file that defines this project. */
   public File getTsConfigFile() {
     return tsConfigFile;
   }
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ArrayTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/ArrayTypeExpr.java
index badcf444439..07a1da74ed7 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ArrayTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ArrayTypeExpr.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
 /**
- * An array type, such as <tt>number[]</tt>, or in general <tt>T[]</tt> where <tt>T</tt> is a type.
+ * An array type, such as <code>number[]</code>, or in general <code>T[]</code> where <code>T</code> is a type.
  */
 public class ArrayTypeExpr extends TypeExpression {
   private final ITypeExpression elementType;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ConditionalTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/ConditionalTypeExpr.java
index 61bc2c647f2..e690f6b6244 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ConditionalTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ConditionalTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A conditional type annotation, such as <tt>T extends any[] ? A : B</tt>. */
+/** A conditional type annotation, such as <code>T extends any[] ? A : B</code>. */
 public class ConditionalTypeExpr extends TypeExpression {
   private ITypeExpression checkType;
   private ITypeExpression extendsType;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ExportAsNamespaceDeclaration.java b/javascript/extractor/src/com/semmle/ts/ast/ExportAsNamespaceDeclaration.java
index b6921b34924..f836f052f23 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ExportAsNamespaceDeclaration.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ExportAsNamespaceDeclaration.java
@@ -5,7 +5,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Statement;
 import com.semmle.js.ast.Visitor;
 
-/** A statement of form <tt>export as namespace X</tt> where <tt>X</tt> is an identifier. */
+/** A statement of form <code>export as namespace X</code> where <code>X</code> is an identifier. */
 public class ExportAsNamespaceDeclaration extends Statement {
   private Identifier id;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ExpressionWithTypeArguments.java b/javascript/extractor/src/com/semmle/ts/ast/ExpressionWithTypeArguments.java
index 4c4c681d078..c1f3c318a9e 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ExpressionWithTypeArguments.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ExpressionWithTypeArguments.java
@@ -13,7 +13,7 @@ import java.util.List;
  * class StringList extends List&lt;string&gt; {}
  * </pre>
  *
- * Above, <tt>List</tt> is a concrete expression whereas its type argument is a type.
+ * Above, <code>List</code> is a concrete expression whereas its type argument is a type.
  */
 public class ExpressionWithTypeArguments extends Expression {
   private final Expression expression;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ExternalModuleDeclaration.java b/javascript/extractor/src/com/semmle/ts/ast/ExternalModuleDeclaration.java
index 58baaac7424..555e86da2b4 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ExternalModuleDeclaration.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ExternalModuleDeclaration.java
@@ -6,7 +6,7 @@ import com.semmle.js.ast.Statement;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** A statement of form <tt>declare module "X" {...}</tt>. */
+/** A statement of form <code>declare module "X" {...}</code>. */
 public class ExternalModuleDeclaration extends Statement {
   private final Literal name;
   private final List<Statement> body;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/GenericTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/GenericTypeExpr.java
index efaee334c1f..1df66ae1fe2 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/GenericTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/GenericTypeExpr.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** An instantiation of a named type, such as <tt>Array&lt;number&gt;</tt> */
+/** An instantiation of a named type, such as <code>Array&lt;number&gt;</code> */
 public class GenericTypeExpr extends TypeExpression {
   private final ITypeExpression typeName; // Always Identifier or MemberExpression
   private final List<ITypeExpression> typeArguments;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/GlobalAugmentationDeclaration.java b/javascript/extractor/src/com/semmle/ts/ast/GlobalAugmentationDeclaration.java
index b8eec7fac94..008e5e403c1 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/GlobalAugmentationDeclaration.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/GlobalAugmentationDeclaration.java
@@ -5,7 +5,7 @@ import com.semmle.js.ast.Statement;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** A statement of form: <tt>declare global { ... }</tt> */
+/** A statement of form: <code>declare global { ... }</code> */
 public class GlobalAugmentationDeclaration extends Statement {
   private final List<Statement> body;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/INodeWithSymbol.java b/javascript/extractor/src/com/semmle/ts/ast/INodeWithSymbol.java
index 9f5e1fe2993..c0fc5864c63 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/INodeWithSymbol.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/INodeWithSymbol.java
@@ -8,7 +8,7 @@ package com.semmle.ts.ast;
  */
 public interface INodeWithSymbol {
   /**
-   * Gets a number identifying the symbol associated with this AST node, or <tt>-1</tt> if there is
+   * Gets a number identifying the symbol associated with this AST node, or <code>-1</code> if there is
    * no such symbol.
    */
   int getSymbol();
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ITypeExpression.java b/javascript/extractor/src/com/semmle/ts/ast/ITypeExpression.java
index 0054adb4f72..71185a7f92c 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ITypeExpression.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ITypeExpression.java
@@ -8,6 +8,6 @@ import com.semmle.js.ast.Literal;
  *
  * <p>At the QL level, expressions and type annotations are completely separate. In the extractor,
  * however, some expressions such as {@link Literal} type may occur in a type annotation because the
- * TypeScript AST does not distinguish <tt>null</tt> literals from the <tt>null</tt> type.
+ * TypeScript AST does not distinguish <code>null</code> literals from the <code>null</code> type.
  */
 public interface ITypeExpression extends INode, ITypedAstNode {}
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ImportTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/ImportTypeExpr.java
index edf60004645..11535c3376c 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ImportTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ImportTypeExpr.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.Expression;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** An import type such as in <tt>import("http").ServerRequest</tt>. */
+/** An import type such as in <code>import("http").ServerRequest</code>. */
 public class ImportTypeExpr extends Expression implements ITypeExpression {
   private final ITypeExpression path;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ImportWholeDeclaration.java b/javascript/extractor/src/com/semmle/ts/ast/ImportWholeDeclaration.java
index 4631a615fe2..9b4c7b6b6d8 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ImportWholeDeclaration.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ImportWholeDeclaration.java
@@ -6,7 +6,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Statement;
 import com.semmle.js.ast.Visitor;
 
-/** An import of form <tt>import a = E</tt>. */
+/** An import of form <code>import a = E</code>. */
 public class ImportWholeDeclaration extends Statement {
   private final Identifier lhs;
   private final Expression rhs;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/IndexedAccessTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/IndexedAccessTypeExpr.java
index baf7b95ff2e..420084d3ef2 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/IndexedAccessTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/IndexedAccessTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A type of form <tt>T[K]</tt> where <tt>T</tt> and <tt>K</tt> are types. */
+/** A type of form <code>T[K]</code> where <code>T</code> and <code>K</code> are types. */
 public class IndexedAccessTypeExpr extends TypeExpression {
   private final ITypeExpression objectType;
   private final ITypeExpression indexType;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/InferTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/InferTypeExpr.java
index a18269ce6c2..b9d24409ea6 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/InferTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/InferTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A type annotation of form <tt>infer R</tt> */
+/** A type annotation of form <code>infer R</code> */
 public class InferTypeExpr extends TypeExpression {
   private TypeParameter typeParameter;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/InterfaceTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/InterfaceTypeExpr.java
index 20f2b45b2b8..2c34d0bdb6a 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/InterfaceTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/InterfaceTypeExpr.java
@@ -5,7 +5,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** An inline interface type, such as <tt>{x: number; y: number}</tt>. */
+/** An inline interface type, such as <code>{x: number; y: number}</code>. */
 public class InterfaceTypeExpr extends TypeExpression {
   private final List<MemberDefinition<?>> body;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/IntersectionTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/IntersectionTypeExpr.java
index 2ff10be12cb..820ec752ce7 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/IntersectionTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/IntersectionTypeExpr.java
@@ -5,8 +5,8 @@ import com.semmle.js.ast.Visitor;
 import java.util.List;
 
 /**
- * An intersection type such as <tt>T&amp;S</tt>, denoting the intersection of type <tt>T</tt> and
- * type <tt>S</tt>.
+ * An intersection type such as <code>T&amp;S</code>, denoting the intersection of type <code>T</code> and
+ * type <code>S</code>.
  */
 public class IntersectionTypeExpr extends TypeExpression {
   private final List<ITypeExpression> elementTypes;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/KeywordTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/KeywordTypeExpr.java
index ede17e079e9..173dfc36294 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/KeywordTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/KeywordTypeExpr.java
@@ -4,14 +4,14 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
 /**
- * One of the TypeScript keyword types, such as <tt>string</tt> or <tt>any</tt>.
+ * One of the TypeScript keyword types, such as <code>string</code> or <code>any</code>.
  *
- * <p>This includes the type <tt>unique symbol</tt> which consists of two keywords but is
+ * <p>This includes the type <code>unique symbol</code> which consists of two keywords but is
  * represented as a keyword single type expression.
  *
- * <p>At the QL level, the <tt>null</tt> type is also a keyword type. In the extractor, however,
+ * <p>At the QL level, the <code>null</code> type is also a keyword type. In the extractor, however,
  * this is represented by a Literal, because the TypeScript AST does not distinguish those two uses
- * of <tt>null</tt>.
+ * of <code>null</code>.
  */
 public class KeywordTypeExpr extends TypeExpression {
   private final String keyword;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/MappedTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/MappedTypeExpr.java
index 30129296f34..7c951096bcc 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/MappedTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/MappedTypeExpr.java
@@ -4,10 +4,10 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
 /**
- * A type of form <tt>{ [K in C]: T }</tt>, where <tt>T</tt> is a type that may refer to <tt>K</tt>.
+ * A type of form <code>{ [K in C]: T }</code>, where <code>T</code> is a type that may refer to <code>K</code>.
  *
- * <p>As with the TypeScript AST, the <tt>K in C</tt> part is represented as a type parameter with
- * <tt>C</tt> as its upper bound.
+ * <p>As with the TypeScript AST, the <code>K in C</code> part is represented as a type parameter with
+ * <code>C</code> as its upper bound.
  */
 public class MappedTypeExpr extends TypeExpression {
   private final TypeParameter typeParameter;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/NonNullAssertion.java b/javascript/extractor/src/com/semmle/ts/ast/NonNullAssertion.java
index 485b827ce97..6fe3d04b6c8 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/NonNullAssertion.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/NonNullAssertion.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.Expression;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A TypeScript expression of form <tt>E!</tt>, asserting that <tt>E</tt> is not null. */
+/** A TypeScript expression of form <code>E!</code>, asserting that <code>E</code> is not null. */
 public class NonNullAssertion extends Expression {
   private final Expression expression;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/OptionalTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/OptionalTypeExpr.java
index 3d98f563127..b474c8cbaea 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/OptionalTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/OptionalTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** An optional type in a tuple type, such as <tt>number?</tt> in <tt>[string, number?]</tt>. */
+/** An optional type in a tuple type, such as <code>number?</code> in <code>[string, number?]</code>. */
 public class OptionalTypeExpr extends TypeExpression {
   private final ITypeExpression elementType;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/ParenthesizedTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/ParenthesizedTypeExpr.java
index 1be6f191ff7..fd17b9ade0a 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/ParenthesizedTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/ParenthesizedTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A type expression in parentheses, such as <tt>("foo" | "bar")</tt>. */
+/** A type expression in parentheses, such as <code>("foo" | "bar")</code>. */
 public class ParenthesizedTypeExpr extends TypeExpression {
   private final ITypeExpression elementType;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/PredicateTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/PredicateTypeExpr.java
index 27bd3c1718c..f0b6042448a 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/PredicateTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/PredicateTypeExpr.java
@@ -4,8 +4,8 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
 /**
- * A type of form <tt>E is T</tt>, <tt>asserts E is T</tt> or <tt>asserts E</tt> where <tt>E</tt> is
- * a parameter name or <tt>this</tt> and <tt>T</tt> is a type.
+ * A type of form <code>E is T</code>, <code>asserts E is T</code> or <code>asserts E</code> where <code>E</code> is
+ * a parameter name or <code>this</code> and <code>T</code> is a type.
  */
 public class PredicateTypeExpr extends TypeExpression {
   private final ITypeExpression expression;
@@ -23,12 +23,12 @@ public class PredicateTypeExpr extends TypeExpression {
     this.hasAssertsKeyword = hasAssertsKeyword;
   }
 
-  /** Returns the <tt>E</tt> in <tt>E is T</tt>. */
+  /** Returns the <code>E</code> in <code>E is T</code>. */
   public ITypeExpression getExpression() {
     return expression;
   }
 
-  /** Returns the <tt>T</tt> in <tt>E is T</tt>. */
+  /** Returns the <code>T</code> in <code>E is T</code>. */
   public ITypeExpression getTypeExpr() {
     return type;
   }
diff --git a/javascript/extractor/src/com/semmle/ts/ast/RestTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/RestTypeExpr.java
index ef0d9ad7f7f..5acb1069ee5 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/RestTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/RestTypeExpr.java
@@ -3,7 +3,7 @@ package com.semmle.ts.ast;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
-/** A rest type in a tuple type, such as <tt>number[]</tt> in <tt>[string, ...number[]]</tt>. */
+/** A rest type in a tuple type, such as <code>number[]</code> in <code>[string, ...number[]]</code>. */
 public class RestTypeExpr extends TypeExpression {
   private final ITypeExpression arrayType;
 
diff --git a/javascript/extractor/src/com/semmle/ts/ast/TupleTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/TupleTypeExpr.java
index a42df41847e..aa175b59167 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/TupleTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/TupleTypeExpr.java
@@ -5,7 +5,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** A tuple type, such as <tt>[number, string]</tt>. */
+/** A tuple type, such as <code>[number, string]</code>. */
 public class TupleTypeExpr extends TypeExpression {
   private final List<ITypeExpression> elementTypes;
   private final List<Identifier> elementNames;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/TypeAssertion.java b/javascript/extractor/src/com/semmle/ts/ast/TypeAssertion.java
index 6a9150f93c2..39b108dac79 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/TypeAssertion.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/TypeAssertion.java
@@ -30,7 +30,7 @@ public class TypeAssertion extends Expression {
   }
 
   /**
-   * True if this is an assertion of form <tt>E as T</tt>, as opposed to the old syntax <code>
+   * True if this is an assertion of form <code>E as T</code>, as opposed to the old syntax <code>
    * &lt;T&gt; E</code>.
    */
   public boolean isAsExpression() {
diff --git a/javascript/extractor/src/com/semmle/ts/ast/TypeParameter.java b/javascript/extractor/src/com/semmle/ts/ast/TypeParameter.java
index 7cbf8d2d0eb..c5c516ef2d4 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/TypeParameter.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/TypeParameter.java
@@ -7,7 +7,7 @@ import com.semmle.js.ast.Visitor;
 /**
  * A type parameter declared on a class, interface, function, or type alias.
  *
- * <p>The general form of a type parameter is: <tt>S extends T = U</tt>.
+ * <p>The general form of a type parameter is: <code>S extends T = U</code>.
  */
 public class TypeParameter extends TypeExpression {
   private final Identifier id;
@@ -29,7 +29,7 @@ public class TypeParameter extends TypeExpression {
   /**
    * Returns the bound on the type parameter, or {@code null} if there is no bound.
    *
-   * <p>For example, in <tt>T extends Array = number[]</tt> the bound is <tt>Array</tt>.
+   * <p>For example, in <code>T extends Array = number[]</code> the bound is <code>Array</code>.
    */
   public ITypeExpression getBound() {
     return bound;
@@ -38,7 +38,7 @@ public class TypeParameter extends TypeExpression {
   /**
    * Returns the type parameter default, or {@code null} if there is no default,
    *
-   * <p>For example, in <tt>T extends Array = number[]</tt> the default is <tt>number[]</tt>.
+   * <p>For example, in <code>T extends Array = number[]</code> the default is <code>number[]</code>.
    */
   public ITypeExpression getDefault() {
     return default_;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/TypeofTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/TypeofTypeExpr.java
index cf308191a03..ed56a4c7f9b 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/TypeofTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/TypeofTypeExpr.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 
 /**
- * A type of form <tt>typeof E</tt> where <tt>E</tt> is an expression that takes the form of a
+ * A type of form <code>typeof E</code> where <code>E</code> is an expression that takes the form of a
  * qualified name.
  */
 public class TypeofTypeExpr extends TypeExpression {
diff --git a/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
index 5682bb11d03..66658f27c8e 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
@@ -6,7 +6,7 @@ import com.semmle.js.ast.Visitor;
 /**
  * A unary operator applied to a type.
  *
- * <p>This can be <tt>keyof T</tt> or <tt>readonly T</tt>.
+ * <p>This can be <code>keyof T</code> or <code>readonly T</code>.
  */
 public class UnaryTypeExpr extends TypeExpression {
   private final ITypeExpression elementType;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/UnionTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/UnionTypeExpr.java
index 4be288914f4..fedb0dc5482 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/UnionTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/UnionTypeExpr.java
@@ -4,7 +4,7 @@ import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
 
-/** A union type such as <tt>number | string | boolean</tt>. */
+/** A union type such as <code>number | string | boolean</code>. */
 public class UnionTypeExpr extends TypeExpression {
   private final List<ITypeExpression> elementTypes;
 
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeExtractor.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeExtractor.java
index caf88175956..08f261b71de 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeExtractor.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeExtractor.java
@@ -12,7 +12,7 @@ import java.util.Map;
 /**
  * Extracts type and symbol information into TRAP files.
  *
- * <p>This is closely coupled with the <tt>type_table.ts</tt> file in the parser-wrapper. Type
+ * <p>This is closely coupled with the <code>type_table.ts</code> file in the parser-wrapper. Type
  * strings and symbol strings generated in that file are parsed here. See that file for reference
  * and documentation.
  */
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
index 0824ad9be17..36d4f888618 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
@@ -703,14 +703,14 @@ public class TypeScriptASTConverter {
   }
 
   /**
-   * Converts the given child to an AST node of the given type or <tt>null</tt>. A ParseError is
+   * Converts the given child to an AST node of the given type or <code>null</code>. A ParseError is
    * thrown if a different type of node was found.
    *
    * <p>This is used to detect syntax errors that are not reported as syntax errors by the
    * TypeScript parser. Usually they are reported as errors in a later compiler stage, which the
    * extractor does not run.
    *
-   * <p>Returns <tt>null</tt> if the child is absent.
+   * <p>Returns <code>null</code> if the child is absent.
    */
   @SuppressWarnings("unchecked")
   private <T extends Node> T tryConvertChild(JsonObject node, String prop, Class<T> expectedType)
@@ -2515,8 +2515,8 @@ public class TypeScriptASTConverter {
   }
 
   /**
-   * Returns a specific modifier from the given node (or <tt>null</tt> if absent), as defined by its
-   * <tt>modifiers</tt> property and the <tt>kind</tt> property of the modifier AST node.
+   * Returns a specific modifier from the given node (or <code>null</code> if absent), as defined by its
+   * <code>modifiers</code> property and the <code>kind</code> property of the modifier AST node.
    */
   private JsonObject getModifier(JsonObject node, String modKind) {
     for (JsonElement mod : getModifiers(node))
@@ -2526,8 +2526,8 @@ public class TypeScriptASTConverter {
   }
 
   /**
-   * Check whether a node has a particular modifier, as defined by its <tt>modifiers</tt> property
-   * and the <tt>kind</tt> property of the modifier AST node.
+   * Check whether a node has a particular modifier, as defined by its <code>modifiers</code> property
+   * and the <code>kind</code> property of the modifier AST node.
    */
   private boolean hasModifier(JsonObject node, String modKind) {
     return getModifier(node, modKind) != null;
@@ -2568,8 +2568,8 @@ public class TypeScriptASTConverter {
   }
 
   /**
-   * Check whether a node has a particular flag, as defined by its <tt>flags</tt> property and the
-   * <tt>ts.NodeFlags</tt> in enum.
+   * Check whether a node has a particular flag, as defined by its <code>flags</code> property and the
+   * <code>ts.NodeFlags</code> in enum.
    */
   private boolean hasFlag(JsonObject node, String flagName) {
     int flagId = metadata.getNodeFlagId(flagName);
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptParser.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptParser.java
index 36792f2d204..70a06656df8 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptParser.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptParser.java
@@ -97,7 +97,7 @@ public class TypeScriptParser {
   public static final String TYPESCRIPT_RETRIES_VAR = "SEMMLE_TYPESCRIPT_RETRIES";
 
   /**
-   * An environment variable (without the <tt>SEMMLE_</tt> or <tt>LGTM_</tt> prefix), that can be
+   * An environment variable (without the <code>SEMMLE_</code> or <code>LGTM_</code> prefix), that can be
    * set to indicate the maximum heap space usable by the Node.js process, in addition to its
    * "reserve memory".
    *
@@ -106,7 +106,7 @@ public class TypeScriptParser {
   public static final String TYPESCRIPT_RAM_SUFFIX = "TYPESCRIPT_RAM";
 
   /**
-   * An environment variable (without the <tt>SEMMLE_</tt> or <tt>LGTM_</tt> prefix), that can be
+   * An environment variable (without the <code>SEMMLE_</code> or <code>LGTM_</code> prefix), that can be
    * set to indicate the amount of heap space the Node.js process should reserve for extracting
    * individual files.
    *
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeTable.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeTable.java
index 0b7e98d0c2a..53d8c437d92 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeTable.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeTable.java
@@ -4,9 +4,9 @@ import com.google.gson.JsonArray;
 import com.google.gson.JsonObject;
 
 /**
- * Holds the output of the <tt>get-type-table</tt> command.
+ * Holds the output of the <code>get-type-table</code> command.
  *
- * <p>See documentation in <tt>parser-wrapper/src/type_table.ts</tt>.
+ * <p>See documentation in <code>parser-wrapper/src/type_table.ts</code>.
  */
 public class TypeTable {
   private final JsonArray typeStrings;
diff --git a/javascript/ql/src/experimental/Security/CWE-073/TemplateObjectInjection.ql b/javascript/ql/src/experimental/Security/CWE-073/TemplateObjectInjection.ql
new file mode 100644
index 00000000000..58c02667af3
--- /dev/null
+++ b/javascript/ql/src/experimental/Security/CWE-073/TemplateObjectInjection.ql
@@ -0,0 +1,49 @@
+/**
+ * @name Template Object Injection
+ * @description Instantiating a template using a user-controlled object is vulnerable to local file read and potential remote code execution.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id js/template-object-injection
+ * @tags security
+ *       external/cwe/cwe-073
+ *       external/cwe/cwe-094
+ */
+
+import javascript
+import DataFlow::PathGraph
+import semmle.javascript.security.TaintedObject
+
+class TemplateObjInjectionConfig extends TaintTracking::Configuration {
+  TemplateObjInjectionConfig() { this = "TemplateObjInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
+    TaintedObject::isSource(source, label)
+  }
+
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
+    label = TaintedObject::label() and
+    exists(MethodCallExpr mc |
+      Express::isResponse(mc.getReceiver()) and
+      mc.getMethodName() = "render" and
+      sink.asExpr() = mc.getArgument(1)
+    )
+  }
+
+  override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
+    guard instanceof TaintedObject::SanitizerGuard
+  }
+
+  override predicate isAdditionalFlowStep(
+    DataFlow::Node src, DataFlow::Node trg, DataFlow::FlowLabel inlbl, DataFlow::FlowLabel outlbl
+  ) {
+    TaintedObject::step(src, trg, inlbl, outlbl)
+  }
+}
+
+from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+where cfg.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Template object injection due to $@.", source.getNode(),
+  "user-provided value"
diff --git a/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection.js b/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection.js
new file mode 100644
index 00000000000..3e0e42f33ca
--- /dev/null
+++ b/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection.js
@@ -0,0 +1,10 @@
+var app = require('express')();
+app.set('view engine', 'hbs');
+
+app.post('/path', function(req, res) {
+    var bodyParameter = req.body.bodyParameter
+    var queryParameter = req.query.queryParameter
+    
+    res.render('template', bodyParameter)
+    res.render('template', queryParameter)
+});
\ No newline at end of file
diff --git a/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection_fixed.js b/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection_fixed.js
new file mode 100644
index 00000000000..54e8e865a1d
--- /dev/null
+++ b/javascript/ql/src/experimental/Security/CWE-073/documentation-examples/TemplateObjectInjection_fixed.js
@@ -0,0 +1,10 @@
+var app = require('express')();
+app.set('view engine', 'hbs');
+
+app.post('/path', function(req, res) {
+    var bodyParameter = req.body.bodyParameter
+    var queryParameter = req.query.queryParameter
+    
+    res.render('template', {bodyParameter})
+    res.render('template', {queryParameter})
+});
\ No newline at end of file
diff --git a/javascript/ql/src/javascript.qll b/javascript/ql/src/javascript.qll
index 9cc8e112b5b..d83f173071c 100644
--- a/javascript/ql/src/javascript.qll
+++ b/javascript/ql/src/javascript.qll
@@ -85,13 +85,16 @@ import semmle.javascript.frameworks.Electron
 import semmle.javascript.frameworks.EventEmitter
 import semmle.javascript.frameworks.Files
 import semmle.javascript.frameworks.Firebase
+import semmle.javascript.frameworks.FormParsers
 import semmle.javascript.frameworks.jQuery
 import semmle.javascript.frameworks.JWT
 import semmle.javascript.frameworks.Handlebars
+import semmle.javascript.frameworks.Immutable
 import semmle.javascript.frameworks.LazyCache
 import semmle.javascript.frameworks.LodashUnderscore
 import semmle.javascript.frameworks.Logging
 import semmle.javascript.frameworks.HttpFrameworks
+import semmle.javascript.frameworks.Markdown
 import semmle.javascript.frameworks.NoSQL
 import semmle.javascript.frameworks.PkgCloud
 import semmle.javascript.frameworks.PropertyProjection
diff --git a/javascript/ql/src/semmle/javascript/AMD.qll b/javascript/ql/src/semmle/javascript/AMD.qll
index 03523f9f66d..74ba3d204af 100644
--- a/javascript/ql/src/semmle/javascript/AMD.qll
+++ b/javascript/ql/src/semmle/javascript/AMD.qll
@@ -155,9 +155,17 @@ class AmdModuleDefinition extends CallExpr {
    * into this module's `module.exports` property.
    */
   DefiniteAbstractValue getAModuleExportsValue() {
+    result = [getAnImplicitExportsValue(), getAnExplicitExportsValue()]
+  }
+
+  pragma[noinline]
+  private AbstractValue getAnImplicitExportsValue() {
     // implicit exports: anything that is returned from the factory function
     result = getModuleExpr().analyze().getAValue()
-    or
+  }
+
+  pragma[noinline]
+  private AbstractValue getAnExplicitExportsValue() {
     // explicit exports: anything assigned to `module.exports`
     exists(AbstractProperty moduleExports, AmdModule m |
       this = m.getDefine() and
diff --git a/javascript/ql/src/semmle/javascript/AST.qll b/javascript/ql/src/semmle/javascript/AST.qll
index 6fbabe89d66..8cced037dec 100644
--- a/javascript/ql/src/semmle/javascript/AST.qll
+++ b/javascript/ql/src/semmle/javascript/AST.qll
@@ -118,6 +118,7 @@ class ASTNode extends @ast_node, NodeInStmtContainer {
   int getNumChildStmt() { result = count(getAChildStmt()) }
 
   /** Gets the parent node of this node, if any. */
+  cached
   ASTNode getParent() { this = result.getAChild() }
 
   /** Gets the first control flow node belonging to this syntactic entity. */
diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index bc548ae30b8..6c8c9533557 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -738,9 +738,7 @@ module API {
         boundArgs in [0 .. 10]
       )
       or
-      exists(StepSummary summary |
-        t = useStep(nd, promisified, boundArgs, result, summary).append(summary)
-      )
+      t = useStep(nd, promisified, boundArgs, result)
     }
 
     private import semmle.javascript.dataflow.internal.StepSummary
@@ -748,15 +746,19 @@ module API {
     /**
      * Holds if `nd`, which is a use of an API-graph node, flows in zero or more potentially
      * inter-procedural steps to some intermediate node, and then from that intermediate node to
-     * `res` in one step described by `summary`.
+     * `res` in one step. The entire flow is described by the resulting `TypeTracker`.
      *
      * This predicate exists solely to enforce a better join order in `trackUseNode` above.
      */
-    pragma[noinline]
+    pragma[noopt]
     private DataFlow::TypeTracker useStep(
-      DataFlow::Node nd, boolean promisified, int boundArgs, DataFlow::Node res, StepSummary summary
+      DataFlow::Node nd, boolean promisified, int boundArgs, DataFlow::Node res
     ) {
-      StepSummary::step(trackUseNode(nd, promisified, boundArgs, result), res, summary)
+      exists(DataFlow::TypeTracker t, StepSummary summary, DataFlow::SourceNode prev |
+        prev = trackUseNode(nd, promisified, boundArgs, t) and
+        StepSummary::step(prev, res, summary) and
+        result = t.append(summary)
+      )
     }
 
     private DataFlow::SourceNode trackUseNode(
@@ -788,7 +790,23 @@ module API {
         )
       )
       or
-      exists(DataFlow::TypeBackTracker t2 | result = trackDefNode(nd, t2).backtrack(t2, t))
+      t = defStep(nd, result)
+    }
+
+    /**
+     * Holds if `nd`, which is a def of an API-graph node, can be reached in zero or more potentially
+     * inter-procedural steps from some intermediate node, and `prev` flows into that intermediate node
+     * in one step. The entire flow is described by the resulting `TypeTracker`.
+     *
+     * This predicate exists solely to enforce a better join order in `trackDefNode` above.
+     */
+    pragma[noopt]
+    private DataFlow::TypeBackTracker defStep(DataFlow::Node nd, DataFlow::SourceNode prev) {
+      exists(DataFlow::TypeBackTracker t, StepSummary summary, DataFlow::Node next |
+        next = trackDefNode(nd, t) and
+        StepSummary::step(prev, next, summary) and
+        result = t.prepend(summary)
+      )
     }
 
     /**
@@ -912,11 +930,17 @@ module API {
     }
 
     /** Gets the API node for the `i`th parameter of this invocation. */
+    pragma[nomagic]
     Node getParameter(int i) {
       result = callee.getParameter(i) and
-      result.getARhs() = getArgument(i)
+      result = getAParameterCandidate(i)
     }
 
+    /**
+     * Gets an API node where a RHS of the node is the `i`th argument to this call.
+     */
+    private Node getAParameterCandidate(int i) { result.getARhs() = getArgument(i) }
+
     /** Gets the API node for a parameter of this invocation. */
     Node getAParameter() { result = getParameter(_) }
 
diff --git a/javascript/ql/src/semmle/javascript/Arrays.qll b/javascript/ql/src/semmle/javascript/Arrays.qll
index 5bbcc00a0c1..47b3771560b 100644
--- a/javascript/ql/src/semmle/javascript/Arrays.qll
+++ b/javascript/ql/src/semmle/javascript/Arrays.qll
@@ -156,9 +156,8 @@ private module ArrayDataFlow {
 
     ArrayIndexingStep() {
       read = this and
-      forex(InferredType type | type = read.getPropertyNameExpr().flow().analyze().getAType() |
-        type = TTNumber()
-      ) and
+      TTNumber() =
+        unique(InferredType type | type = read.getPropertyNameExpr().flow().analyze().getAType()) and
       exists(VarAccess i, ExprOrVarDecl init |
         i = read.getPropertyNameExpr() and init = any(ForStmt f).getInit()
       |
diff --git a/javascript/ql/src/semmle/javascript/DOM.qll b/javascript/ql/src/semmle/javascript/DOM.qll
index a1facf39505..5b1b9c30542 100644
--- a/javascript/ql/src/semmle/javascript/DOM.qll
+++ b/javascript/ql/src/semmle/javascript/DOM.qll
@@ -357,6 +357,25 @@ module DOM {
     }
   }
 
+  /**
+   * Gets a reference to a DOM event.
+   */
+  private DataFlow::SourceNode domEventSource() {
+    // e.g. <form onSubmit={e => e.target}/>
+    exists(JSXAttribute attr | attr.getName().matches("on%") |
+      result = attr.getValue().flow().getABoundFunctionValue(0).getParameter(0)
+    )
+    or
+    // node.addEventListener("submit", e => e.target)
+    result = domValueRef().getAMethodCall("addEventListener").getABoundCallbackParameter(1, 0)
+    or
+    // node.onSubmit = (e => e.target);
+    exists(DataFlow::PropWrite write | write = domValueRef().getAPropertyWrite() |
+      write.getPropertyName().matches("on%") and
+      result = write.getRhs().getAFunctionValue().getParameter(0)
+    )
+  }
+
   /** Gets a data flow node that refers directly to a value from the DOM. */
   DataFlow::SourceNode domValueSource() { result instanceof DomValueSource::Range }
 
@@ -368,6 +387,9 @@ module DOM {
     t.start() and
     result = domValueRef().getAMethodCall(["item", "namedItem"])
     or
+    t.startInProp("target") and
+    result = domEventSource()
+    or
     exists(DataFlow::TypeTracker t2 | result = domValueRef(t2).track(t2, t))
   }
 
diff --git a/javascript/ql/src/semmle/javascript/Expr.qll b/javascript/ql/src/semmle/javascript/Expr.qll
index 8d15653c5b2..a03bb54e6f6 100644
--- a/javascript/ql/src/semmle/javascript/Expr.qll
+++ b/javascript/ql/src/semmle/javascript/Expr.qll
@@ -115,8 +115,8 @@ class Expr extends @expr, ExprOrStmt, ExprOrType, AST::ValueNode {
   predicate isImpure() { any() }
 
   /**
-   * Holds if this expression is pure, that is, is its evaluation is guaranteed to be
-   * side effect-free.
+   * Holds if this expression is pure, that is, is its evaluation is guaranteed
+   * to be side-effect free.
    */
   predicate isPure() { not isImpure() }
 
diff --git a/javascript/ql/src/semmle/javascript/NodeJS.qll b/javascript/ql/src/semmle/javascript/NodeJS.qll
index 37263793abe..4c98c4fbefe 100644
--- a/javascript/ql/src/semmle/javascript/NodeJS.qll
+++ b/javascript/ql/src/semmle/javascript/NodeJS.qll
@@ -33,31 +33,25 @@ class NodeModule extends Module {
    * Gets an abstract value representing one or more values that may flow
    * into this module's `module.exports` property.
    */
+  pragma[noinline]
   DefiniteAbstractValue getAModuleExportsValue() {
-    exists(AbstractProperty moduleExports |
-      moduleExports.getBase().(AbstractModuleObject).getModule() = this and
-      moduleExports.getPropertyName() = "exports"
-    |
-      result = moduleExports.getAValue()
-    )
+    result = getAModuleExportsProperty().getAValue()
+  }
+
+  pragma[noinline]
+  private AbstractProperty getAModuleExportsProperty() {
+    result.getBase().(AbstractModuleObject).getModule() = this and
+    result.getPropertyName() = "exports"
   }
 
   /**
    * Gets an expression that is an alias for `module.exports`.
-   * For performance this predicate only computes relevant expressions.
+   * For performance this predicate only computes relevant expressions (in `getAModuleExportsCandidate`).
    * So if using this predicate - consider expanding the list of relevant expressions.
    */
-  pragma[noinline]
-  DataFlow::Node getAModuleExportsNode() {
-    (
-      // A bit of manual magic
-      result = any(DataFlow::PropWrite w | exists(w.getPropertyName())).getBase()
-      or
-      result = DataFlow::valueNode(any(PropAccess p | exists(p.getPropertyName())).getBase())
-      or
-      result = DataFlow::valueNode(any(ObjectExpr obj))
-    ) and
-    result.analyze().getAValue() = getAModuleExportsValue()
+  DataFlow::AnalyzedNode getAModuleExportsNode() {
+    result = getAModuleExportsCandidate() and
+    result.getAValue() = getAModuleExportsValue()
   }
 
   /** Gets a symbol exported by this module. */
@@ -148,6 +142,21 @@ class NodeModule extends Module {
   }
 }
 
+/**
+ * Gets an expression that syntactically could be a alias for `module.exports`.
+ * This predicate exists to reduce the size of `getAModuleExportsNode`,
+ * while keeping all the tuples that could be relevant in later computations.
+ */
+pragma[noinline]
+private DataFlow::Node getAModuleExportsCandidate() {
+  // A bit of manual magic
+  result = any(DataFlow::PropWrite w | exists(w.getPropertyName())).getBase()
+  or
+  result = DataFlow::valueNode(any(PropAccess p | exists(p.getPropertyName())).getBase())
+  or
+  result = DataFlow::valueNode(any(ObjectExpr obj))
+}
+
 /**
  * Holds if `nodeModules` is a folder of the form `<prefix>/node_modules`, where
  * `<prefix>` is a (not necessarily proper) prefix of `f` and does not end in `/node_modules`,
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
index def92d07fe3..9fe4864249d 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -474,20 +474,29 @@ pragma[nomagic]
 private predicate barrierGuardBlocksEdge(
   BarrierGuardNode guard, DataFlow::Node pred, DataFlow::Node succ, string label
 ) {
-  barrierGuardIsRelevant(guard) and
   exists(
     SsaVariable input, SsaPhiNode phi, BasicBlock bb, ConditionGuardNode cond, boolean outcome
   |
+    bb = getADominatedBasicBlock(guard, cond) and
     pred = DataFlow::ssaDefinitionNode(input) and
     succ = DataFlow::ssaDefinitionNode(phi) and
     input = phi.getInputFromBlock(bb) and
-    guard.getEnclosingExpr() = cond.getTest() and
     outcome = cond.getOutcome() and
-    barrierGuardBlocksExpr(guard, outcome, input.getAUse(), label) and
-    cond.dominates(bb)
+    barrierGuardBlocksExpr(guard, outcome, input.getAUse(), label)
   )
 }
 
+/**
+ * Gets a basicblock that is dominated by `cond`, where the test for `cond` cond is `guard`.
+ *
+ * This predicate exists to get a better join-order for the `barrierGuardBlocksEdge` predicate above.
+ */
+private BasicBlock getADominatedBasicBlock(BarrierGuardNode guard, ConditionGuardNode cond) {
+  barrierGuardIsRelevant(guard) and
+  guard.getEnclosingExpr() = cond.getTest() and
+  cond.dominates(result)
+}
+
 /**
  * Holds if there is a barrier edge `pred -> succ` in `cfg` either through an explicit barrier edge
  * or one implied by a barrier guard.
@@ -659,9 +668,15 @@ module PseudoProperties {
    */
   pragma[inline]
   string mapValueKnownKey(DataFlow::Node key) {
-    result = pseudoProperty("mapValue", any(string s | key.mayHaveStringValue(s)))
+    result = mapValueKey(any(string s | key.mayHaveStringValue(s)))
   }
 
+  /**
+   * Gets a pseudo-property for the location of a map value where the key is `key`.
+   */
+  bindingset[key]
+  string mapValueKey(string key) { result = pseudoProperty("mapValue", key) }
+
   /**
    * Gets a pseudo-property for the location of a map value where the key is `key`.
    */
@@ -1290,12 +1305,9 @@ private predicate summarizedHigherOrderCall(
     Function f, DataFlow::InvokeNode outer, DataFlow::InvokeNode inner, int j,
     DataFlow::Node innerArg, DataFlow::SourceNode cbParm, PathSummary oldSummary
   |
-    reachableFromInput(f, outer, arg, innerArg, cfg, oldSummary) and
-    // Only track actual parameter flow.
     // Captured flow does not need to be summarized - it is handled by the local case in `higherOrderCall`.
     not arg = DataFlow::capturedVariableNode(_) and
-    argumentPassing(outer, cb, f, cbParm) and
-    innerArg = inner.getArgument(j)
+    summarizedHigherOrderCallAux(f, outer, arg, innerArg, cfg, oldSummary, cbParm, inner, j, cb)
   |
     // direct higher-order call
     cbParm.flowsTo(inner.getCalleeNode()) and
@@ -1311,6 +1323,21 @@ private predicate summarizedHigherOrderCall(
   )
 }
 
+/**
+ * @see `summarizedHigherOrderCall`.
+ */
+pragma[noinline]
+private predicate summarizedHigherOrderCallAux(
+  Function f, DataFlow::InvokeNode outer, DataFlow::Node arg, DataFlow::Node innerArg,
+  DataFlow::Configuration cfg, PathSummary oldSummary, DataFlow::SourceNode cbParm,
+  DataFlow::InvokeNode inner, int j, DataFlow::Node cb
+) {
+  reachableFromInput(f, outer, arg, innerArg, cfg, oldSummary) and
+  // Only track actual parameter flow.
+  argumentPassing(outer, cb, f, cbParm) and
+  innerArg = inner.getArgument(j)
+}
+
 /**
  * Holds if `arg` is passed as the `i`th argument to `callback` through a callback invocation.
  *
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index 4b5744d2453..99dd8cb9524 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -365,22 +365,38 @@ DataFlow::SourceNode globalObjectRef() {
   )
   or
   // DOM
-  result = globalVarRef("window")
+  result = globalVariable("window")
   or
   // Node.js
-  result = globalVarRef("global")
+  result = globalVariable("global")
   or
   // DOM and service workers
-  result = globalVarRef("self")
+  result = globalVariable("self")
   or
   // ECMAScript 2020
-  result = globalVarRef("globalThis")
+  result = globalVariable("globalThis")
   or
   // `require("global")`
   result = moduleImport("global")
   or
   // Closure library - based on AST to avoid recursion with Closure library model
-  result = globalVarRef("goog").getAPropertyRead("global")
+  result = globalVariable("goog").getAPropertyRead("global")
+}
+
+/**
+ * Gets a reference to a global variable `name`.
+ * For example, if `name` is "foo":
+ * ```js
+ * foo
+ * require('global/foo')
+ * ```
+ */
+private DataFlow::SourceNode globalVariable(string name) {
+  result.(GlobalVarRefNode).getName() = name
+  or
+  // `require("global/document")` or `require("global/window")`
+  (name = "document" or name = "window") and
+  result = moduleImport("global/" + name)
 }
 
 /**
@@ -398,13 +414,9 @@ DataFlow::SourceNode globalObjectRef() {
  */
 pragma[nomagic]
 DataFlow::SourceNode globalVarRef(string name) {
-  result.(GlobalVarRefNode).getName() = name
+  result = globalVariable(name)
   or
   result = globalObjectRef().getAPropertyReference(name)
-  or
-  // `require("global/document")` or `require("global/window")`
-  (name = "document" or name = "window") and
-  result = moduleImport("global/" + name)
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Refinements.qll b/javascript/ql/src/semmle/javascript/dataflow/Refinements.qll
index 59a827a9e85..4cfc9099254 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Refinements.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Refinements.qll
@@ -324,7 +324,12 @@ class VarRefinementContext extends RefinementContext, TVarRefinementContext {
 }
 
 /** Holds if `e` is nested inside a guard node. */
-private predicate inGuard(Expr e) { e.getParentExpr*() = any(GuardControlFlowNode g).getTest() }
+pragma[nomagic]
+private predicate inGuard(Expr e) {
+  e = any(GuardControlFlowNode g).getTest()
+  or
+  inGuard(e.getParentExpr())
+}
 
 /**
  * An abstract value of a refinement expression.
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll b/javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll
index f3627a314c6..dbb5542c151 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll
@@ -85,7 +85,7 @@ class AnalyzedNode extends DataFlow::Node {
   }
 
   /** Gets a type inferred for this node. */
-  pragma[nomagic]
+  cached
   InferredType getAType() { result = getAValue().getType() }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
index 0cf65bb97f5..87268190a07 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
@@ -180,8 +180,8 @@ private newtype TTypeBackTracker = MkTypeBackTracker(Boolean hasReturn, Optional
 /**
  * Summary of the steps needed to back-track a use of a value to a given dataflow node.
  *
- * This can be used to track callbacks that are passed to a certian API call, and are
- * therefore expected to called with a certain type of value.
+ * This can be used to track callbacks that are passed to a certain API call, and are
+ * therefore expected to be called with a certain type of value.
  *
  * Note that type back-tracking does not provide a source/sink relation, that is,
  * it may determine that a node will be used in an API call somewhere, but it won't
diff --git a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
index f405b28beca..ebfdc874f64 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
@@ -823,4 +823,35 @@ module ClientRequest {
 
     override DataFlow::Node getADataNode() { none() }
   }
+
+  /**
+   * Classes and predicates modelling the `apollo-client` library.
+   */
+  private module ApolloClient {
+    /**
+     * A function from `apollo-client` that accepts an options object that may contain a `uri` property.
+     */
+    API::Node apolloUriCallee() {
+      result = API::moduleImport("apollo-link-http").getMember(["HttpLink", "createHttpLink"])
+      or
+      result =
+        API::moduleImport(["apollo-boost", "apollo-client", "apollo-client-preset"])
+            .getMember(["ApolloClient", "HttpLink", "createNetworkInterface"])
+      or
+      result = API::moduleImport("apollo-link-ws").getMember("WebSocketLink")
+    }
+
+    /**
+     * A model of a URL request made using apollo-client.
+     */
+    class ApolloClientRequest extends ClientRequest::Range, API::InvokeNode {
+      ApolloClientRequest() { this = apolloUriCallee().getAnInvocation() }
+
+      override DataFlow::Node getUrl() { result = getParameter(0).getMember("uri").getARhs() }
+
+      override DataFlow::Node getHost() { none() }
+
+      override DataFlow::Node getADataNode() { none() }
+    }
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index e1519892caf..3931f96cbb6 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -509,8 +509,9 @@ module Express {
         this = request.getAPropertyRead("cookies")
         or
         // `req.files`, treated the same as `req.body`.
+        // `express-fileupload` uses .files, and `multer` uses .files or .file
         kind = "body" and
-        this = request.getAPropertyRead("files")
+        this = request.getAPropertyRead(["files", "file"])
       )
       or
       kind = "body" and
diff --git a/javascript/ql/src/semmle/javascript/frameworks/FormParsers.qll b/javascript/ql/src/semmle/javascript/frameworks/FormParsers.qll
new file mode 100644
index 00000000000..73e00a8e96f
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/FormParsers.qll
@@ -0,0 +1,63 @@
+/**
+ * Provides classes for modelling the server-side form/file parsing libraries.
+ */
+
+import javascript
+
+/**
+ * A source of remote flow from the `Busboy` library.
+ */
+private class BusBoyRemoteFlow extends RemoteFlowSource {
+  BusBoyRemoteFlow() {
+    this =
+      API::moduleImport("busboy")
+          .getInstance()
+          .getMember("on")
+          .getParameter(1)
+          .getAParameter()
+          .getAnImmediateUse()
+  }
+
+  override string getSourceType() { result = "parsed user value from Busbuy" }
+}
+
+/**
+ * A source of remote flow from the `Formidable` library parsing a HTTP request.
+ */
+private class FormidableRemoteFlow extends RemoteFlowSource {
+  FormidableRemoteFlow() {
+    exists(API::Node formidable |
+      formidable = API::moduleImport("formidable").getReturn()
+      or
+      formidable = API::moduleImport("formidable").getMember("formidable").getReturn()
+      or
+      formidable =
+        API::moduleImport("formidable").getMember(["IncomingForm", "Formidable"]).getInstance()
+    |
+      this =
+        formidable.getMember("parse").getACall().getABoundCallbackParameter(1, any(int i | i > 0))
+    )
+  }
+
+  override string getSourceType() { result = "parsed user value from Formidable" }
+}
+
+/**
+ * A source of remote flow from the `Multiparty` library.
+ */
+private class MultipartyRemoteFlow extends RemoteFlowSource {
+  MultipartyRemoteFlow() {
+    exists(API::Node form | form = API::moduleImport("multiparty").getMember("Form").getInstance() |
+      exists(API::CallNode parse | parse = form.getMember("parse").getACall() |
+        this = parse.getParameter(1).getAParameter().getAnImmediateUse()
+      )
+      or
+      exists(API::CallNode on | on = form.getMember("on").getACall() |
+        on.getArgument(0).mayHaveStringValue(["part", "file", "field"]) and
+        this = on.getParameter(1).getAParameter().getAnImmediateUse()
+      )
+    )
+  }
+
+  override string getSourceType() { result = "parsed user value from Multiparty" }
+}
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll b/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll
new file mode 100644
index 00000000000..16cf7de2cc0
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll
@@ -0,0 +1,185 @@
+/**
+ * Provides classes and predicates for reasoning about [immutable](https://www.npmjs.com/package/immutable).
+ */
+
+import javascript
+
+/**
+ * Provides classes implementing data-flow for Immutable.
+ *
+ * The implemention rely on the flowsteps implemented in `Collections.qll`.
+ */
+private module Immutable {
+  /**
+   * An API entrypoint for the global `Immutable` variable.
+   */
+  private class ImmutableGlobalEntry extends API::EntryPoint {
+    ImmutableGlobalEntry() { this = "ImmutableGlobalEntry" }
+
+    override DataFlow::SourceNode getAUse() { result = DataFlow::globalVarRef("Immutable") }
+
+    override DataFlow::Node getARhs() { none() }
+  }
+
+  /**
+   * An import of the `Immutable` library.
+   */
+  API::Node immutableImport() {
+    result = API::moduleImport("immutable")
+    or
+    result = API::root().getASuccessor(any(ImmutableGlobalEntry i))
+  }
+
+  /**
+   * An instance of any immutable collection.
+   *
+   * This predicate keeps track of which values in the program are Immutable collections.
+   */
+  API::Node immutableCollection() {
+    // keep this predicate in sync with the constructors defined in `storeStep`/`step`.
+    result =
+      immutableImport()
+          .getMember(["Map", "OrderedMap", "List", "Stack", "Set", "OrderedSet", "fromJS", "merge"])
+          .getReturn()
+    or
+    result = immutableImport().getMember("Record").getReturn().getReturn()
+    or
+    result =
+      immutableImport()
+          .getMember(["List", "Set", "OrderedSet", "Stack"])
+          .getMember("of")
+          .getReturn()
+    or
+    result = immutableCollection().getMember(["set", "map", "filter", "push", "merge"]).getReturn()
+  }
+
+  /**
+   * Gets the immutable collection where `pred` has been stored using the name `prop`.
+   */
+  DataFlow::SourceNode storeStep(DataFlow::Node pred, string prop) {
+    // Immutable.Map() and Immutable.fromJS().
+    exists(DataFlow::CallNode call |
+      call = immutableImport().getMember(["Map", "OrderedMap", "fromJS"]).getACall()
+    |
+      pred = call.getOptionArgument(0, prop) and
+      result = call
+    )
+    or
+    // Immutable.List()
+    exists(DataFlow::CallNode call, DataFlow::ArrayCreationNode arr |
+      call = immutableImport().getMember(["List", "Stack", "Set", "OrderedSet"]).getACall()
+    |
+      arr = call.getArgument(0).getALocalSource() and
+      exists(int i |
+        prop = DataFlow::PseudoProperties::arrayElement(i) and
+        pred = arr.getElement(i) and
+        result = call
+      )
+    )
+    or
+    // collection.set(key, value)
+    exists(DataFlow::CallNode call | call = immutableCollection().getMember("set").getACall() |
+      call.getArgument(0).mayHaveStringValue(prop) and
+      pred = call.getArgument(1) and
+      result = call
+    )
+    or
+    // list.push(x)
+    exists(DataFlow::CallNode call | call = immutableCollection().getMember("push").getACall() |
+      pred = call.getArgument(0) and
+      result = call and
+      prop = DataFlow::PseudoProperties::arrayElement()
+    )
+    or
+    // Immutable.Record({defaults})({values}).
+    exists(API::CallNode factoryCall, API::CallNode recordCall |
+      factoryCall = immutableImport().getMember("Record").getACall() and
+      recordCall = factoryCall.getReturn().getACall()
+    |
+      pred = [factoryCall, recordCall].getOptionArgument(0, prop) and
+      result = recordCall
+    )
+    or
+    // List/Set/Stack.of(values)
+    exists(API::CallNode call |
+      call =
+        immutableImport()
+            .getMember(["List", "Set", "OrderedSet", "Stack"])
+            .getMember("of")
+            .getACall()
+    |
+      pred = call.getAnArgument() and
+      result = call and
+      prop = DataFlow::PseudoProperties::arrayElement()
+    )
+  }
+
+  /**
+   * Gets the value that was stored in the immutable collection `pred` under the name `prop`.
+   */
+  DataFlow::Node loadStep(DataFlow::Node pred, string prop) {
+    // map.get()
+    exists(DataFlow::MethodCallNode call |
+      call = immutableCollection().getMember("get").getACall()
+    |
+      call.getArgument(0).mayHaveStringValue(prop) and
+      pred = call.getReceiver() and
+      result = call
+    )
+  }
+
+  /**
+   * Gets an immutable collection that contains all the elements from `pred`.
+   */
+  DataFlow::SourceNode step(DataFlow::Node pred) {
+    // map.set() / list.push() copies all existing values
+    exists(DataFlow::CallNode call |
+      call = immutableCollection().getMember(["set", "push"]).getACall()
+    |
+      pred = call.getReceiver() and
+      result = call
+    )
+    or
+    // toJS()/toList() on any immutable collection converts it to a plain JavaScript object/array (and vice versa for `fromJS`).
+    exists(DataFlow::CallNode call |
+      call = immutableCollection().getMember(["toJS", "toList"]).getACall()
+    |
+      pred = call.getReceiver() and
+      result = call
+    )
+    or
+    // Immutable.merge(x, y)
+    exists(DataFlow::CallNode call | call = immutableImport().getMember("merge").getACall() |
+      pred = call.getAnArgument() and
+      result = call
+    )
+    or
+    // collection.merge(other)
+    exists(DataFlow::CallNode call | call = immutableCollection().getMember("merge").getACall() |
+      pred = [call.getAnArgument(), call.getReceiver()] and
+      result = call
+    )
+  }
+
+  /**
+   * A dataflow step for an immutable collection.
+   */
+  class ImmutableConstructionStep extends DataFlow::AdditionalFlowStep {
+    ImmutableConstructionStep() { this = [loadStep(_, _), storeStep(_, _), step(_)] }
+
+    override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+      this = loadStep(pred, prop) and
+      succ = this
+    }
+
+    override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+      this = storeStep(pred, prop) and
+      succ = this
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      this = step(pred) and
+      succ = this
+    }
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
new file mode 100644
index 00000000000..bff1c364d00
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/Markdown.qll
@@ -0,0 +1,120 @@
+/**
+ * Provides classes for modelling common markdown parsers and generators.
+ */
+
+import javascript
+
+/**
+ * A taint step for the `marked` library, that converts markdown to HTML.
+ */
+private class MarkedStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+  MarkedStep() {
+    this = DataFlow::globalVarRef("marked").getACall()
+    or
+    this = DataFlow::moduleImport("marked").getACall()
+  }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    succ = this and
+    pred = this.getArgument(0)
+  }
+}
+
+/**
+ * A taint step for the `markdown-table` library.
+ */
+private class MarkdownTableStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+  MarkdownTableStep() { this = DataFlow::moduleImport("markdown-table").getACall() }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    succ = this and
+    pred = this.getArgument(0)
+  }
+}
+
+/**
+ * A taint step for the `showdown` library.
+ */
+private class ShowDownStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+  ShowDownStep() {
+    this =
+      [DataFlow::globalVarRef("showdown"), DataFlow::moduleImport("showdown")]
+          .getAConstructorInvocation("Converter")
+          .getAMemberCall(["makeHtml", "makeMd"])
+  }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    succ = this and
+    pred = this.getArgument(0)
+  }
+}
+
+/**
+ * Classes and predicates for modelling taint steps in `unified` and `remark`.
+ */
+private module Unified {
+  /**
+   * The creation of a parser from `unified`.
+   * The `remark` module is a shorthand that initializes `unified` with a markdown parser.
+   */
+  DataFlow::CallNode unified() { result = DataFlow::moduleImport(["unified", "remark"]).getACall() }
+
+  /**
+   * A chain of method calls that process an input with `unified`.
+   */
+  class UnifiedChain extends DataFlow::CallNode {
+    DataFlow::CallNode root;
+
+    UnifiedChain() {
+      root = unified() and
+      this = root.getAChainedMethodCall(["process", "processSync"])
+    }
+
+    /**
+     * Gets a plugin that is used in this chain.
+     */
+    DataFlow::Node getAUsedPlugin() { result = root.getAChainedMethodCall("use").getArgument(0) }
+
+    /**
+     * Gets the input that is processed.
+     */
+    DataFlow::Node getInput() { result = getArgument(0) }
+
+    /**
+     * Gets the processed output.
+     */
+    DataFlow::Node getOutput() {
+      this.getCalleeName() = "process" and result = getABoundCallbackParameter(1, 1)
+      or
+      this.getCalleeName() = "processSync" and result = this
+    }
+  }
+
+  /**
+   * A taint step for the `unified` library.
+   */
+  class UnifiedStep extends TaintTracking::AdditionalTaintStep, UnifiedChain {
+    UnifiedStep() {
+      // sanitizer. Mostly looking for `rehype-sanitize`, but also other plugins with `sanitize` in their name.
+      not this.getAUsedPlugin().getALocalSource() =
+        DataFlow::moduleImport(any(string s | s.matches("%sanitize%")))
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = getInput() and
+      succ = getOutput()
+    }
+  }
+}
+
+/**
+ * A taint step for the `snarkdown` library.
+ */
+private class SnarkdownStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+  SnarkdownStep() { this = DataFlow::moduleImport("snarkdown").getACall() }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    this = succ and
+    pred = this.getArgument(0)
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll b/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
index 8f031c81c33..cd5d18aa77d 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
@@ -65,6 +65,53 @@ module PropertyProjection {
 
 deprecated class CustomPropertyProjection = PropertyProjection::Range;
 
+/**
+ * Gets a callee of a simple property projection call.
+ * This predicate is used exclusively in `SimplePropertyProjection`.
+ */
+pragma[noinline]
+private DataFlow::SourceNode getASimplePropertyProjectionCallee(
+  boolean singleton, int selectorIndex, int objectIndex
+) {
+  singleton = false and
+  (
+    result = LodashUnderscore::member("pick") and
+    objectIndex = 0 and
+    selectorIndex = [1 .. max(result.getACall().getNumArgument())]
+    or
+    result = LodashUnderscore::member("pickBy") and
+    objectIndex = 0 and
+    selectorIndex = 1
+    or
+    result = DataFlow::moduleMember("ramda", ["pick", "pickAll", "pickBy"]) and
+    objectIndex = 1 and
+    selectorIndex = 0
+    or
+    result = DataFlow::moduleMember("dotty", "search") and
+    objectIndex = 0 and
+    selectorIndex = 1
+  )
+  or
+  singleton = true and
+  (
+    result = LodashUnderscore::member("get") and
+    objectIndex = 0 and
+    selectorIndex = 1
+    or
+    result = DataFlow::moduleMember("ramda", "path") and
+    objectIndex = 1 and
+    selectorIndex = 0
+    or
+    result = DataFlow::moduleMember("dottie", "get") and
+    objectIndex = 0 and
+    selectorIndex = 1
+    or
+    result = DataFlow::moduleMember("dotty", "get") and
+    objectIndex = 0 and
+    selectorIndex = 1
+  )
+}
+
 /**
  * A simple model of common property projection functions.
  */
@@ -74,51 +121,7 @@ private class SimplePropertyProjection extends PropertyProjection::Range {
   boolean singleton;
 
   SimplePropertyProjection() {
-    exists(DataFlow::SourceNode callee | this = callee.getACall() |
-      singleton = false and
-      (
-        callee = LodashUnderscore::member("pick") and
-        objectIndex = 0 and
-        selectorIndex = [1 .. getNumArgument()]
-        or
-        callee = LodashUnderscore::member("pickBy") and
-        objectIndex = 0 and
-        selectorIndex = 1
-        or
-        exists(string name |
-          name = "pick" or
-          name = "pickAll" or
-          name = "pickBy"
-        |
-          callee = DataFlow::moduleMember("ramda", name) and
-          objectIndex = 1 and
-          selectorIndex = 0
-        )
-        or
-        callee = DataFlow::moduleMember("dotty", "search") and
-        objectIndex = 0 and
-        selectorIndex = 1
-      )
-      or
-      singleton = true and
-      (
-        callee = LodashUnderscore::member("get") and
-        objectIndex = 0 and
-        selectorIndex = 1
-        or
-        callee = DataFlow::moduleMember("ramda", "path") and
-        objectIndex = 1 and
-        selectorIndex = 0
-        or
-        callee = DataFlow::moduleMember("dottie", "get") and
-        objectIndex = 0 and
-        selectorIndex = 1
-        or
-        callee = DataFlow::moduleMember("dotty", "get") and
-        objectIndex = 0 and
-        selectorIndex = 1
-      )
-    )
+    this = getASimplePropertyProjectionCallee(singleton, selectorIndex, objectIndex).getACall()
   }
 
   override DataFlow::Node getObject() { result = getArgument(objectIndex) }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll b/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
index a95be280be6..913f7fd7205 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
@@ -5,33 +5,29 @@
 
 import javascript
 
-private predicate execApi(string mod, string fn, int cmdArg, int optionsArg, boolean shell) {
-  mod = "cross-spawn" and
-  fn = "sync" and
-  cmdArg = 0 and
-  shell = false and
-  optionsArg = -1
-  or
-  mod = "execa" and
-  optionsArg = -1 and
+pragma[noinline]
+private predicate execApi(
+  string mod, string fn, int cmdArg, int optionsArg, boolean shell, boolean sync
+) {
+  sync = getSync(fn) and
   (
+    mod = "cross-spawn" and
+    fn = "sync" and
+    cmdArg = 0 and
     shell = false and
-    (
-      fn = "node" or
-      fn = "stdout" or
-      fn = "stderr" or
-      fn = "sync"
-    )
+    optionsArg = -1
     or
-    shell = true and
+    mod = "execa" and
+    optionsArg = -1 and
     (
-      fn = "command" or
-      fn = "commandSync" or
-      fn = "shell" or
-      fn = "shellSync"
-    )
-  ) and
-  cmdArg = 0
+      shell = false and
+      fn = ["node", "stdout", "stderr", "sync"]
+      or
+      shell = true and
+      fn = ["command", "commandSync", "shell", "shellSync"]
+    ) and
+    cmdArg = 0
+  )
 }
 
 private predicate execApi(string mod, int cmdArg, int optionsArg, boolean shell) {
@@ -61,17 +57,16 @@ private class SystemCommandExecutors extends SystemCommandExecution, DataFlow::I
   SystemCommandExecutors() {
     exists(string mod |
       exists(string fn |
-        execApi(mod, fn, cmdArg, optionsArg, shell) and
-        sync = getSync(fn) and
-        this = API::moduleImport(mod).getMember(fn).getReturn().getAUse()
+        execApi(mod, fn, cmdArg, optionsArg, shell, sync) and
+        this = API::moduleImport(mod).getMember(fn).getAnInvocation()
       )
       or
       execApi(mod, cmdArg, optionsArg, shell) and
       sync = false and
-      this = API::moduleImport(mod).getReturn().getAUse()
+      this = API::moduleImport(mod).getAnInvocation()
     )
     or
-    this = API::moduleImport("foreground-child").getReturn().getAUse() and
+    this = API::moduleImport("foreground-child").getACall() and
     cmdArg = 0 and
     optionsArg = 1 and
     shell = false and
@@ -115,19 +110,19 @@ private class RemoteCommandExecutor extends SystemCommandExecution, DataFlow::In
   int cmdArg;
 
   RemoteCommandExecutor() {
-    this = API::moduleImport("remote-exec").getReturn().getAUse() and
+    this = API::moduleImport("remote-exec").getACall() and
     cmdArg = 1
     or
     exists(API::Node ssh2, API::Node client |
       ssh2 = API::moduleImport("ssh2") and
       client in [ssh2, ssh2.getMember("Client")] and
-      this = client.getInstance().getMember("exec").getReturn().getAUse() and
+      this = client.getInstance().getMember("exec").getACall() and
       cmdArg = 0
     )
     or
     exists(API::Node ssh2stream |
       ssh2stream = API::moduleImport("ssh2-streams").getMember("SSH2Stream") and
-      this = ssh2stream.getInstance().getMember("exec").getReturn().getAUse() and
+      this = ssh2stream.getInstance().getMember("exec").getACall() and
       cmdArg = 1
     )
   }
@@ -142,7 +137,7 @@ private class RemoteCommandExecutor extends SystemCommandExecution, DataFlow::In
 }
 
 private class Opener extends SystemCommandExecution, DataFlow::InvokeNode {
-  Opener() { this = API::moduleImport("opener").getReturn().getAUse() }
+  Opener() { this = API::moduleImport("opener").getACall() }
 
   override DataFlow::Node getACommandArgument() { result = getOptionArgument(1, "command") }
 
diff --git a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
index 060fa62ee76..80c2ff8a608 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
@@ -25,6 +25,9 @@ module XML {
 
     /** Holds if this call to the XML parser resolves entities of the given `kind`. */
     abstract predicate resolvesEntities(EntityKind kind);
+
+    /** Gets a reference to a value resulting from parsing the XML. */
+    js::DataFlow::Node getAResult() { none() }
   }
 
   /**
@@ -98,10 +101,11 @@ module XML {
    * An invocation of `expat.Parser.parse` or `expat.Parser.write`.
    */
   class ExpatParserInvocation extends ParserInvocation {
+    js::DataFlow::NewNode parser;
+
     ExpatParserInvocation() {
-      exists(string m | m = "parse" or m = "write" |
-        this = moduleMethodCall("node-expat", "Parser", m)
-      )
+      parser = js::DataFlow::moduleMember("node-expat", "Parser").getAnInstantiation() and
+      this = parser.getAMemberCall(["parse", "write"]).asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -110,6 +114,10 @@ module XML {
       // only internal entities are resolved by default
       kind = InternalEntity()
     }
+
+    override js::DataFlow::Node getAResult() {
+      result = parser.getAMemberCall("on").getABoundCallbackParameter(1, _)
+    }
   }
 
   /**
@@ -160,4 +168,122 @@ module XML {
 
     override predicate resolvesEntities(XML::EntityKind kind) { kind = InternalEntity() }
   }
+
+  /**
+   * An invocation of `xml2js`.
+   */
+  private class Xml2JSInvocation extends XML::ParserInvocation {
+    js::DataFlow::CallNode call;
+
+    Xml2JSInvocation() {
+      exists(js::API::Node imp | imp = js::API::moduleImport("xml2js") |
+        call = [imp, imp.getMember("Parser").getInstance()].getMember("parseString").getACall() and
+        this = call.asExpr()
+      )
+    }
+
+    override js::Expr getSourceArgument() { result = getArgument(0) }
+
+    override predicate resolvesEntities(XML::EntityKind kind) {
+      // sax-js (the parser used) does not expand entities.
+      none()
+    }
+
+    override js::DataFlow::Node getAResult() {
+      result = call.getABoundCallbackParameter(call.getNumArgument() - 1, 1)
+    }
+  }
+
+  /**
+   * An invocation of `sax`.
+   */
+  private class SaxInvocation extends XML::ParserInvocation {
+    js::DataFlow::InvokeNode parser;
+
+    SaxInvocation() {
+      exists(js::API::Node imp | imp = js::API::moduleImport("sax") |
+        parser = imp.getMember("parser").getACall()
+        or
+        parser = imp.getMember("SAXParser").getAnInstantiation()
+      ) and
+      this = parser.getAMemberCall("write").asExpr()
+    }
+
+    override js::Expr getSourceArgument() { result = getArgument(0) }
+
+    override predicate resolvesEntities(XML::EntityKind kind) {
+      // sax-js does not expand entities.
+      none()
+    }
+
+    override js::DataFlow::Node getAResult() {
+      result =
+        parser
+            .getAPropertyWrite(any(string s | s.matches("on%")))
+            .getRhs()
+            .getAFunctionValue()
+            .getAParameter()
+    }
+  }
+
+  /**
+   * An invocation of `xml-js`.
+   */
+  private class XmlJSInvocation extends XML::ParserInvocation {
+    XmlJSInvocation() {
+      this =
+        js::DataFlow::moduleMember("xml-js", ["xml2json", "xml2js", "json2xml", "js2xml"])
+            .getACall()
+            .asExpr()
+    }
+
+    override js::Expr getSourceArgument() { result = getArgument(0) }
+
+    override predicate resolvesEntities(XML::EntityKind kind) {
+      // xml-js does not expand custom entities.
+      none()
+    }
+
+    override js::DataFlow::Node getAResult() { result.asExpr() = this }
+  }
+
+  /**
+   * An invocation of `htmlparser2`.
+   */
+  private class HtmlParser2Invocation extends XML::ParserInvocation {
+    js::DataFlow::NewNode parser;
+
+    HtmlParser2Invocation() {
+      parser = js::DataFlow::moduleMember("htmlparser2", "Parser").getAnInstantiation() and
+      this = parser.getAMemberCall("write").asExpr()
+    }
+
+    override js::Expr getSourceArgument() { result = getArgument(0) }
+
+    override predicate resolvesEntities(XML::EntityKind kind) {
+      // htmlparser2 does not expand entities.
+      none()
+    }
+
+    override js::DataFlow::Node getAResult() {
+      result =
+        parser
+            .getArgument(0)
+            .getALocalSource()
+            .getAPropertySource()
+            .getAFunctionValue()
+            .getAParameter()
+    }
+  }
+
+  private class XMLParserTaintStep extends js::TaintTracking::AdditionalTaintStep {
+    XML::ParserInvocation parser;
+
+    XMLParserTaintStep() { this.asExpr() = parser }
+
+    override predicate step(js::DataFlow::Node pred, js::DataFlow::Node succ) {
+      pred.asExpr() = parser.getSourceArgument() and
+      succ = parser.getAResult()
+    }
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll
index 78a26eb4228..b0b9632a63c 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll
@@ -221,20 +221,16 @@ module CleartextLogging {
   /**
    * Holds if `name` is filtered by e.g. a regular-expression test or a filter call.
    */
-  private predicate isFilteredPropertyName(DataFlow::Node name) {
+  private predicate isFilteredPropertyName(DataFlow::SourceNode name) {
     exists(DataFlow::MethodCallNode reduceCall |
-      reduceCall.getABoundCallbackParameter(0, 1).flowsTo(name) and
-      reduceCall.getMethodName() = "reduce"
+      reduceCall.getMethodName() = "reduce" and
+      reduceCall.getABoundCallbackParameter(0, 1) = name
     |
       reduceCall.getReceiver+().(DataFlow::MethodCallNode).getMethodName() = "filter"
     )
     or
-    exists(StringOps::RegExpTest test |
-      test.getStringOperand().getALocalSource() = name.getALocalSource()
-    )
+    exists(StringOps::RegExpTest test | test.getStringOperand().getALocalSource() = name)
     or
-    exists(MembershipCandidate test |
-      test.getAMemberNode().getALocalSource() = name.getALocalSource()
-    )
+    exists(MembershipCandidate test | test.getAMemberNode().getALocalSource() = name)
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll b/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll
index 8c3157fcce4..f0f3c9d973c 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDom.qll
@@ -11,8 +11,8 @@ private import semmle.javascript.dataflow.InferredTypes
  */
 module XssThroughDom {
   import Xss::XssThroughDom
+  private import XssThroughDomCustomizations::XssThroughDom
   private import semmle.javascript.security.dataflow.Xss::DomBasedXss as DomBasedXss
-  private import semmle.javascript.dataflow.InferredTypes
   private import semmle.javascript.security.dataflow.UnsafeJQueryPluginCustomizations::UnsafeJQueryPlugin as UnsafeJQuery
 
   /**
@@ -40,88 +40,4 @@ module XssThroughDom {
       DomBasedXss::isOptionallySanitizedEdge(pred, succ)
     }
   }
-
-  /**
-   * Gets an attribute name that could store user-controlled data.
-   *
-   * Attributes such as "id", "href", and "src" are often used as input to HTML.
-   * However, they are either rarely controlable by a user, or already a sink for other XSS vulnerabilities.
-   * Such attributes are therefore ignored.
-   */
-  bindingset[result]
-  string unsafeAttributeName() {
-    result.regexpMatch("data-.*") or
-    result.regexpMatch("aria-.*") or
-    result = ["name", "value", "title", "alt"]
-  }
-
-  /**
-   * A source for text from the DOM from a JQuery method call.
-   */
-  class JQueryTextSource extends Source, JQuery::MethodCall {
-    JQueryTextSource() {
-      (
-        this.getMethodName() = ["text", "val"] and this.getNumArgument() = 0
-        or
-        this.getMethodName() = "attr" and
-        this.getNumArgument() = 1 and
-        forex(InferredType t | t = this.getArgument(0).analyze().getAType() | t = TTString()) and
-        this.getArgument(0).mayHaveStringValue(unsafeAttributeName())
-      ) and
-      // looks like a $("<p>" + ... ) source, which is benign for this query.
-      not exists(DataFlow::Node prefix |
-        DomBasedXss::isPrefixOfJQueryHtmlString(this.getReceiver()
-              .(DataFlow::CallNode)
-              .getAnArgument(), prefix)
-      |
-        prefix.getStringValue().regexpMatch("\\s*<.*")
-      )
-    }
-  }
-
-  /**
-   * A source for text from the DOM from a DOM property read or call to `getAttribute()`.
-   */
-  class DOMTextSource extends Source {
-    DOMTextSource() {
-      exists(DataFlow::PropRead read | read = this |
-        read.getBase().getALocalSource() = DOM::domValueRef() and
-        read.mayHavePropertyName(["innerText", "textContent", "value", "name"])
-      )
-      or
-      exists(DataFlow::MethodCallNode mcn | mcn = this |
-        mcn.getReceiver().getALocalSource() = DOM::domValueRef() and
-        mcn.getMethodName() = "getAttribute" and
-        mcn.getArgument(0).mayHaveStringValue(unsafeAttributeName())
-      )
-    }
-  }
-
-  /**
-   * A test of form `typeof x === "something"`, preventing `x` from being a string in some cases.
-   *
-   * This sanitizer helps prune infeasible paths in type-overloaded functions.
-   */
-  class TypeTestGuard extends TaintTracking::SanitizerGuardNode, DataFlow::ValueNode {
-    override EqualityTest astNode;
-    Expr operand;
-    boolean polarity;
-
-    TypeTestGuard() {
-      exists(TypeofTag tag | TaintTracking::isTypeofGuard(astNode, operand, tag) |
-        // typeof x === "string" sanitizes `x` when it evaluates to false
-        tag = "string" and
-        polarity = astNode.getPolarity().booleanNot()
-        or
-        // typeof x === "object" sanitizes `x` when it evaluates to true
-        tag != "string" and
-        polarity = astNode.getPolarity()
-      )
-    }
-
-    override predicate sanitizes(boolean outcome, Expr e) {
-      polarity = outcome and
-      e = operand
-    }
-  }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
new file mode 100644
index 00000000000..2176d5f83c6
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
@@ -0,0 +1,174 @@
+/**
+ * Provides default sources for reasoning about
+ * cross-site scripting vulnerabilities through the DOM.
+ */
+
+import javascript
+
+/**
+ * Sources for cross-site scripting vulnerabilities through the DOM.
+ */
+module XssThroughDom {
+  import Xss::XssThroughDom
+  private import semmle.javascript.dataflow.InferredTypes
+  private import semmle.javascript.security.dataflow.Xss::DomBasedXss as DomBasedXss
+
+  /**
+   * Gets an attribute name that could store user-controlled data.
+   *
+   * Attributes such as "id", "href", and "src" are often used as input to HTML.
+   * However, they are either rarely controlable by a user, or already a sink for other XSS vulnerabilities.
+   * Such attributes are therefore ignored.
+   */
+  bindingset[result]
+  string unsafeAttributeName() {
+    result.regexpMatch("data-.*") or
+    result.regexpMatch("aria-.*") or
+    result = ["name", "value", "title", "alt"]
+  }
+
+  /**
+   * A source for text from the DOM from a JQuery method call.
+   */
+  class JQueryTextSource extends Source, JQuery::MethodCall {
+    JQueryTextSource() {
+      (
+        this.getMethodName() = ["text", "val"] and this.getNumArgument() = 0
+        or
+        this.getMethodName() = "attr" and
+        this.getNumArgument() = 1 and
+        forex(InferredType t | t = this.getArgument(0).analyze().getAType() | t = TTString()) and
+        this.getArgument(0).mayHaveStringValue(unsafeAttributeName())
+      ) and
+      // looks like a $("<p>" + ... ) source, which is benign for this query.
+      not exists(DataFlow::Node prefix |
+        DomBasedXss::isPrefixOfJQueryHtmlString(this.getReceiver()
+              .(DataFlow::CallNode)
+              .getAnArgument(), prefix)
+      |
+        prefix.getStringValue().regexpMatch("\\s*<.*")
+      )
+    }
+  }
+
+  /**
+   * A source for text from the DOM from a DOM property read or call to `getAttribute()`.
+   */
+  class DOMTextSource extends Source {
+    DOMTextSource() {
+      exists(DataFlow::PropRead read | read = this |
+        read.getBase().getALocalSource() = DOM::domValueRef() and
+        read.mayHavePropertyName(["innerText", "textContent", "value", "name"])
+      )
+      or
+      exists(DataFlow::MethodCallNode mcn | mcn = this |
+        mcn.getReceiver().getALocalSource() = DOM::domValueRef() and
+        mcn.getMethodName() = "getAttribute" and
+        mcn.getArgument(0).mayHaveStringValue(unsafeAttributeName())
+      )
+    }
+  }
+
+  /**
+   * A test of form `typeof x === "something"`, preventing `x` from being a string in some cases.
+   *
+   * This sanitizer helps prune infeasible paths in type-overloaded functions.
+   */
+  class TypeTestGuard extends TaintTracking::SanitizerGuardNode, DataFlow::ValueNode {
+    override EqualityTest astNode;
+    Expr operand;
+    boolean polarity;
+
+    TypeTestGuard() {
+      exists(TypeofTag tag | TaintTracking::isTypeofGuard(astNode, operand, tag) |
+        // typeof x === "string" sanitizes `x` when it evaluates to false
+        tag = "string" and
+        polarity = astNode.getPolarity().booleanNot()
+        or
+        // typeof x === "object" sanitizes `x` when it evaluates to true
+        tag != "string" and
+        polarity = astNode.getPolarity()
+      )
+    }
+
+    override predicate sanitizes(boolean outcome, Expr e) {
+      polarity = outcome and
+      e = operand
+    }
+  }
+
+  /**
+   * A module for form inputs seen as sources for xss-through-dom.
+   */
+  module Forms {
+    /**
+     * A reference to an import of `Formik`.
+     */
+    private DataFlow::SourceNode formik() {
+      result = DataFlow::moduleImport("formik")
+      or
+      result = DataFlow::globalVarRef("Formik")
+    }
+
+    /**
+     * An object containing input values from a form build with `Formik`.
+     */
+    class FormikSource extends Source {
+      FormikSource() {
+        exists(JSXElement elem |
+          formik().getAPropertyRead("Formik").flowsToExpr(elem.getNameExpr())
+        |
+          this =
+            elem.getAttributeByName(["validate", "onSubmit"])
+                .getValue()
+                .flow()
+                .getAFunctionValue()
+                .getParameter(0)
+        )
+        or
+        this =
+          formik()
+              .getAMemberCall("withFormik")
+              .getOptionArgument(0, ["validate", "handleSubmit"])
+              .getAFunctionValue()
+              .getParameter(0)
+        or
+        this = formik().getAMemberCall("useFormikContext").getAPropertyRead("values")
+      }
+    }
+
+    /**
+     * An object containing input values from a form build with `react-final-form`.
+     */
+    class ReactFinalFormSource extends Source {
+      ReactFinalFormSource() {
+        exists(JSXElement elem |
+          DataFlow::moduleMember("react-final-form", "Form").flowsToExpr(elem.getNameExpr())
+        |
+          this =
+            elem.getAttributeByName("onSubmit")
+                .getValue()
+                .flow()
+                .getAFunctionValue()
+                .getParameter(0)
+        )
+      }
+    }
+
+    /**
+     * An object containing input values from a form build with `react-hook-form`.
+     */
+    class ReactHookFormSource extends Source {
+      ReactHookFormSource() {
+        exists(API::Node useForm |
+          useForm = API::moduleImport("react-hook-form").getMember("useForm").getReturn()
+        |
+          this =
+            useForm.getMember("handleSubmit").getParameter(0).getParameter(0).getAnImmediateUse()
+          or
+          this = useForm.getMember("getValues").getACall()
+        )
+      }
+    }
+  }
+}
diff --git a/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.expected b/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.expected
new file mode 100644
index 00000000000..f8dc8d8f47d
--- /dev/null
+++ b/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.expected
@@ -0,0 +1,55 @@
+nodes
+| tst.js:5:9:5:46 | bodyParameter |
+| tst.js:5:25:5:32 | req.body |
+| tst.js:5:25:5:32 | req.body |
+| tst.js:5:25:5:46 | req.bod ... rameter |
+| tst.js:6:9:6:49 | queryParameter |
+| tst.js:6:9:6:49 | queryParameter |
+| tst.js:6:26:6:49 | req.que ... rameter |
+| tst.js:6:26:6:49 | req.que ... rameter |
+| tst.js:6:26:6:49 | req.que ... rameter |
+| tst.js:8:28:8:40 | bodyParameter |
+| tst.js:8:28:8:40 | bodyParameter |
+| tst.js:9:28:9:41 | queryParameter |
+| tst.js:9:28:9:41 | queryParameter |
+| tst.js:18:19:18:32 | queryParameter |
+| tst.js:18:19:18:32 | queryParameter |
+| tst.js:21:24:21:26 | obj |
+| tst.js:21:24:21:26 | obj |
+| tst.js:22:28:22:30 | obj |
+| tst.js:22:28:22:30 | obj |
+| tst.js:24:11:24:24 | str |
+| tst.js:24:17:24:19 | obj |
+| tst.js:24:17:24:24 | obj + "" |
+| tst.js:27:28:27:42 | JSON.parse(str) |
+| tst.js:27:28:27:42 | JSON.parse(str) |
+| tst.js:27:39:27:41 | str |
+edges
+| tst.js:5:9:5:46 | bodyParameter | tst.js:8:28:8:40 | bodyParameter |
+| tst.js:5:9:5:46 | bodyParameter | tst.js:8:28:8:40 | bodyParameter |
+| tst.js:5:25:5:32 | req.body | tst.js:5:25:5:46 | req.bod ... rameter |
+| tst.js:5:25:5:32 | req.body | tst.js:5:25:5:46 | req.bod ... rameter |
+| tst.js:5:25:5:46 | req.bod ... rameter | tst.js:5:9:5:46 | bodyParameter |
+| tst.js:6:9:6:49 | queryParameter | tst.js:9:28:9:41 | queryParameter |
+| tst.js:6:9:6:49 | queryParameter | tst.js:9:28:9:41 | queryParameter |
+| tst.js:6:9:6:49 | queryParameter | tst.js:18:19:18:32 | queryParameter |
+| tst.js:6:9:6:49 | queryParameter | tst.js:18:19:18:32 | queryParameter |
+| tst.js:6:26:6:49 | req.que ... rameter | tst.js:6:9:6:49 | queryParameter |
+| tst.js:6:26:6:49 | req.que ... rameter | tst.js:6:9:6:49 | queryParameter |
+| tst.js:6:26:6:49 | req.que ... rameter | tst.js:6:9:6:49 | queryParameter |
+| tst.js:6:26:6:49 | req.que ... rameter | tst.js:6:9:6:49 | queryParameter |
+| tst.js:18:19:18:32 | queryParameter | tst.js:21:24:21:26 | obj |
+| tst.js:18:19:18:32 | queryParameter | tst.js:21:24:21:26 | obj |
+| tst.js:21:24:21:26 | obj | tst.js:22:28:22:30 | obj |
+| tst.js:21:24:21:26 | obj | tst.js:22:28:22:30 | obj |
+| tst.js:21:24:21:26 | obj | tst.js:24:17:24:19 | obj |
+| tst.js:24:11:24:24 | str | tst.js:27:39:27:41 | str |
+| tst.js:24:17:24:19 | obj | tst.js:24:17:24:24 | obj + "" |
+| tst.js:24:17:24:24 | obj + "" | tst.js:24:11:24:24 | str |
+| tst.js:27:39:27:41 | str | tst.js:27:28:27:42 | JSON.parse(str) |
+| tst.js:27:39:27:41 | str | tst.js:27:28:27:42 | JSON.parse(str) |
+#select
+| tst.js:8:28:8:40 | bodyParameter | tst.js:5:25:5:32 | req.body | tst.js:8:28:8:40 | bodyParameter | Template object injection due to $@. | tst.js:5:25:5:32 | req.body | user-provided value |
+| tst.js:9:28:9:41 | queryParameter | tst.js:6:26:6:49 | req.que ... rameter | tst.js:9:28:9:41 | queryParameter | Template object injection due to $@. | tst.js:6:26:6:49 | req.que ... rameter | user-provided value |
+| tst.js:22:28:22:30 | obj | tst.js:6:26:6:49 | req.que ... rameter | tst.js:22:28:22:30 | obj | Template object injection due to $@. | tst.js:6:26:6:49 | req.que ... rameter | user-provided value |
+| tst.js:27:28:27:42 | JSON.parse(str) | tst.js:6:26:6:49 | req.que ... rameter | tst.js:27:28:27:42 | JSON.parse(str) | Template object injection due to $@. | tst.js:6:26:6:49 | req.que ... rameter | user-provided value |
diff --git a/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.qlref b/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.qlref
new file mode 100644
index 00000000000..4fcdae0f812
--- /dev/null
+++ b/javascript/ql/test/experimental/Security/CWE-073/TemplateObjectInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE-073/TemplateObjectInjection.ql
diff --git a/javascript/ql/test/experimental/Security/CWE-073/tst.js b/javascript/ql/test/experimental/Security/CWE-073/tst.js
new file mode 100644
index 00000000000..9ff93d14cb5
--- /dev/null
+++ b/javascript/ql/test/experimental/Security/CWE-073/tst.js
@@ -0,0 +1,28 @@
+var app = require('express')();
+app.set('view engine', 'hbs');
+
+app.post('/path', function(req, res) {
+    var bodyParameter = req.body.bodyParameter;
+    var queryParameter = req.query.queryParameter;
+
+    res.render('template', bodyParameter); // NOT OK
+    res.render('template', queryParameter); // NOT OK
+
+    if (typeof bodyParameter === "string") {
+        res.render('template', bodyParameter); // OK
+    }
+    res.render('template', queryParameter + ""); // OK
+
+    res.render('template', {profile: bodyParameter}); // OK
+
+    indirect(res, queryParameter);
+}); 
+
+function indirect(res, obj) {
+    res.render("template", obj); // NOT OK
+
+    const str = obj + "";
+    res.render("template", str); // OK 
+
+    res.render("template", JSON.parse(str)); // NOT OK
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/Nodes/globalObjectRef.expected b/javascript/ql/test/library-tests/Nodes/globalObjectRef.expected
index bb4b3b78277..0c35fe87b26 100644
--- a/javascript/ql/test/library-tests/Nodes/globalObjectRef.expected
+++ b/javascript/ql/test/library-tests/Nodes/globalObjectRef.expected
@@ -9,6 +9,5 @@
 | tst.js:1:1:1:6 | window |
 | tst.js:3:1:3:6 | window |
 | tst.js:4:1:4:6 | window |
-| tst.js:4:1:4:13 | window.window |
 | tst.js:5:1:5:4 | self |
 | tst.js:6:1:6:10 | globalThis |
diff --git a/javascript/ql/test/library-tests/Nodes/globalVarRef.expected b/javascript/ql/test/library-tests/Nodes/globalVarRef.expected
index 8a46d27562f..507e099b80a 100644
--- a/javascript/ql/test/library-tests/Nodes/globalVarRef.expected
+++ b/javascript/ql/test/library-tests/Nodes/globalVarRef.expected
@@ -2,7 +2,6 @@
 | String | tst2.js:9:1:9:11 | this.String |
 | document | tst2.js:2:1:2:26 | require ... ument") |
 | document | tst.js:3:1:3:15 | window.document |
-| document | tst.js:4:1:4:22 | window. ... ocument |
 | document | tst.js:5:1:5:13 | self.document |
 | document | tst.js:6:1:6:19 | globalThis.document |
 | foo | tst3.js:4:1:4:5 | w.foo |
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index 24fcbb5a6ef..c98e9ad7e79 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -145,3 +145,8 @@ typeInferenceMismatch
 | tst.js:2:13:2:20 | source() | tst.js:45:10:45:24 | x.map(x2 => x2) |
 | tst.js:2:13:2:20 | source() | tst.js:47:10:47:30 | Buffer. ...  'hex') |
 | tst.js:2:13:2:20 | source() | tst.js:48:10:48:22 | new Buffer(x) |
+| xml.js:5:18:5:25 | source() | xml.js:8:14:8:17 | text |
+| xml.js:12:17:12:24 | source() | xml.js:13:14:13:19 | result |
+| xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |
+| xml.js:26:27:26:34 | source() | xml.js:26:10:26:39 | convert ... (), {}) |
+| xml.js:34:18:34:25 | source() | xml.js:31:18:31:21 | name |
diff --git a/javascript/ql/test/library-tests/TaintTracking/xml.js b/javascript/ql/test/library-tests/TaintTracking/xml.js
new file mode 100644
index 00000000000..8e3785d4a2b
--- /dev/null
+++ b/javascript/ql/test/library-tests/TaintTracking/xml.js
@@ -0,0 +1,37 @@
+(function () {
+    var Parser = require("node-expat").Parser
+    var parser = new Parser();
+
+    parser.write(source());
+
+    parser.on("text", text => {
+        sink(text); // NOT OK
+    });
+
+    var parseString = require('xml2js').parseString;
+    parseString(source(), function (err, result) {
+        sink(result); // NOT OK
+    });
+
+    var sax = require("sax");
+    var parser = sax.parser(strict);
+    
+    parser.onattribute = function (attr) {
+        sink(attr); // NOT OK
+    };
+    
+    parser.write(source()).close();
+
+    var convert = require('xml-js');
+    sink(convert.xml2json(source(), {})); // NOT OK
+
+    const htmlparser2 = require("htmlparser2");
+    const parser = new htmlparser2.Parser({
+        onopentag(name, attributes) {
+            sink(name) // NOT OK
+        }
+    });
+    parser.write(source());
+    parser.end();
+
+})();
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
index 5ba426c968f..47c340f7a8e 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
@@ -1,4 +1,10 @@
 test_ClientRequest
+| apollo.js:5:18:5:78 | new cre ... hql' }) |
+| apollo.js:10:1:10:54 | new Htt ... hql' }) |
+| apollo.js:14:16:14:69 | new Apo ... .com'}) |
+| apollo.js:17:1:17:34 | new Pre ... yurl"}) |
+| apollo.js:20:1:20:77 | createN ... phql'}) |
+| apollo.js:23:1:23:31 | new Web ... wsUri}) |
 | tst.js:11:5:11:16 | request(url) |
 | tst.js:13:5:13:20 | request.get(url) |
 | tst.js:15:5:15:23 | request.delete(url) |
@@ -111,6 +117,12 @@ test_getHost
 | tst.js:93:5:93:35 | net.req ... host }) | tst.js:93:29:93:32 | host |
 | tst.js:219:5:219:41 | data.so ... Host"}) | tst.js:219:32:219:39 | "myHost" |
 test_getUrl
+| apollo.js:5:18:5:78 | new cre ... hql' }) | apollo.js:5:44:5:75 | 'https: ... raphql' |
+| apollo.js:10:1:10:54 | new Htt ... hql' }) | apollo.js:10:21:10:51 | 'http:/ ... raphql' |
+| apollo.js:14:16:14:69 | new Apo ... .com'}) | apollo.js:14:39:14:67 | 'https: ... le.com' |
+| apollo.js:17:1:17:34 | new Pre ... yurl"}) | apollo.js:17:26:17:32 | "myurl" |
+| apollo.js:20:1:20:77 | createN ... phql'}) | apollo.js:20:30:20:75 | 'https: ... raphql' |
+| apollo.js:23:1:23:31 | new Web ... wsUri}) | apollo.js:23:25:23:29 | wsUri |
 | tst.js:11:5:11:16 | request(url) | tst.js:11:13:11:15 | url |
 | tst.js:13:5:13:20 | request.get(url) | tst.js:13:17:13:19 | url |
 | tst.js:15:5:15:23 | request.delete(url) | tst.js:15:20:15:22 | url |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/apollo.js b/javascript/ql/test/library-tests/frameworks/ClientRequests/apollo.js
new file mode 100644
index 00000000000..9aff4e64ab1
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/apollo.js
@@ -0,0 +1,23 @@
+import { ApolloClient } from 'apollo-client'
+import { HttpLink } from 'apollo-link-http'
+import { createHttpLink } from 'apollo-link-http'
+
+const httpLink = new createHttpLink({ uri: 'https://api.github.com/graphql' }) // url 1
+
+const ApolloClient = require('apollo-client-preset').ApolloClient;
+const HttpLink = require('apollo-link-http').HttpLink;
+
+new HttpLink({ uri: 'http://localhost:8080/graphql' }); // url 2
+
+import ApolloClient from 'apollo-boost'; // / 'apollo-client'
+ 
+const client = new ApolloClient({uri: 'https://graphql.example.com'}); // url 3
+
+let PresetHttpLink = require('apollo-client-preset').HttpLink;
+new PresetHttpLink({uri: "myurl"}); // url 4
+
+import { createNetworkInterface } from 'apollo-client';
+createNetworkInterface({uri: 'https://web-go-demo.herokuapp.com/__/graphql'}) // url 5
+
+const { WebSocketLink } = require('apollo-link-ws')
+new WebSocketLink({uri: wsUri}) // url 6
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/Immutable/immutable.js b/javascript/ql/test/library-tests/frameworks/Immutable/immutable.js
new file mode 100644
index 00000000000..78104b6a20a
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Immutable/immutable.js
@@ -0,0 +1,58 @@
+var obj = { a: source("a"), b: source("b1") };
+sink(obj["a"]); // NOT OK
+
+const { Map, fromJS, List, OrderedMap, Record, merge, Stack, Set, OrderedSet } = require('immutable');
+
+const map1 = Map(obj);
+
+sink(map1.get("b")); // NOT OK
+
+const map2 = map1.set('c', "safe");
+sink(map1.get("a")); // NOT OK
+sink(map2.get("a")); // NOT OK
+sink(map2.get("b")); // OK - but still flagged [INCONSISTENCY]
+
+const map3 = map2.set("d", source("d"));
+sink(map1.get("d")); // OK
+sink(map3.get("d")); // NOT OK
+
+
+sink(map3.toJS()["a"]); // NOT OK
+
+sink(fromJS({"e": source("e")}).get("e")); // NOT OK
+
+const l1 = List([source(), "foobar"]);
+l1.forEach(x => sink(x)); // NOT OK
+
+l1.map(x => "safe").forEach(x => sink(x)); // OK
+
+List(["safe"]).map(x => source()).forEach(x => sink(x)); // NOT OK
+
+List([source()]).map(x => x).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
+
+List(["safe"]).push(source()).forEach(x => sink(x)); // NOT OK
+
+
+const map4 = OrderedMap({}).set("f", source());
+sink(map4.get("f")); // NOT OK
+
+const map5 = Record({a: source(), b: null, c: null})({b: source()});
+sink(map5.get("a")); // NOT OK
+sink(map5.get("b")); // NOT OK
+sink(map5.get("c")); // OK
+
+const map6 = merge(Map({}), Record({a: source()})());
+sink(map6.get("a")); // NOT OK
+
+const map7 = map6.merge(Map({b: source()}));
+sink(map7.get("b")); // NOT OK
+
+Stack.of(source(), "foobar").forEach(x => sink(x)); // NOT OK
+
+List.of(source()).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
+
+Set.of(source()).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
+
+Set([source()]).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
+
+OrderedSet([source()]).filter(x => true).toList().forEach(x => sink(x)); // NOT OK
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/Immutable/tests.expected b/javascript/ql/test/library-tests/frameworks/Immutable/tests.expected
new file mode 100644
index 00000000000..6edc4ee1a96
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Immutable/tests.expected
@@ -0,0 +1,22 @@
+| immutable.js:1:16:1:26 | source("a") | immutable.js:2:6:2:13 | obj["a"] |
+| immutable.js:1:16:1:26 | source("a") | immutable.js:11:6:11:18 | map1.get("a") |
+| immutable.js:1:16:1:26 | source("a") | immutable.js:12:6:12:18 | map2.get("a") |
+| immutable.js:1:16:1:26 | source("a") | immutable.js:20:6:20:21 | map3.toJS()["a"] |
+| immutable.js:1:32:1:43 | source("b1") | immutable.js:8:6:8:18 | map1.get("b") |
+| immutable.js:1:32:1:43 | source("b1") | immutable.js:13:6:13:18 | map2.get("b") |
+| immutable.js:15:28:15:38 | source("d") | immutable.js:17:6:17:18 | map3.get("d") |
+| immutable.js:22:19:22:29 | source("e") | immutable.js:22:6:22:40 | fromJS( ... et("e") |
+| immutable.js:24:18:24:25 | source() | immutable.js:25:22:25:22 | x |
+| immutable.js:29:25:29:32 | source() | immutable.js:29:53:29:53 | x |
+| immutable.js:31:7:31:14 | source() | immutable.js:31:75:31:75 | x |
+| immutable.js:33:21:33:28 | source() | immutable.js:33:49:33:49 | x |
+| immutable.js:36:38:36:45 | source() | immutable.js:37:6:37:18 | map4.get("f") |
+| immutable.js:39:25:39:32 | source() | immutable.js:40:6:40:18 | map5.get("a") |
+| immutable.js:39:58:39:65 | source() | immutable.js:41:6:41:18 | map5.get("b") |
+| immutable.js:44:40:44:47 | source() | immutable.js:45:6:45:18 | map6.get("a") |
+| immutable.js:47:33:47:40 | source() | immutable.js:48:6:48:18 | map7.get("b") |
+| immutable.js:50:10:50:17 | source() | immutable.js:50:48:50:48 | x |
+| immutable.js:52:9:52:16 | source() | immutable.js:52:64:52:64 | x |
+| immutable.js:54:8:54:15 | source() | immutable.js:54:63:54:63 | x |
+| immutable.js:56:6:56:13 | source() | immutable.js:56:62:56:62 | x |
+| immutable.js:58:13:58:20 | source() | immutable.js:58:69:58:69 | x |
diff --git a/javascript/ql/test/library-tests/frameworks/Immutable/tests.ql b/javascript/ql/test/library-tests/frameworks/Immutable/tests.ql
new file mode 100644
index 00000000000..58d12ea774f
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Immutable/tests.ql
@@ -0,0 +1,18 @@
+import javascript
+private import semmle.javascript.dataflow.internal.StepSummary
+
+class Config extends DataFlow::Configuration {
+  Config() { this = "Config" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.(DataFlow::CallNode).getCalleeName() = "source"
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(DataFlow::CallNode call | call.getCalleeName() = "sink" | call.getAnArgument() = sink)
+  }
+}
+
+query predicate dataFlow(DataFlow::Node pred, DataFlow::Node succ) {
+  any(Config c).hasFlow(pred, succ)
+}
diff --git a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
index a78e3314283..4155ef62341 100644
--- a/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
+++ b/javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html
@@ -1 +1,3 @@
 <a href="https://semmle.com" href="https://semmle.com">Semmle</a>
+
+<td {% foo %} {% foo %}></td>
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
index 68549d11e3d..ef45c7f87bd 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
@@ -351,3 +351,7 @@ var bad79 = /(a*)*b/;
 var bad80 = /(a+)*b/;
 var bad81 = /(a*)+b/;
 var bad82 = /(a+)+b/;
+
+// GOOD
+var good40 = /(a|b)+/;
+var good41 = /(?:[\s;,"'<>(){}|[\]@=+*]|:(?![/\\]))+/;
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected b/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
index 5d9c4fcdb61..3878bbc2088 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
@@ -88,6 +88,47 @@ nodes
 | execSeries.js:18:34:18:40 | req.url |
 | execSeries.js:19:12:19:16 | [cmd] |
 | execSeries.js:19:13:19:15 | cmd |
+| form-parsers.js:9:8:9:39 | "touch  ... nalname |
+| form-parsers.js:9:8:9:39 | "touch  ... nalname |
+| form-parsers.js:9:19:9:26 | req.file |
+| form-parsers.js:9:19:9:26 | req.file |
+| form-parsers.js:9:19:9:39 | req.fil ... nalname |
+| form-parsers.js:13:3:13:11 | req.files |
+| form-parsers.js:13:3:13:11 | req.files |
+| form-parsers.js:13:21:13:24 | file |
+| form-parsers.js:14:10:14:37 | "touch  ... nalname |
+| form-parsers.js:14:10:14:37 | "touch  ... nalname |
+| form-parsers.js:14:21:14:24 | file |
+| form-parsers.js:14:21:14:37 | file.originalname |
+| form-parsers.js:24:48:24:55 | filename |
+| form-parsers.js:24:48:24:55 | filename |
+| form-parsers.js:25:10:25:28 | "touch " + filename |
+| form-parsers.js:25:10:25:28 | "touch " + filename |
+| form-parsers.js:25:21:25:28 | filename |
+| form-parsers.js:35:25:35:30 | fields |
+| form-parsers.js:35:25:35:30 | fields |
+| form-parsers.js:36:10:36:31 | "touch  ... ds.name |
+| form-parsers.js:36:10:36:31 | "touch  ... ds.name |
+| form-parsers.js:36:21:36:26 | fields |
+| form-parsers.js:36:21:36:31 | fields.name |
+| form-parsers.js:40:26:40:31 | fields |
+| form-parsers.js:40:26:40:31 | fields |
+| form-parsers.js:41:10:41:31 | "touch  ... ds.name |
+| form-parsers.js:41:10:41:31 | "touch  ... ds.name |
+| form-parsers.js:41:21:41:26 | fields |
+| form-parsers.js:41:21:41:31 | fields.name |
+| form-parsers.js:52:34:52:39 | fields |
+| form-parsers.js:52:34:52:39 | fields |
+| form-parsers.js:53:10:53:31 | "touch  ... ds.name |
+| form-parsers.js:53:10:53:31 | "touch  ... ds.name |
+| form-parsers.js:53:21:53:26 | fields |
+| form-parsers.js:53:21:53:31 | fields.name |
+| form-parsers.js:58:30:58:33 | part |
+| form-parsers.js:58:30:58:33 | part |
+| form-parsers.js:59:10:59:33 | "touch  ... ilename |
+| form-parsers.js:59:10:59:33 | "touch  ... ilename |
+| form-parsers.js:59:21:59:24 | part |
+| form-parsers.js:59:21:59:33 | part.filename |
 | lib/subLib/index.js:7:32:7:35 | name |
 | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
 | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -222,6 +263,40 @@ edges
 | execSeries.js:18:34:18:40 | req.url | execSeries.js:18:13:18:47 | require ... , true) |
 | execSeries.js:19:12:19:16 | [cmd] | execSeries.js:13:19:13:26 | commands |
 | execSeries.js:19:13:19:15 | cmd | execSeries.js:19:12:19:16 | [cmd] |
+| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:19:9:39 | req.fil ... nalname |
+| form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:19:9:39 | req.fil ... nalname |
+| form-parsers.js:9:19:9:39 | req.fil ... nalname | form-parsers.js:9:8:9:39 | "touch  ... nalname |
+| form-parsers.js:9:19:9:39 | req.fil ... nalname | form-parsers.js:9:8:9:39 | "touch  ... nalname |
+| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file |
+| form-parsers.js:13:3:13:11 | req.files | form-parsers.js:13:21:13:24 | file |
+| form-parsers.js:13:21:13:24 | file | form-parsers.js:14:21:14:24 | file |
+| form-parsers.js:14:21:14:24 | file | form-parsers.js:14:21:14:37 | file.originalname |
+| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch  ... nalname |
+| form-parsers.js:14:21:14:37 | file.originalname | form-parsers.js:14:10:14:37 | "touch  ... nalname |
+| form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:21:25:28 | filename |
+| form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:21:25:28 | filename |
+| form-parsers.js:25:21:25:28 | filename | form-parsers.js:25:10:25:28 | "touch " + filename |
+| form-parsers.js:25:21:25:28 | filename | form-parsers.js:25:10:25:28 | "touch " + filename |
+| form-parsers.js:35:25:35:30 | fields | form-parsers.js:36:21:36:26 | fields |
+| form-parsers.js:35:25:35:30 | fields | form-parsers.js:36:21:36:26 | fields |
+| form-parsers.js:36:21:36:26 | fields | form-parsers.js:36:21:36:31 | fields.name |
+| form-parsers.js:36:21:36:31 | fields.name | form-parsers.js:36:10:36:31 | "touch  ... ds.name |
+| form-parsers.js:36:21:36:31 | fields.name | form-parsers.js:36:10:36:31 | "touch  ... ds.name |
+| form-parsers.js:40:26:40:31 | fields | form-parsers.js:41:21:41:26 | fields |
+| form-parsers.js:40:26:40:31 | fields | form-parsers.js:41:21:41:26 | fields |
+| form-parsers.js:41:21:41:26 | fields | form-parsers.js:41:21:41:31 | fields.name |
+| form-parsers.js:41:21:41:31 | fields.name | form-parsers.js:41:10:41:31 | "touch  ... ds.name |
+| form-parsers.js:41:21:41:31 | fields.name | form-parsers.js:41:10:41:31 | "touch  ... ds.name |
+| form-parsers.js:52:34:52:39 | fields | form-parsers.js:53:21:53:26 | fields |
+| form-parsers.js:52:34:52:39 | fields | form-parsers.js:53:21:53:26 | fields |
+| form-parsers.js:53:21:53:26 | fields | form-parsers.js:53:21:53:31 | fields.name |
+| form-parsers.js:53:21:53:31 | fields.name | form-parsers.js:53:10:53:31 | "touch  ... ds.name |
+| form-parsers.js:53:21:53:31 | fields.name | form-parsers.js:53:10:53:31 | "touch  ... ds.name |
+| form-parsers.js:58:30:58:33 | part | form-parsers.js:59:21:59:24 | part |
+| form-parsers.js:58:30:58:33 | part | form-parsers.js:59:21:59:24 | part |
+| form-parsers.js:59:21:59:24 | part | form-parsers.js:59:21:59:33 | part.filename |
+| form-parsers.js:59:21:59:33 | part.filename | form-parsers.js:59:10:59:33 | "touch  ... ilename |
+| form-parsers.js:59:21:59:33 | part.filename | form-parsers.js:59:10:59:33 | "touch  ... ilename |
 | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
 | lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
 | lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -293,6 +368,13 @@ edges
 | exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | This command depends on $@. | exec-sh2.js:14:25:14:31 | req.url | a user-provided value |
 | exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | This command depends on $@. | exec-sh.js:19:25:19:31 | req.url | a user-provided value |
 | execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
+| form-parsers.js:9:8:9:39 | "touch  ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch  ... nalname | This command depends on $@. | form-parsers.js:9:19:9:26 | req.file | a user-provided value |
+| form-parsers.js:14:10:14:37 | "touch  ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch  ... nalname | This command depends on $@. | form-parsers.js:13:3:13:11 | req.files | a user-provided value |
+| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | This command depends on $@. | form-parsers.js:24:48:24:55 | filename | a user-provided value |
+| form-parsers.js:36:10:36:31 | "touch  ... ds.name | form-parsers.js:35:25:35:30 | fields | form-parsers.js:36:10:36:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:35:25:35:30 | fields | a user-provided value |
+| form-parsers.js:41:10:41:31 | "touch  ... ds.name | form-parsers.js:40:26:40:31 | fields | form-parsers.js:41:10:41:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:40:26:40:31 | fields | a user-provided value |
+| form-parsers.js:53:10:53:31 | "touch  ... ds.name | form-parsers.js:52:34:52:39 | fields | form-parsers.js:53:10:53:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:52:34:52:39 | fields | a user-provided value |
+| form-parsers.js:59:10:59:33 | "touch  ... ilename | form-parsers.js:58:30:58:33 | part | form-parsers.js:59:10:59:33 | "touch  ... ilename | This command depends on $@. | form-parsers.js:58:30:58:33 | part | a user-provided value |
 | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
 | other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
 | other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/form-parsers.js b/javascript/ql/test/query-tests/Security/CWE-078/form-parsers.js
new file mode 100644
index 00000000000..4b1dabde441
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/form-parsers.js
@@ -0,0 +1,63 @@
+var express = require('express');
+var multer  = require('multer');
+var upload = multer({ dest: 'uploads/' });
+ 
+var app = express();
+var exec = require("child_process").exec;
+ 
+app.post('/profile', upload.single('avatar'), function (req, res, next) {
+  exec("touch " + req.file.originalname); // NOT OK
+});
+ 
+app.post('/photos/upload', upload.array('photos', 12), function (req, res, next) {
+  req.files.forEach(file => {
+    exec("touch " + file.originalname); // NOT OK
+  })
+});
+
+
+var http = require('http');
+var Busboy = require('busboy');
+
+http.createServer(function (req, res) {
+  var busboy = new Busboy({ headers: req.headers });
+  busboy.on('file', function (fieldname, file, filename, encoding, mimetype) {
+    exec("touch " + filename); // NOT OK
+  });
+  req.pipe(busboy);
+}).listen(8000);
+
+
+const formidable = require('formidable'); 
+app.post('/api/upload', (req, res, next) => {
+  let form = formidable({ multiples: true });
+ 
+  form.parse(req, (err, fields, files) => {
+    exec("touch " + fields.name); // NOT OK
+  });
+
+  let form2 = new formidable.IncomingForm();
+  form2.parse(req, (err, fields, files) => {
+    exec("touch " + fields.name); // NOT OK
+  });
+});
+
+var multiparty = require('multiparty');
+var http = require('http');
+
+http.createServer(function (req, res) {
+  // parse a file upload
+  var form = new multiparty.Form();
+
+  form.parse(req, function (err, fields, files) {
+    exec("touch " + fields.name); // NOT OK
+  });
+
+
+  var form2 = new multiparty.Form();
+  form2.on('part', function (part) { // / file / field
+    exec("touch " + part.filename); // NOT OK
+  });
+  form2.parse(req);
+
+}).listen(8080);
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
index bc28be8d730..e0f353a9d32 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected
@@ -7,6 +7,65 @@ nodes
 | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id |
 | ReflectedXss.js:17:31:17:39 | params.id |
 | ReflectedXss.js:17:31:17:39 | params.id |
+| ReflectedXss.js:22:12:22:19 | req.body |
+| ReflectedXss.js:22:12:22:19 | req.body |
+| ReflectedXss.js:22:12:22:19 | req.body |
+| ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:23:19:23:26 | req.body |
+| ReflectedXss.js:23:19:23:26 | req.body |
+| ReflectedXss.js:29:12:29:19 | req.body |
+| ReflectedXss.js:29:12:29:19 | req.body |
+| ReflectedXss.js:29:12:29:19 | req.body |
+| ReflectedXss.js:30:7:33:4 | mytable |
+| ReflectedXss.js:30:17:33:4 | table([ ... y]\\n  ]) |
+| ReflectedXss.js:30:23:33:3 | [\\n    [ ... dy]\\n  ] |
+| ReflectedXss.js:32:5:32:22 | ['body', req.body] |
+| ReflectedXss.js:32:14:32:21 | req.body |
+| ReflectedXss.js:32:14:32:21 | req.body |
+| ReflectedXss.js:34:12:34:18 | mytable |
+| ReflectedXss.js:34:12:34:18 | mytable |
+| ReflectedXss.js:41:12:41:19 | req.body |
+| ReflectedXss.js:41:12:41:19 | req.body |
+| ReflectedXss.js:41:12:41:19 | req.body |
+| ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:42:31:42:38 | req.body |
+| ReflectedXss.js:42:31:42:38 | req.body |
+| ReflectedXss.js:56:12:56:19 | req.body |
+| ReflectedXss.js:56:12:56:19 | req.body |
+| ReflectedXss.js:56:12:56:19 | req.body |
+| ReflectedXss.js:64:14:64:21 | req.body |
+| ReflectedXss.js:64:14:64:21 | req.body |
+| ReflectedXss.js:64:39:64:42 | file |
+| ReflectedXss.js:65:16:65:19 | file |
+| ReflectedXss.js:65:16:65:19 | file |
+| ReflectedXss.js:68:12:68:41 | remark( ... q.body) |
+| ReflectedXss.js:68:12:68:52 | remark( ... tring() |
+| ReflectedXss.js:68:12:68:52 | remark( ... tring() |
+| ReflectedXss.js:68:33:68:40 | req.body |
+| ReflectedXss.js:68:33:68:40 | req.body |
+| ReflectedXss.js:72:12:72:56 | unified ... q.body) |
+| ReflectedXss.js:72:12:72:65 | unified ... oString |
+| ReflectedXss.js:72:12:72:65 | unified ... oString |
+| ReflectedXss.js:72:48:72:55 | req.body |
+| ReflectedXss.js:72:48:72:55 | req.body |
+| ReflectedXss.js:74:20:74:27 | req.body |
+| ReflectedXss.js:74:20:74:27 | req.body |
+| ReflectedXss.js:74:34:74:34 | f |
+| ReflectedXss.js:75:14:75:14 | f |
+| ReflectedXss.js:75:14:75:14 | f |
+| ReflectedXss.js:83:12:83:19 | req.body |
+| ReflectedXss.js:83:12:83:19 | req.body |
+| ReflectedXss.js:83:12:83:19 | req.body |
+| ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:84:22:84:29 | req.body |
+| ReflectedXss.js:84:22:84:29 | req.body |
+| ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:85:23:85:30 | req.body |
+| ReflectedXss.js:85:23:85:30 | req.body |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id |
@@ -100,6 +159,50 @@ edges
 | ReflectedXss.js:17:31:17:39 | params.id | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id |
 | ReflectedXss.js:17:31:17:39 | params.id | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id |
 | ReflectedXss.js:17:31:17:39 | params.id | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id |
+| ReflectedXss.js:22:12:22:19 | req.body | ReflectedXss.js:22:12:22:19 | req.body |
+| ReflectedXss.js:23:19:23:26 | req.body | ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:23:19:23:26 | req.body | ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:23:19:23:26 | req.body | ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:23:19:23:26 | req.body | ReflectedXss.js:23:12:23:27 | marked(req.body) |
+| ReflectedXss.js:29:12:29:19 | req.body | ReflectedXss.js:29:12:29:19 | req.body |
+| ReflectedXss.js:30:7:33:4 | mytable | ReflectedXss.js:34:12:34:18 | mytable |
+| ReflectedXss.js:30:7:33:4 | mytable | ReflectedXss.js:34:12:34:18 | mytable |
+| ReflectedXss.js:30:17:33:4 | table([ ... y]\\n  ]) | ReflectedXss.js:30:7:33:4 | mytable |
+| ReflectedXss.js:30:23:33:3 | [\\n    [ ... dy]\\n  ] | ReflectedXss.js:30:17:33:4 | table([ ... y]\\n  ]) |
+| ReflectedXss.js:32:5:32:22 | ['body', req.body] | ReflectedXss.js:30:23:33:3 | [\\n    [ ... dy]\\n  ] |
+| ReflectedXss.js:32:14:32:21 | req.body | ReflectedXss.js:32:5:32:22 | ['body', req.body] |
+| ReflectedXss.js:32:14:32:21 | req.body | ReflectedXss.js:32:5:32:22 | ['body', req.body] |
+| ReflectedXss.js:41:12:41:19 | req.body | ReflectedXss.js:41:12:41:19 | req.body |
+| ReflectedXss.js:42:31:42:38 | req.body | ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:42:31:42:38 | req.body | ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:42:31:42:38 | req.body | ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:42:31:42:38 | req.body | ReflectedXss.js:42:12:42:39 | convert ... q.body) |
+| ReflectedXss.js:56:12:56:19 | req.body | ReflectedXss.js:56:12:56:19 | req.body |
+| ReflectedXss.js:64:14:64:21 | req.body | ReflectedXss.js:64:39:64:42 | file |
+| ReflectedXss.js:64:14:64:21 | req.body | ReflectedXss.js:64:39:64:42 | file |
+| ReflectedXss.js:64:39:64:42 | file | ReflectedXss.js:65:16:65:19 | file |
+| ReflectedXss.js:64:39:64:42 | file | ReflectedXss.js:65:16:65:19 | file |
+| ReflectedXss.js:68:12:68:41 | remark( ... q.body) | ReflectedXss.js:68:12:68:52 | remark( ... tring() |
+| ReflectedXss.js:68:12:68:41 | remark( ... q.body) | ReflectedXss.js:68:12:68:52 | remark( ... tring() |
+| ReflectedXss.js:68:33:68:40 | req.body | ReflectedXss.js:68:12:68:41 | remark( ... q.body) |
+| ReflectedXss.js:68:33:68:40 | req.body | ReflectedXss.js:68:12:68:41 | remark( ... q.body) |
+| ReflectedXss.js:72:12:72:56 | unified ... q.body) | ReflectedXss.js:72:12:72:65 | unified ... oString |
+| ReflectedXss.js:72:12:72:56 | unified ... q.body) | ReflectedXss.js:72:12:72:65 | unified ... oString |
+| ReflectedXss.js:72:48:72:55 | req.body | ReflectedXss.js:72:12:72:56 | unified ... q.body) |
+| ReflectedXss.js:72:48:72:55 | req.body | ReflectedXss.js:72:12:72:56 | unified ... q.body) |
+| ReflectedXss.js:74:20:74:27 | req.body | ReflectedXss.js:74:34:74:34 | f |
+| ReflectedXss.js:74:20:74:27 | req.body | ReflectedXss.js:74:34:74:34 | f |
+| ReflectedXss.js:74:34:74:34 | f | ReflectedXss.js:75:14:75:14 | f |
+| ReflectedXss.js:74:34:74:34 | f | ReflectedXss.js:75:14:75:14 | f |
+| ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body |
+| ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) |
+| ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
+| ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
 | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id |
@@ -178,6 +281,20 @@ edges
 #select
 | ReflectedXss.js:8:14:8:45 | "Unknow ... rams.id | ReflectedXss.js:8:33:8:45 | req.params.id | ReflectedXss.js:8:14:8:45 | "Unknow ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:8:33:8:45 | req.params.id | user-provided value |
 | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id | ReflectedXss.js:17:31:17:39 | params.id | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:17:31:17:39 | params.id | user-provided value |
+| ReflectedXss.js:22:12:22:19 | req.body | ReflectedXss.js:22:12:22:19 | req.body | ReflectedXss.js:22:12:22:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:22:12:22:19 | req.body | user-provided value |
+| ReflectedXss.js:23:12:23:27 | marked(req.body) | ReflectedXss.js:23:19:23:26 | req.body | ReflectedXss.js:23:12:23:27 | marked(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:23:19:23:26 | req.body | user-provided value |
+| ReflectedXss.js:29:12:29:19 | req.body | ReflectedXss.js:29:12:29:19 | req.body | ReflectedXss.js:29:12:29:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:29:12:29:19 | req.body | user-provided value |
+| ReflectedXss.js:34:12:34:18 | mytable | ReflectedXss.js:32:14:32:21 | req.body | ReflectedXss.js:34:12:34:18 | mytable | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:32:14:32:21 | req.body | user-provided value |
+| ReflectedXss.js:41:12:41:19 | req.body | ReflectedXss.js:41:12:41:19 | req.body | ReflectedXss.js:41:12:41:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:41:12:41:19 | req.body | user-provided value |
+| ReflectedXss.js:42:12:42:39 | convert ... q.body) | ReflectedXss.js:42:31:42:38 | req.body | ReflectedXss.js:42:12:42:39 | convert ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:42:31:42:38 | req.body | user-provided value |
+| ReflectedXss.js:56:12:56:19 | req.body | ReflectedXss.js:56:12:56:19 | req.body | ReflectedXss.js:56:12:56:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:56:12:56:19 | req.body | user-provided value |
+| ReflectedXss.js:65:16:65:19 | file | ReflectedXss.js:64:14:64:21 | req.body | ReflectedXss.js:65:16:65:19 | file | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:64:14:64:21 | req.body | user-provided value |
+| ReflectedXss.js:68:12:68:52 | remark( ... tring() | ReflectedXss.js:68:33:68:40 | req.body | ReflectedXss.js:68:12:68:52 | remark( ... tring() | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:68:33:68:40 | req.body | user-provided value |
+| ReflectedXss.js:72:12:72:65 | unified ... oString | ReflectedXss.js:72:48:72:55 | req.body | ReflectedXss.js:72:12:72:65 | unified ... oString | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:72:48:72:55 | req.body | user-provided value |
+| ReflectedXss.js:75:14:75:14 | f | ReflectedXss.js:74:20:74:27 | req.body | ReflectedXss.js:75:14:75:14 | f | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:74:20:74:27 | req.body | user-provided value |
+| ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
+| ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | ReflectedXss.js:84:22:84:29 | req.body | ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
+| ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | ReflectedXss.js:85:23:85:30 | req.body | ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
index 4a7c04a989c..7e531bdd4e1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.js
@@ -16,3 +16,71 @@ app.get('/user/:id', function(req, res) {
 function moreBadStuff(params, res) {
   res.send("Unknown user: " + params.id); // NOT OK
 }
+
+var marked = require("marked");
+app.get('/user/:id', function(req, res) {
+  res.send(req.body); // NOT OK
+  res.send(marked(req.body)); // NOT OK
+});
+
+
+var table = require('markdown-table')
+app.get('/user/:id', function(req, res) {
+  res.send(req.body); // NOT OK
+  var mytable = table([
+    ['Name', 'Content'],
+    ['body', req.body]
+  ]);
+  res.send(mytable); // NOT OK
+});
+
+var showdown  = require('showdown');
+var converter = new showdown.Converter();
+
+app.get('/user/:id', function(req, res) {
+  res.send(req.body); // NOT OK
+  res.send(converter.makeHtml(req.body)); // NOT OK
+});
+
+var unified = require('unified');
+var markdown = require('remark-parse');
+var remark2rehype = require('remark-rehype');
+var doc = require('rehype-document');
+var format = require('rehype-format');
+var html = require('rehype-stringify');
+var remark = require("remark");
+var sanitize = require("rehype-sanitize");
+const { resetExtensions } = require('showdown');
+
+app.get('/user/:id', function (req, res) {
+  res.send(req.body); // NOT OK
+
+  unified()
+    .use(markdown)
+    .use(remark2rehype)
+    .use(doc, { title: '👋🌍' })
+    .use(format)
+    .use(html)
+    .process(req.body, function (err, file) {
+      res.send(file); // NOT OK
+    });
+
+  res.send(remark().processSync(req.body).toString()); // NOT OK
+
+  res.send(remark().use(sanitize).processSync(req.body).toString()); // OK
+
+  res.send(unified().use(markdown).processSync(req.body).toString); // NOT OK
+
+  remark().process(req.body, (e, f) => {
+    res.send(f); // NOT OK
+  })
+});
+
+import snarkdown from 'snarkdown';
+var snarkdown2 = require("snarkdown");
+
+app.get('/user/:id', function (req, res) {
+  res.send(req.body); // NOT OK
+  res.send(snarkdown(req.body)); // NOT OK
+  res.send(snarkdown2(req.body)); // NOT OK
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
index b35bbd53c1b..92017e8f378 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected
@@ -1,5 +1,19 @@
 | ReflectedXss.js:8:14:8:45 | "Unknow ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:8:33:8:45 | req.params.id | user-provided value |
 | ReflectedXss.js:17:12:17:39 | "Unknow ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:17:31:17:39 | params.id | user-provided value |
+| ReflectedXss.js:22:12:22:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:22:12:22:19 | req.body | user-provided value |
+| ReflectedXss.js:23:12:23:27 | marked(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:23:19:23:26 | req.body | user-provided value |
+| ReflectedXss.js:29:12:29:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:29:12:29:19 | req.body | user-provided value |
+| ReflectedXss.js:34:12:34:18 | mytable | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:32:14:32:21 | req.body | user-provided value |
+| ReflectedXss.js:41:12:41:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:41:12:41:19 | req.body | user-provided value |
+| ReflectedXss.js:42:12:42:39 | convert ... q.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:42:31:42:38 | req.body | user-provided value |
+| ReflectedXss.js:56:12:56:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:56:12:56:19 | req.body | user-provided value |
+| ReflectedXss.js:65:16:65:19 | file | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:64:14:64:21 | req.body | user-provided value |
+| ReflectedXss.js:68:12:68:52 | remark( ... tring() | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:68:33:68:40 | req.body | user-provided value |
+| ReflectedXss.js:72:12:72:65 | unified ... oString | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:72:48:72:55 | req.body | user-provided value |
+| ReflectedXss.js:75:14:75:14 | f | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:74:20:74:27 | req.body | user-provided value |
+| ReflectedXss.js:83:12:83:19 | req.body | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:83:12:83:19 | req.body | user-provided value |
+| ReflectedXss.js:84:12:84:30 | snarkdown(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:84:22:84:29 | req.body | user-provided value |
+| ReflectedXss.js:85:12:85:31 | snarkdown2(req.body) | Cross-site scripting vulnerability due to $@. | ReflectedXss.js:85:23:85:30 | req.body | user-provided value |
 | ReflectedXssContentTypes.js:10:14:10:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:10:24:10:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:20:14:20:36 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:20:24:20:36 | req.params.id | user-provided value |
 | ReflectedXssContentTypes.js:39:13:39:35 | "FOO: " ... rams.id | Cross-site scripting vulnerability due to $@. | ReflectedXssContentTypes.js:39:23:39:35 | req.params.id | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
index ae003b99243..cfa5ba99070 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/XssThroughDom.expected
@@ -1,4 +1,55 @@
 nodes
+| forms.js:8:23:8:28 | values |
+| forms.js:8:23:8:28 | values |
+| forms.js:9:31:9:36 | values |
+| forms.js:9:31:9:40 | values.foo |
+| forms.js:9:31:9:40 | values.foo |
+| forms.js:11:24:11:29 | values |
+| forms.js:11:24:11:29 | values |
+| forms.js:12:31:12:36 | values |
+| forms.js:12:31:12:40 | values.bar |
+| forms.js:12:31:12:40 | values.bar |
+| forms.js:24:15:24:20 | values |
+| forms.js:24:15:24:20 | values |
+| forms.js:25:23:25:28 | values |
+| forms.js:25:23:25:34 | values.email |
+| forms.js:25:23:25:34 | values.email |
+| forms.js:28:20:28:25 | values |
+| forms.js:28:20:28:25 | values |
+| forms.js:29:23:29:28 | values |
+| forms.js:29:23:29:34 | values.email |
+| forms.js:29:23:29:34 | values.email |
+| forms.js:34:11:34:53 | values |
+| forms.js:34:13:34:18 | values |
+| forms.js:34:13:34:18 | values |
+| forms.js:35:19:35:24 | values |
+| forms.js:35:19:35:30 | values.email |
+| forms.js:35:19:35:30 | values.email |
+| forms.js:44:21:44:26 | values |
+| forms.js:44:21:44:26 | values |
+| forms.js:45:21:45:26 | values |
+| forms.js:45:21:45:33 | values.stooge |
+| forms.js:45:21:45:33 | values.stooge |
+| forms.js:57:19:57:32 | e.target.value |
+| forms.js:57:19:57:32 | e.target.value |
+| forms.js:57:19:57:32 | e.target.value |
+| forms.js:71:21:71:24 | data |
+| forms.js:71:21:71:24 | data |
+| forms.js:72:19:72:22 | data |
+| forms.js:72:19:72:27 | data.name |
+| forms.js:72:19:72:27 | data.name |
+| forms.js:92:17:92:36 | values |
+| forms.js:92:26:92:36 | getValues() |
+| forms.js:92:26:92:36 | getValues() |
+| forms.js:93:25:93:30 | values |
+| forms.js:93:25:93:35 | values.name |
+| forms.js:93:25:93:35 | values.name |
+| forms.js:103:23:103:36 | e.target.value |
+| forms.js:103:23:103:36 | e.target.value |
+| forms.js:103:23:103:36 | e.target.value |
+| forms.js:107:23:107:36 | e.target.value |
+| forms.js:107:23:107:36 | e.target.value |
+| forms.js:107:23:107:36 | e.target.value |
 | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
 | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
 | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
@@ -50,6 +101,43 @@ nodes
 | xss-through-dom.js:79:4:79:34 | documen ... t.value |
 | xss-through-dom.js:79:4:79:34 | documen ... t.value |
 edges
+| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
+| forms.js:8:23:8:28 | values | forms.js:9:31:9:36 | values |
+| forms.js:9:31:9:36 | values | forms.js:9:31:9:40 | values.foo |
+| forms.js:9:31:9:36 | values | forms.js:9:31:9:40 | values.foo |
+| forms.js:11:24:11:29 | values | forms.js:12:31:12:36 | values |
+| forms.js:11:24:11:29 | values | forms.js:12:31:12:36 | values |
+| forms.js:12:31:12:36 | values | forms.js:12:31:12:40 | values.bar |
+| forms.js:12:31:12:36 | values | forms.js:12:31:12:40 | values.bar |
+| forms.js:24:15:24:20 | values | forms.js:25:23:25:28 | values |
+| forms.js:24:15:24:20 | values | forms.js:25:23:25:28 | values |
+| forms.js:25:23:25:28 | values | forms.js:25:23:25:34 | values.email |
+| forms.js:25:23:25:28 | values | forms.js:25:23:25:34 | values.email |
+| forms.js:28:20:28:25 | values | forms.js:29:23:29:28 | values |
+| forms.js:28:20:28:25 | values | forms.js:29:23:29:28 | values |
+| forms.js:29:23:29:28 | values | forms.js:29:23:29:34 | values.email |
+| forms.js:29:23:29:28 | values | forms.js:29:23:29:34 | values.email |
+| forms.js:34:11:34:53 | values | forms.js:35:19:35:24 | values |
+| forms.js:34:13:34:18 | values | forms.js:34:11:34:53 | values |
+| forms.js:34:13:34:18 | values | forms.js:34:11:34:53 | values |
+| forms.js:35:19:35:24 | values | forms.js:35:19:35:30 | values.email |
+| forms.js:35:19:35:24 | values | forms.js:35:19:35:30 | values.email |
+| forms.js:44:21:44:26 | values | forms.js:45:21:45:26 | values |
+| forms.js:44:21:44:26 | values | forms.js:45:21:45:26 | values |
+| forms.js:45:21:45:26 | values | forms.js:45:21:45:33 | values.stooge |
+| forms.js:45:21:45:26 | values | forms.js:45:21:45:33 | values.stooge |
+| forms.js:57:19:57:32 | e.target.value | forms.js:57:19:57:32 | e.target.value |
+| forms.js:71:21:71:24 | data | forms.js:72:19:72:22 | data |
+| forms.js:71:21:71:24 | data | forms.js:72:19:72:22 | data |
+| forms.js:72:19:72:22 | data | forms.js:72:19:72:27 | data.name |
+| forms.js:72:19:72:22 | data | forms.js:72:19:72:27 | data.name |
+| forms.js:92:17:92:36 | values | forms.js:93:25:93:30 | values |
+| forms.js:92:26:92:36 | getValues() | forms.js:92:17:92:36 | values |
+| forms.js:92:26:92:36 | getValues() | forms.js:92:17:92:36 | values |
+| forms.js:93:25:93:30 | values | forms.js:93:25:93:35 | values.name |
+| forms.js:93:25:93:30 | values | forms.js:93:25:93:35 | values.name |
+| forms.js:103:23:103:36 | e.target.value | forms.js:103:23:103:36 | e.target.value |
+| forms.js:107:23:107:36 | e.target.value | forms.js:107:23:107:36 | e.target.value |
 | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() |
 | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() |
 | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") |
@@ -70,6 +158,17 @@ edges
 | xss-through-dom.js:73:20:73:41 | $("inpu ... 0).name | xss-through-dom.js:73:9:73:41 | selector |
 | xss-through-dom.js:79:4:79:34 | documen ... t.value | xss-through-dom.js:79:4:79:34 | documen ... t.value |
 #select
+| forms.js:9:31:9:40 | values.foo | forms.js:8:23:8:28 | values | forms.js:9:31:9:40 | values.foo | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:8:23:8:28 | values | DOM text |
+| forms.js:12:31:12:40 | values.bar | forms.js:11:24:11:29 | values | forms.js:12:31:12:40 | values.bar | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:11:24:11:29 | values | DOM text |
+| forms.js:25:23:25:34 | values.email | forms.js:24:15:24:20 | values | forms.js:25:23:25:34 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:24:15:24:20 | values | DOM text |
+| forms.js:29:23:29:34 | values.email | forms.js:28:20:28:25 | values | forms.js:29:23:29:34 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:28:20:28:25 | values | DOM text |
+| forms.js:35:19:35:30 | values.email | forms.js:34:13:34:18 | values | forms.js:35:19:35:30 | values.email | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:34:13:34:18 | values | DOM text |
+| forms.js:45:21:45:33 | values.stooge | forms.js:44:21:44:26 | values | forms.js:45:21:45:33 | values.stooge | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:44:21:44:26 | values | DOM text |
+| forms.js:57:19:57:32 | e.target.value | forms.js:57:19:57:32 | e.target.value | forms.js:57:19:57:32 | e.target.value | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:57:19:57:32 | e.target.value | DOM text |
+| forms.js:72:19:72:27 | data.name | forms.js:71:21:71:24 | data | forms.js:72:19:72:27 | data.name | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:71:21:71:24 | data | DOM text |
+| forms.js:93:25:93:35 | values.name | forms.js:92:26:92:36 | getValues() | forms.js:93:25:93:35 | values.name | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:92:26:92:36 | getValues() | DOM text |
+| forms.js:103:23:103:36 | e.target.value | forms.js:103:23:103:36 | e.target.value | forms.js:103:23:103:36 | e.target.value | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:103:23:103:36 | e.target.value | DOM text |
+| forms.js:107:23:107:36 | e.target.value | forms.js:107:23:107:36 | e.target.value | forms.js:107:23:107:36 | e.target.value | $@ is reinterpreted as HTML without escaping meta-characters. | forms.js:107:23:107:36 | e.target.value | DOM text |
 | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | xss-through-dom.js:2:16:2:34 | $("textarea").val() | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:2:16:2:34 | $("textarea").val() | DOM text |
 | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:4:16:4:40 | $(".som ... .text() | DOM text |
 | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | $@ is reinterpreted as HTML without escaping meta-characters. | xss-through-dom.js:8:16:8:53 | $(".som ... arget") | DOM text |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/forms.js b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/forms.js
new file mode 100644
index 00000000000..b91b7490bb2
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/XssThroughDom/forms.js
@@ -0,0 +1,109 @@
+import React from 'react';
+import { Formik, withFormik, useFormikContext } from 'formik';
+
+const FormikBasic = () => (
+    <div>
+        <Formik
+            initialValues={{ email: '', password: '' }}
+            validate={values => {
+                $("#id").html(values.foo); // NOT OK
+            }}
+            onSubmit={(values, { setSubmitting }) => {
+                $("#id").html(values.bar); // NOT OK
+            }}
+        >
+            {(inputs) => (
+                <form onSubmit={handleSubmit}></form>
+            )}
+        </Formik>
+    </div>
+);
+
+const FormikEnhanced = withFormik({
+    mapPropsToValues: () => ({ name: '' }),
+    validate: values => {
+        $("#id").html(values.email); // NOT OK
+    },
+
+    handleSubmit: (values, { setSubmitting }) => {
+        $("#id").html(values.email); // NOT OK
+    }
+})(MyForm);
+
+(function () {
+    const { values, submitForm } = useFormikContext();
+    $("#id").html(values.email); // NOT OK
+
+    $("#id").html(submitForm.email); // OK 
+})
+
+import { Form } from 'react-final-form'
+
+const App = () => (
+  <Form
+    onSubmit={async values => {
+      $("#id").html(values.stooge); // NOT OK
+    }}
+    initialValues={{ stooge: 'larry', employed: false }}
+    render={({ handleSubmit, form, submitting, pristine, values }) => (
+      <form onSubmit={handleSubmit}>
+        <input type="text" name="stooge"></input>
+      </form>
+    )}
+  />
+);
+
+function plainSubmit(e) {
+    $("#id").html(e.target.value); // NOT OK
+}
+
+const plainReact = () => (
+    <form onSubmit={e => plainSubmit(e)}>
+        <input type="text" value={this.state.value} onChange={this.handleChange} />
+        <input type="submit" value="Submit" />
+    </form>
+)
+
+import { useForm } from 'react-hook-form';
+
+function HookForm() {
+  const { register, handleSubmit, errors } = useForm(); // initialize the hook
+  const onSubmit = (data) => {
+    $("#id").html(data.name); // NOT OK 
+  };
+
+  return (
+    <form onSubmit={handleSubmit(onSubmit)}>
+        <input name="name" ref={register({ required: true })} />
+        <input type="submit" />
+    </form>
+  );
+}
+
+function HookForm2() {
+  const { register, getValues } = useForm();
+  
+  return (
+    <form>
+      <input name="name" ref={register} />
+      <button
+        type="button"
+        onClick={() => {
+          const values = getValues(); // { test: "test-input", test1: "test1-input" }
+          $("#id").html(values.name); // NOT OK
+        }}
+      >
+      </button>
+    </form>
+  );
+}
+
+function vanillaJS() {
+    document.querySelector("form.myform").addEventListener("submit", e => {
+        $("#id").html(e.target.value); // NOT OK
+    });
+
+    document.querySelector("form.myform").onsubmit = function (e) {
+        $("#id").html(e.target.value); // NOT OK
+    }
+}
\ No newline at end of file
diff --git a/python/.vscode/ql.code-snippets b/python/.vscode/ql.code-snippets
index 80c6ef1290d..59f230193b0 100644
--- a/python/.vscode/ql.code-snippets
+++ b/python/.vscode/ql.code-snippets
@@ -105,8 +105,8 @@
         "scope": "ql",
         "prefix": "type tracking",
         "body": [
-            "/** Gets a reference to a ${3:thing}. */",
-            "private DataFlow::Node ${1:myType}(DataFlow::TypeTracker t) {",
+            "/** Gets a reference to ${3:a thing}. */",
+            "private DataFlow::LocalSourceNode ${1:myType}(DataFlow::TypeTracker t) {",
             "  t.start() and",
             "  result = ${2:value}",
             "  or",
@@ -115,100 +115,14 @@
             "  )",
             "}",
             "",
-            "/** Gets a reference to a ${3:thing}. */",
+            "/** Gets a reference to $3. */",
             "DataFlow::Node $1() {",
-            "  result = $1(DataFlow::TypeTracker::end())",
+            "  $1(DataFlow::TypeTracker::end()).flowsTo(result)",
             "}"
         ],
         "description": "Type tracking predicate",
     },
 
-    "Type tracking module": {
-        "scope": "ql",
-        "prefix": "type tracking module",
-        "body": [
-            "// ---------------------------------------------------------------------------",
-            "// ${1:modulename}",
-            "// ---------------------------------------------------------------------------",
-            "/** Gets a reference to the `$1` module. */",
-            "private DataFlow::Node $1(DataFlow::TypeTracker t) {",
-            "  t.start() and",
-            "  result = DataFlow::importNode(\"$1\")",
-            "  or",
-            "  exists(DataFlow::TypeTracker t2 | result = $1(t2).track(t2, t))",
-            "}",
-            "",
-            "/** Gets a reference to the `$1` module. */",
-            "DataFlow::Node $1() { result = $1(DataFlow::TypeTracker::end()) }",
-            "",
-            "/**",
-            " * Gets a reference to the attribute `attr_name` of the `$1` module.",
-            " * WARNING: Only holds for a few predefined attributes.",
-            " */",
-            "private DataFlow::Node $1_attr(DataFlow::TypeTracker t, string attr_name) {",
-            "  attr_name in [\"${2:name}\"] and",
-            "  (",
-            "    t.start() and",
-            "    result = DataFlow::importNode(\"$1\" + \".\" + attr_name)",
-            "    or",
-            "    t.startInAttr(attr_name) and",
-            "    result = $1()",
-            "  )",
-            "  or",
-            "  // Due to bad performance when using normal setup with `$1_attr(t2, attr_name).track(t2, t)`",
-            "  // we have inlined that code and forced a join",
-            "  exists(DataFlow::TypeTracker t2 |",
-            "    exists(DataFlow::StepSummary summary |",
-            "      $1_attr_first_join(t2, attr_name, result, summary) and",
-            "      t = t2.append(summary)",
-            "    )",
-            "  )",
-            "}",
-            "",
-            "pragma[nomagic]",
-            "private predicate $1_attr_first_join(",
-            "  DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary",
-            ") {",
-            "  DataFlow::StepSummary::step($1_attr(t2, attr_name), res, summary)",
-            "}",
-            "",
-            "/**",
-            " * Gets a reference to the attribute `attr_name` of the `$1` module.",
-            " * WARNING: Only holds for a few predefined attributes.",
-            " */",
-            "private DataFlow::Node $1_attr(string attr_name) {",
-            "  result = $1_attr(DataFlow::TypeTracker::end(), attr_name)",
-            "}",
-            "",
-            "/** Provides models for the `$1` module. */",
-            "module $1 {",
-            "",
-            "}",
-        ],
-        "description": "Type tracking module",
-    },
-
-    "Type tracking module member": {
-        "scope": "ql",
-        "prefix": "type tracking module member",
-        "body": [
-             "/** Gets a reference to the `${1:module}.${2:member}` ${3:object/class}. */",
-             "private DataFlow::Node ${4:$2}(DataFlow::TypeTracker t) {",
-             "  t.start() and",
-             "  result = DataFlow::importNode(\"$1.$2\")",
-             "  or",
-             "  t.startInAttr(\"$2\") and",
-             "  result = $1()",
-             "  or",
-             "  exists(DataFlow::TypeTracker t2 | result = $4(t2).track(t2, t))",
-             "}",
-             " ",
-             "/** Gets a reference to the `$1.$2` $3. */",
-             "DataFlow::Node $4() { result = $4(DataFlow::TypeTracker::end()) }",
-        ],
-        "description": "Type tracking module member",
-    },
-
     "Taint tracking configuration": {
         "scope": "ql",
         "prefix": "taint tracking",
@@ -238,118 +152,4 @@
         ]
     },
 
-    "Type tracking submodule": {
-        "scope": "ql",
-        "prefix": "type tracking submodule",
-        "body": [
-            "    // -------------------------------------------------------------------------",
-            "    // ${1:parent}.${2:submodule}",
-            "    // -------------------------------------------------------------------------",
-            "    /** Gets a reference to the `$1.$2` module. */",
-            "    DataFlow::Node $2() { result = $1_attr(\"$2\") }",
-            "",
-            "    /** Provides models for the `$1.$2` module */",
-            "    module $2 {",
-            "      /**",
-            "       * Gets a reference to the attribute `attr_name` of the `$1.$2` module.",
-            "       * WARNING: Only holds for a few predefined attributes.",
-            "       */",
-            "      private DataFlow::Node $2_attr(DataFlow::TypeTracker t, string attr_name) {",
-            "        attr_name in [\"$3\"] and",
-            "        (",
-            "          t.start() and",
-            "          result = DataFlow::importNode(\"$1.$2\" + \".\" + attr_name)",
-            "          or",
-            "          t.startInAttr(attr_name) and",
-            "          result = $2()",
-            "        )",
-            "        or",
-            "        // Due to bad performance when using normal setup with `$2_attr(t2, attr_name).track(t2, t)`",
-            "        // we have inlined that code and forced a join",
-            "        exists(DataFlow::TypeTracker t2 |",
-            "          exists(DataFlow::StepSummary summary |",
-            "            $2_attr_first_join(t2, attr_name, result, summary) and",
-            "            t = t2.append(summary)",
-            "          )",
-            "        )",
-            "      }",
-            "",
-            "      pragma[nomagic]",
-            "      private predicate $2_attr_first_join(",
-            "        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,",
-            "        DataFlow::StepSummary summary",
-            "      ) {",
-            "        DataFlow::StepSummary::step($2_attr(t2, attr_name), res, summary)",
-            "      }",
-            "",
-            "      /**",
-            "       * Gets a reference to the attribute `attr_name` of the `$1.$2` module.",
-            "       * WARNING: Only holds for a few predefined attributes.",
-            "       */",
-            "      private DataFlow::Node $2_attr(string attr_name) {",
-            "        result = $2_attr(DataFlow::TypeTracker::end(), attr_name)",
-            "      }",
-            "    }",
-        ],
-        "description": "Type tracking submodule",
-    },
-
-    "Type tracking class": {
-        "scope": "ql",
-        "prefix": "type tracking class",
-        "body": [
-            "    /**",
-            "     * Provides models for the `${1:module}.${2:classname}` class",
-            "     *",
-            "     * See ${6:apiref}.",
-            "     */",
-            "    module $2 {",
-            "      /** Gets a reference to the `$1.$2` class. */",
-            "      private DataFlow::Node classRef(DataFlow::TypeTracker t) {",
-            "        t.start() and",
-            "        result = ${4:module}_attr(\"$2\")",
-            "        or",
-            "        // TODO: remove/expand this part of the template as needed",
-            "        // Handle `${5:toplevel}.$2` alias",
-            "        t.start() and",
-            "        result = $5_attr(\"$2\")",
-            "        or",
-            "        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))",
-            "      }",
-            "",
-            "      /** Gets a reference to the `$1.$2` class. */",
-            "      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }",
-            "",
-            "      /**",
-            "       * A source of instances of `$1.$2`, extend this class to model new instances.",
-            "       *",
-            "       * This can include instantiations of the class, return values from function",
-            "       * calls, or a special parameter that will be set when functions are called by an external",
-            "       * library.",
-            "       *",
-            "       * Use the predicate `$2::instance()` to get references to instances of `$1.$2`.",
-            "       */",
-            "      abstract class InstanceSource extends DataFlow::Node { }",
-            "",
-            "      /** A direct instantiation of `$1.$2`. */",
-            "      private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {",
-            "          override CallNode node;",
-            "",
-            "          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }",
-            "      }",
-            "",
-            "      /** Gets a reference to an instance of `$1.$2`. */",
-            "      private DataFlow::Node instance(DataFlow::TypeTracker t) {",
-            "        t.start() and",
-            "        result instanceof InstanceSource",
-            "        or",
-            "        exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))",
-            "      }",
-            "",
-            "      /** Gets a reference to an instance of `$1.$2`. */",
-            "      DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }",
-            "    }",
-        ],
-        "description": "Type tracking class",
-    },
 }
diff --git a/python/change-notes/2021-02-03-flask-add-blueprint-modeling.md b/python/change-notes/2021-02-03-flask-add-blueprint-modeling.md
new file mode 100644
index 00000000000..62776a7adb4
--- /dev/null
+++ b/python/change-notes/2021-02-03-flask-add-blueprint-modeling.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of flask blueprints (`flask.Blueprint`), specifically request handlers defined with such blueprints. This can result in new sources of remote user input (`RemoteFlowSource`) -- since we're now able to detect routed parameters -- and new XSS sinks from the responses of these request handlers.
diff --git a/python/change-notes/2021-02-10-django-improvements.md b/python/change-notes/2021-02-10-django-improvements.md
new file mode 100644
index 00000000000..fb2e7494983
--- /dev/null
+++ b/python/change-notes/2021-02-10-django-improvements.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* Improved modeling of `django` to recognize request handlers functions that are decorated (for example with `django.views.decorators.http.require_GET`). This leads to more sources of remote user input (`RemoteFlowSource`), since we correctly identify the first parameter as being passed a django request.
+* Improved modeling of django View classes. We now consider any class using in a routing setup with `<class>.as_view()` as django view class. This leads to more sources of remote user input (`RemoteFlowSource`), since we correctly identify the first parameter as being passed a django request.
+* Improved modeling of `django`, so for View classes we now model `self.request`, `self.args`, and `self.kwargs` as sources of remote user input (`RemoteFlowSource`).
diff --git a/python/change-notes/2021-02-10-yaml-more-loading-functions.md b/python/change-notes/2021-02-10-yaml-more-loading-functions.md
new file mode 100644
index 00000000000..0d31b89fba7
--- /dev/null
+++ b/python/change-notes/2021-02-10-yaml-more-loading-functions.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of the `PyYAML` PyPI package (imported as `yaml`) now includes `safe_load`, `unsafe_load`, and `full_load` (as well as the `..._load_all` functions). In the current version of PyYAML (5.4.1), only `safe_load` and `safe_load_all` are known to be safe from code execution exploits. Consequently, calls to the other functions are modeled as sinks of the _Deserializing untrusted input_ (`py/unsafe-deserialization`) query.
diff --git a/python/change-notes/2021-02-18-type-backtrackers.md b/python/change-notes/2021-02-18-type-backtrackers.md
new file mode 100644
index 00000000000..d6829a6da65
--- /dev/null
+++ b/python/change-notes/2021-02-18-type-backtrackers.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for type backtracking. Dual to the `TypeTracker` class, the `TypeBackTracker` class allows the propagation of user-defined type information backwards from a set of data flow nodes.
diff --git a/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll b/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
index da52edd6af1..b3482012e9a 100644
--- a/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
+++ b/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
@@ -41,6 +41,7 @@ private import semmle.python.objects.ObjectInternal
  * A callable that is considered a "safe" external API from a security perspective.
  */
 class SafeExternalAPI extends Unit {
+  /** Gets a callable that is considered a "safe" external API from a security perspective. */
   abstract DataFlowPrivate::DataFlowCallable getSafeCallable();
 }
 
diff --git a/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql b/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql
index 2241a212690..ee39c198475 100644
--- a/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql
+++ b/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql
@@ -10,25 +10,25 @@
  */
 
 import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.ApiGraphs
 
-private ModuleValue theParamikoClientModule() { result = Value::named("paramiko.client") }
-
-private ClassValue theParamikoSSHClientClass() {
-  result = theParamikoClientModule().attr("SSHClient")
+private API::Node unsafe_paramiko_policy(string name) {
+  name in ["AutoAddPolicy", "WarningPolicy"] and
+  result = API::moduleImport("paramiko").getMember("client").getMember(name)
 }
 
-private ClassValue unsafe_paramiko_policy(string name) {
-  (name = "AutoAddPolicy" or name = "WarningPolicy") and
-  result = theParamikoClientModule().attr(name)
+private API::Node paramikoSSHClientInstance() {
+  result = API::moduleImport("paramiko").getMember("client").getMember("SSHClient").getReturn()
 }
 
-from CallNode call, ControlFlowNode arg, string name
+from DataFlow::CallCfgNode call, DataFlow::Node arg, string name
 where
-  call =
-    theParamikoSSHClientClass().lookup("set_missing_host_key_policy").(FunctionValue).getACall() and
-  arg = call.getAnArg() and
+  // see http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.set_missing_host_key_policy
+  call = paramikoSSHClientInstance().getMember("set_missing_host_key_policy").getACall() and
+  arg in [call.getArg(0), call.getArgByName("policy")] and
   (
-    arg.pointsTo(unsafe_paramiko_policy(name)) or
-    arg.pointsTo().getClass() = unsafe_paramiko_policy(name)
+    arg = unsafe_paramiko_policy(name).getAUse() or
+    arg = unsafe_paramiko_policy(name).getReturn().getAUse()
   )
 select call, "Setting missing host key policy to " + name + " may be unsafe."
diff --git a/python/ql/src/Security/CWE-377/InsecureTemporaryFile.ql b/python/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
index df694e8303d..174a841598c 100644
--- a/python/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
+++ b/python/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
@@ -11,8 +11,9 @@
  */
 
 import python
+import semmle.python.ApiGraphs
 
-FunctionValue temporary_name_function(string mod, string function) {
+API::Node temporary_name_function(string mod, string function) {
   (
     mod = "tempfile" and function = "mktemp"
     or
@@ -23,9 +24,9 @@ FunctionValue temporary_name_function(string mod, string function) {
       function = "tempnam"
     )
   ) and
-  result = Module::named(mod).attr(function)
+  result = API::moduleImport(mod).getMember(function)
 }
 
 from Call c, string mod, string function
-where temporary_name_function(mod, function).getACall().getNode() = c
+where temporary_name_function(mod, function).getACall().asExpr() = c
 select c, "Call to deprecated function " + mod + "." + function + " may be insecure."
diff --git a/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp b/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
index 8c2660b9865..2c5afee586b 100644
--- a/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
+++ b/python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
@@ -24,6 +24,9 @@ Avoid deserialization of untrusted data if at all possible.  If the
 architecture permits it then use other formats instead of serialized objects,
 for example JSON.
 </p>
+<p>
+If you need to use YAML, use the <code>yaml.safe_load</code> function.
+</p>
 </recommendation>
 
 <example>
diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index 20d5c848a0d..40a3bf4f756 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -92,6 +92,11 @@ module API {
      */
     Node getReturn() { result = getASuccessor(Label::return()) }
 
+    /**
+     * Gets a node representing a subclass of the class represented by this node.
+     */
+    Node getASubclass() { result = getASuccessor(Label::subclass()) }
+
     /**
      * Gets a string representation of the lexicographically least among all shortest access paths
      * from the root to this node.
@@ -312,12 +317,11 @@ module API {
      * For instance, `prefix_member("foo.bar", "baz", "foo.bar.baz")` would hold.
      */
     private predicate prefix_member(TApiNode base, string member, TApiNode sub) {
-      exists(string base_str, string sub_str |
-        base = MkModuleImport(base_str) and
+      exists(string sub_str, string regexp |
+        regexp = "(.+)[.]([^.]+)" and
+        base = MkModuleImport(sub_str.regexpCapture(regexp, 1)) and
+        member = sub_str.regexpCapture(regexp, 2) and
         sub = MkModuleImport(sub_str)
-      |
-        base_str + "." + member = sub_str and
-        not member.matches("%.%")
       )
     }
 
@@ -351,13 +355,19 @@ module API {
         // the relationship between `pred` and `ref`.
         use(base, src) and pred = trackUseNode(src)
       |
-        // Reading an attribute on a node that is a use of `base`:
+        // Referring to an attribute on a node that is a use of `base`:
         lbl = Label::memberFromRef(ref) and
-        ref = pred.getAnAttributeRead()
+        ref = pred.getAnAttributeReference()
         or
         // Calling a node that is a use of `base`
         lbl = Label::return() and
         ref = pred.getACall()
+        or
+        // Subclassing a node
+        lbl = Label::subclass() and
+        exists(DataFlow::Node superclass | pred.flowsTo(superclass) |
+          ref.asExpr().(ClassExpr).getABase() = superclass.asExpr()
+        )
       )
     }
 
@@ -468,4 +478,6 @@ private module Label {
 
   /** Gets the `return` edge label. */
   string return() { result = "getReturn()" }
+
+  string subclass() { result = "getASubclass()" }
 }
diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index 24e9210e088..39cf8372279 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -373,6 +373,9 @@ module HTTP {
        * requests for this route, if any. These automatically become a `RemoteFlowSource`.
        */
       Parameter getARoutedParameter() { result = range.getARoutedParameter() }
+
+      /** Gets a string that identifies the framework used for this route setup. */
+      string getFramework() { result = range.getFramework() }
     }
 
     /** Provides a class for modeling new HTTP routing APIs. */
@@ -407,6 +410,9 @@ module HTTP {
          * requests for this route, if any. These automatically become a `RemoteFlowSource`.
          */
         abstract Parameter getARoutedParameter();
+
+        /** Gets a string that identifies the framework used for this route setup. */
+        abstract string getFramework();
       }
     }
 
@@ -426,6 +432,9 @@ module HTTP {
        * requests, if any. These automatically become a `RemoteFlowSource`.
        */
       Parameter getARoutedParameter() { result = range.getARoutedParameter() }
+
+      /** Gets a string that identifies the framework used for this route setup. */
+      string getFramework() { result = range.getFramework() }
     }
 
     /** Provides a class for modeling new HTTP request handlers. */
@@ -444,6 +453,9 @@ module HTTP {
          * requests, if any. These automatically become a `RemoteFlowSource`.
          */
         abstract Parameter getARoutedParameter();
+
+        /** Gets a string that identifies the framework used for this request handler. */
+        abstract string getFramework();
       }
     }
 
@@ -456,13 +468,17 @@ module HTTP {
         result = rs.getARoutedParameter() and
         result in [this.getArg(_), this.getArgByName(_)]
       }
+
+      override string getFramework() { result = rs.getFramework() }
     }
 
     /** A parameter that will receive parts of the url when handling an incoming request. */
     private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
-      RoutedParameter() { this.getParameter() = any(RequestHandler handler).getARoutedParameter() }
+      RequestHandler handler;
 
-      override string getSourceType() { result = "RoutedParameter" }
+      RoutedParameter() { this.getParameter() = handler.getARoutedParameter() }
+
+      override string getSourceType() { result = handler.getFramework() + " RoutedParameter" }
     }
 
     /**
diff --git a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
index b6de3cd7764..b6c4bdb06ea 100644
--- a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
+++ b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
@@ -180,7 +180,7 @@ private newtype TTypeTracker = MkTypeTracker(Boolean hasCall, OptionalAttributeN
  * It is recommended that all uses of this type are written in the following form,
  * for tracking some type `myType`:
  * ```
- * DataFlow::Node myType(DataFlow::TypeTracker t) {
+ * DataFlow::LocalSourceNode myType(DataFlow::TypeTracker t) {
  *   t.start() and
  *   result = < source of myType >
  *   or
@@ -189,7 +189,7 @@ private newtype TTypeTracker = MkTypeTracker(Boolean hasCall, OptionalAttributeN
  *   )
  * }
  *
- * DataFlow::Node myType() { result = myType(DataFlow::TypeTracker::end()) }
+ * DataFlow::Node myType() { myType(DataFlow::TypeTracker::end()).flowsTo(result) }
  * ```
  *
  * Instead of `result = myType(t2).track(t2, t)`, you can also use the equivalent
@@ -324,3 +324,144 @@ module TypeTracker {
    */
   TypeTracker end() { result.end() }
 }
+
+private newtype TTypeBackTracker = MkTypeBackTracker(Boolean hasReturn, OptionalAttributeName attr)
+
+/**
+ * Summary of the steps needed to back-track a use of a value to a given dataflow node.
+ *
+ * This can for example be used to track callbacks that are passed to a certain API,
+ * so we can model specific parameters of that callback as having a certain type.
+ *
+ * Note that type back-tracking does not provide a source/sink relation, that is,
+ * it may determine that a node will be used in an API call somewhere, but it won't
+ * determine exactly where that use was, or the path that led to the use.
+ *
+ * It is recommended that all uses of this type are written in the following form,
+ * for back-tracking some callback type `myCallback`:
+ *
+ * ```
+ * DataFlow::LocalSourceNode myCallback(DataFlow::TypeBackTracker t) {
+ *   t.start() and
+ *   result = (< some API call >).getArgument(< n >).getALocalSource()
+ *   or
+ *   exists (DataFlow::TypeBackTracker t2 |
+ *     result = myCallback(t2).backtrack(t2, t)
+ *   )
+ * }
+ *
+ * DataFlow::LocalSourceNode myCallback() { result = myCallback(DataFlow::TypeBackTracker::end()) }
+ * ```
+ *
+ * Instead of `result = myCallback(t2).backtrack(t2, t)`, you can also use the equivalent
+ * `t2 = t.step(result, myCallback(t2))`. If you additionally want to track individual
+ * intra-procedural steps, use `t2 = t.smallstep(result, myCallback(t2))`.
+ */
+class TypeBackTracker extends TTypeBackTracker {
+  Boolean hasReturn;
+  string attr;
+
+  TypeBackTracker() { this = MkTypeBackTracker(hasReturn, attr) }
+
+  /** Gets the summary resulting from prepending `step` to this type-tracking summary. */
+  TypeBackTracker prepend(StepSummary step) {
+    step = LevelStep() and result = this
+    or
+    step = CallStep() and hasReturn = false and result = this
+    or
+    step = ReturnStep() and result = MkTypeBackTracker(true, attr)
+    or
+    exists(string p | step = LoadStep(p) and attr = "" and result = MkTypeBackTracker(hasReturn, p))
+    or
+    step = StoreStep(attr) and result = MkTypeBackTracker(hasReturn, "")
+  }
+
+  /** Gets a textual representation of this summary. */
+  string toString() {
+    exists(string withReturn, string withAttr |
+      (if hasReturn = true then withReturn = "with" else withReturn = "without") and
+      (if attr != "" then withAttr = " with attribute " + attr else withAttr = "") and
+      result = "type back-tracker " + withReturn + " return steps" + withAttr
+    )
+  }
+
+  /**
+   * Holds if this is the starting point of type tracking.
+   */
+  predicate start() { hasReturn = false and attr = "" }
+
+  /**
+   * Holds if this is the end point of type tracking.
+   */
+  predicate end() { attr = "" }
+
+  /**
+   * INTERNAL. DO NOT USE.
+   *
+   * Holds if this type has been back-tracked into a call through return edge.
+   */
+  boolean hasReturn() { result = hasReturn }
+
+  /**
+   * Gets a type tracker that starts where this one has left off to allow continued
+   * tracking.
+   *
+   * This predicate is only defined if the type has not been tracked into an attribute.
+   */
+  TypeBackTracker continue() { attr = "" and result = this }
+
+  /**
+   * Gets the summary that corresponds to having taken a backwards
+   * heap and/or inter-procedural step from `nodeTo` to `nodeFrom`.
+   */
+  pragma[inline]
+  TypeBackTracker step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo) {
+    exists(StepSummary summary |
+      StepSummary::step(nodeFrom, nodeTo, summary) and
+      this = result.prepend(summary)
+    )
+  }
+
+  /**
+   * Gets the summary that corresponds to having taken a backwards
+   * local, heap and/or inter-procedural step from `nodeTo` to `nodeFrom`.
+   *
+   * Unlike `TypeBackTracker::step`, this predicate exposes all edges
+   * in the flowgraph, and not just the edges between
+   * `LocalSourceNode`s. It may therefore be less performant.
+   *
+   * Type tracking predicates using small steps typically take the following form:
+   * ```ql
+   * DataFlow::Node myType(DataFlow::TypeBackTracker t) {
+   *   t.start() and
+   *   result = < some API call >.getArgument(< n >)
+   *   or
+   *   exists (DataFlow::TypeBackTracker t2 |
+   *     t = t2.smallstep(result, myType(t2))
+   *   )
+   * }
+   *
+   * DataFlow::Node myType() {
+   *   result = myType(DataFlow::TypeBackTracker::end())
+   * }
+   * ```
+   */
+  pragma[inline]
+  TypeBackTracker smallstep(Node nodeFrom, Node nodeTo) {
+    exists(StepSummary summary |
+      StepSummary::smallstep(nodeFrom, nodeTo, summary) and
+      this = result.prepend(summary)
+    )
+    or
+    typePreservingStep(nodeFrom, nodeTo) and
+    this = result
+  }
+}
+
+/** Provides predicates for implementing custom `TypeBackTracker`s. */
+module TypeBackTracker {
+  /**
+   * Gets a valid end point of type back-tracking.
+   */
+  TypeBackTracker end() { result.end() }
+}
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll b/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
index cfe05cb3173..1bd5f961a36 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
@@ -159,7 +159,9 @@ private class SetAttrCallAsAttrWrite extends AttrWrite, CfgNode {
  * Instances of this class correspond to the `NameNode` for `attr`, and also gives access to `value` by
  * virtue of being a `DefinitionNode`.
  */
-private class ClassAttributeAssignmentNode extends DefinitionNode, NameNode { }
+private class ClassAttributeAssignmentNode extends DefinitionNode, NameNode {
+  ClassAttributeAssignmentNode() { this.getScope() = any(ClassExpr c).getInnerScope() }
+}
 
 /**
  * An attribute assignment via a class field, e.g.
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
index d9f5acdd279..59cc8d529a7 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -3598,6 +3598,7 @@ private module FlowExploration {
       or
       exists(PartialPathNodeRev mid |
         revPartialPathStep(mid, node, sc1, sc2, ap, config) and
+        not clearsContent(node, ap.getHead()) and
         not fullBarrier(node, config) and
         distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
       )
@@ -3611,6 +3612,7 @@ private module FlowExploration {
     exists(PartialPathNodeFwd mid |
       partialPathStep(mid, node, cc, sc1, sc2, ap, config) and
       not fullBarrier(node, config) and
+      not clearsContent(node, ap.getHead().getContent()) and
       if node instanceof CastingNode
       then compatibleTypes(getNodeType(node), ap.getType())
       else any()
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index 10ced3c768c..b1eb741a570 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -1508,6 +1508,8 @@ predicate forReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
     c instanceof ListElementContent
     or
     c instanceof SetElementContent
+    or
+    c instanceof TupleElementContent
   )
 }
 
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 93540203f94..1b96b980673 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -125,6 +125,19 @@ class Node extends TNode {
    */
   pragma[inline]
   Node track(TypeTracker t2, TypeTracker t) { t = t2.step(this, result) }
+
+  /**
+   * Gets a node that may flow into this one using one heap and/or interprocedural step.
+   *
+   * See `TypeBackTracker` for more details about how to use this.
+   */
+  pragma[inline]
+  LocalSourceNode backtrack(TypeBackTracker t2, TypeBackTracker t) { t2 = t.step(result, this) }
+
+  /**
+   * Gets a local source node from which data may flow to this node in zero or more local steps.
+   */
+  LocalSourceNode getALocalSource() { result.flowsTo(this) }
 }
 
 /** A data-flow node corresponding to an SSA variable. */
@@ -165,6 +178,23 @@ class CfgNode extends Node, TCfgNode {
   override Location getLocation() { result = node.getLocation() }
 }
 
+/** A data-flow node corresponding to a `CallNode` in the control-flow graph. */
+class CallCfgNode extends CfgNode {
+  override CallNode node;
+
+  /**
+   * Gets the data-flow node for the function component of the call corresponding to this data-flow
+   * node.
+   */
+  Node getFunction() { result.asCfgNode() = node.getFunction() }
+
+  /** Gets the data-flow node corresponding to the i'th argument of the call corresponding to this data-flow node */
+  Node getArg(int i) { result.asCfgNode() = node.getArg(i) }
+
+  /** Gets the data-flow node corresponding to the named argument of the call corresponding to this data-flow node */
+  Node getArgByName(string name) { result.asCfgNode() = node.getArgByName(name) }
+}
+
 /**
  * An expression, viewed as a node in a data flow graph.
  *
@@ -481,7 +511,7 @@ class LocalSourceNode extends Node {
   /**
    * Gets a call to this node.
    */
-  Node getACall() { Cached::call(this, result) }
+  CallCfgNode getACall() { Cached::call(this, result) }
 }
 
 cached
@@ -526,10 +556,10 @@ private module Cached {
    * Holds if `func` flows to the callee of `call`.
    */
   cached
-  predicate call(LocalSourceNode func, Node call) {
+  predicate call(LocalSourceNode func, CallCfgNode call) {
     exists(CfgNode n |
       func.flowsTo(n) and
-      n.asCfgNode() = call.asCfgNode().(CallNode).getFunction()
+      n = call.getFunction()
     )
   }
 }
@@ -544,7 +574,12 @@ newtype TContent =
   /** An element of a set. */
   TSetElementContent() or
   /** An element of a tuple at a specific index. */
-  TTupleElementContent(int index) { exists(any(TupleNode tn).getElement(index)) } or
+  TTupleElementContent(int index) {
+    exists(any(TupleNode tn).getElement(index))
+    or
+    // Arguments can overflow and end up in the starred parameter tuple.
+    exists(any(CallNode cn).getArg(index))
+  } or
   /** An element of a dictionary under a specific key. */
   TDictionaryElementContent(string key) {
     key = any(KeyValuePair kvp).getKey().(StrConst).getS()
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index fd43d938806..fb9a77e1adc 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1975,6 +1975,14 @@ private module Django {
     }
   }
 
+  /**
+   * Gets the last decorator call for the function `func`, if `func` has decorators.
+   */
+  private Expr lastDecoratorCall(Function func) {
+    result = func.getDefinition().(FunctionExpr).getADecoratorCall() and
+    not exists(Call other_decorator | other_decorator.getArg(0) = result)
+  }
+
   // ---------------------------------------------------------------------------
   // routing modeling
   // ---------------------------------------------------------------------------
@@ -1987,7 +1995,18 @@ private module Django {
    */
   private DataFlow::Node djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker t, Function func) {
     t.start() and
-    result = DataFlow::exprNode(func.getDefinition())
+    (
+      not exists(func.getADecorator()) and
+      result.asExpr() = func.getDefinition()
+      or
+      // If the function has decorators, we still want to model the function as being
+      // the request handler for a route setup. In such situations, we must track the
+      // last decorator call instead of the function itself.
+      //
+      // Note that this means that we blindly ignore what the decorator actually does to
+      // the function, which seems like an OK tradeoff.
+      result.asExpr() = lastDecoratorCall(func)
+    )
     or
     exists(DataFlow::TypeTracker t2 |
       result = djangoRouteHandlerFunctionTracker(t2, func).track(t2, t)
@@ -2005,18 +2024,15 @@ private module Django {
     result = djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker::end(), func)
   }
 
-  /** A django View class defined in project code. */
-  class DjangoViewClassDef extends Class {
-    DjangoViewClassDef() { this.getABase() = django::views::generic::View::subclassRef().asExpr() }
-
-    /** Gets a function that could handle incoming requests, if any. */
-    DjangoRouteHandler getARequestHandler() {
-      // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
-      // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
-      result = this.getAMethod() and
-      result.getName() = HTTP::httpVerbLower()
-    }
-
+  /**
+   * In order to recognize a class as being a django view class, based on the `as_view`
+   * call, we need to be able to track such calls on _any_ class. This is provided by
+   * the member predicates of this QL class.
+   *
+   * As such, a Python class being part of `DjangoViewClassHelper` doesn't signify that
+   * we model it as a django view class.
+   */
+  class DjangoViewClassHelper extends Class {
     /** Gets a reference to this class. */
     private DataFlow::Node getARef(DataFlow::TypeTracker t) {
       t.start() and
@@ -2051,15 +2067,69 @@ private module Django {
     DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
   }
 
+  /** A class that we consider a django View class. */
+  abstract class DjangoViewClass extends DjangoViewClassHelper {
+    /** Gets a function that could handle incoming requests, if any. */
+    Function getARequestHandler() {
+      // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
+      // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
+      result = this.getAMethod() and
+      result.getName() = HTTP::httpVerbLower()
+    }
+
+    /**
+     * Gets a reference to instances of this class, originating from a self parameter of
+     * a method defined on this class.
+     *
+     * Note: TODO: This doesn't take MRO into account
+     * Note: TODO: This doesn't take staticmethod/classmethod into account
+     */
+    private DataFlow::Node getASelfRef(DataFlow::TypeTracker t) {
+      t.start() and
+      result.(DataFlow::ParameterNode).getParameter() = this.getAMethod().getArg(0)
+      or
+      exists(DataFlow::TypeTracker t2 | result = this.getASelfRef(t2).track(t2, t))
+    }
+
+    /**
+     * Gets a reference to instances of this class, originating from a self parameter of
+     * a method defined on this class.
+     *
+     * Note: TODO: This doesn't take MRO into account
+     * Note: TODO: This doesn't take staticmethod/classmethod into account
+     */
+    DataFlow::Node getASelfRef() { result = this.getASelfRef(DataFlow::TypeTracker::end()) }
+  }
+
+  /**
+   * A class that is used in a route-setup, with `<class>.as_view()`, therefore being
+   * considered a django View class.
+   */
+  class DjangoViewClassFromRouteSetup extends DjangoViewClass {
+    DjangoViewClassFromRouteSetup() {
+      exists(DjangoRouteSetup setup | setup.getViewArg() = this.asViewResult())
+    }
+  }
+
+  /**
+   * A class that has a super-type which is a django View class, therefore also
+   * becoming a django View class.
+   */
+  class DjangoViewClassFromSuperClass extends DjangoViewClass {
+    DjangoViewClassFromSuperClass() {
+      this.getABase() = django::views::generic::View::subclassRef().asExpr()
+    }
+  }
+
   /**
    * A function that is a django route handler, meaning it handles incoming requests
    * with the django framework.
    */
   private class DjangoRouteHandler extends Function {
     DjangoRouteHandler() {
-      exists(djangoRouteHandlerFunctionTracker(this))
+      exists(DjangoRouteSetup route | route.getViewArg() = djangoRouteHandlerFunctionTracker(this))
       or
-      any(DjangoViewClassDef vc).getARequestHandler() = this
+      any(DjangoViewClass vc).getARequestHandler() = this
     }
 
     /** Gets the index of the request parameter. */
@@ -2083,18 +2153,20 @@ private module Django {
     final override DjangoRouteHandler getARequestHandler() {
       djangoRouteHandlerFunctionTracker(result) = getViewArg()
       or
-      exists(DjangoViewClassDef vc |
+      exists(DjangoViewClass vc |
         getViewArg() = vc.asViewResult() and
         result = vc.getARequestHandler()
       )
     }
+
+    override string getFramework() { result = "Django" }
   }
 
   /** A request handler defined in a django view class, that has no known route. */
   private class DjangoViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range,
     DjangoRouteHandler {
     DjangoViewClassHandlerWithoutKnownRoute() {
-      exists(DjangoViewClassDef vc | vc.getARequestHandler() = this) and
+      exists(DjangoViewClass vc | vc.getARequestHandler() = this) and
       not exists(DjangoRouteSetup setup | setup.getARequestHandler() = this)
     }
 
@@ -2105,6 +2177,8 @@ private module Django {
       result in [this.getArg(_), this.getArgByName(_)] and
       not result = any(int i | i <= this.getRequestParamIndex() | this.getArg(i))
     }
+
+    override string getFramework() { result = "Django" }
   }
 
   /**
@@ -2267,6 +2341,46 @@ private module Django {
     override string getSourceType() { result = "django.http.request.HttpRequest" }
   }
 
+  /**
+   * A read of the `request` attribute on a reference to an instance of a View class,
+   * which is the request being processed currently.
+   *
+   * See https://docs.djangoproject.com/en/3.1/topics/class-based-views/generic-display/#dynamic-filtering
+   */
+  private class DjangoViewClassRequestAttributeRead extends django::http::request::HttpRequest::InstanceSource,
+    RemoteFlowSource::Range, DataFlow::Node {
+    DjangoViewClassRequestAttributeRead() {
+      exists(DataFlow::AttrRead read | this = read |
+        read.getObject() = any(DjangoViewClass vc).getASelfRef() and
+        read.getAttributeName() = "request"
+      )
+    }
+
+    override string getSourceType() {
+      result = "django.http.request.HttpRequest (attribute on self in View class)"
+    }
+  }
+
+  /**
+   * A read of the `args` or `kwargs` attribute on a reference to an instance of a View class,
+   * which contains the routed parameters captured from the URL route.
+   *
+   * See https://docs.djangoproject.com/en/3.1/topics/class-based-views/generic-display/#dynamic-filtering
+   */
+  private class DjangoViewClassRoutedParamsAttributeRead extends RemoteFlowSource::Range,
+    DataFlow::Node {
+    DjangoViewClassRoutedParamsAttributeRead() {
+      exists(DataFlow::AttrRead read | this = read |
+        read.getObject() = any(DjangoViewClass vc).getASelfRef() and
+        read.getAttributeName() in ["args", "kwargs"]
+      )
+    }
+
+    override string getSourceType() {
+      result = "django routed param from attribute on self in View class"
+    }
+  }
+
   private class DjangoHttpRequstAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
     override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
       nodeFrom = django::http::request::HttpRequest::instance() and
diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index c49c012f6f0..8a69162525c 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -9,295 +9,98 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
 private import semmle.python.frameworks.Werkzeug
+private import semmle.python.ApiGraphs
 
 /**
  * Provides models for the `flask` PyPI package.
  * See https://flask.palletsprojects.com/en/1.1.x/.
  */
-private module FlaskModel {
-  // ---------------------------------------------------------------------------
-  // flask
-  // ---------------------------------------------------------------------------
-  /** Gets a reference to the `flask` module. */
-  private DataFlow::Node flask(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("flask")
-    or
-    exists(DataFlow::TypeTracker t2 | result = flask(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `flask` module. */
-  DataFlow::Node flask() { result = flask(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `flask` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node flask_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["request", "make_response", "Response", "views", "redirect"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("flask" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = flask()
-    )
-    or
-    // Due to bad performance when using normal setup with `flask_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        flask_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate flask_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(flask_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `flask` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node flask_attr(string attr_name) {
-    result = flask_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
-
-  /** Provides models for the `flask` module. */
-  module flask {
-    /** Gets a reference to the `flask.request` object. */
-    DataFlow::Node request() { result = flask_attr("request") }
-
-    /** Gets a reference to the `flask.make_response` function. */
-    DataFlow::Node make_response() { result = flask_attr("make_response") }
+module Flask {
+  /** Provides models for flask view classes (defined in the `flask.views` module) */
+  module Views {
+    /**
+     * Provides models for the `flask.views.View` class and subclasses.
+     *
+     * See https://flask.palletsprojects.com/en/1.1.x/views/#basic-principle.
+     */
+    module View {
+      /** Gets a reference to the `flask.views.View` class or any subclass. */
+      API::Node subclassRef() {
+        result =
+          API::moduleImport("flask")
+              .getMember("views")
+              .getMember([
+                  "View",
+                  // MethodView is a known subclass
+                  "MethodView"
+                ])
+              .getASubclass*()
+      }
+    }
 
     /**
-     * Provides models for the `flask.Flask` class
+     * Provides models for the `flask.views.MethodView` class and subclasses.
      *
-     * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.
+     * See https://flask.palletsprojects.com/en/1.1.x/views/#method-based-dispatching.
      */
-    module Flask {
-      /** Gets a reference to the `flask.Flask` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("flask.Flask")
-        or
-        t.startInAttr("Flask") and
-        result = flask()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `flask.Flask` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
-      /**
-       * A source of instances of `flask.Flask`, extend this class to model new instances.
-       *
-       * This can include instantiations of the class, return values from function
-       * calls, or a special parameter that will be set when functions are called by an external
-       * library.
-       *
-       * Use the predicate `Flask::instance()` to get references to instances of `flask.Flask`.
-       */
-      abstract class InstanceSource extends DataFlow::Node { }
-
-      /** A direct instantiation of `flask.Flask`. */
-      private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-        override CallNode node;
-
-        ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
-      }
-
-      /** Gets a reference to an instance of `flask.Flask` (a flask application). */
-      private DataFlow::Node instance(DataFlow::TypeTracker t) {
-        t.start() and
-        result instanceof InstanceSource
-        or
-        exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-      }
-
-      /** Gets a reference to an instance of `flask.Flask` (a flask application). */
-      DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of an instance of `flask.Flask` (a flask application).
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node instance_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["route", "add_url_rule", "make_response"] and
-        t.startInAttr(attr_name) and
-        result = flask::Flask::instance()
-        or
-        // Due to bad performance when using normal setup with `instance_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            instance_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate instance_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(instance_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of an instance of `flask.Flask` (a flask application).
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node instance_attr(string attr_name) {
-        result = instance_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
-      /** Gets a reference to the `route` method on an instance of `flask.Flask`. */
-      DataFlow::Node route() { result = instance_attr("route") }
-
-      /** Gets a reference to the `add_url_rule` method on an instance of `flask.Flask`. */
-      DataFlow::Node add_url_rule() { result = instance_attr("add_url_rule") }
-
-      /** Gets a reference to the `make_response` method on an instance of `flask.Flask`. */
-      // HACK: We can't call this predicate `make_response` since shadowing is
-      // completely disallowed in QL. I added an underscore to move things forward for
-      // now :(
-      DataFlow::Node make_response_() { result = instance_attr("make_response") }
-
-      /** Gets a reference to the `response_class` attribute on the `flask.Flask` class or an instance. */
-      private DataFlow::Node response_class(DataFlow::TypeTracker t) {
-        t.startInAttr("response_class") and
-        result in [classRef(), instance()]
-        or
-        exists(DataFlow::TypeTracker t2 | result = response_class(t2).track(t2, t))
-      }
-
-      /**
-       * Gets a reference to the `response_class` attribute on the `flask.Flask` class or an instance.
-       *
-       * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.response_class
-       */
-      DataFlow::Node response_class() { result = response_class(DataFlow::TypeTracker::end()) }
-    }
-
-    // -------------------------------------------------------------------------
-    // flask.views
-    // -------------------------------------------------------------------------
-    /** Gets a reference to the `flask.views` module. */
-    DataFlow::Node views() { result = flask_attr("views") }
-
-    /** Provides models for the `flask.views` module */
-    module views {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `flask.views` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node views_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["View", "MethodView"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("flask.views" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = views()
-        )
-        or
-        // Due to bad performance when using normal setup with `views_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            views_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate views_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(views_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `flask.views` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node views_attr(string attr_name) {
-        result = views_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
-      /**
-       * Provides models for the `flask.views.View` class and subclasses.
-       *
-       * See https://flask.palletsprojects.com/en/1.1.x/views/#basic-principle.
-       */
-      module View {
-        /** Gets a reference to the `flask.views.View` class or any subclass. */
-        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = views_attr(["View", "MethodView"])
-          or
-          // subclasses in project code
-          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `flask.views.View` class or any subclass. */
-        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
-      }
-
-      /**
-       * Provides models for the `flask.views.MethodView` class and subclasses.
-       *
-       * See https://flask.palletsprojects.com/en/1.1.x/views/#method-based-dispatching.
-       */
-      module MethodView {
-        /** Gets a reference to the `flask.views.View` class or any subclass. */
-        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = views_attr("MethodView")
-          or
-          // subclasses in project code
-          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `flask.views.View` class or any subclass. */
-        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+    module MethodView {
+      /** Gets a reference to the `flask.views.MethodView` class or any subclass. */
+      API::Node subclassRef() {
+        result =
+          API::moduleImport("flask").getMember("views").getMember("MethodView").getASubclass*()
       }
     }
   }
 
+  /**
+   * Provides models for flask applications (instances of the `flask.Flask` class).
+   *
+   * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.
+   */
+  module FlaskApp {
+    /** Gets a reference to the `flask.Flask` class. */
+    API::Node classRef() { result = API::moduleImport("flask").getMember("Flask") }
+
+    /** Gets a reference to an instance of `flask.Flask` (a flask application). */
+    API::Node instance() { result = classRef().getReturn() }
+  }
+
+  /**
+   * Provides models for flask blueprints (instances of the `flask.Blueprint` class).
+   *
+   * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Blueprint.
+   */
+  module Blueprint {
+    /** Gets a reference to the `flask.Blueprint` class. */
+    API::Node classRef() { result = API::moduleImport("flask").getMember("Blueprint") }
+
+    /** Gets a reference to an instance of `flask.Blueprint`. */
+    API::Node instance() { result = classRef().getReturn() }
+  }
+
+  /** Gets a reference to the `flask.request` object. */
+  API::Node request() { result = API::moduleImport("flask").getMember("request") }
+
   /**
    * Provides models for the `flask.Response` class
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Response.
    */
   module Response {
-    /** Gets a reference to the `flask.Response` class. */
-    private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-      t.start() and
-      result in [flask_attr("Response"), flask::Flask::response_class()]
+    /**
+     * Gets a reference to the `flask.Response` class, possibly through the
+     * `response_class` class attribute on a flask application (which by is an alias for
+     * `flask.Response` by default).
+     */
+    API::Node classRef() {
+      result = API::moduleImport("flask").getMember("Response")
       or
-      exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+      result = [FlaskApp::classRef(), FlaskApp::instance()].getMember("response_class")
     }
 
-    /** Gets a reference to the `flask.Response` class. */
-    DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
     /**
+     * INTERNAL: Do not use.
+     *
      * A source of instances of `flask.Response`, extend this class to model new instances.
      *
      * This can include instantiations of the class, return values from function
@@ -309,23 +112,21 @@ private module FlaskModel {
     abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node { }
 
     /** A direct instantiation of `flask.Response`. */
-    private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-      override CallNode node;
+    private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+      ClassInstantiation() { this = classRef().getACall() }
 
-      ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
-
-      override DataFlow::Node getBody() { result.asCfgNode() = node.getArg(0) }
+      override DataFlow::Node getBody() { result = this.getArg(0) }
 
       override string getMimetypeDefault() { result = "text/html" }
 
       /** Gets the argument passed to the `mimetype` parameter, if any. */
       private DataFlow::Node getMimetypeArg() {
-        result.asCfgNode() in [node.getArg(3), node.getArgByName("mimetype")]
+        result in [this.getArg(3), this.getArgByName("mimetype")]
       }
 
       /** Gets the argument passed to the `content_type` parameter, if any. */
       private DataFlow::Node getContentTypeArg() {
-        result.asCfgNode() in [node.getArg(4), node.getArgByName("content_type")]
+        result in [this.getArg(4), this.getArgByName("content_type")]
       }
 
       override DataFlow::Node getMimetypeOrContentTypeArg() {
@@ -337,8 +138,32 @@ private module FlaskModel {
       }
     }
 
+    /**
+     * A call to either `flask.make_response` function, or the `make_response` method on
+     * an instance of `flask.Flask`. This creates an instance of the `flask_response`
+     * class (class-attribute on a flask application), which by default is
+     * `flask.Response`.
+     *
+     * See
+     * - https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response
+     * - https://flask.palletsprojects.com/en/1.1.x/api/#flask.make_response
+     */
+    private class FlaskMakeResponseCall extends InstanceSource, DataFlow::CallCfgNode {
+      FlaskMakeResponseCall() {
+        this = API::moduleImport("flask").getMember("make_response").getACall()
+        or
+        this = FlaskApp::instance().getMember("make_response").getACall()
+      }
+
+      override DataFlow::Node getBody() { result = this.getArg(0) }
+
+      override string getMimetypeDefault() { result = "text/html" }
+
+      override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
+    }
+
     /** Gets a reference to an instance of `flask.Response`. */
-    private DataFlow::Node instance(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
       t.start() and
       result instanceof InstanceSource
       or
@@ -346,15 +171,23 @@ private module FlaskModel {
     }
 
     /** Gets a reference to an instance of `flask.Response`. */
-    DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+    DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
   }
 
   // ---------------------------------------------------------------------------
   // routing modeling
   // ---------------------------------------------------------------------------
-  /** A flask View class defined in project code. */
-  class FlaskViewClassDef extends Class {
-    FlaskViewClassDef() { this.getABase() = flask::views::View::subclassRef().asExpr() }
+  /**
+   * A class that is a subclass of the `flask.views.View` class,
+   * thereby being able to handle incoming HTTP requests.
+   */
+  class FlaskViewClass extends Class {
+    API::Node api_node;
+
+    FlaskViewClass() {
+      this.getABase() = Views::View::subclassRef().getAUse().asExpr() and
+      api_node.getAnImmediateUse().asExpr().(ClassExpr) = this.getParent()
+    }
 
     /** Gets a function that could handle incoming requests, if any. */
     Function getARequestHandler() {
@@ -364,42 +197,22 @@ private module FlaskModel {
       result.getName() = "dispatch_request"
     }
 
-    /** Gets a reference to this class. */
-    private DataFlow::Node getARef(DataFlow::TypeTracker t) {
-      t.start() and
-      result.asExpr().(ClassExpr) = this.getParent()
-      or
-      exists(DataFlow::TypeTracker t2 | result = this.getARef(t2).track(t2, t))
-    }
-
-    /** Gets a reference to this class. */
-    DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
-
-    /** Gets a reference to the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewRef(DataFlow::TypeTracker t) {
-      t.startInAttr("as_view") and
-      result = this.getARef()
-      or
-      exists(DataFlow::TypeTracker t2 | result = this.asViewRef(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `as_view` classmethod of this class. */
-    DataFlow::Node asViewRef() { result = this.asViewRef(DataFlow::TypeTracker::end()) }
-
-    /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewResult(DataFlow::TypeTracker t) {
-      t.start() and
-      result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
-      or
-      exists(DataFlow::TypeTracker t2 | result = asViewResult(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
+    /**
+     * INTERNAL: Do not use.
+     * Gets a reference to the result of calling the `as_view` classmethod of this class.
+     */
+    API::Node asViewResult() { result = api_node.getMember("as_view").getReturn() }
   }
 
-  class FlaskMethodViewClassDef extends FlaskViewClassDef {
-    FlaskMethodViewClassDef() { this.getABase() = flask::views::MethodView::subclassRef().asExpr() }
+  /**
+   * A class that is a subclass of the `flask.views.MethodView` class.
+   * thereby being able to handle incoming HTTP requests.
+   */
+  class FlaskMethodViewClass extends FlaskViewClass {
+    FlaskMethodViewClass() {
+      this.getABase() = Views::MethodView::subclassRef().getAUse().asExpr() and
+      api_node.getAnImmediateUse().asExpr().(ClassExpr) = this.getParent()
+    }
 
     override Function getARequestHandler() {
       result = super.getARequestHandler()
@@ -435,42 +248,46 @@ private module FlaskModel {
         )
       )
     }
+
+    override string getFramework() { result = "Flask" }
   }
 
   /**
-   * A call to the `route` method on an instance of `flask.Flask`.
+   * A call to the `route` method on an instance of `flask.Flask` or an instance of `flask.Blueprint`.
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.route
    */
-  private class FlaskAppRouteCall extends FlaskRouteSetup, DataFlow::CfgNode {
-    override CallNode node;
-
-    FlaskAppRouteCall() { node.getFunction() = flask::Flask::route().asCfgNode() }
+  private class FlaskAppRouteCall extends FlaskRouteSetup, DataFlow::CallCfgNode {
+    FlaskAppRouteCall() {
+      this = FlaskApp::instance().getMember("route").getACall()
+      or
+      this = Blueprint::instance().getMember("route").getACall()
+    }
 
     override DataFlow::Node getUrlPatternArg() {
-      result.asCfgNode() in [node.getArg(0), node.getArgByName("rule")]
+      result in [this.getArg(0), this.getArgByName("rule")]
     }
 
     override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
   }
 
   /**
-   * A call to the `add_url_rule` method on an instance of `flask.Flask`.
+   * A call to the `add_url_rule` method on an instance of `flask.Flask` or an instance of `flask.Blueprint`.
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.add_url_rule
    */
-  private class FlaskAppAddUrlRuleCall extends FlaskRouteSetup, DataFlow::CfgNode {
-    override CallNode node;
-
-    FlaskAppAddUrlRuleCall() { node.getFunction() = flask::Flask::add_url_rule().asCfgNode() }
+  private class FlaskAppAddUrlRuleCall extends FlaskRouteSetup, DataFlow::CallCfgNode {
+    FlaskAppAddUrlRuleCall() {
+      this = FlaskApp::instance().getMember("add_url_rule").getACall()
+      or
+      this = Blueprint::instance().getMember("add_url_rule").getACall()
+    }
 
     override DataFlow::Node getUrlPatternArg() {
-      result.asCfgNode() in [node.getArg(0), node.getArgByName("rule")]
+      result in [this.getArg(0), this.getArgByName("rule")]
     }
 
-    DataFlow::Node getViewArg() {
-      result.asCfgNode() in [node.getArg(2), node.getArgByName("view_func")]
-    }
+    DataFlow::Node getViewArg() { result in [this.getArg(2), this.getArgByName("view_func")] }
 
     override Function getARequestHandler() {
       exists(DataFlow::LocalSourceNode func_src |
@@ -478,8 +295,8 @@ private module FlaskModel {
         func_src.asExpr().(CallableExpr) = result.getDefinition()
       )
       or
-      exists(FlaskViewClassDef vc |
-        getViewArg() = vc.asViewResult() and
+      exists(FlaskViewClass vc |
+        getViewArg() = vc.asViewResult().getAUse() and
         result = vc.getARequestHandler()
       )
     }
@@ -488,7 +305,7 @@ private module FlaskModel {
   /** A request handler defined in a django view class, that has no known route. */
   private class FlaskViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
     FlaskViewClassHandlerWithoutKnownRoute() {
-      exists(FlaskViewClassDef vc | vc.getARequestHandler() = this) and
+      exists(FlaskViewClass vc | vc.getARequestHandler() = this) and
       not exists(FlaskRouteSetup setup | setup.getARequestHandler() = this)
     }
 
@@ -499,70 +316,52 @@ private module FlaskModel {
       result in [this.getArg(_), this.getArgByName(_)] and
       not result = this.getArg(0)
     }
+
+    override string getFramework() { result = "Flask" }
   }
 
   // ---------------------------------------------------------------------------
   // flask.Request taint modeling
   // ---------------------------------------------------------------------------
-  // TODO: Do we even need this class? :|
   /**
    * A source of remote flow from a flask request.
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Request
    */
-  private class RequestSource extends RemoteFlowSource::Range {
-    RequestSource() { this = flask::request() }
+  private class FlaskRequestSource extends RemoteFlowSource::Range {
+    FlaskRequestSource() {
+      this = request().getAUse() and
+      not any(Import imp).contains(this.asExpr()) and
+      not exists(ControlFlowNode def | this.asVar().getSourceVariable().hasDefiningNode(def) |
+        any(Import imp).contains(def.getNode())
+      )
+    }
 
     override string getSourceType() { result = "flask.request" }
   }
 
-  private module FlaskRequestTracking {
-    /** Gets a reference to the `get_data` attribute of a Flask request. */
-    private DataFlow::Node get_data(DataFlow::TypeTracker t) {
-      t.startInAttr("get_data") and
-      result = flask::request()
-      or
-      exists(DataFlow::TypeTracker t2 | result = get_data(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `get_data` attribute of a Flask request. */
-    DataFlow::Node get_data() { result = get_data(DataFlow::TypeTracker::end()) }
-
-    /** Gets a reference to the `get_json` attribute of a Flask request. */
-    private DataFlow::Node get_json(DataFlow::TypeTracker t) {
-      t.startInAttr("get_json") and
-      result = flask::request()
-      or
-      exists(DataFlow::TypeTracker t2 | result = get_json(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `get_json` attribute of a Flask request. */
-    DataFlow::Node get_json() { result = get_json(DataFlow::TypeTracker::end()) }
-
-    /** Gets a reference to either of the `get_json` or `get_data` attributes of a Flask request. */
-    DataFlow::Node tainted_methods(string attr_name) {
-      result = get_data() and
-      attr_name = "get_data"
-      or
-      result = get_json() and
-      attr_name = "get_json"
-    }
-  }
-
   /**
-   * A source of remote flow from attributes from a flask request.
+   * Taint propagation for a flask request.
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Request
    */
-  private class RequestInputAccess extends RemoteFlowSource::Range {
-    string attr_name;
-
-    RequestInputAccess() {
-      // attributes
-      exists(AttrNode attr |
-        this.asCfgNode() = attr and attr.getObject(attr_name) = flask::request().asCfgNode()
-      |
-        attr_name in [
+  private class FlaskRequestAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
+    override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+      // Methods
+      exists(string method_name | method_name in ["get_data", "get_json"] |
+        // Method access
+        nodeFrom = request().getAUse() and
+        nodeTo = request().getMember(method_name).getAnImmediateUse()
+        or
+        // Method call
+        nodeFrom = request().getMember(method_name).getAUse() and
+        nodeTo.(DataFlow::CallCfgNode).getFunction() = nodeFrom
+      )
+      or
+      // Attributes
+      nodeFrom = request().getAUse() and
+      exists(DataFlow::AttrRead read | nodeTo = read and read.getObject() = nodeFrom |
+        read.getAttributeName() in [
             // str
             "path", "full_path", "base_url", "url", "access_control_request_method",
             "content_encoding", "content_md5", "content_type", "data", "method", "mimetype",
@@ -598,63 +397,29 @@ private module FlaskModel {
             "headers"
           ]
       )
-      or
-      // methods (needs special handling to track bound-methods -- see `FlaskRequestMethodCallsAdditionalTaintStep` below)
-      this = FlaskRequestTracking::tainted_methods(attr_name)
-    }
-
-    override string getSourceType() { result = "flask.request input" }
-  }
-
-  private class FlaskRequestMethodCallsAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
-    override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-      // NOTE: `request -> request.tainted_method` part is handled as part of RequestInputAccess
-      // tainted_method -> tainted_method()
-      nodeFrom = FlaskRequestTracking::tainted_methods(_) and
-      nodeTo.asCfgNode().(CallNode).getFunction() = nodeFrom.asCfgNode()
     }
   }
 
-  private class RequestInputMultiDict extends RequestInputAccess,
-    Werkzeug::werkzeug::datastructures::MultiDict::InstanceSource {
-    RequestInputMultiDict() { attr_name in ["args", "values", "form", "files"] }
+  private class RequestAttrMultiDict extends Werkzeug::werkzeug::datastructures::MultiDict::InstanceSource {
+    string attr_name;
+
+    RequestAttrMultiDict() {
+      attr_name in ["args", "values", "form", "files"] and
+      this = request().getMember(attr_name).getAnImmediateUse()
+    }
   }
 
-  private class RequestInputFiles extends RequestInputMultiDict {
-    RequestInputFiles() { attr_name = "files" }
+  private class RequestAttrFiles extends RequestAttrMultiDict {
+    // TODO: Somehow specify that elements of `RequestAttrFiles` are
+    // Werkzeug::werkzeug::datastructures::FileStorage and should have those additional taint steps
+    // AND that the 0-indexed argument to its' save method is a sink for path-injection.
+    // https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage.save
+    RequestAttrFiles() { attr_name = "files" }
   }
 
-  // TODO: Somehow specify that elements of `RequestInputFiles` are
-  // Werkzeug::werkzeug::datastructures::FileStorage and should have those additional taint steps
-  // AND that the 0-indexed argument to its' save method is a sink for path-injection.
-  // https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage.save
   // ---------------------------------------------------------------------------
-  // Response modeling
+  // Implicit response from returns of flask request handlers
   // ---------------------------------------------------------------------------
-  /**
-   * A call to either `flask.make_response` function, or the `make_response` method on
-   * an instance of `flask.Flask`.
-   *
-   * See
-   * - https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response
-   * - https://flask.palletsprojects.com/en/1.1.x/api/#flask.make_response
-   */
-  private class FlaskMakeResponseCall extends HTTP::Server::HttpResponse::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    FlaskMakeResponseCall() {
-      node.getFunction() = flask::make_response().asCfgNode()
-      or
-      node.getFunction() = flask::Flask::make_response_().asCfgNode()
-    }
-
-    override DataFlow::Node getBody() { result.asCfgNode() = node.getArg(0) }
-
-    override string getMimetypeDefault() { result = "text/html" }
-
-    override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
-  }
-
   private class FlaskRouteHandlerReturn extends HTTP::Server::HttpResponse::Range, DataFlow::CfgNode {
     FlaskRouteHandlerReturn() {
       exists(Function routeHandler |
@@ -670,19 +435,20 @@ private module FlaskModel {
     override string getMimetypeDefault() { result = "text/html" }
   }
 
+  // ---------------------------------------------------------------------------
+  // flask.redirect
+  // ---------------------------------------------------------------------------
   /**
    * A call to the `flask.redirect` function.
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.redirect
    */
   private class FlaskRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
-    FlaskRedirectCall() { node.getFunction() = flask_attr("redirect").asCfgNode() }
+    DataFlow::CallCfgNode {
+    FlaskRedirectCall() { this = API::moduleImport("flask").getMember("redirect").getACall() }
 
     override DataFlow::Node getRedirectLocation() {
-      result.asCfgNode() in [node.getArg(0), node.getArgByName("location")]
+      result in [this.getArg(0), this.getArgByName("location")]
     }
 
     override DataFlow::Node getBody() { none() }
diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 9b969cba99a..d6f417f99c3 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -1630,6 +1630,8 @@ private module Stdlib {
       }
 
       override Parameter getARoutedParameter() { none() }
+
+      override string getFramework() { result = "Stdlib" }
     }
   }
 
diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 4351188d8bb..a43edcaca90 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -486,7 +486,9 @@ private module Tornado {
   }
 
   /** A tornado route setup. */
-  abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range { }
+  abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range {
+    override string getFramework() { result = "Tornado" }
+  }
 
   /**
    * A regex that is used to set up a route.
@@ -561,6 +563,8 @@ private module Tornado {
       result in [this.getArg(_), this.getArgByName(_)] and
       not result = this.getArg(0)
     }
+
+    override string getFramework() { result = "Tornado" }
   }
 
   // ---------------------------------------------------------------------------
diff --git a/python/ql/src/semmle/python/frameworks/Yaml.qll b/python/ql/src/semmle/python/frameworks/Yaml.qll
index 2a41acf8d0e..7e9d7f100e9 100644
--- a/python/ql/src/semmle/python/frameworks/Yaml.qll
+++ b/python/ql/src/semmle/python/frameworks/Yaml.qll
@@ -29,7 +29,13 @@ private module Yaml {
      * For example, using `attr_name = "load"` will get all uses of `yaml.load`.
      */
     private DataFlow::Node yaml_attr(DataFlow::TypeTracker t, string attr_name) {
-      attr_name in ["load", "SafeLoader", "BaseLoader"] and
+      attr_name in [
+          // functions
+          "load", "load_all", "full_load", "full_load_all", "unsafe_load", "unsafe_load_all",
+          "safe_load", "safe_load_all",
+          // Classes
+          "SafeLoader", "BaseLoader"
+        ] and
       (
         t.start() and
         result = DataFlow::importNode("yaml." + attr_name)
@@ -68,13 +74,22 @@ private module Yaml {
 }
 
 /**
- * A call to `yaml.load`
+ * A call to any of the loading functions in `yaml` (`load`, `load_all`, `full_load`,
+ * `full_load_all`, `unsafe_load`, `unsafe_load_all`, `safe_load`, `safe_load_all`)
+ *
  * See https://pyyaml.org/wiki/PyYAMLDocumentation (you will have to scroll down).
  */
 private class YamlLoadCall extends Decoding::Range, DataFlow::CfgNode {
   override CallNode node;
+  string func_name;
 
-  YamlLoadCall() { node.getFunction() = Yaml::yaml::yaml_attr("load").asCfgNode() }
+  YamlLoadCall() {
+    func_name in [
+        "load", "load_all", "full_load", "full_load_all", "unsafe_load", "unsafe_load_all",
+        "safe_load", "safe_load_all"
+      ] and
+    node.getFunction() = Yaml::yaml::yaml_attr(func_name).asCfgNode()
+  }
 
   /**
    * This function was thought safe from the 5.1 release in 2017, when the default loader was changed to `FullLoader`.
@@ -84,10 +99,16 @@ private class YamlLoadCall extends Decoding::Range, DataFlow::CfgNode {
    * See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation for more details.
    */
   override predicate mayExecuteInput() {
+    func_name in ["full_load", "full_load_all", "unsafe_load", "unsafe_load_all"]
+    or
+    func_name in ["load", "load_all"] and
     // If the `Loader` is not set to either `SafeLoader` or `BaseLoader` or not set at all,
     // then the default loader will be used, which is not safe.
-    not node.getArgByName("Loader") =
-      Yaml::yaml::yaml_attr(["SafeLoader", "BaseLoader"]).asCfgNode()
+    not exists(DataFlow::Node loader_arg |
+      loader_arg.asCfgNode() in [node.getArg(1), node.getArgByName("Loader")]
+    |
+      loader_arg = Yaml::yaml::yaml_attr(["SafeLoader", "BaseLoader"])
+    )
   }
 
   override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
diff --git a/python/ql/test/experimental/dataflow/ApiGraphs/test.py b/python/ql/test/experimental/dataflow/ApiGraphs/test.py
index b250c7985e2..179f0f522df 100644
--- a/python/ql/test/experimental/dataflow/ApiGraphs/test.py
+++ b/python/ql/test/experimental/dataflow/ApiGraphs/test.py
@@ -79,3 +79,24 @@ def f():
 from unknown import * #$ use=moduleImport("unknown")
 
 hello() #$ MISSING: use=moduleImport("unknown").getMember("hello").getReturn()
+
+
+# Subclasses
+
+from flask.views import View #$ use=moduleImport("flask").getMember("views").getMember("View")
+
+class MyView(View): #$ use=moduleImport("flask").getMember("views").getMember("View").getASubclass()
+    myvar = 45 #$ use=moduleImport("flask").getMember("views").getMember("View").getASubclass().getMember("myvar")
+    def my_method(self): #$ use=moduleImport("flask").getMember("views").getMember("View").getASubclass().getMember("my_method")
+        pass
+
+instance = MyView() #$ use=moduleImport("flask").getMember("views").getMember("View").getASubclass().getReturn()
+
+def internal():
+    from pflask.views import View #$ use=moduleImport("pflask").getMember("views").getMember("View")
+    class IntMyView(View): #$ use=moduleImport("pflask").getMember("views").getMember("View").getASubclass()
+        my_internal_var = 35 #$ use=moduleImport("pflask").getMember("views").getMember("View").getASubclass().getMember("my_internal_var")
+        def my_internal_method(self): #$ use=moduleImport("pflask").getMember("views").getMember("View").getASubclass().getMember("my_internal_method")
+            pass
+
+    int_instance = IntMyView() #$ use=moduleImport("pflask").getMember("views").getMember("View").getASubclass().getReturn()
diff --git a/python/ql/test/experimental/dataflow/coverage/dataflow.expected b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
index ff3d518d1bc..a98fc0b5e2a 100644
--- a/python/ql/test/experimental/dataflow/coverage/dataflow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
@@ -336,7 +336,17 @@ edges
 | test.py:673:9:673:14 | ControlFlowNode for Tuple [Tuple element at index 0] | test.py:673:9:673:9 | SSA variable x |
 | test.py:673:9:673:14 | IterableSequence [Tuple element at index 0] | test.py:673:9:673:14 | ControlFlowNode for Tuple [Tuple element at index 0] |
 | test.py:673:19:673:20 | ControlFlowNode for tl [List element, Tuple element at index 0] | test.py:673:9:673:14 | IterableSequence [Tuple element at index 0] |
-| test.py:748:16:748:21 | ControlFlowNode for SOURCE | test.py:751:10:751:36 | ControlFlowNode for return_from_inner_scope() |
+| test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 0] | test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 0] |
+| test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 1] | test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 1] |
+| test.py:679:7:679:9 | SSA variable arg | test.py:680:10:680:12 | ControlFlowNode for arg |
+| test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 0] | test.py:679:7:679:9 | SSA variable arg |
+| test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 1] | test.py:679:7:679:9 | SSA variable arg |
+| test.py:685:7:685:12 | ControlFlowNode for SOURCE | test.py:686:51:686:51 | ControlFlowNode for s |
+| test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 0] | test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 0] |
+| test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 1] | test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 1] |
+| test.py:686:43:686:48 | ControlFlowNode for SOURCE | test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 0] |
+| test.py:686:51:686:51 | ControlFlowNode for s | test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 1] |
+| test.py:757:16:757:21 | ControlFlowNode for SOURCE | test.py:760:10:760:36 | ControlFlowNode for return_from_inner_scope() |
 nodes
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | semmle.label | ControlFlowNode for f() |
 | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
@@ -735,8 +745,19 @@ nodes
 | test.py:673:9:673:14 | IterableSequence [Tuple element at index 0] | semmle.label | IterableSequence [Tuple element at index 0] |
 | test.py:673:19:673:20 | ControlFlowNode for tl [List element, Tuple element at index 0] | semmle.label | ControlFlowNode for tl [List element, Tuple element at index 0] |
 | test.py:674:14:674:14 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
-| test.py:748:16:748:21 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:751:10:751:36 | ControlFlowNode for return_from_inner_scope() | semmle.label | ControlFlowNode for return_from_inner_scope() |
+| test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 0] | semmle.label | ControlFlowNode for args [Tuple element at index 0] |
+| test.py:678:39:678:42 | ControlFlowNode for args [Tuple element at index 1] | semmle.label | ControlFlowNode for args [Tuple element at index 1] |
+| test.py:679:7:679:9 | SSA variable arg | semmle.label | SSA variable arg |
+| test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 0] | semmle.label | ControlFlowNode for args [Tuple element at index 0] |
+| test.py:679:14:679:17 | ControlFlowNode for args [Tuple element at index 1] | semmle.label | ControlFlowNode for args [Tuple element at index 1] |
+| test.py:680:10:680:12 | ControlFlowNode for arg | semmle.label | ControlFlowNode for arg |
+| test.py:685:7:685:12 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 0] | semmle.label | PosOverflowNode for iterate_star_args() [Tuple element at index 0] |
+| test.py:686:3:686:52 | PosOverflowNode for iterate_star_args() [Tuple element at index 1] | semmle.label | PosOverflowNode for iterate_star_args() [Tuple element at index 1] |
+| test.py:686:43:686:48 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:686:51:686:51 | ControlFlowNode for s | semmle.label | ControlFlowNode for s |
+| test.py:757:16:757:21 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:760:10:760:36 | ControlFlowNode for return_from_inner_scope() | semmle.label | ControlFlowNode for return_from_inner_scope() |
 #select
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:38:6:38:17 | ControlFlowNode for f() | Flow found |
 | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | Flow found |
@@ -841,4 +862,6 @@ nodes
 | test.py:667:16:667:16 | ControlFlowNode for y | test.py:663:33:663:38 | ControlFlowNode for SOURCE | test.py:667:16:667:16 | ControlFlowNode for y | Flow found |
 | test.py:674:14:674:14 | ControlFlowNode for x | test.py:672:12:672:17 | ControlFlowNode for SOURCE | test.py:674:14:674:14 | ControlFlowNode for x | Flow found |
 | test.py:674:14:674:14 | ControlFlowNode for x | test.py:672:33:672:38 | ControlFlowNode for SOURCE | test.py:674:14:674:14 | ControlFlowNode for x | Flow found |
-| test.py:751:10:751:36 | ControlFlowNode for return_from_inner_scope() | test.py:748:16:748:21 | ControlFlowNode for SOURCE | test.py:751:10:751:36 | ControlFlowNode for return_from_inner_scope() | Flow found |
+| test.py:680:10:680:12 | ControlFlowNode for arg | test.py:685:7:685:12 | ControlFlowNode for SOURCE | test.py:680:10:680:12 | ControlFlowNode for arg | Flow found |
+| test.py:680:10:680:12 | ControlFlowNode for arg | test.py:686:43:686:48 | ControlFlowNode for SOURCE | test.py:680:10:680:12 | ControlFlowNode for arg | Flow found |
+| test.py:760:10:760:36 | ControlFlowNode for return_from_inner_scope() | test.py:757:16:757:21 | ControlFlowNode for SOURCE | test.py:760:10:760:36 | ControlFlowNode for return_from_inner_scope() | Flow found |
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index 2fdf9a9984d..c7d5f063eb9 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -675,6 +675,15 @@ def test_iterable_star_unpacking_in_for_2():
         SINK_F(y)  # The list itself is not tainted (and is here empty)
         SINK_F(z)
 
+def iterate_star_args(first, second, *args):
+  for arg in args:
+    SINK(arg) #$ flow="SOURCE, l:+5 -> arg" flow="SOURCE, l:+6 -> arg"
+
+# FP reported here: https://github.com/github/codeql-python-team/issues/49
+@expects(2)
+def test_overflow_iteration():
+  s = SOURCE
+  iterate_star_args(NONSOURCE, NONSOURCE, SOURCE, s)
 
 def test_deep_callgraph():
     # port of python/ql/test/library-tests/taint/general/deep.py
@@ -781,3 +790,9 @@ def test_reverse_read_subscript_cls():
     l = [withA]
     l[0].setA(SOURCE)
     SINK(withA.a) #$ MISSING:flow="SOURCE, l:-1 -> self.a"
+
+@expects(3)
+def test_with_default_param_value(x=SOURCE, /, y=SOURCE, *, z=SOURCE):
+    SINK(x) #$ MISSING:flow="SOURCE, l:-1 -> x"
+    SINK(y) #$ MISSING:flow="SOURCE, l:-2 -> y"
+    SINK(z) #$ MISSING:flow="SOURCE, l:-3 -> z"
diff --git a/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected b/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
index adfc8c5a379..82aa6e99c3c 100644
--- a/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
+++ b/python/ql/test/experimental/dataflow/typetracking/moduleattr.expected
@@ -1,7 +1,6 @@
 module_tracker
 | import_as_attr.py:1:6:1:11 | ControlFlowNode for ImportExpr |
 module_attr_tracker
-| import_as_attr.py:0:0:0:0 | ModuleVariableNode for Global Variable attr_ref in Module import_as_attr |
 | import_as_attr.py:1:20:1:35 | ControlFlowNode for ImportMember |
 | import_as_attr.py:1:28:1:35 | GSSA Variable attr_ref |
 | import_as_attr.py:3:1:3:1 | GSSA Variable x |
diff --git a/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql b/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
index 1d3430493ab..b546dc7491d 100644
--- a/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
@@ -2,16 +2,18 @@ import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TypeTracker
 
-DataFlow::Node module_tracker(TypeTracker t) {
+DataFlow::LocalSourceNode module_tracker(TypeTracker t) {
   t.start() and
   result = DataFlow::importNode("module")
   or
   exists(TypeTracker t2 | result = module_tracker(t2).track(t2, t))
 }
 
-query DataFlow::Node module_tracker() { result = module_tracker(DataFlow::TypeTracker::end()) }
+query DataFlow::Node module_tracker() {
+  module_tracker(DataFlow::TypeTracker::end()).flowsTo(result)
+}
 
-DataFlow::Node module_attr_tracker(TypeTracker t) {
+DataFlow::LocalSourceNode module_attr_tracker(TypeTracker t) {
   t.startInAttr("attr") and
   result = module_tracker()
   or
@@ -19,5 +21,5 @@ DataFlow::Node module_attr_tracker(TypeTracker t) {
 }
 
 query DataFlow::Node module_attr_tracker() {
-  result = module_attr_tracker(DataFlow::TypeTracker::end())
+  module_attr_tracker(DataFlow::TypeTracker::end()).flowsTo(result)
 }
diff --git a/python/ql/test/experimental/dataflow/typetracking/test.py b/python/ql/test/experimental/dataflow/typetracking/test.py
index a4dd1baeac1..4392e3bbf46 100644
--- a/python/ql/test/experimental/dataflow/typetracking/test.py
+++ b/python/ql/test/experimental/dataflow/typetracking/test.py
@@ -56,6 +56,41 @@ def test_import():
     y # $tracked
     mymodule.z # $tracked
 
+
+def to_inner_scope():
+    x = tracked # $tracked
+    def foo():
+        y = x # $ MISSING: tracked
+        return y # $ MISSING: tracked
+    also_x = foo() # $ MISSING: tracked
+    print(also_x) # $ MISSING: tracked
+
+
+def my_decorator(func):
+    # This part doesn't make any sense in a normal decorator, but just shows how we
+    # handle type-tracking
+
+    func() # $tracked
+
+    def wrapper():
+        print("before function call")
+        val = func() # $ MISSING: tracked
+        print("after function call")
+        return val # $ MISSING: tracked
+    return wrapper
+
+@my_decorator
+def get_tracked2():
+    return tracked # $tracked
+
+@my_decorator
+def unrelated_func():
+    return "foo"
+
+def use_funcs_with_decorators():
+    x = get_tracked2() # $ MISSING: tracked
+    y = unrelated_func()
+
 # ------------------------------------------------------------------------------
 
 def expects_int(x): # $int
diff --git a/python/ql/test/experimental/dataflow/typetracking/tracked.ql b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
index 0797e484c97..91ffe7e47c1 100644
--- a/python/ql/test/experimental/dataflow/typetracking/tracked.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
@@ -6,7 +6,7 @@ import TestUtilities.InlineExpectationsTest
 // -----------------------------------------------------------------------------
 // tracked
 // -----------------------------------------------------------------------------
-DataFlow::Node tracked(TypeTracker t) {
+DataFlow::LocalSourceNode tracked(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(NameNode n | n.getId() = "tracked")
   or
@@ -20,7 +20,7 @@ class TrackedTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(DataFlow::Node e, TypeTracker t |
-      e = tracked(t) and
+      tracked(t).flowsTo(e) and
       // Module variables have no sensible location, and hence can't be annotated.
       not e instanceof DataFlow::ModuleVariableNode and
       tag = "tracked" and
@@ -34,14 +34,14 @@ class TrackedTest extends InlineExpectationsTest {
 // -----------------------------------------------------------------------------
 // int + str
 // -----------------------------------------------------------------------------
-DataFlow::Node int_type(TypeTracker t) {
+DataFlow::LocalSourceNode int_type(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(CallNode c | c.getFunction().(NameNode).getId() = "int")
   or
   exists(TypeTracker t2 | result = int_type(t2).track(t2, t))
 }
 
-DataFlow::Node string_type(TypeTracker t) {
+DataFlow::LocalSourceNode string_type(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(CallNode c | c.getFunction().(NameNode).getId() = "str")
   or
@@ -55,7 +55,7 @@ class TrackedIntTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(DataFlow::Node e, TypeTracker t |
-      e = int_type(t) and
+      int_type(t).flowsTo(e) and
       tag = "int" and
       location = e.getLocation() and
       value = t.getAttr() and
@@ -71,7 +71,7 @@ class TrackedStringTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(DataFlow::Node e, TypeTracker t |
-      e = string_type(t) and
+      string_type(t).flowsTo(e) and
       tag = "str" and
       location = e.getLocation() and
       value = t.getAttr() and
@@ -83,7 +83,7 @@ class TrackedStringTest extends InlineExpectationsTest {
 // -----------------------------------------------------------------------------
 // tracked_self
 // -----------------------------------------------------------------------------
-DataFlow::Node tracked_self(TypeTracker t) {
+DataFlow::LocalSourceNode tracked_self(TypeTracker t) {
   t.start() and
   exists(Function f |
     f.isMethod() and
@@ -101,7 +101,7 @@ class TrackedSelfTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(DataFlow::Node e, TypeTracker t |
-      e = tracked_self(t) and
+      tracked_self(t).flowsTo(e) and
       // Module variables have no sensible location, and hence can't be annotated.
       not e instanceof DataFlow::ModuleVariableNode and
       tag = "tracked_self" and
@@ -117,7 +117,7 @@ class TrackedSelfTest extends InlineExpectationsTest {
 // -----------------------------------------------------------------------------
 // This modeling follows the same pattern that we currently use in our real library modeling.
 /** Gets a reference to `foo` (fictive module). */
-private DataFlow::Node foo(DataFlow::TypeTracker t) {
+private DataFlow::LocalSourceNode foo(DataFlow::TypeTracker t) {
   t.start() and
   result = DataFlow::importNode("foo")
   or
@@ -125,10 +125,10 @@ private DataFlow::Node foo(DataFlow::TypeTracker t) {
 }
 
 /** Gets a reference to `foo` (fictive module). */
-DataFlow::Node foo() { result = foo(DataFlow::TypeTracker::end()) }
+DataFlow::Node foo() { foo(DataFlow::TypeTracker::end()).flowsTo(result) }
 
 /** Gets a reference to `foo.bar` (fictive module). */
-private DataFlow::Node foo_bar(DataFlow::TypeTracker t) {
+private DataFlow::LocalSourceNode foo_bar(DataFlow::TypeTracker t) {
   t.start() and
   result = DataFlow::importNode("foo.bar")
   or
@@ -139,10 +139,10 @@ private DataFlow::Node foo_bar(DataFlow::TypeTracker t) {
 }
 
 /** Gets a reference to `foo.bar` (fictive module). */
-DataFlow::Node foo_bar() { result = foo_bar(DataFlow::TypeTracker::end()) }
+DataFlow::Node foo_bar() { foo_bar(DataFlow::TypeTracker::end()).flowsTo(result) }
 
 /** Gets a reference to `foo.bar.baz` (fictive attribute on `foo.bar` module). */
-private DataFlow::Node foo_bar_baz(DataFlow::TypeTracker t) {
+private DataFlow::LocalSourceNode foo_bar_baz(DataFlow::TypeTracker t) {
   t.start() and
   result = DataFlow::importNode("foo.bar.baz")
   or
@@ -153,7 +153,7 @@ private DataFlow::Node foo_bar_baz(DataFlow::TypeTracker t) {
 }
 
 /** Gets a reference to `foo.bar.baz` (fictive attribute on `foo.bar` module). */
-DataFlow::Node foo_bar_baz() { result = foo_bar_baz(DataFlow::TypeTracker::end()) }
+DataFlow::Node foo_bar_baz() { foo_bar_baz(DataFlow::TypeTracker::end()).flowsTo(result) }
 
 class TrackedFooBarBaz extends InlineExpectationsTest {
   TrackedFooBarBaz() { this = "TrackedFooBarBaz" }
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected
index 97037cb1079..c76685c6739 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected
@@ -1,82 +1,88 @@
-| taint_test.py:7 | ok   | test_taint | bar |
-| taint_test.py:7 | ok   | test_taint | foo |
-| taint_test.py:8 | ok   | test_taint | baz |
-| taint_test.py:14 | ok   | test_taint | request |
-| taint_test.py:16 | ok   | test_taint | request.body |
-| taint_test.py:17 | ok   | test_taint | request.path |
-| taint_test.py:18 | ok   | test_taint | request.path_info |
-| taint_test.py:22 | ok   | test_taint | request.method |
-| taint_test.py:24 | ok   | test_taint | request.encoding |
-| taint_test.py:25 | ok   | test_taint | request.content_type |
-| taint_test.py:28 | ok   | test_taint | request.content_params |
-| taint_test.py:29 | ok   | test_taint | request.content_params["key"] |
-| taint_test.py:30 | ok   | test_taint | request.content_params.get(..) |
-| taint_test.py:34 | ok   | test_taint | request.GET |
-| taint_test.py:35 | ok   | test_taint | request.GET["key"] |
-| taint_test.py:36 | ok   | test_taint | request.GET.get(..) |
-| taint_test.py:37 | fail | test_taint | request.GET.getlist(..) |
-| taint_test.py:38 | fail | test_taint | request.GET.getlist(..)[0] |
-| taint_test.py:39 | ok   | test_taint | request.GET.pop(..) |
-| taint_test.py:40 | ok   | test_taint | request.GET.pop(..)[0] |
-| taint_test.py:41 | ok   | test_taint | request.GET.popitem()[0] |
-| taint_test.py:42 | ok   | test_taint | request.GET.popitem()[1] |
-| taint_test.py:43 | ok   | test_taint | request.GET.popitem()[1][0] |
-| taint_test.py:44 | fail | test_taint | request.GET.dict() |
-| taint_test.py:45 | fail | test_taint | request.GET.dict()["key"] |
-| taint_test.py:46 | fail | test_taint | request.GET.urlencode() |
-| taint_test.py:49 | ok   | test_taint | request.POST |
-| taint_test.py:52 | ok   | test_taint | request.COOKIES |
-| taint_test.py:53 | ok   | test_taint | request.COOKIES["key"] |
-| taint_test.py:54 | ok   | test_taint | request.COOKIES.get(..) |
-| taint_test.py:57 | ok   | test_taint | request.FILES |
-| taint_test.py:58 | ok   | test_taint | request.FILES["key"] |
-| taint_test.py:59 | fail | test_taint | request.FILES["key"].content_type |
-| taint_test.py:60 | fail | test_taint | request.FILES["key"].content_type_extra |
-| taint_test.py:61 | fail | test_taint | request.FILES["key"].content_type_extra["key"] |
-| taint_test.py:62 | fail | test_taint | request.FILES["key"].charset |
-| taint_test.py:63 | fail | test_taint | request.FILES["key"].name |
-| taint_test.py:64 | fail | test_taint | request.FILES["key"].file |
-| taint_test.py:65 | fail | test_taint | request.FILES["key"].file.read() |
-| taint_test.py:67 | ok   | test_taint | request.FILES.get(..) |
-| taint_test.py:68 | fail | test_taint | request.FILES.get(..).name |
-| taint_test.py:69 | fail | test_taint | request.FILES.getlist(..) |
-| taint_test.py:70 | fail | test_taint | request.FILES.getlist(..)[0] |
-| taint_test.py:71 | fail | test_taint | request.FILES.getlist(..)[0].name |
-| taint_test.py:72 | fail | test_taint | request.FILES.dict() |
-| taint_test.py:73 | fail | test_taint | request.FILES.dict()["key"] |
-| taint_test.py:74 | fail | test_taint | request.FILES.dict()["key"].name |
-| taint_test.py:77 | ok   | test_taint | request.META |
-| taint_test.py:78 | ok   | test_taint | request.META["HTTP_USER_AGENT"] |
-| taint_test.py:79 | ok   | test_taint | request.META.get(..) |
-| taint_test.py:82 | ok   | test_taint | request.headers |
-| taint_test.py:83 | ok   | test_taint | request.headers["user-agent"] |
-| taint_test.py:84 | ok   | test_taint | request.headers["USER_AGENT"] |
-| taint_test.py:87 | ok   | test_taint | request.resolver_match |
-| taint_test.py:88 | fail | test_taint | request.resolver_match.args |
-| taint_test.py:89 | fail | test_taint | request.resolver_match.args[0] |
-| taint_test.py:90 | fail | test_taint | request.resolver_match.kwargs |
-| taint_test.py:91 | fail | test_taint | request.resolver_match.kwargs["key"] |
-| taint_test.py:93 | fail | test_taint | request.get_full_path() |
-| taint_test.py:94 | fail | test_taint | request.get_full_path_info() |
-| taint_test.py:98 | fail | test_taint | request.read() |
-| taint_test.py:99 | fail | test_taint | request.readline() |
-| taint_test.py:100 | fail | test_taint | request.readlines() |
-| taint_test.py:101 | fail | test_taint | request.readlines()[0] |
-| taint_test.py:102 | fail | test_taint | ListComp |
-| taint_test.py:108 | ok   | test_taint | args |
-| taint_test.py:109 | ok   | test_taint | args[0] |
-| taint_test.py:110 | ok   | test_taint | kwargs |
-| taint_test.py:111 | ok   | test_taint | kwargs["key"] |
-| taint_test.py:115 | ok   | test_taint | request.current_app |
-| taint_test.py:120 | ok   | test_taint | request.get_host() |
-| taint_test.py:121 | ok   | test_taint | request.get_port() |
-| taint_test.py:128 | fail | test_taint | request.build_absolute_uri() |
-| taint_test.py:129 | fail | test_taint | request.build_absolute_uri(..) |
+| taint_test.py:8 | ok   | test_taint | bar |
+| taint_test.py:8 | ok   | test_taint | foo |
+| taint_test.py:9 | ok   | test_taint | baz |
+| taint_test.py:15 | ok   | test_taint | request |
+| taint_test.py:17 | ok   | test_taint | request.body |
+| taint_test.py:18 | ok   | test_taint | request.path |
+| taint_test.py:19 | ok   | test_taint | request.path_info |
+| taint_test.py:23 | ok   | test_taint | request.method |
+| taint_test.py:25 | ok   | test_taint | request.encoding |
+| taint_test.py:26 | ok   | test_taint | request.content_type |
+| taint_test.py:29 | ok   | test_taint | request.content_params |
+| taint_test.py:30 | ok   | test_taint | request.content_params["key"] |
+| taint_test.py:31 | ok   | test_taint | request.content_params.get(..) |
+| taint_test.py:35 | ok   | test_taint | request.GET |
+| taint_test.py:36 | ok   | test_taint | request.GET["key"] |
+| taint_test.py:37 | ok   | test_taint | request.GET.get(..) |
+| taint_test.py:38 | fail | test_taint | request.GET.getlist(..) |
+| taint_test.py:39 | fail | test_taint | request.GET.getlist(..)[0] |
+| taint_test.py:40 | ok   | test_taint | request.GET.pop(..) |
+| taint_test.py:41 | ok   | test_taint | request.GET.pop(..)[0] |
+| taint_test.py:42 | ok   | test_taint | request.GET.popitem()[0] |
+| taint_test.py:43 | ok   | test_taint | request.GET.popitem()[1] |
+| taint_test.py:44 | ok   | test_taint | request.GET.popitem()[1][0] |
+| taint_test.py:45 | fail | test_taint | request.GET.dict() |
+| taint_test.py:46 | fail | test_taint | request.GET.dict()["key"] |
+| taint_test.py:47 | fail | test_taint | request.GET.urlencode() |
+| taint_test.py:50 | ok   | test_taint | request.POST |
+| taint_test.py:53 | ok   | test_taint | request.COOKIES |
+| taint_test.py:54 | ok   | test_taint | request.COOKIES["key"] |
+| taint_test.py:55 | ok   | test_taint | request.COOKIES.get(..) |
+| taint_test.py:58 | ok   | test_taint | request.FILES |
+| taint_test.py:59 | ok   | test_taint | request.FILES["key"] |
+| taint_test.py:60 | fail | test_taint | request.FILES["key"].content_type |
+| taint_test.py:61 | fail | test_taint | request.FILES["key"].content_type_extra |
+| taint_test.py:62 | fail | test_taint | request.FILES["key"].content_type_extra["key"] |
+| taint_test.py:63 | fail | test_taint | request.FILES["key"].charset |
+| taint_test.py:64 | fail | test_taint | request.FILES["key"].name |
+| taint_test.py:65 | fail | test_taint | request.FILES["key"].file |
+| taint_test.py:66 | fail | test_taint | request.FILES["key"].file.read() |
+| taint_test.py:68 | ok   | test_taint | request.FILES.get(..) |
+| taint_test.py:69 | fail | test_taint | request.FILES.get(..).name |
+| taint_test.py:70 | fail | test_taint | request.FILES.getlist(..) |
+| taint_test.py:71 | fail | test_taint | request.FILES.getlist(..)[0] |
+| taint_test.py:72 | fail | test_taint | request.FILES.getlist(..)[0].name |
+| taint_test.py:73 | fail | test_taint | request.FILES.dict() |
+| taint_test.py:74 | fail | test_taint | request.FILES.dict()["key"] |
+| taint_test.py:75 | fail | test_taint | request.FILES.dict()["key"].name |
+| taint_test.py:78 | ok   | test_taint | request.META |
+| taint_test.py:79 | ok   | test_taint | request.META["HTTP_USER_AGENT"] |
+| taint_test.py:80 | ok   | test_taint | request.META.get(..) |
+| taint_test.py:83 | ok   | test_taint | request.headers |
+| taint_test.py:84 | ok   | test_taint | request.headers["user-agent"] |
+| taint_test.py:85 | ok   | test_taint | request.headers["USER_AGENT"] |
+| taint_test.py:88 | ok   | test_taint | request.resolver_match |
+| taint_test.py:89 | fail | test_taint | request.resolver_match.args |
+| taint_test.py:90 | fail | test_taint | request.resolver_match.args[0] |
+| taint_test.py:91 | fail | test_taint | request.resolver_match.kwargs |
+| taint_test.py:92 | fail | test_taint | request.resolver_match.kwargs["key"] |
+| taint_test.py:94 | fail | test_taint | request.get_full_path() |
+| taint_test.py:95 | fail | test_taint | request.get_full_path_info() |
+| taint_test.py:99 | fail | test_taint | request.read() |
+| taint_test.py:100 | fail | test_taint | request.readline() |
+| taint_test.py:101 | fail | test_taint | request.readlines() |
+| taint_test.py:102 | fail | test_taint | request.readlines()[0] |
+| taint_test.py:103 | fail | test_taint | ListComp |
+| taint_test.py:109 | ok   | test_taint | args |
+| taint_test.py:110 | ok   | test_taint | args[0] |
+| taint_test.py:111 | ok   | test_taint | kwargs |
+| taint_test.py:112 | ok   | test_taint | kwargs["key"] |
+| taint_test.py:116 | ok   | test_taint | request.current_app |
+| taint_test.py:121 | ok   | test_taint | request.get_host() |
+| taint_test.py:122 | ok   | test_taint | request.get_port() |
+| taint_test.py:129 | fail | test_taint | request.build_absolute_uri() |
 | taint_test.py:130 | fail | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:133 | ok   | test_taint | request.build_absolute_uri(..) |
+| taint_test.py:131 | fail | test_taint | request.build_absolute_uri(..) |
 | taint_test.py:134 | ok   | test_taint | request.build_absolute_uri(..) |
-| taint_test.py:142 | ok   | test_taint | request.get_signed_cookie(..) |
+| taint_test.py:135 | ok   | test_taint | request.build_absolute_uri(..) |
 | taint_test.py:143 | ok   | test_taint | request.get_signed_cookie(..) |
 | taint_test.py:144 | ok   | test_taint | request.get_signed_cookie(..) |
-| taint_test.py:148 | fail | test_taint | request.get_signed_cookie(..) |
+| taint_test.py:145 | ok   | test_taint | request.get_signed_cookie(..) |
 | taint_test.py:149 | fail | test_taint | request.get_signed_cookie(..) |
+| taint_test.py:150 | fail | test_taint | request.get_signed_cookie(..) |
+| taint_test.py:157 | ok   | some_method | self.request |
+| taint_test.py:158 | ok   | some_method | self.request.GET["key"] |
+| taint_test.py:160 | ok   | some_method | self.args |
+| taint_test.py:161 | ok   | some_method | self.args[0] |
+| taint_test.py:163 | ok   | some_method | self.kwargs |
+| taint_test.py:164 | ok   | some_method | self.kwargs["key"] |
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
index 9d8c2dedc03..acdbe2cfa42 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
@@ -3,6 +3,7 @@ from django.urls import path, re_path
 from django.http import HttpResponse, HttpResponseRedirect, JsonResponse, HttpResponseNotFound
 from django.views import View
 import django.views.generic.base
+from django.views.decorators.http import require_GET
 
 
 def url_match_xss(request, foo, bar, no_taint=None):  # $requestHandler routedParameter=foo routedParameter=bar
@@ -105,6 +106,10 @@ urlpatterns = [
     path("not_valid/<not_valid!>", not_valid_identifier),  # $routeSetup="not_valid/<not_valid!>"
 ]
 
+################################################################################
+# Deprecated django.conf.urls.url
+################################################################################
+
 # This version 1.x way of defining urls is deprecated in Django 3.1, but still works
 from django.conf.urls import url
 
@@ -116,9 +121,32 @@ urlpatterns = [
 ]
 
 
+################################################################################
+# Special stuff
+################################################################################
+
 class PossiblyNotRouted(View):
     # Even if our analysis can't find a route-setup for this class, we should still
     # consider it to be a handle incoming HTTP requests
 
     def get(self, request, possibly_not_routed=42):  # $ requestHandler routedParameter=possibly_not_routed
         return HttpResponse('PossiblyNotRouted get: {}'.format(possibly_not_routed))  # $HttpResponse
+
+
+@require_GET
+def with_decorator(request, foo):  # $ requestHandler routedParameter=foo
+    pass
+
+urlpatterns = [
+    path("with_decorator/<foo>", with_decorator),  # $ routeSetup="with_decorator/<foo>"
+]
+
+class UnknownViewSubclass(UnknownViewSuperclass):
+    # Although we don't know for certain that this class is a django view class, the fact that it's
+    # used with `as_view()` in the routing setup should be enough that we treat it as such.
+    def get(self, request): # $ requestHandler
+        pass
+
+urlpatterns = [
+    path("UnknownViewSubclass/", UnknownViewSubclass.as_view()),  # $ routeSetup="UnknownViewSubclass/"
+]
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
index a0db86f2961..9c21e59e2e3 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
@@ -1,6 +1,7 @@
 """testing views for Django 2.x and 3.x"""
 from django.urls import path
 from django.http import HttpRequest
+from django.views import View
 
 
 def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler routedParameter=foo routedParameter=bar
@@ -150,7 +151,22 @@ def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler rou
     )
 
 
+class ClassView(View):
+    def some_method(self):
+        ensure_tainted(
+            self.request,
+            self.request.GET["key"],
+
+            self.args,
+            self.args[0],
+
+            self.kwargs,
+            self.kwargs["key"],
+        )
+
+
 # fake setup, you can't actually run this
 urlpatterns = [
-    path("test-taint/<foo>/<bar>", test_taint),  # $routeSetup="test-taint/<foo>/<bar>"
+    path("test-taint/<foo>/<bar>", test_taint),  # $ routeSetup="test-taint/<foo>/<bar>"
+    path("ClassView/", ClassView.as_view()), # $ routeSetup="ClassView/"
 ]
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
index 55c60a551a0..d2028d0dd03 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
@@ -30,4 +30,5 @@ class MyCustomViewBaseClass(View):
 
 class MyViewHandlerWithCustomInheritance(MyCustomViewBaseClass):
     def get(self, request: HttpRequest): # $ requestHandler
+        print(self.request.GET)
         return HttpResponse("MyViewHandlerWithCustomInheritance: GET") # $ HttpResponse
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/external_blueprint.py b/python/ql/test/experimental/library-tests/frameworks/flask/external_blueprint.py
new file mode 100644
index 00000000000..d426cb37867
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/external_blueprint.py
@@ -0,0 +1,7 @@
+import flask
+
+bp3 = flask.Blueprint("bp3", __name__)
+
+@bp3.route("/bp3/example") # $ routeSetup="/bp3/example"
+def bp3_example(): # $ requestHandler
+    return "bp 3 example" # $ HttpResponse
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
index 813e3751152..11e44f52e71 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
@@ -93,5 +93,32 @@ class WithoutKnownRoute2(MethodView):
         pass
 
 
+# Blueprints
+#
+# see https://flask.palletsprojects.com/en/1.1.x/blueprints/
+
+bp1 = flask.Blueprint("bp1", __name__)
+
+@bp1.route("/bp1/example/<foo>") # $ routeSetup="/bp1/example/<foo>"
+def bp1_example(foo): # $ requestHandler routedParameter=foo
+    return "bp 1 example foo={}".format(foo) # $ HttpResponse
+
+app.register_blueprint(bp1) # by default, URLs of blueprints are not prefixed
+
+
+bp2 = flask.Blueprint("bp2", __name__)
+
+@bp2.route("/example") # $ routeSetup="/example"
+def bp2_example(): # $ requestHandler
+    return "bp 2 example" # $ HttpResponse
+
+app.register_blueprint(bp2, url_prefix="/bp2") # but it is possible to add a URL prefix
+
+
+from external_blueprint import bp3
+app.register_blueprint(bp3)
+
+
 if __name__ == "__main__":
+    print(app.url_map)
     app.run(debug=True)
diff --git a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py b/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
index 6fa904f6077..816d91d9068 100644
--- a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
+++ b/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
@@ -2,5 +2,15 @@ import yaml
 from yaml import SafeLoader
 
 yaml.load(payload)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.load(payload, SafeLoader)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
 yaml.load(payload, Loader=SafeLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
 yaml.load(payload, Loader=yaml.BaseLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+
+yaml.safe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.unsafe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.full_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+
+yaml.load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.safe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.unsafe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.full_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
diff --git a/python/ql/test/query-tests/Expressions/Formatting/UnusedNamedArgumentIn3101Format.expected b/python/ql/test/query-tests/Expressions/Formatting/UnusedNamedArgumentIn3101Format.expected
index 849920f8c07..462a9ed3992 100644
--- a/python/ql/test/query-tests/Expressions/Formatting/UnusedNamedArgumentIn3101Format.expected
+++ b/python/ql/test/query-tests/Expressions/Formatting/UnusedNamedArgumentIn3101Format.expected
@@ -6,3 +6,6 @@
 | test.py:45:1:45:35 | format() | Surplus named argument for string format. An argument named 'z' is provided, but it is not required by $@. | test.py:39:14:39:18 | Str | any format used. |
 | test.py:46:1:46:34 | Attribute() | Surplus named argument for string format. An argument named 'z' is provided, but it is not required by $@. | test.py:37:14:37:18 | Str | any format used. |
 | test.py:46:1:46:34 | Attribute() | Surplus named argument for string format. An argument named 'z' is provided, but it is not required by $@. | test.py:39:14:39:18 | Str | any format used. |
+| unknown_format_string.py:9:12:9:30 | Attribute() | Surplus named argument for string format. An argument named 'b' is provided, but it is not required by $@. | unknown_format_string.py:8:15:8:19 | Str | format "{a}" |
+| unknown_format_string.py:17:12:17:30 | Attribute() | Surplus named argument for string format. An argument named 'b' is provided, but it is not required by $@. | unknown_format_string.py:16:15:16:19 | Str | format "{a}" |
+| unknown_format_string.py:25:12:25:30 | Attribute() | Surplus named argument for string format. An argument named 'b' is provided, but it is not required by $@. | unknown_format_string.py:24:15:24:19 | Str | format "{a}" |
diff --git a/python/ql/test/query-tests/Expressions/Formatting/unknown_format_string.py b/python/ql/test/query-tests/Expressions/Formatting/unknown_format_string.py
new file mode 100644
index 00000000000..a3b32a504db
--- /dev/null
+++ b/python/ql/test/query-tests/Expressions/Formatting/unknown_format_string.py
@@ -0,0 +1,25 @@
+# FP Reported in https://github.com/github/codeql/issues/2650
+
+def possibly_unknown_format_string1(x):
+    user_specified = unknown_function()
+    if user_specified:
+        fmt = user_specified
+    else:
+        fmt = "{a}"
+    return fmt.format(a=1,b=2)
+
+def possibly_unknown_format_string2(x):
+    user_specified = input()
+    if user_specified:
+        fmt = user_specified
+    else:
+        fmt = "{a}"
+    return fmt.format(a=1,b=2)
+
+
+def possibly_unknown_format_string3(x):
+    if unknown_function():
+        fmt = input()
+    else:
+        fmt = "{a}"
+    return fmt.format(a=1,b=2)
diff --git a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected b/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected
index e83a3558a61..96e2dc9392a 100644
--- a/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected
+++ b/python/ql/test/query-tests/Security/CWE-020-ExternalAPIs/UntrustedDataToExternalAPI.expected
@@ -1,7 +1,7 @@
 edges
-| test.py:13:16:13:27 | ControlFlowNode for Attribute | test.py:15:36:15:39 | ControlFlowNode for data |
+| test.py:13:16:13:22 | ControlFlowNode for request | test.py:15:36:15:39 | ControlFlowNode for data |
 nodes
-| test.py:13:16:13:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:13:16:13:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:15:36:15:39 | ControlFlowNode for data | semmle.label | ControlFlowNode for data |
 #select
-| test.py:15:36:15:39 | ControlFlowNode for data | test.py:13:16:13:27 | ControlFlowNode for Attribute | test.py:15:36:15:39 | ControlFlowNode for data | Call to hmac.new [param 1] with untrusted data from $@. | test.py:13:16:13:27 | ControlFlowNode for Attribute | ControlFlowNode for Attribute |
+| test.py:15:36:15:39 | ControlFlowNode for data | test.py:13:16:13:22 | ControlFlowNode for request | test.py:15:36:15:39 | ControlFlowNode for data | Call to hmac.new [param 1] with untrusted data from $@. | test.py:13:16:13:22 | ControlFlowNode for request | ControlFlowNode for request |
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected b/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected
index 994f3376526..87c199e56fa 100644
--- a/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-022-PathInjection/PathInjection.expected
@@ -1,25 +1,25 @@
 edges
-| path_injection.py:12:16:12:27 | ControlFlowNode for Attribute | path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() |
-| path_injection.py:19:16:19:27 | ControlFlowNode for Attribute | path_injection.py:20:13:20:64 | ControlFlowNode for Attribute() |
+| path_injection.py:12:16:12:22 | ControlFlowNode for request | path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() |
+| path_injection.py:19:16:19:22 | ControlFlowNode for request | path_injection.py:20:13:20:64 | ControlFlowNode for Attribute() |
 | path_injection.py:20:13:20:64 | ControlFlowNode for Attribute() | path_injection.py:21:14:21:18 | ControlFlowNode for npath |
-| path_injection.py:27:16:27:27 | ControlFlowNode for Attribute | path_injection.py:28:13:28:64 | ControlFlowNode for Attribute() |
+| path_injection.py:27:16:27:22 | ControlFlowNode for request | path_injection.py:28:13:28:64 | ControlFlowNode for Attribute() |
 | path_injection.py:28:13:28:64 | ControlFlowNode for Attribute() | path_injection.py:31:14:31:18 | ControlFlowNode for npath |
-| path_injection.py:37:16:37:27 | ControlFlowNode for Attribute | path_injection.py:38:13:38:64 | ControlFlowNode for Attribute() |
-| path_injection.py:46:16:46:27 | ControlFlowNode for Attribute | path_injection.py:47:13:47:64 | ControlFlowNode for Attribute() |
+| path_injection.py:37:16:37:22 | ControlFlowNode for request | path_injection.py:38:13:38:64 | ControlFlowNode for Attribute() |
+| path_injection.py:46:16:46:22 | ControlFlowNode for request | path_injection.py:47:13:47:64 | ControlFlowNode for Attribute() |
 | path_injection.py:47:13:47:64 | ControlFlowNode for Attribute() | path_injection.py:48:14:48:18 | ControlFlowNode for npath |
-| path_injection.py:54:16:54:27 | ControlFlowNode for Attribute | path_injection.py:55:13:55:64 | ControlFlowNode for Attribute() |
-| path_injection.py:63:16:63:27 | ControlFlowNode for Attribute | path_injection.py:64:13:64:63 | ControlFlowNode for Attribute() |
+| path_injection.py:54:16:54:22 | ControlFlowNode for request | path_injection.py:55:13:55:64 | ControlFlowNode for Attribute() |
+| path_injection.py:63:16:63:22 | ControlFlowNode for request | path_injection.py:64:13:64:63 | ControlFlowNode for Attribute() |
 | path_injection.py:64:13:64:63 | ControlFlowNode for Attribute() | path_injection.py:65:14:65:18 | ControlFlowNode for npath |
-| path_injection.py:71:16:71:27 | ControlFlowNode for Attribute | path_injection.py:72:13:72:63 | ControlFlowNode for Attribute() |
+| path_injection.py:71:16:71:22 | ControlFlowNode for request | path_injection.py:72:13:72:63 | ControlFlowNode for Attribute() |
 | path_injection.py:78:20:78:25 | ControlFlowNode for foo_id | path_injection.py:81:14:81:17 | ControlFlowNode for path |
 | path_injection.py:85:20:85:22 | ControlFlowNode for foo | path_injection.py:89:14:89:17 | ControlFlowNode for path |
-| path_injection.py:94:16:94:27 | ControlFlowNode for Attribute | path_injection.py:100:14:100:17 | ControlFlowNode for path |
-| path_injection.py:105:16:105:27 | ControlFlowNode for Attribute | path_injection.py:111:14:111:17 | ControlFlowNode for path |
-| path_injection.py:116:16:116:27 | ControlFlowNode for Attribute | path_injection.py:119:14:119:22 | ControlFlowNode for sanitized |
-| path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | path_injection.py:127:30:127:51 | ControlFlowNode for Attribute() |
-| path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | path_injection.py:129:14:129:17 | ControlFlowNode for path |
-| test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:9:12:9:39 | ControlFlowNode for Attribute() |
-| test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:9:12:9:39 | ControlFlowNode for Attribute() |
+| path_injection.py:94:16:94:22 | ControlFlowNode for request | path_injection.py:100:14:100:17 | ControlFlowNode for path |
+| path_injection.py:105:16:105:22 | ControlFlowNode for request | path_injection.py:111:14:111:17 | ControlFlowNode for path |
+| path_injection.py:116:16:116:22 | ControlFlowNode for request | path_injection.py:119:14:119:22 | ControlFlowNode for sanitized |
+| path_injection.py:125:16:125:22 | ControlFlowNode for request | path_injection.py:127:30:127:51 | ControlFlowNode for Attribute() |
+| path_injection.py:125:16:125:22 | ControlFlowNode for request | path_injection.py:129:14:129:17 | ControlFlowNode for path |
+| test.py:9:12:9:18 | ControlFlowNode for request | test.py:9:12:9:39 | ControlFlowNode for Attribute() |
+| test.py:9:12:9:18 | ControlFlowNode for request | test.py:9:12:9:39 | ControlFlowNode for Attribute() |
 | test.py:9:12:9:39 | ControlFlowNode for Attribute() | test.py:18:9:18:16 | ControlFlowNode for source() |
 | test.py:9:12:9:39 | ControlFlowNode for Attribute() | test.py:24:9:24:16 | ControlFlowNode for source() |
 | test.py:9:12:9:39 | ControlFlowNode for Attribute() | test.py:31:9:31:16 | ControlFlowNode for source() |
@@ -38,7 +38,7 @@ edges
 | test.py:46:9:46:16 | ControlFlowNode for source() | test.py:48:23:48:23 | ControlFlowNode for x |
 | test.py:48:13:48:24 | ControlFlowNode for normalize() | test.py:49:14:49:14 | ControlFlowNode for y |
 | test.py:48:23:48:23 | ControlFlowNode for x | test.py:12:15:12:15 | ControlFlowNode for x |
-| test_chaining.py:9:12:9:23 | ControlFlowNode for Attribute | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() |
+| test_chaining.py:9:12:9:18 | ControlFlowNode for request | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() |
 | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() | test_chaining.py:20:9:20:16 | ControlFlowNode for source() |
 | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() | test_chaining.py:28:9:28:16 | ControlFlowNode for source() |
 | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() | test_chaining.py:41:9:41:16 | ControlFlowNode for source() |
@@ -52,42 +52,42 @@ edges
 | test_chaining.py:41:9:41:16 | ControlFlowNode for source() | test_chaining.py:42:9:42:19 | ControlFlowNode for normpath() |
 | test_chaining.py:44:13:44:23 | ControlFlowNode for normpath() | test_chaining.py:45:14:45:14 | ControlFlowNode for z |
 nodes
-| path_injection.py:12:16:12:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:12:16:12:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
-| path_injection.py:19:16:19:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:19:16:19:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:20:13:20:64 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:21:14:21:18 | ControlFlowNode for npath | semmle.label | ControlFlowNode for npath |
-| path_injection.py:27:16:27:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:27:16:27:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:28:13:28:64 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:31:14:31:18 | ControlFlowNode for npath | semmle.label | ControlFlowNode for npath |
-| path_injection.py:37:16:37:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:37:16:37:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:38:13:38:64 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
-| path_injection.py:46:16:46:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:46:16:46:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:47:13:47:64 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:48:14:48:18 | ControlFlowNode for npath | semmle.label | ControlFlowNode for npath |
-| path_injection.py:54:16:54:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:54:16:54:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:55:13:55:64 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
-| path_injection.py:63:16:63:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:63:16:63:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:64:13:64:63 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:65:14:65:18 | ControlFlowNode for npath | semmle.label | ControlFlowNode for npath |
-| path_injection.py:71:16:71:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:71:16:71:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:72:13:72:63 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:78:20:78:25 | ControlFlowNode for foo_id | semmle.label | ControlFlowNode for foo_id |
 | path_injection.py:81:14:81:17 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
 | path_injection.py:85:20:85:22 | ControlFlowNode for foo | semmle.label | ControlFlowNode for foo |
 | path_injection.py:89:14:89:17 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
-| path_injection.py:94:16:94:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:94:16:94:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:100:14:100:17 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
-| path_injection.py:105:16:105:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:105:16:105:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:111:14:111:17 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
-| path_injection.py:116:16:116:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:116:16:116:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:119:14:119:22 | ControlFlowNode for sanitized | semmle.label | ControlFlowNode for sanitized |
-| path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| path_injection.py:125:16:125:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
+| path_injection.py:125:16:125:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | path_injection.py:127:30:127:51 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | path_injection.py:129:14:129:17 | ControlFlowNode for path | semmle.label | ControlFlowNode for path |
-| test.py:9:12:9:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| test.py:9:12:9:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:9:12:9:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
+| test.py:9:12:9:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:9:12:9:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | test.py:9:12:9:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | test.py:12:15:12:15 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
@@ -106,7 +106,7 @@ nodes
 | test.py:48:13:48:24 | ControlFlowNode for normalize() | semmle.label | ControlFlowNode for normalize() |
 | test.py:48:23:48:23 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
 | test.py:49:14:49:14 | ControlFlowNode for y | semmle.label | ControlFlowNode for y |
-| test_chaining.py:9:12:9:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test_chaining.py:9:12:9:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test_chaining.py:9:12:9:39 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | test_chaining.py:14:15:14:15 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
 | test_chaining.py:15:12:15:30 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
@@ -121,19 +121,19 @@ nodes
 | test_chaining.py:44:13:44:23 | ControlFlowNode for normpath() | semmle.label | ControlFlowNode for normpath() |
 | test_chaining.py:45:14:45:14 | ControlFlowNode for z | semmle.label | ControlFlowNode for z |
 #select
-| path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() | path_injection.py:12:16:12:27 | ControlFlowNode for Attribute | path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() | This path depends on $@. | path_injection.py:12:16:12:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:21:14:21:18 | ControlFlowNode for npath | path_injection.py:19:16:19:27 | ControlFlowNode for Attribute | path_injection.py:21:14:21:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:19:16:19:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:31:14:31:18 | ControlFlowNode for npath | path_injection.py:27:16:27:27 | ControlFlowNode for Attribute | path_injection.py:31:14:31:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:27:16:27:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:48:14:48:18 | ControlFlowNode for npath | path_injection.py:46:16:46:27 | ControlFlowNode for Attribute | path_injection.py:48:14:48:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:46:16:46:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:65:14:65:18 | ControlFlowNode for npath | path_injection.py:63:16:63:27 | ControlFlowNode for Attribute | path_injection.py:65:14:65:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:63:16:63:27 | ControlFlowNode for Attribute | a user-provided value |
+| path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() | path_injection.py:12:16:12:22 | ControlFlowNode for request | path_injection.py:13:14:13:47 | ControlFlowNode for Attribute() | This path depends on $@. | path_injection.py:12:16:12:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:21:14:21:18 | ControlFlowNode for npath | path_injection.py:19:16:19:22 | ControlFlowNode for request | path_injection.py:21:14:21:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:19:16:19:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:31:14:31:18 | ControlFlowNode for npath | path_injection.py:27:16:27:22 | ControlFlowNode for request | path_injection.py:31:14:31:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:27:16:27:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:48:14:48:18 | ControlFlowNode for npath | path_injection.py:46:16:46:22 | ControlFlowNode for request | path_injection.py:48:14:48:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:46:16:46:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:65:14:65:18 | ControlFlowNode for npath | path_injection.py:63:16:63:22 | ControlFlowNode for request | path_injection.py:65:14:65:18 | ControlFlowNode for npath | This path depends on $@. | path_injection.py:63:16:63:22 | ControlFlowNode for request | a user-provided value |
 | path_injection.py:81:14:81:17 | ControlFlowNode for path | path_injection.py:78:20:78:25 | ControlFlowNode for foo_id | path_injection.py:81:14:81:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:78:20:78:25 | ControlFlowNode for foo_id | a user-provided value |
 | path_injection.py:89:14:89:17 | ControlFlowNode for path | path_injection.py:85:20:85:22 | ControlFlowNode for foo | path_injection.py:89:14:89:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:85:20:85:22 | ControlFlowNode for foo | a user-provided value |
-| path_injection.py:100:14:100:17 | ControlFlowNode for path | path_injection.py:94:16:94:27 | ControlFlowNode for Attribute | path_injection.py:100:14:100:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:94:16:94:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:111:14:111:17 | ControlFlowNode for path | path_injection.py:105:16:105:27 | ControlFlowNode for Attribute | path_injection.py:111:14:111:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:105:16:105:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:119:14:119:22 | ControlFlowNode for sanitized | path_injection.py:116:16:116:27 | ControlFlowNode for Attribute | path_injection.py:119:14:119:22 | ControlFlowNode for sanitized | This path depends on $@. | path_injection.py:116:16:116:27 | ControlFlowNode for Attribute | a user-provided value |
-| path_injection.py:129:14:129:17 | ControlFlowNode for path | path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | path_injection.py:129:14:129:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:125:16:125:27 | ControlFlowNode for Attribute | a user-provided value |
-| test.py:19:10:19:10 | ControlFlowNode for x | test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:19:10:19:10 | ControlFlowNode for x | This path depends on $@. | test.py:9:12:9:23 | ControlFlowNode for Attribute | a user-provided value |
-| test.py:26:10:26:10 | ControlFlowNode for y | test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:26:10:26:10 | ControlFlowNode for y | This path depends on $@. | test.py:9:12:9:23 | ControlFlowNode for Attribute | a user-provided value |
-| test.py:33:14:33:14 | ControlFlowNode for x | test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:33:14:33:14 | ControlFlowNode for x | This path depends on $@. | test.py:9:12:9:23 | ControlFlowNode for Attribute | a user-provided value |
-| test.py:49:14:49:14 | ControlFlowNode for y | test.py:9:12:9:23 | ControlFlowNode for Attribute | test.py:49:14:49:14 | ControlFlowNode for y | This path depends on $@. | test.py:9:12:9:23 | ControlFlowNode for Attribute | a user-provided value |
-| test_chaining.py:32:14:32:14 | ControlFlowNode for z | test_chaining.py:9:12:9:23 | ControlFlowNode for Attribute | test_chaining.py:32:14:32:14 | ControlFlowNode for z | This path depends on $@. | test_chaining.py:9:12:9:23 | ControlFlowNode for Attribute | a user-provided value |
+| path_injection.py:100:14:100:17 | ControlFlowNode for path | path_injection.py:94:16:94:22 | ControlFlowNode for request | path_injection.py:100:14:100:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:94:16:94:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:111:14:111:17 | ControlFlowNode for path | path_injection.py:105:16:105:22 | ControlFlowNode for request | path_injection.py:111:14:111:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:105:16:105:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:119:14:119:22 | ControlFlowNode for sanitized | path_injection.py:116:16:116:22 | ControlFlowNode for request | path_injection.py:119:14:119:22 | ControlFlowNode for sanitized | This path depends on $@. | path_injection.py:116:16:116:22 | ControlFlowNode for request | a user-provided value |
+| path_injection.py:129:14:129:17 | ControlFlowNode for path | path_injection.py:125:16:125:22 | ControlFlowNode for request | path_injection.py:129:14:129:17 | ControlFlowNode for path | This path depends on $@. | path_injection.py:125:16:125:22 | ControlFlowNode for request | a user-provided value |
+| test.py:19:10:19:10 | ControlFlowNode for x | test.py:9:12:9:18 | ControlFlowNode for request | test.py:19:10:19:10 | ControlFlowNode for x | This path depends on $@. | test.py:9:12:9:18 | ControlFlowNode for request | a user-provided value |
+| test.py:26:10:26:10 | ControlFlowNode for y | test.py:9:12:9:18 | ControlFlowNode for request | test.py:26:10:26:10 | ControlFlowNode for y | This path depends on $@. | test.py:9:12:9:18 | ControlFlowNode for request | a user-provided value |
+| test.py:33:14:33:14 | ControlFlowNode for x | test.py:9:12:9:18 | ControlFlowNode for request | test.py:33:14:33:14 | ControlFlowNode for x | This path depends on $@. | test.py:9:12:9:18 | ControlFlowNode for request | a user-provided value |
+| test.py:49:14:49:14 | ControlFlowNode for y | test.py:9:12:9:18 | ControlFlowNode for request | test.py:49:14:49:14 | ControlFlowNode for y | This path depends on $@. | test.py:9:12:9:18 | ControlFlowNode for request | a user-provided value |
+| test_chaining.py:32:14:32:14 | ControlFlowNode for z | test_chaining.py:9:12:9:18 | ControlFlowNode for request | test_chaining.py:32:14:32:14 | ControlFlowNode for z | This path depends on $@. | test_chaining.py:9:12:9:18 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected b/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected
index 1ab00f7ecad..99959dfceba 100644
--- a/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078-py2/CommandInjection.expected
@@ -1,15 +1,15 @@
 edges
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr |
 nodes
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
@@ -20,12 +20,12 @@ nodes
 | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 #select
-| command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected b/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
index db299d8d64b..1022b278c5a 100644
--- a/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
@@ -1,50 +1,50 @@
 edges
-| command_injection.py:11:13:11:24 | ControlFlowNode for Attribute | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr |
-| command_injection.py:25:11:25:22 | ControlFlowNode for Attribute | command_injection.py:26:23:26:25 | ControlFlowNode for cmd |
-| command_injection.py:31:13:31:24 | ControlFlowNode for Attribute | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr |
-| command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | command_injection.py:41:15:41:21 | ControlFlowNode for command |
-| command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | command_injection.py:42:15:42:21 | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:55:15:55:21 | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:56:14:56:20 | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:57:21:57:27 | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:58:27:58:33 | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:59:20:59:26 | ControlFlowNode for command |
-| command_injection.py:71:12:71:23 | ControlFlowNode for Attribute | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr |
-| command_injection.py:78:12:78:23 | ControlFlowNode for Attribute | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr |
+| command_injection.py:11:13:11:19 | ControlFlowNode for request | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr |
+| command_injection.py:25:11:25:17 | ControlFlowNode for request | command_injection.py:26:23:26:25 | ControlFlowNode for cmd |
+| command_injection.py:31:13:31:19 | ControlFlowNode for request | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr |
+| command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:41:15:41:21 | ControlFlowNode for command |
+| command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:42:15:42:21 | ControlFlowNode for command |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:55:15:55:21 | ControlFlowNode for command |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:56:14:56:20 | ControlFlowNode for command |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:57:21:57:27 | ControlFlowNode for command |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:58:27:58:33 | ControlFlowNode for command |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:59:20:59:26 | ControlFlowNode for command |
+| command_injection.py:71:12:71:18 | ControlFlowNode for request | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr |
+| command_injection.py:78:12:78:18 | ControlFlowNode for request | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr |
 nodes
-| command_injection.py:11:13:11:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:11:13:11:19 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:18:13:18:19 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:25:11:25:22 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:25:11:25:17 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:26:23:26:25 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
-| command_injection.py:31:13:31:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:31:13:31:19 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:38:15:38:21 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:41:15:41:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 | command_injection.py:42:15:42:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:54:15:54:21 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:55:15:55:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 | command_injection.py:56:14:56:20 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 | command_injection.py:57:21:57:27 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 | command_injection.py:58:27:58:33 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
 | command_injection.py:59:20:59:26 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
-| command_injection.py:71:12:71:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:71:12:71:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| command_injection.py:78:12:78:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| command_injection.py:78:12:78:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 #select
-| command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | command_injection.py:11:13:11:24 | ControlFlowNode for Attribute | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:11:13:11:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:26:23:26:25 | ControlFlowNode for cmd | command_injection.py:25:11:25:22 | ControlFlowNode for Attribute | command_injection.py:26:23:26:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:25:11:25:22 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | command_injection.py:31:13:31:24 | ControlFlowNode for Attribute | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:31:13:31:24 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:41:15:41:21 | ControlFlowNode for command | command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | command_injection.py:41:15:41:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:42:15:42:21 | ControlFlowNode for command | command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | command_injection.py:42:15:42:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:55:15:55:21 | ControlFlowNode for command | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:55:15:55:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:56:14:56:20 | ControlFlowNode for command | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:56:14:56:20 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:57:21:57:27 | ControlFlowNode for command | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:57:21:57:27 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:58:27:58:33 | ControlFlowNode for command | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:58:27:58:33 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:59:20:59:26 | ControlFlowNode for command | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | command_injection.py:59:20:59:26 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:26 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | command_injection.py:71:12:71:23 | ControlFlowNode for Attribute | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:71:12:71:23 | ControlFlowNode for Attribute | a user-provided value |
-| command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | command_injection.py:78:12:78:23 | ControlFlowNode for Attribute | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:78:12:78:23 | ControlFlowNode for Attribute | a user-provided value |
+| command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | command_injection.py:11:13:11:19 | ControlFlowNode for request | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:11:13:11:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:26:23:26:25 | ControlFlowNode for cmd | command_injection.py:25:11:25:17 | ControlFlowNode for request | command_injection.py:26:23:26:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:25:11:25:17 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | command_injection.py:31:13:31:19 | ControlFlowNode for request | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:31:13:31:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:41:15:41:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:41:15:41:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:42:15:42:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:42:15:42:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:55:15:55:21 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:55:15:55:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:56:14:56:20 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:56:14:56:20 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:57:21:57:27 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:57:21:57:27 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:58:27:58:33 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:58:27:58:33 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:59:20:59:26 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:59:20:59:26 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | command_injection.py:71:12:71:18 | ControlFlowNode for request | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:71:12:71:18 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | command_injection.py:78:12:78:18 | ControlFlowNode for request | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:78:12:78:18 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected b/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
index 61b93ae27a7..a0ee49bc7e4 100644
--- a/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
+++ b/python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
@@ -1,15 +1,15 @@
 edges
-| reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr |
-| reflected_xss.py:21:23:21:34 | ControlFlowNode for Attribute | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() |
-| reflected_xss.py:27:23:27:34 | ControlFlowNode for Attribute | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() |
+| reflected_xss.py:9:18:9:24 | ControlFlowNode for request | reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr |
+| reflected_xss.py:21:23:21:29 | ControlFlowNode for request | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() |
+| reflected_xss.py:27:23:27:29 | ControlFlowNode for request | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() |
 nodes
-| reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| reflected_xss.py:9:18:9:24 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
-| reflected_xss.py:21:23:21:34 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| reflected_xss.py:21:23:21:29 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
-| reflected_xss.py:27:23:27:34 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| reflected_xss.py:27:23:27:29 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 #select
-| reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr | reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr | Cross-site scripting vulnerability due to $@. | reflected_xss.py:9:18:9:29 | ControlFlowNode for Attribute | a user-provided value |
-| reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | reflected_xss.py:21:23:21:34 | ControlFlowNode for Attribute | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | Cross-site scripting vulnerability due to $@. | reflected_xss.py:21:23:21:34 | ControlFlowNode for Attribute | a user-provided value |
-| reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | reflected_xss.py:27:23:27:34 | ControlFlowNode for Attribute | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | Cross-site scripting vulnerability due to $@. | reflected_xss.py:27:23:27:34 | ControlFlowNode for Attribute | a user-provided value |
+| reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr | reflected_xss.py:9:18:9:24 | ControlFlowNode for request | reflected_xss.py:10:26:10:53 | ControlFlowNode for BinaryExpr | Cross-site scripting vulnerability due to $@. | reflected_xss.py:9:18:9:24 | ControlFlowNode for request | a user-provided value |
+| reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | reflected_xss.py:21:23:21:29 | ControlFlowNode for request | reflected_xss.py:22:26:22:41 | ControlFlowNode for Attribute() | Cross-site scripting vulnerability due to $@. | reflected_xss.py:21:23:21:29 | ControlFlowNode for request | a user-provided value |
+| reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | reflected_xss.py:27:23:27:29 | ControlFlowNode for request | reflected_xss.py:28:26:28:41 | ControlFlowNode for Attribute() | Cross-site scripting vulnerability due to $@. | reflected_xss.py:27:23:27:29 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected b/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
index 26d6e0f165c..92a9aef4f4d 100644
--- a/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
@@ -1,17 +1,17 @@
 edges
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code |
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code |
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd |
-| code_injection.py:18:16:18:27 | ControlFlowNode for Attribute | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name |
+| code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:7:10:7:13 | ControlFlowNode for code |
+| code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:8:10:8:13 | ControlFlowNode for code |
+| code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:10:10:10:12 | ControlFlowNode for cmd |
+| code_injection.py:18:16:18:22 | ControlFlowNode for request | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name |
 nodes
-| code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| code_injection.py:6:12:6:18 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | code_injection.py:7:10:7:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
 | code_injection.py:8:10:8:13 | ControlFlowNode for code | semmle.label | ControlFlowNode for code |
 | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
-| code_injection.py:18:16:18:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| code_injection.py:18:16:18:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | semmle.label | ControlFlowNode for obj_name |
 #select
-| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:7:10:7:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
-| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:8:10:8:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
-| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:23 | ControlFlowNode for Attribute | A user-provided value |
-| code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | code_injection.py:18:16:18:27 | ControlFlowNode for Attribute | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | $@ flows to here and is interpreted as code. | code_injection.py:18:16:18:27 | ControlFlowNode for Attribute | A user-provided value |
+| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:7:10:7:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
+| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:8:10:8:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
+| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
+| code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | code_injection.py:18:16:18:22 | ControlFlowNode for request | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | $@ flows to here and is interpreted as code. | code_injection.py:18:16:18:22 | ControlFlowNode for request | A user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected b/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
index 44685494671..155c4e9af51 100644
--- a/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
+++ b/python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
@@ -1,16 +1,16 @@
 edges
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload |
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload |
+| unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload |
 nodes
-| unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 #select
-| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
-| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:26 | ControlFlowNode for Attribute | untrusted input |
+| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
+| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
+| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
+| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
diff --git a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected b/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
index 53098240671..ffd87e345c3 100644
--- a/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
+++ b/python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
@@ -1,35 +1,35 @@
 edges
-| test.py:7:14:7:25 | ControlFlowNode for Attribute | test.py:8:21:8:26 | ControlFlowNode for target |
-| test.py:30:17:30:28 | ControlFlowNode for Attribute | test.py:32:21:32:24 | ControlFlowNode for safe |
-| test.py:37:17:37:28 | ControlFlowNode for Attribute | test.py:39:21:39:24 | ControlFlowNode for safe |
-| test.py:44:17:44:28 | ControlFlowNode for Attribute | test.py:46:21:46:24 | ControlFlowNode for safe |
-| test.py:60:17:60:28 | ControlFlowNode for Attribute | test.py:62:21:62:26 | ControlFlowNode for unsafe |
-| test.py:67:17:67:28 | ControlFlowNode for Attribute | test.py:69:21:69:26 | ControlFlowNode for unsafe |
-| test.py:74:17:74:28 | ControlFlowNode for Attribute | test.py:76:21:76:26 | ControlFlowNode for unsafe |
-| test.py:81:17:81:28 | ControlFlowNode for Attribute | test.py:83:21:83:26 | ControlFlowNode for unsafe |
+| test.py:7:14:7:20 | ControlFlowNode for request | test.py:8:21:8:26 | ControlFlowNode for target |
+| test.py:30:17:30:23 | ControlFlowNode for request | test.py:32:21:32:24 | ControlFlowNode for safe |
+| test.py:37:17:37:23 | ControlFlowNode for request | test.py:39:21:39:24 | ControlFlowNode for safe |
+| test.py:44:17:44:23 | ControlFlowNode for request | test.py:46:21:46:24 | ControlFlowNode for safe |
+| test.py:60:17:60:23 | ControlFlowNode for request | test.py:62:21:62:26 | ControlFlowNode for unsafe |
+| test.py:67:17:67:23 | ControlFlowNode for request | test.py:69:21:69:26 | ControlFlowNode for unsafe |
+| test.py:74:17:74:23 | ControlFlowNode for request | test.py:76:21:76:26 | ControlFlowNode for unsafe |
+| test.py:81:17:81:23 | ControlFlowNode for request | test.py:83:21:83:26 | ControlFlowNode for unsafe |
 nodes
-| test.py:7:14:7:25 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:7:14:7:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:8:21:8:26 | ControlFlowNode for target | semmle.label | ControlFlowNode for target |
-| test.py:30:17:30:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:30:17:30:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:32:21:32:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
-| test.py:37:17:37:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:37:17:37:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:39:21:39:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
-| test.py:44:17:44:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:44:17:44:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:46:21:46:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
-| test.py:60:17:60:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:60:17:60:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:62:21:62:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
-| test.py:67:17:67:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:67:17:67:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:69:21:69:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
-| test.py:74:17:74:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:74:17:74:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:76:21:76:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
-| test.py:81:17:81:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| test.py:81:17:81:23 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
 | test.py:83:21:83:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
 #select
-| test.py:8:21:8:26 | ControlFlowNode for target | test.py:7:14:7:25 | ControlFlowNode for Attribute | test.py:8:21:8:26 | ControlFlowNode for target | Untrusted URL redirection due to $@. | test.py:7:14:7:25 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:32:21:32:24 | ControlFlowNode for safe | test.py:30:17:30:28 | ControlFlowNode for Attribute | test.py:32:21:32:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:30:17:30:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:39:21:39:24 | ControlFlowNode for safe | test.py:37:17:37:28 | ControlFlowNode for Attribute | test.py:39:21:39:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:37:17:37:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:46:21:46:24 | ControlFlowNode for safe | test.py:44:17:44:28 | ControlFlowNode for Attribute | test.py:46:21:46:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:44:17:44:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:62:21:62:26 | ControlFlowNode for unsafe | test.py:60:17:60:28 | ControlFlowNode for Attribute | test.py:62:21:62:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:60:17:60:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:69:21:69:26 | ControlFlowNode for unsafe | test.py:67:17:67:28 | ControlFlowNode for Attribute | test.py:69:21:69:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:67:17:67:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:76:21:76:26 | ControlFlowNode for unsafe | test.py:74:17:74:28 | ControlFlowNode for Attribute | test.py:76:21:76:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:74:17:74:28 | ControlFlowNode for Attribute | A user-provided value |
-| test.py:83:21:83:26 | ControlFlowNode for unsafe | test.py:81:17:81:28 | ControlFlowNode for Attribute | test.py:83:21:83:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:81:17:81:28 | ControlFlowNode for Attribute | A user-provided value |
+| test.py:8:21:8:26 | ControlFlowNode for target | test.py:7:14:7:20 | ControlFlowNode for request | test.py:8:21:8:26 | ControlFlowNode for target | Untrusted URL redirection due to $@. | test.py:7:14:7:20 | ControlFlowNode for request | A user-provided value |
+| test.py:32:21:32:24 | ControlFlowNode for safe | test.py:30:17:30:23 | ControlFlowNode for request | test.py:32:21:32:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:30:17:30:23 | ControlFlowNode for request | A user-provided value |
+| test.py:39:21:39:24 | ControlFlowNode for safe | test.py:37:17:37:23 | ControlFlowNode for request | test.py:39:21:39:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:37:17:37:23 | ControlFlowNode for request | A user-provided value |
+| test.py:46:21:46:24 | ControlFlowNode for safe | test.py:44:17:44:23 | ControlFlowNode for request | test.py:46:21:46:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:44:17:44:23 | ControlFlowNode for request | A user-provided value |
+| test.py:62:21:62:26 | ControlFlowNode for unsafe | test.py:60:17:60:23 | ControlFlowNode for request | test.py:62:21:62:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:60:17:60:23 | ControlFlowNode for request | A user-provided value |
+| test.py:69:21:69:26 | ControlFlowNode for unsafe | test.py:67:17:67:23 | ControlFlowNode for request | test.py:69:21:69:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:67:17:67:23 | ControlFlowNode for request | A user-provided value |
+| test.py:76:21:76:26 | ControlFlowNode for unsafe | test.py:74:17:74:23 | ControlFlowNode for request | test.py:76:21:76:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:74:17:74:23 | ControlFlowNode for request | A user-provided value |
+| test.py:83:21:83:26 | ControlFlowNode for unsafe | test.py:81:17:81:23 | ControlFlowNode for request | test.py:83:21:83:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:81:17:81:23 | ControlFlowNode for request | A user-provided value |
diff --git a/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected b/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
index a902cad04cb..339a74432bc 100644
--- a/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
+++ b/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
@@ -1,3 +1,4 @@
+| type_annotation_fp.py:5:5:5:7 | foo | The value assigned to local variable 'foo' is never used. |
 | variables_test.py:29:5:29:5 | x | The value assigned to local variable 'x' is never used. |
 | variables_test.py:89:5:89:5 | a | The value assigned to local variable 'a' is never used. |
 | variables_test.py:89:7:89:7 | b | The value assigned to local variable 'b' is never used. |
diff --git a/python/ql/test/query-tests/Variables/unused/type_annotation_fp.py b/python/ql/test/query-tests/Variables/unused/type_annotation_fp.py
new file mode 100644
index 00000000000..72293f232e5
--- /dev/null
+++ b/python/ql/test/query-tests/Variables/unused/type_annotation_fp.py
@@ -0,0 +1,11 @@
+# FP Type annotation counts as redefinition
+# See https://github.com/Semmle/ql/issues/2652
+
+def type_annotation(x):
+    foo = 5
+    if x:
+        foo : int
+        do_stuff_with(foo)
+    else:
+        foo : float
+        do_other_stuff_with(foo)